{ "Event": { "published": true, "date": "2026-07-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-27", "timestamp": 1785196982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "52f2cf90-07cd-4393-8605-a5f4e367e381", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc0bf74-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154264, "uuid": "3aea5419-584d-41c8-b5be-46df039e7b6f", "comment": "Malware payload", "value": "c04faf2baaaee154668ac00cc29bad95", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154264, "uuid": "65b43412-5cf6-4732-b011-311e4b57d11b", "comment": "Malware payload", "value": "0087b476390894ca846b48a49c5d7430832c5a55cb206354b021e8f9b2e6dcf6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154264, "uuid": "31ce32d7-b3aa-42bf-b0de-b09cb3e4de28", "comment": "Malware payload", "value": "638f0b61556236254e3dce9828e8027303d92561", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154264, "uuid": "b9af9b69-40b6-48c5-abd4-d816d92b3bc5", "comment": "Malware payload", "value": "dcf8897db7a07fd01e983ab250da7f3b6128d3bde019b3f19402b23dfb640298418345e7d5a16de237af7adb2bddec57", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154264, "uuid": "8b8a30dd-9cd0-4450-a9e0-569223c6e6fc", "value": "T1C221B920F81CC0A2C48D98353C4AB6CC1271E9A4B03047EF161B5B5F3EC3D1C97591B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154264, "uuid": "f8155fde-7725-4fb3-befb-35d7a91708b4", "value": "24:9UOiTsa4RwfHF4h4arbp6bjtYbH0z3xgmSuNhGY78Njh6OC6x9l:9Rssa4RwfHC5wGb/PMGY78jLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154264, "uuid": "9a56e5a2-1094-42da-b8da-7941e52a60a8", "value": 1136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154264, "uuid": "d013c1ee-d87d-42d9-9fa6-985ca4e53ac0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154264, "uuid": "79cc447b-4ec0-40db-a5b5-701722f216cd", "value": "photov_357293949314.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483e510d-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158147, "uuid": "eba806f0-8969-498c-8b89-23059c861e00", "comment": "Malware payload", "value": "bdb63dcf250b9e79d3539cd472f8b265", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158147, "uuid": "640ca9fd-7d58-414e-b3a3-50696b076993", "comment": "Malware payload", "value": "00918a79f2daaa5940db523e04004b79d12c5986fa21415b8b6c535b0286b4c2", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158147, "uuid": "a9d32b00-90a7-475d-ab69-651aaea41ea6", "comment": "Malware payload", "value": "3a0918905b10241fdefeb62ac996712b5c5cec59", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158147, "uuid": "b21734c5-cb38-4492-8abc-e1e73b64cd43", "comment": "Malware payload", "value": "b9577f72b91299947da352452914101383c0924240337f46c6dc4fe251ae21fe7b48c928810d44d312e16688daa65f05", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158147, "uuid": "2ef8b52b-d321-46ac-bb85-63d1e199418b", "value": "T1BC16335B8192F660B05B8CA3D3DA5534EE4B448C1BD06A0FBCB07AF61F5BD1D88B5398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158147, "uuid": "68e83b92-aa72-4490-9589-7395b88880ea", "value": "98304:5qevEDAEDchJJaQ9hgLaty2ajavQqmkd1cmzbEOz9PL0DU/a1:5qevUQ9h5AOvQNO/bEulL0A/a1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158147, "uuid": "0508a84d-8274-43cf-83c0-e975a747bccb", "value": 4281793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158147, "uuid": "2a9e1057-25d0-4f38-aac3-7464ed3fcff2", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158147, "uuid": "5dfc638d-0b9d-4906-af18-b7d84fa591a1", "value": "00918a79f2daaa5940db523e04004b79d12c5986fa21415b8b6c535b0286b4c2.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3784a0bf-8966-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785120753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785120753, "uuid": "111c9097-7c05-402a-9447-8c156a59cabb", "comment": "Malware payload (Efimer)", "value": "b25fd6814be7f03c56bfb669d8587844", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785120753, "uuid": "2c212e2f-bf20-4273-b36e-b229e42eea39", "comment": "Malware payload (Efimer)", "value": "00ec97c78c9c4fc27f8beda4ffe27d4f4cb98b0208e13b7a1652d6c1e120cd76", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785120753, "uuid": "066ea9b6-d7c9-4e9c-8789-430c7a4aa3fc", "comment": "Malware payload (Efimer)", "value": "27f9857ee08246eacb56c194989071ec5213c704", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785120753, "uuid": "424384ae-6fba-4ad2-bba5-3036e1943122", "comment": "Malware payload (Efimer)", "value": "d4ae0e9fceb1b7654c0b015f18325f85091ffb36a8bae7fa47b51917139544e470acae348932a4a02cf3d565201f86c1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785120753, "uuid": "032c1a52-9c80-4a37-8032-355323691dac", "value": "T18BE63318A2D012EEE5F34239DD51B9D6A591B8361B7BC98B4BB443A25F831E0CD3D336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785120753, "uuid": "a0025ba4-9ccd-403b-ab70-6817a914e87f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785120753, "uuid": "6a057ab3-0c6b-44b7-b7fc-fec5210da470", "value": "393216:flsqU3uO/jL2yKlthvC1n1mgXMCHWUjXycuI3/PGTAI:flsb9z8tZcnYgXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785120753, "uuid": "b7a0c294-a5ff-4a53-9bba-323e2ecc2bc5", "value": 14297580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785120753, "uuid": "ac3ef8c8-1b68-4228-a4b0-5ac4b440aa82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785120753, "uuid": "e67b77f5-f5da-409c-8460-a5de4ffc395c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa3dc07-89c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785160675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160675, "uuid": "5c61d92c-5a2b-4e59-bbaf-57362a263bcc", "comment": "Malware payload (Mirai)", "value": "f06b8596f2db28f2f2fb73b3099f94e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160675, "uuid": "cfb87ae6-748d-439c-a43e-2e34221cd336", "comment": "Malware payload (Mirai)", "value": "0297e0f41003143f95e1d2006432056201976288f35f139d86c473b51f70df2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160675, "uuid": "e118e506-c6d7-463d-9854-966fcc67bdc5", "comment": "Malware payload (Mirai)", "value": "6322a024d5ac9889776b335a0af156b9790402ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160675, "uuid": "7e9065e7-9899-42ef-a816-246709533047", "comment": "Malware payload (Mirai)", "value": "eead1f8e3f86d0296ec7765a48433d9f2f9701c1603b1d57c6f24bef61232fb8b282548022b97f021b055ccd0aa79dff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160675, "uuid": "fc84e19f-1b81-4f29-8abd-6147076cd9bb", "value": "T1C614A71E6A228F7EF668873047F74A309B6933D617E1D645E2ACC2105F6028E545FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160675, "uuid": "656ac090-2cb5-4c1f-967a-34852f096dce", "value": "3072:UmEuLPWBN8ym/8d00Q+5vztjRKBvz7SkVpWpCVP:UmEOPWMD275btNivikVYCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785160675, "uuid": "c002ce4f-1cc8-4975-94a4-b8356f304fc7", "value": 195540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785160675, "uuid": "ee81c2f8-5d25-4af7-8e74-e1c83fb1b1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160675, "uuid": "2261c827-7c4e-426c-b8cb-ed031db8e6c8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bf8a21-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133023, "uuid": "58247329-1347-4e73-8295-7d042fd44915", "comment": "Malware payload (PureRAT)", "value": "bb4db3ca249eb4707938c3001d802e10", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133023, "uuid": "c7684558-7c9a-4130-9742-f3dfbe1ad3c3", "comment": "Malware payload (PureRAT)", "value": "02aa7bc221a75ce60adb8c29b57e55379769dd8c15b26249c8fd05ac304bf46b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133023, "uuid": "4c3bf0ad-8a43-45fa-870a-ee8481624fff", "comment": "Malware payload (PureRAT)", "value": "45cc2674fe6302f2475bef40a0fc34687b2f7b4d", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133023, "uuid": "9dab452f-68ad-4640-afb0-b01bdf38dda2", "comment": "Malware payload (PureRAT)", "value": "30ab73b81755f4abca1a300f3e4d7094ce4a28b0c62f2ac3d51d6370e53c89720b5f187bf438b7cedde27efa609b74b7", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133023, "uuid": "08bf338e-1b62-4352-9d8a-2e59856b19f2", "value": "T1FA21A310C25EFE40D05AD67AA4F1C8AB37188CDAA08613CF12502D6D2E006DBAA6E0A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133023, "uuid": "4348a200-da56-4c90-b604-d46a4ad23a79", "value": "24:9d2QYZN8911W3qL83D/jLnARG39mSVFdoxUgMMppkqOzRzkYmj:9d2VZNu1SLLXAo39PVgCgMWkdRILj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133023, "uuid": "02425bab-4bc1-4599-968f-bd8c18b13f93", "value": 1200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133023, "uuid": "49bc66b3-aeaf-4869-a126-86fbcae82cf3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133023, "uuid": "836e9249-666a-4bfe-8f1d-ed3f7adf0fe5", "value": "photov_550049928311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d9a949-8974-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785126944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126944, "uuid": "c91877bd-81a1-4dd3-a0e6-339cace94922", "comment": "Malware payload", "value": "c3cec70c65f28d3ecfd075af7ed0cdc0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126944, "uuid": "222c914b-edd4-443c-8cb4-148b0cfabeae", "comment": "Malware payload", "value": "031141870683cc41121ed8e2fbbdaa06da3720043ec448b000869cde34ebc352", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126944, "uuid": "550c8ae0-d9f8-46b2-83b4-7dc6b7a74e5a", "comment": "Malware payload", "value": "8a34ab30c6c4cc2c0e58c5765a78816628c81ce9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126944, "uuid": "3f4e7ebe-65fb-4430-91ec-97b871e46e4e", "comment": "Malware payload", "value": "325dbd9a64fedaf513bd43eb9eba31ba0e1c2cf7404a99d6560f5151b1d3f8b9d3192884bfcb54241c598f0d34d54665", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126944, "uuid": "1fe4c914-27a4-4190-9e99-7e83f75e0125", "value": "T17A563342C478C5A8F195F87EAD6E94A8FA592101EC671FBF1F2502600C9F8C9F729678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126944, "uuid": "8de09a04-5d76-4399-bf8b-016e519945ee", "value": "98304:vK0aBfy4p26C5DEWiKQdjl6zFqRuSh9csTNw4bY6mSU6oIBYTb1Zu4z5zLh3ruJr:YjbCxETKQd3RDh9jTu40FTTbXugbud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785126944, "uuid": "0dc4be70-2886-46aa-be87-b75cf96aa1ed", "value": 5911511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785126944, "uuid": "c62aca2a-7f77-438c-927e-eaee736b658b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126944, "uuid": "196a87d6-2d70-4e18-98e7-af5b6223c279", "value": "tenis-team-km.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eef4a49-89c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785160843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160843, "uuid": "b7679b97-0398-4b15-9c46-83061b6c0a3d", "comment": "Malware payload (Mirai)", "value": "dc2e9f97aa7b6e56098fffccef8630e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160843, "uuid": "102a48d5-1de7-4e9a-a2b6-206bfeb4d34e", "comment": "Malware payload (Mirai)", "value": "03ea5a00f2cb9501fbf2833e49d597994e9ef3acef7cdf6b3e8d704a287d7f1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160843, "uuid": "67a0f485-ab11-4a30-b056-56d26b83460d", "comment": "Malware payload (Mirai)", "value": "669f70ca72ca2ec49bcfad075949f5efa0a9ec62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160843, "uuid": "06f2a097-95a4-4eeb-b83e-2d0a43e010de", "comment": "Malware payload (Mirai)", "value": "a3cca87a28bd75b9b160d067061d9e6d6ad3b753a7db3747a2f2208586348a66c5caafcbfd1c54086598936acc771835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160843, "uuid": "b9c41bb3-bce8-40e3-85a1-c9e002da260b", "value": "T179D39EC1E743D0F5E85205F0103BA7318B7AD53A943AEB96D7B93E31AC62A419B1B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160843, "uuid": "1ebd7f8a-eef7-44df-8428-733ac139a3f7", "value": "3072:RtqlV/o6aopCtw4EL8H3vjmqx1Gyx0JMk:RtI/DGtnVdxQo0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785160843, "uuid": "900cbbbe-564f-4258-a507-960a8dde19db", "value": 133452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785160843, "uuid": "50597f86-542a-414a-9991-39e64d19b01f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160843, "uuid": "eacdb2da-a22f-4919-8480-858e8dc18198", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdaed44-89b2-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785153672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153672, "uuid": "6abf46ab-830c-4353-9adc-9951b357bd03", "comment": "Malware payload (XWorm)", "value": "e2a8c377f7b973e8851cf684f0b48961", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153672, "uuid": "70f769ef-f7ab-4556-9c66-9f94d45fe76b", "comment": "Malware payload (XWorm)", "value": "046c529ce1063a6a302925fa2cc4804fc16d1e8ce33ec883f99869f018461f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153672, "uuid": "077c1307-c9e1-4164-b63c-1f133f1c4d2e", "comment": "Malware payload (XWorm)", "value": "0d92fb682f9c655b90569bc21ac849becdd04ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153672, "uuid": "6f11d85a-914e-46ed-8424-5c73c0ad0752", "comment": "Malware payload (XWorm)", "value": "4b127271c216b5ba8602b78e15af3ad97775b3b88f34fbf8aa8031197390080b2e93c5cd453e096f4339470bce6c063a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153672, "uuid": "f5ffd247-513e-4e5f-9ce8-186ed8aac592", "value": "T1BBB512FFF7DE61D5AE24698200967CD0BA95CA9C639801FD3E029DEC2BD07584B63C21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153672, "uuid": "187335e8-b46b-43f0-972b-e6217e2c9d7c", "value": "192:Ph7fMLRX4AE17Ei4lHXMX652olEkO/Q1XHRoEeyZwug8E3bLPBVE2AvEgQeb90v:yQolY8WD2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785153672, "uuid": "07029ecf-d548-43d1-a910-10016a46b6ac", "value": 2293678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785153672, "uuid": "473bf151-0e68-4eb9-85d7-75d8b7909796", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153672, "uuid": "bea0b22e-d38f-4e1f-a15c-471bf2f99eca", "value": "Comprobante fiscal digital ICQ201214351F_RP_325.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdb8d60-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133110, "uuid": "df5b61c1-198d-418a-9d73-96a1ae725fbe", "comment": "Malware payload (PureRAT)", "value": "5277f4e32171eb2506e374e934996484", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133110, "uuid": "86ed8135-9941-4bf7-8ecc-e3c2db590e11", "comment": "Malware payload (PureRAT)", "value": "04c86661aff03fff1892d2172bd883b021e77810e3083963a2722a2a6513d87d", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133110, "uuid": "251f9bc9-60cd-4cd8-a35e-225d94391544", "comment": "Malware payload (PureRAT)", "value": "78a374e5069e0558bf8938822cfa60f9ee77f481", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133110, "uuid": "69fc4e6e-b4eb-4651-8563-8406ff0007f6", "comment": "Malware payload (PureRAT)", "value": "3d1a156d1e4a7e7eb380aaeb3f1cc5c974b54cb3178ed908d60c239f7e85006fbac992c767200d45a55bb8a3c1d18998", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133110, "uuid": "86cc9f9f-b403-4661-ac38-59a4d047a8f0", "value": "T1FC11B9E185DC8D70CE6F81B974A7E538583C02818595D05A07C5A517DEA6C153F0D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133110, "uuid": "83bd624c-502b-46e3-9005-bcab83c387f5", "value": "24:9XGWub2TwcsoNyauqOm22V/UymS3+gWq1mCZEtl:9WJbARsoTr7/UyP3+gWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133110, "uuid": "1badcbe2-2fa3-4b99-af80-d76d055316cf", "value": 1106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133110, "uuid": "d75a069b-bc9d-43fe-bf5d-4d729b9d9fc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133110, "uuid": "bfde21ec-9656-479f-91d5-593077677faf", "value": "photov_018843825200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7b38b0-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154348, "uuid": "296d541f-611a-4153-b8e8-e38039c4e370", "comment": "Malware payload", "value": "77fc962565387d172591a296f30c08b5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154348, "uuid": "58f47153-032b-4aca-a1b4-18e2281cad37", "comment": "Malware payload", "value": "05a30c96dc70ef966c86dc75d5ac6d5c45775cc8a73b74a1ed8a0b93b59f5d73", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154348, "uuid": "8ad4670b-f033-407e-884b-f54219e3225d", "comment": "Malware payload", "value": "7839674ad66aee7c73d12c3246538cab81da0919", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154348, "uuid": "5be595a2-f19e-4090-9622-afa8d0db77ce", "comment": "Malware payload", "value": "46d4c85693a52d35c6bae12464109bdec3d12797f1d04de0d46a8655f9f2c3098b5981509e83fdaf0d6e7bdbc21d4fea", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154348, "uuid": "829673f0-0f00-45ab-ae43-f5b8626df206", "value": "T12421DA65A45C9D83D07B497FCC55D42269142B793712BCA7078A3D45BC6FC24C3376D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154348, "uuid": "dabee00a-4b3c-47cc-97c4-fc65b99c7876", "value": "24:989R+4TzYtYv4YJztw5lc8UuRKd9EclgOvf1DepmSdX35bpWqxJ0gWePo9aFr:9BqY+NzuWuOvtKPNnWO0Hwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154348, "uuid": "7eac4ecc-4ce0-41a9-ab96-62f78e69b62e", "value": 1230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154348, "uuid": "d377c262-4098-494f-87cf-6a79f1613ff2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154348, "uuid": "024fa529-d4f3-4453-a783-19e81d719531", "value": "photov_802353782493.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392d8659-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143519, "uuid": "ea36359c-93f9-4569-bac0-7e065f499af3", "comment": "Malware payload", "value": "9f04bac4a7fbf73517fd9d3c6d73e131", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143519, "uuid": "dc5489c1-bf5d-4fae-a85a-0255447f293b", "comment": "Malware payload", "value": "06214d9ab940c32343acb68c81f25125b05d203dc3ecb0326a4e488d21416437", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143519, "uuid": "585c31f0-ff4d-4cc2-b450-b8a8d535f95e", "comment": "Malware payload", "value": "1660de89917e13a81457fb252fc76764eee8fa58", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143519, "uuid": "234aa05e-b2f2-4469-ac3e-08ff3ddb33c7", "comment": "Malware payload", "value": "619ab9630535e86abfb33ca04f7fceeaebe658bd22d4f884080149e9c4d48bceae6a9f8ee5639474a42e2651cf22dd62", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143519, "uuid": "d946d872-aeaa-4514-9a17-bbbc3b2f6540", "value": "T13D21866970955880CACF5F35B85FAB1DB5811180B1A1DD953346307F6F0AFEC8F081E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143519, "uuid": "ef543d0a-3a57-4d7f-8d6a-8877e51684eb", "value": "24:9pNmvJs8n+aautG2txsrm4WqppmSh6yhGY7cU9wx0hZafpDw:9pNmvJD+a9thtxsrDBpPxGY7/r0Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143519, "uuid": "e1f9552c-0862-41f9-9aa9-47e6fc1b9247", "value": 1115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143519, "uuid": "5f22499d-c444-43fc-9057-b4baa23ea6db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143519, "uuid": "8b559cdc-6c02-462c-89e7-65fb47835ba3", "value": "photov_254575495544.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aee019b-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158045, "uuid": "fb7b22c7-1eb8-4918-b6d4-fa7819586b38", "comment": "Malware payload", "value": "3097b5fefc532c8dead3cedec894bfca", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158045, "uuid": "5d859671-7c7c-4f7b-a2c3-d6fd470afe9d", "comment": "Malware payload", "value": "06ce231966926723090b8daa85b61eb70a77c23e55babe51d080de3a4809078c", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158045, "uuid": "a81f1328-c878-4dea-95ba-625acdb51ae4", "comment": "Malware payload", "value": "e9742711e8c8343239c2c45900d21665225e8b59", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158045, "uuid": "204d5446-2efc-4509-965f-41f4614dfe53", "comment": "Malware payload", "value": "1232e1ee8a5f9bb844a1bcfb2319a8f06e8fc79daa8782ddf513be1ea92e88c8e14a7b62b14ec84b6ef3407d20c9d305", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158045, "uuid": "5f066180-cfd6-4152-b32d-f38aa1a540fd", "value": "T1A4E53389CE6481DDF82F1A7024A5610986FC4C259C6969213ED63F32B8FB683FF55327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158045, "uuid": "dee27612-c955-4cf0-bb9c-f987f0918b2d", "value": "49152:H1t/8p3mHcYFEs3dfriZRQ0J/cgpKTZagJwsKV2a8lyAQ6TdVKoLXU+w0pY:HIg8YyOfMP5cgpK7LKIa8l9Thk+wMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158045, "uuid": "900139e5-165e-4928-9e8b-b2063fa740b1", "value": 3224786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158045, "uuid": "eeaa2f5b-bd48-4087-9554-3b80384f8d8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158045, "uuid": "777b62f3-4318-4cba-a8b5-367d71cb7c60", "value": "06ce231966926723090b8daa85b61eb70a77c23e55babe51d080de3a4809078c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa2595-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154412, "uuid": "efbbff90-5d94-4ca7-8d5b-906c6abc7488", "comment": "Malware payload", "value": "7e4cf1d4518ff9b5f606f3200c35eefc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154412, "uuid": "1e57ce9e-4039-459f-8db0-fc7bf4ab4095", "comment": "Malware payload", "value": "07146ca82b6f4867862b4d74a8169360d01204151d9070853abf7da636d944b4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154412, "uuid": "d4fe2efb-d2d1-41e2-945f-ee55ee8e4d0b", "comment": "Malware payload", "value": "0bd01b874a725b2cdefa6ca537e11fbd603afe9e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154412, "uuid": "89d51d95-de23-4094-bc05-dc53290841eb", "comment": "Malware payload", "value": "dc5d09098a976963fdf40dd75671484709c85881ced02867d775a0b7f82c25a3f803c3fd8261b60e48c3b8b81f0950a5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154412, "uuid": "94682998-6ed6-4137-8dee-ca41f3cad1c4", "value": "T1D221B4D185AD8310CC2B153F38889E89188472A9F2440AE2727FA98C1F736A85300CA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154412, "uuid": "3163fbc6-9b44-400b-9ffe-ea21a92fa0e8", "value": "24:9eBNzsQ3MEs7qw1dwFJL8cqHoio5aDLrauNwCmSvlbdWqSxAN/qN/:9eXsm+/dC8Zfgazau6CPvTWlyNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154412, "uuid": "43e2869c-ab04-4294-a8bd-23b1c2d836d6", "value": 1221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154412, "uuid": "17b6a5c4-15cf-43a2-bb1d-dc5ebd98e264", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154412, "uuid": "eafd7c52-6346-4143-8e8f-168c2597b7a7", "value": "photov_457828597195.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003cb606-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132686, "uuid": "d7ddbedf-7515-414e-819a-76de14ecac3c", "comment": "Malware payload (PureRAT)", "value": "b98457c1194a7daf57f44a9f85fff66b", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132686, "uuid": "4c14efa5-b5b4-44ff-8dd0-d4a4810a673a", "comment": "Malware payload (PureRAT)", "value": "082aa37b35e1fd7b851a833f7abec75f2cd924993cdb5ad63044cc7a93116c92", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132686, "uuid": "dc6255c8-d560-4d80-bb11-d8e0e217eeca", "comment": "Malware payload (PureRAT)", "value": "8ed537d92dd12ad15e1dbd664bda422aeb24edfa", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132686, "uuid": "feaa9964-1503-4dd4-8d0c-b42490edf6ce", "comment": "Malware payload (PureRAT)", "value": "0ed6b7d3243798c032c764ca09f5c210a9573ab9bf41b18ac435e6ef0e3497f9fa4fa932e37d1b4f18c2f783d3df542b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132686, "uuid": "80d0b449-a561-4571-9d49-72155c0b744f", "value": "T15F21740CD1649586D6C1CD73B007CE1776F0C922A58613127F543A3B2FAAFBDDB1A89A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132686, "uuid": "9f72613c-517e-474e-8e65-e69c491cd517", "value": "24:9jkzVZduzBTMb0pU1Q1FXt9+6blqbHLQPmSBL2hheY7t1zc2t9lpfWZ:9jkzTd0zquqXQPPF+heY7t1z195WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132686, "uuid": "6522b096-262c-4d09-9d3c-f1afe148d5af", "value": 1222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132686, "uuid": "2c5a0691-9896-439b-8a0c-1170080d2516", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132686, "uuid": "e58fb402-f907-43cc-a46b-e2c4566ab68f", "value": "photov_669209540645.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32a3d65-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132638, "uuid": "5eb69eaf-758b-440c-ab65-ca62ad14e061", "comment": "Malware payload (PureRAT)", "value": "147113be2b20663c4975005f8f6b333c", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132638, "uuid": "1ac128f3-b989-41ec-a4a2-6e0549b68499", "comment": "Malware payload (PureRAT)", "value": "099eff58b36bb1292068cad4e1d45d2d70308423001b72f49603f9d46136fc48", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132638, "uuid": "5f5ac39a-9ced-472e-b44c-261d8d70b6f4", "comment": "Malware payload (PureRAT)", "value": "ed7ca7fddc960fa6d68078d9d8f0965d6d51439d", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132638, "uuid": "67d5fb48-29d7-403e-b6e0-99614ca98eb9", "comment": "Malware payload (PureRAT)", "value": "f7d1c6b39b2907d76e7b4ec431d2a5f94673f56d4ca033250c21b50ddd128c49691df7ab4658493b54391588418f935f", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132638, "uuid": "8ff51471-aa44-47f4-99a6-c6e7f005d2b0", "value": "T15521DAD0D002DFE1D8A1BEB3F67087292394137371211860B80A79623DC791E7FBE188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132638, "uuid": "7e024fce-e14d-4d44-bec5-ce2f0eb9bd50", "value": "24:92qqujHBK7RVWCjyB++AhzVD41mS+7hT+FV8uoax6VLobINFLOw:92qbjHBK7RVLjm5AXiPEB+FroaQ9osT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132638, "uuid": "0316d07a-4e2e-4619-b7c2-3dfa8182589b", "value": 1221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132638, "uuid": "ad02c6c2-4752-4b85-9754-0e3fac9efd8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132638, "uuid": "f74bd3a1-53e3-4fac-be93-45c4609cbee5", "value": "photov_278877220655.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31c8e4e-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785135134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135134, "uuid": "10b37a68-9562-4ad6-ab3e-f769a2995892", "comment": "Malware payload (Formbook)", "value": "825820fc81056e0cb65b2ef0dbffac08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135134, "uuid": "94a8a428-7455-4dc9-833f-a44aa7262b05", "comment": "Malware payload (Formbook)", "value": "09a511feeb109ce18780160d2664e3c31cc33a39025f9ec25a677d21e793bdb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135134, "uuid": "fe17cdc5-5c19-4173-8709-d42fdebf624d", "comment": "Malware payload (Formbook)", "value": "5818fa3ad64cafd8fad05bf3e93d9f21ab60a3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135134, "uuid": "f89ee7a2-a4ed-41d6-ab58-23fc6ce80b6f", "comment": "Malware payload (Formbook)", "value": "049e71134c52fe8fa8e3054d4fbc6b0440ee1696f5ab484af8f300ae23024c362fb3af4db4d1d40fb6b1363c39c18516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135134, "uuid": "e102fbc4-6928-40a5-862a-7cfe08cb3127", "value": "T10235F1051257D842E0E687B6A8F1C23437B15ECEB8F3C2975FE96FA779253C29194382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135134, "uuid": "9752670e-989d-4fcc-aa8f-571cdcd75e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135134, "uuid": "595eea35-5f57-4880-99d0-caf4d37380ea", "value": "24576:jp50ngTtDEt2Mg9WnzqILl3vw07KApp+JyrZ6nCN:jpGWNlXmzq4xvHKALkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135134, "uuid": "72725fb1-dd9a-4e2a-b873-e016c8021f79", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135134, "uuid": "748c7123-a194-4e80-a5eb-3282b8880523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135134, "uuid": "f028a1fd-0156-4981-944d-144ed61e1d9e", "value": "TALIMAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612e408b-8984-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133708, "uuid": "dfd817be-8cae-4581-a418-849d081ac01f", "comment": "Malware payload (Mirai)", "value": "27350943609e5a9d7398bf5e8e00e270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133708, "uuid": "b97b8b6e-ce5b-425a-94d9-ae54db34d45d", "comment": "Malware payload (Mirai)", "value": "0aa16d2a755a5440054080498a423dfe90cb513a79d79973aadb2b48aaddd68a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133708, "uuid": "3cd248f7-da6a-4038-8924-6f79a86e3ceb", "comment": "Malware payload (Mirai)", "value": "68552706b397449bc22f664da46deba56c04d57f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133708, "uuid": "16bea088-4e46-4da7-a22a-785d86e98d30", "comment": "Malware payload (Mirai)", "value": "d69eb34348203928cb65e358ddfc6514599540c915533645e478952608a5beabc17c75598734b6895c2c0b04c044e526", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133708, "uuid": "2e42e8be-15d2-434b-9a19-3cee2d8763f6", "value": "T12C21CE9AA3D36D2BCC540273DCAF5710E362AE40C68EF503E32212250C2E30A1F2114A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133708, "uuid": "dabf14a6-53d5-450a-8d43-de82d921d3df", "value": "24:JYolMlgP9qD0at6EoKGArUlFSy4WzLCkIddx2HuGI2ANfc7:JYolMOFqDPtlrkFSy4WzLmGI2ANy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133708, "uuid": "e34084ab-7633-42f9-bd1a-e6e8c890eb48", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133708, "uuid": "6e270b30-f861-489b-8f76-4446414f240f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133708, "uuid": "2a3a8a4c-d528-41fb-9c2f-637ed20820f2", "value": "dlr.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36295adf-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154252, "uuid": "7e62ae7c-2178-4f51-b835-43900c7cec0e", "comment": "Malware payload", "value": "4c6b91bddfd71e3a7cabee67efd284c4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154252, "uuid": "ad5ab1e1-6e22-42f6-8762-49d56f6b8b38", "comment": "Malware payload", "value": "0bafff7ff608cec6f014e50d6496f9f9592cac6f64e8bfd513740b18f75a91d3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154252, "uuid": "e5238a26-6c07-431a-b527-7819809c7b87", "comment": "Malware payload", "value": "286f022416190ec260d5c91b091c9d4ad79075b7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154252, "uuid": "bc74eeed-d867-4705-bd53-c018b2a4de1c", "comment": "Malware payload", "value": "5e8f8e0f8d56772a82d79fba885d5fee5f651beaa69d2358c5dd658a8c67ffc860e99fa03fa01fe14e8bd82f68f16481", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154252, "uuid": "0a3ba104-cc57-491a-a10a-1f95e7c13222", "value": "T160219310A9A44E0ED9CF633938BDEFE51521A0ECA4078653271468FCBA91CC82780ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154252, "uuid": "2d5a3ad5-7760-4697-b44d-c6568492a792", "value": "24:93+2nzUn2cyyp94wTvYruXuZreYA0128h0yWNUr0mSZnhGY7eE4vL3DUr1X:93ODP7XqrU0AFur0PbGY7+vjIr1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154252, "uuid": "e20a1b12-d324-4519-80f2-3e585db7dcf3", "value": 1162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154252, "uuid": "71cf546a-8cc1-41f9-8272-46249c45ba32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154252, "uuid": "4de86df1-558d-44fc-8122-6a8e1ada60a3", "value": "photov_924912653169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ac5682-89cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785166112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166112, "uuid": "699f0afa-6b54-4dd4-a102-29e516b8f5df", "comment": "Malware payload (Vidar)", "value": "f090a25b25faae55a0a11648a890b12e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166112, "uuid": "638db836-43d8-4f7c-97b8-22346552b361", "comment": "Malware payload (Vidar)", "value": "0be457a4975587e112cc1027dd69302c5b549c30f706fdbd8a6b38aefe65c40f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166112, "uuid": "a1836f03-ee71-4639-8871-691e57303cb9", "comment": "Malware payload (Vidar)", "value": "1cfab76ae6d607178bd827ec019639d4111a98a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166112, "uuid": "cf390939-0a23-46ac-a33e-1e92bcd41a71", "comment": "Malware payload (Vidar)", "value": "71057b3801274faafbd410473241e40a42406e3b0b1db29465967ea957bb9f647b94e27d1078185d6d4f0d4f863d7a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166112, "uuid": "d3ba96f2-e2b0-40cd-bb37-07e6aa79ebb4", "value": "T18C067C17ACD148FAC199A33289A241567B71BC491B2273E73EA0BB382F737D05D39B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166112, "uuid": "f4f5dd1a-e923-453a-9fff-1b45e5bd3ad7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166112, "uuid": "f230d4f0-43aa-4233-b6b8-df800a2d4f81", "value": "49152:ftoag8oDkSNqNP+W0hSnWGbWYQpx5gs+6Y3MoPPi9OXVOWvr:fOUEIQxSMocOXgir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785166112, "uuid": "cff6baa8-4596-455a-a3dd-0c2552d631ab", "value": 3688328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785166112, "uuid": "b89d0bbc-9ef0-42b0-9e74-2618e7618db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166112, "uuid": "c4af8bab-2ce9-47c2-81d1-01c636726806", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676e482c-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154334, "uuid": "7abb0869-e5bd-43fb-bb6a-4971581c481f", "comment": "Malware payload", "value": "6a1684c748274b36db9f038c11da58c1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154334, "uuid": "c93fef51-e0e5-4da2-9810-8058342d72f2", "comment": "Malware payload", "value": "0c1d2dccbc4c5e2610d26371ffdff3e074b43fd8fef840e8c9e5f964a1c99c2c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154334, "uuid": "11cee2cb-66d0-48a0-9601-0cda7fbe3344", "comment": "Malware payload", "value": "74b136cda629c0a99dd9f805efe545bb3bebcc1f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154334, "uuid": "2838dcd8-3d1c-44f7-94b3-ddb982db493e", "comment": "Malware payload", "value": "e2a7331b2c6cfbcf00aa7c18b125fd5bf6d339bfd2cef9c5921dee69bcbf56e35e72ad8f3b818835d77e99da4b5d4159", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154334, "uuid": "d1228bc5-e4df-4340-8af3-b398b64a7a12", "value": "T1B4210D20909FEE43D75BC03368D4170E1D7B1119E380E4B332F7514B91C74A5939CB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154334, "uuid": "f79390ee-ed94-4ce6-914c-d5fab71cc0b8", "value": "24:9Wfpe2TyvOiYhyqtyGk4+O2R39+BnB+n0nmSx4NWyl+dbR1q2yP:9SJMbYhysHMOXenIPtbdb9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154334, "uuid": "a15578cf-6be4-4d56-a382-286adc7b2889", "value": 1208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154334, "uuid": "18b9a0fd-e29f-4927-a0b0-914cd95515ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154334, "uuid": "7a1273d1-6429-44fd-af41-173d8ab99633", "value": "photov_832775966717.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ce8663-89a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785147574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147574, "uuid": "9486a418-24d2-4a1b-a7e7-ff6c0d1027fb", "comment": "Malware payload (ValleyRAT)", "value": "d71e0b1a9aa1135597d6e70f02e8b738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147574, "uuid": "f15a5548-3eb4-4e03-b5c4-1fcfbab1ca47", "comment": "Malware payload (ValleyRAT)", "value": "0c5ee6a717e999c56f6cad36d47a963dac06769c9740c060829e935eb639625a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147574, "uuid": "8c82558d-d112-4074-b374-d752f9071610", "comment": "Malware payload (ValleyRAT)", "value": "0fe005334900f76ce9ec62a710daeb2e018aaad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147574, "uuid": "11248363-1e48-4bce-9031-9270cc31faf4", "comment": "Malware payload (ValleyRAT)", "value": "869f0a6d96c898b7ba3ed397e2b600f84b80834665adde3d7105e6101514da3fafd484f8bab5eb8d0d25f6b2aa72ee83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147574, "uuid": "856fc204-0502-4598-ac4f-c179211edeeb", "value": "T13A0833BF3180D91AE61DC23EC4A29F50A4376CB51733C9DB9586325AEA339C05FBE254", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147574, "uuid": "d14be25b-1073-45db-b107-655c6ef3ab48", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147574, "uuid": "7600d235-d693-4c29-b954-f749a42c50db", "value": "1572864:ZXqgR72V+466fyynnGwIByh5r+oS6/aF3DkW1VXt1SdICQuYzfe3Uk:Q472VX5nfWM5r+oxqBt1u7Qttk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147574, "uuid": "9da9b8f0-9aca-4ed3-8c98-dbe2b38fb668", "value": 82890908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147574, "uuid": "c7a27fb3-da69-4a81-a3a7-d6f7079c9567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147574, "uuid": "496fe5a5-61c5-4a47-8f4c-2efa21c21ef0", "value": "AweXrk_remote_v15.1.1.2279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb2c240-89cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785165862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165862, "uuid": "fe39761c-ac33-4739-9c3a-7b2d64fc8b52", "comment": "Malware payload (Vidar)", "value": "cc00c3d0b5b43385fca3378c5b86d62f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165862, "uuid": "8046acbe-74a3-48ef-9fb8-86cc348cb4fb", "comment": "Malware payload (Vidar)", "value": "0c6481df65a681fda1687390258e80f944f39302f43cb8f3b44e105ade208d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165862, "uuid": "53ac08a3-e6cd-4845-81c3-9ddfa8f2f2df", "comment": "Malware payload (Vidar)", "value": "4ada6dc4d65fb0140e14c6c77c1493649b598180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165862, "uuid": "11c77c8c-a144-4117-946d-2aa216bfcef4", "comment": "Malware payload (Vidar)", "value": "67093ca6e09ebb340b13b57d745aeb0c20fad589a26499478ae4ee9d087706a29eac964f0ef388166bfba62cc146784d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165862, "uuid": "9e9eda2a-b294-46c2-94a8-63fdb0383540", "value": "T1FA067C07FC9149F6C0A9A23289735256BB75BC090B3233E72E50BB782E727C49D7A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165862, "uuid": "7e879157-364d-4d52-bc7e-92e007b407b9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165862, "uuid": "61ba305f-039b-42a9-af66-6be82f05ce85", "value": "49152:CI46KcKmO1HAOKbkkftfB9HqWrHjnd3RCELRtYc:CnnkfVHhhR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785165862, "uuid": "d37826ab-059b-4832-955c-32291fbed1aa", "value": 3683688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785165862, "uuid": "ea55fbf2-4fab-478b-a43f-744b060202d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165862, "uuid": "4f3fe40e-5e0d-453e-978f-b6a8ca3ba4cf", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae15eec7-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785135125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135125, "uuid": "60d5d224-748c-4d9f-a5a1-a24261da75f1", "comment": "Malware payload (PureLogsStealer)", "value": "404f0d36fcbe5c4643e821403a4827eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135125, "uuid": "102db8cb-94e4-40ae-8472-ccbbb283d8a3", "comment": "Malware payload (PureLogsStealer)", "value": "0cb54132e0a6c763044968293effe0794ae787435ca616a626245d23e2291b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135125, "uuid": "1faf8f36-ddab-4ab3-ad81-25e543b70307", "comment": "Malware payload (PureLogsStealer)", "value": "b2312267c752e3b583cc2f763b0785a4bce7f1e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135125, "uuid": "c0f54bc3-4192-4780-b901-e134a7c03900", "comment": "Malware payload (PureLogsStealer)", "value": "3a7a9b9a887329f57c7907da01344405e2250a3f102969cfab30b8b0478c5cd91250928d47d79385db02fd3b67dc57e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135125, "uuid": "0533a8ec-ff42-489f-b77c-4b9468304663", "value": "T13275E015A3E056F8D627C174CA9A4233F7B6B8410760AECF1694E2292F37AD46F3B711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135125, "uuid": "c62b9224-7b9c-476a-af25-729dca866578", "value": "71b008ad892c449add994b5e45fffabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135125, "uuid": "9354fde0-5984-470f-b1fe-17061c197516", "value": "49152:7Y6TYOEmQB+mmmOlI0KDevQFiCg2dG3c3Y:T7ITSvqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135125, "uuid": "16442316-1c9a-455d-b17f-85cd3d1028f1", "value": 1641984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135125, "uuid": "0dc5db9e-f5d1-4c6b-bb83-4816e88fddb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135125, "uuid": "31fc0a30-f4f1-4ee6-b9b1-75e7b8061ce2", "value": "img-Order-2026.07.26.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c06db2-8975-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785127109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127109, "uuid": "71ca643c-b4c7-4acf-90a4-1c0865dfa86a", "comment": "Malware payload (PureLogsStealer)", "value": "b1065ef20af2ea65ca248a099070e69f", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127109, "uuid": "561c97e6-7de9-44f9-ab07-73d156eff1ef", "comment": "Malware payload (PureLogsStealer)", "value": "0da0e50360469d64558e6de818b57f966126400d0b1e4b50cd50acd6cde86ae1", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127109, "uuid": "b5472e73-7312-452c-b799-1b912d7cd02a", "comment": "Malware payload (PureLogsStealer)", "value": "c02f137367ef3c0246204d0a07414e8a52272065", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127109, "uuid": "bbf20c3f-c378-4045-8eea-6753c8e00efb", "comment": "Malware payload (PureLogsStealer)", "value": "62845d5e56a5d4785af8cb201a42d4a21ca45ade9efa4ad681d732e9707904b1bdad7109eb6a3cf446e0cbb3ef14c70c", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127109, "uuid": "842e58a0-2de6-43b1-9c6f-1eec9f6c8e6d", "value": "T14196AD16F7A845E5C076D13896429236E6B278628B3193CB16EAC72E1F37BD15F3E700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127109, "uuid": "39693326-6e00-461b-a720-7850ffefad93", "value": "196608:84ezE9h9m5HZCK00NeP90g1EHV4WuYZAgkETwRlPBk8CdR:84eoj9iC30cPnCqYZAgylPu82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785127109, "uuid": "5808fba6-0ba0-47fb-b734-e9252a792994", "value": 9091072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785127109, "uuid": "c3e9bfe5-6ecf-4cac-859b-eee0846fc43e", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127109, "uuid": "ffc178c3-660d-4095-b59e-44d850037c15", "value": "IMG-nota-di-credito-n.5-30.06.2026.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c24754-894e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785110704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110704, "uuid": "7763a45d-375a-4721-b007-332b35feeb44", "comment": "Malware payload (RemusStealer)", "value": "87873d4cb6d2c05ffdacb2da3400a033", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110704, "uuid": "914e5e39-af7c-4d92-927d-58af65dba5c8", "comment": "Malware payload (RemusStealer)", "value": "0e13be378b2ddf71bb66fbe2f90e4eeb241fe9fa92ef8e382320c86685f21d6f", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110704, "uuid": "7a279fbb-3aec-4c34-ab44-bc1df016c14e", "comment": "Malware payload (RemusStealer)", "value": "166e44b9008405f89ac2031f62ee5e65e8b3d611", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110704, "uuid": "c3d6562b-28dd-41d9-81c1-8a4ae40298a4", "comment": "Malware payload (RemusStealer)", "value": "fdb18633b4e2e8307daa42fc97d2c32faaef23b4e4bdd8a8507d13999ab63a2843b6fc6449d77b4a637ff3b7af435b02", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110704, "uuid": "f394b021-c360-4a24-925b-c9591199c578", "value": "T1CD24096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110704, "uuid": "8b40b0cf-733b-4b36-b2f7-b6774703116a", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110704, "uuid": "3d3bfa35-903f-48dd-8ea8-67a6cb3deb4a", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFy1gCGiics:Qj5WUEBx+Q7PEfFnQU+t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110704, "uuid": "06f0acda-f7a5-425d-a646-309389b77ff4", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110704, "uuid": "be9a6e17-c751-4e7e-ad67-be80d845c372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110704, "uuid": "d15cfc2c-7071-4432-8e1d-74659ffac13a", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64c35050-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154330, "uuid": "e710b3ac-9139-4961-84ec-e887faad71d8", "comment": "Malware payload", "value": "0b902b1a40351f252bf835002edd881b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154330, "uuid": "36d17dfe-fe43-40fa-8f2a-a5da2a22a36b", "comment": "Malware payload", "value": "0e643ffb1e4df2f5b281f88543f0e7840f350ac1c81b801be0b2bc2d98dfaa94", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154330, "uuid": "1770307b-fc35-481f-9751-71e253fd2511", "comment": "Malware payload", "value": "a033b1fb4abeaf19ad79279da40cc497a3ba46ec", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154330, "uuid": "16053268-9f79-4f3d-831e-6c3876bbe57b", "comment": "Malware payload", "value": "d7e09ade7dce67ec5d20aca2e3f02caec9a542e40f4a8f590843c2d8cad749e23bebbeaf83edcd20b54fbd460b11f766", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154330, "uuid": "8ee65182-e8e2-4f1e-bcf7-27d24e0c4292", "value": "T1D121A768F5D3E672D80FD3B52F252D045301A8B10826417F568C269A3CCEE2C885F285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154330, "uuid": "88630e6e-e2f5-4108-832b-58a9fd2ec17a", "value": "24:99LeiKl9OFBqId1JzlKDvG0mSKyOHeISiLUGmpaI:99Lebli4IdjsDv5P2S6UGmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154330, "uuid": "2bd43bd7-6f85-4ee4-b8ed-9f5a58db6a17", "value": 1196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154330, "uuid": "b356173e-bc90-42c2-b122-6cb12e84e867", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154330, "uuid": "c40a2aaf-8386-4358-87b1-9375eb990e58", "value": "photov_051923903839.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9579160f-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181040, "uuid": "4f7df2ab-c527-48ae-b6d5-d6610453ee87", "comment": "Malware payload (Mirai)", "value": "c171448782757da1d1c78f8bf070dffa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181040, "uuid": "13ed8bd5-52c4-4aad-b282-671110714c61", "comment": "Malware payload (Mirai)", "value": "0f4755d46a150c16e9af5ba03b6b680d05aad08a7eeccba7239ead83c8f1e755", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181040, "uuid": "27e22f8b-4038-4ef5-b8cd-3e7087ae2a0e", "comment": "Malware payload (Mirai)", "value": "c6e8032185c1f66b157b043cc1a839cdc7de506d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181040, "uuid": "b85933b1-d6e2-4e6a-8d57-27d78f11a65a", "comment": "Malware payload (Mirai)", "value": "b4933f4a3f6bec37612d001e9e689dc7ba99382ab9ccb8424e834a297ebcef038f16fb053674027adf3b67a3bcd6650a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181040, "uuid": "4c0a428d-1cb8-41bc-a43e-9ff7b019e280", "value": "T15E732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181040, "uuid": "21e1641b-1618-488e-8170-1172de1ec6a3", "value": "1536:M6dz9MTC0XU66Ee9ps93/UYjDRPz+SbHB+UvAs/w4:M6dS6Es0/UYhb+41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181040, "uuid": "1ff35272-1025-49ad-8fef-a553091c5fe9", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181040, "uuid": "196c6793-d018-4ace-a987-d28267acebbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181040, "uuid": "8550d05f-4e1f-46a3-899b-bf876d8ea68e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3dd9ef-8985-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785134106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134106, "uuid": "4b071114-6c36-4d2b-9493-d8d24d7a1db2", "comment": "Malware payload", "value": "698f6147d9b4b7dda03d0d78598cf45a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134106, "uuid": "fa724e30-1e4d-421f-8fe4-d642ae48cd32", "comment": "Malware payload", "value": "0f637fdc7ddf4c390dc2df486595e5d9f5b3b4faf5b4ebd1e30ee41f220a443a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134106, "uuid": "766ae0cd-3dbe-4fa0-a170-f9f4d313c476", "comment": "Malware payload", "value": "21dab68d0f1a36dfb4cc4e9b5eb8d0de6e77db79", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134106, "uuid": "fae4f0c1-731a-47d5-9440-586f1c9c51e2", "comment": "Malware payload", "value": "b94efaec349e5bcc4eb984dedf9b02ac8b8b55a0d211880b002a04938663c8c655ca444fa437a36026cffa7a52e73b69", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134106, "uuid": "7e2ca79b-634a-43e5-aac6-2e7704cf3e46", "value": "T156F024C841022F5793099D1F7593509EC252F3CC6117E785FD8A4A3C9986BD9B428EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134106, "uuid": "72862cf6-0c87-4913-8bf1-f628950c508f", "value": "12:KhI5W3CtI1/TbNuAIP/3bQWuA3tpLOhcuA66uAegiAE/uAdlHA:KOQyS1bbGPvbzpLOeiAqlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134106, "uuid": "ac33390b-ae39-4aca-87bd-7d0fa91cc730", "value": 525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134106, "uuid": "4be3fc8b-6c71-4bb9-a0a8-1aaaa0879e37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134106, "uuid": "191a8aa2-c95e-4443-ad14-dd5da0f89826", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dfb1d37-89ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156895, "uuid": "d1389b6b-b877-40ea-9b62-dcfd60c2c32a", "comment": "Malware payload (Mirai)", "value": "e2adcf7341f590dd9ee52271308e8a96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156895, "uuid": "c6fd4615-3c57-4e76-bd69-26a267167bd4", "comment": "Malware payload (Mirai)", "value": "108f4d7c341ed33055c498b1156954cc5dce0799eccc4cc7ad2f072303f054ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156895, "uuid": "d119b828-3798-4339-b703-7766abc46d1f", "comment": "Malware payload (Mirai)", "value": "0151829bd469777ec072640ae34445de89ed1310", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156895, "uuid": "579dcb95-18b2-4b96-8897-b6feadc663ed", "comment": "Malware payload (Mirai)", "value": "1d3c60ae9e785c703effe2eae32e1f55ec2ea57f4659db9b6b24010251f3c970a796984a4b6e9e1c58e2d4674872b90f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156895, "uuid": "9be0cc5a-bf15-43ce-9829-31c791407a60", "value": "T1F6041945F8815A17C6C612BBFB4E428D372A67A8D3EE7103DD255F21378B96B0E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156895, "uuid": "55f78340-6a62-41e2-b408-bf4b46967a48", "value": "3072:ZaFuzOREzpKeNFLncVrejnCir4WJ3cxAt+f7SwhDR:BEEFc4D/r4W1cxAQ2wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156895, "uuid": "2a67950e-342e-4d4e-9cf7-50bf2e61ac76", "value": 183040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156895, "uuid": "2d839211-2465-4d4c-94b1-67141b63fca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156895, "uuid": "35c2d91d-5ce0-4f6a-9cbd-35c7e6b132db", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5d462f-8a0c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785192197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192197, "uuid": "5c6e327d-4613-457f-8e55-cc7ecd83f0e8", "comment": "Malware payload", "value": "f5820b371ce9f3c8bc83610bf52151d0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192197, "uuid": "c5b10680-e122-4fc6-a0e6-f349198adba8", "comment": "Malware payload", "value": "10ada20cd985da2b6ba1e0a5ce914582f37b12e6b4fc6c0c3f70466b1f9fa06a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192197, "uuid": "7aa3bdc4-a484-4f53-a098-fce10579eb86", "comment": "Malware payload", "value": "c4657e92e7071ed21549e6be1d3a33af93925004", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192197, "uuid": "ea108e1c-e214-47da-a051-df8538ace766", "comment": "Malware payload", "value": "f30a26fba6cbba96812d8ecb26d9f16e298be2f3c0eb0cfd1c23682dd1a3958bf8baaa65dacb10046fbfd6587e4ea049", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192197, "uuid": "7ed07780-9edf-4576-8a15-376ffbe5efd4", "value": "T1E4236C6516857C14AE98C4375D7F2F0CB9AD43E6314492EE7FCA3CF28C4A6AD920861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192197, "uuid": "10bd08f9-9346-4b68-918d-a905a74a37f4", "value": "768:kr9NyXsZztC2H9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:CHusZecr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785192197, "uuid": "bf942462-f532-4ae1-913b-beff5f71c463", "value": 50035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785192197, "uuid": "dbbc1394-236d-45d5-8090-25523afe510f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192197, "uuid": "d0730119-891a-4b05-b64a-0d5aade2d675", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc0c104-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143554, "uuid": "1bedf87e-7ccd-41e4-8800-ae94b9624589", "comment": "Malware payload", "value": "0d0c29da95a0fe3a44c64fc16ae35b72", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143554, "uuid": "bf10e135-4e6f-445f-9e06-8346c8d426a1", "comment": "Malware payload", "value": "1166690e51e60e83618b14032144a17884c916b06c13476f7a7939ef80f722e5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143554, "uuid": "e3610b11-d1ff-46df-9848-a2ee0c13c6e9", "comment": "Malware payload", "value": "4518ccc8c15167664f202bba261e437da5f2c884", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143554, "uuid": "2d1569d4-1508-4989-a3fd-54b592851057", "comment": "Malware payload", "value": "122c263a11321d60376a29c9f486ae4ac03238abc1d2dea98c5f6f1b2a6ef1abc046cd523e853a0a7a6b4b61e7443375", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143554, "uuid": "e2e53c8a-b364-4a23-87fe-8c992af51ddb", "value": "T17F11A579D81FFC50CF8B0339F2213D192929A1190822E1DF26F3B15928DADE893401F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143554, "uuid": "6b3d4743-daae-4b09-83be-72a282cb0893", "value": "24:9EDVkXNlO5sPoaiNk7wwwMG6ARZoC/ZYA81EZB/N2sgmSpJQtnnY77NrGg3w2Vg2:9UyXaqjjswwMtAToC/ZYb4asgPzUY7ZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143554, "uuid": "6d91838c-4580-49ff-9c2b-d0b3f8586f0a", "value": 1051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143554, "uuid": "efeac49e-f6c5-4229-8b10-89899f32d102", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143554, "uuid": "4a93f0f5-8c2a-45aa-bad0-9379e2ce47c2", "value": "photov_922150137128.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de223f30-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133059, "uuid": "3bcd45b6-bb89-46f5-982d-d40c3604dce6", "comment": "Malware payload (PureRAT)", "value": "8c53b7c9e6a982a0e65e50e2af51bc2d", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133059, "uuid": "ce3e6f79-ff32-4c54-9810-e8f543599a25", "comment": "Malware payload (PureRAT)", "value": "11cb210cdc5797a702d37a9b5f2c840a1ba30d3310265242507656fd85b6ada4", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133059, "uuid": "e611170e-54e7-4c37-8cb6-0538ad443dcd", "comment": "Malware payload (PureRAT)", "value": "fbe12d4b95c8a5f0482b35e5ea0ff9fe74e0109f", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133059, "uuid": "f878c636-992e-4c62-8a24-29dcb84ce56c", "comment": "Malware payload (PureRAT)", "value": "a59f8460fb5251e608e1f8a8230f147a35c7731a38e899eaf867d022426bc1d8064dfb71bc7af3f27fac6a5c764e8d16", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133059, "uuid": "c04069b1-aee5-4133-8f42-68559187cfe2", "value": "T12821A7E0F018CDF2E60FD8316C527A05246A4A748651E24F17F678A636058A87BAC1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133059, "uuid": "e7a87679-01dc-426c-8ac5-0b10959008b5", "value": "24:9VmaPRXjWnIBXKaabPrnnNmQl2KtLZxArvfYSO4mS/M3xSNnf01D:9YaPdKuXKFbjnnQ2BlZx4jO4P03Ix01D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133059, "uuid": "d77ee37b-ac61-46c5-a776-6d347f49a884", "value": 1209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133059, "uuid": "a02a8395-3ac9-42cf-98bd-60bec5490a0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133059, "uuid": "74cf6c1a-3af7-455b-8ccf-6b7ce2b3f3d4", "value": "photov_864260752618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0118a715-8973-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785126245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126245, "uuid": "cc9659d9-fdef-4d4d-8b44-820ec5933359", "comment": "Malware payload (RemcosRAT)", "value": "6a1f005d742435a1548bc9a960b8d122", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126245, "uuid": "a606967b-fc1a-46be-ba8a-7a86720fdfa9", "comment": "Malware payload (RemcosRAT)", "value": "120383ec4f69867cea147fc9368e0d9b711417aea97f0b40c90939cc6500bcd8", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126245, "uuid": "a77fb83e-2eea-4e40-9713-9d7940eb780b", "comment": "Malware payload (RemcosRAT)", "value": "223aad80dd9f46afb925182639d33ac43928ebaf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126245, "uuid": "2b3819b7-0fce-49f3-824e-64999412289e", "comment": "Malware payload (RemcosRAT)", "value": "944b6b12bbfb4f80a88b05a00f0258dc7e47444d60efc0403ccb8224b2dc2b306a16e1c52d46186063026997a5feac4b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126245, "uuid": "2ae8fcd0-6d77-4fe5-90e2-dbf81db642d1", "value": "T14B441820DCD80B3A0E5707DDFE514A65C9FDC6298637D0ACEA9E071E50125ACE7BF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126245, "uuid": "b95b3b9b-0285-4a0e-aef4-6deaa2b0e88c", "value": "6144:FupwvXhX+ULsWaA1LNpXhchyVNTS7VROo2YJTd:ibULsWZZpeYOqYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785126245, "uuid": "9332b777-8f75-4469-ad82-bf4cfb5d05b5", "value": 276400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785126245, "uuid": "cdc4bad8-648f-4df7-853e-535dc3d0fbb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126245, "uuid": "13738ac1-dd4c-4a11-a9af-03abbff67f7d", "value": "SHIPMENT-DOCUMENT-00202P-SHIPMGTG003838399-PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ecf05c-89f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785180001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180001, "uuid": "83d2728c-f249-4384-a676-9e320c03087e", "comment": "Malware payload", "value": "1d1cb7462992da5a544162d697747f2a", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180001, "uuid": "5f4cd935-8f97-4838-a1af-3ad200b55b61", "comment": "Malware payload", "value": "123fefe00c2bf0e83f5bf0263ce8b65a8a20214c661d392e03cecc4d7529e5b0", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180001, "uuid": "585c8b6a-4411-4f32-b81d-434856f16369", "comment": "Malware payload", "value": "1a1537a6b84996ab570d536052ac6d1b51e02353", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180001, "uuid": "c63a20f8-fe29-45c5-8ae5-e22a1ea9ef25", "comment": "Malware payload", "value": "9dbdbead9c2cb998bc79a22b9235fd4f50a9ebe151ce4afcf78ba7edab9a6c46ff561877d4257c340c116ca2cd991bea", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180001, "uuid": "b73a8e9b-bf83-4e52-9485-0e2330f8c6be", "value": "T118622DC7738807BDAB8C9DDD51A450A394F2E0AD3C7322C8E9D59E47B93AD507DA0A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180001, "uuid": "eba49369-035c-444b-9f43-105a1ed811d6", "value": "192:oacvCtkPkn9RVghunz5SEeKxyx3DOJEMHC30yJIUNcE51SzyYfBlTmAnbKQTpOPg:oacvukgiBrTfSPKQgPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180001, "uuid": "e19b9742-69b9-41fa-9b85-11b7854a33d4", "value": 15465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180001, "uuid": "e8fd30bc-3f9d-4f56-acf5-05873b0f3063", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180001, "uuid": "7de7a1e5-c88c-4c84-aa18-a6fddc69b29f", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9bac9f-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132972, "uuid": "e0254f7d-fe21-4c17-89c3-7c2851af3234", "comment": "Malware payload (PureRAT)", "value": "49a027719efa0df4bc7c9fe5f4c2519b", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132972, "uuid": "aec1cbd5-6013-4095-bc3a-e05c6883ff05", "comment": "Malware payload (PureRAT)", "value": "127ab9251e875398303b391dac7b048ee037d0fc96989788fed20d4da7af472b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132972, "uuid": "7c0ee00c-61b7-4453-9160-5682b75c13a0", "comment": "Malware payload (PureRAT)", "value": "b1c8a5b2ff76441b7b97b2b692c61d3e483da463", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132972, "uuid": "85833622-c693-4ee2-b046-935bf6ec2acb", "comment": "Malware payload (PureRAT)", "value": "1fb5b4eb2a2aa04d80a950549711375210ea67b5f49669cc9a7e12d2febce06929b85db17947e761ca1546efbb8a73a5", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132972, "uuid": "5313efbd-b3c3-4386-a77b-724539dc46a4", "value": "T13F1198EAD196FE50FB1BE1306CC766082225D455400D41A87F712D0C7B7ABC99B1FB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132972, "uuid": "3a0cda45-d2d1-4fda-b37e-5af95ea38359", "value": "24:9KJ1MofarM57Fy0pCQtqpQb2mSbo4mhHIOlpJvhh:9KffyIFy0Ttq+b2PbVADh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132972, "uuid": "0d03d999-d94c-4e7c-a88e-44c93e307a9b", "value": 1024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132972, "uuid": "e81963fb-9fd2-47b2-9372-60807de878e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132972, "uuid": "25523a52-b775-4cf2-b5c9-820fb3dafd59", "value": "photov_222486713680.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ea444d-89af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785152350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152350, "uuid": "4896f70e-5a02-4c32-97de-0398df036302", "comment": "Malware payload (Prometei)", "value": "60aaf34bead6e7a56fb5fa4ccd552b4f", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152350, "uuid": "55355711-998c-460d-9dc2-0edaf69afda7", "comment": "Malware payload (Prometei)", "value": "13e58c3b5e45ff821184b68ec229eee463284b0b887cddf3b8bd955439a3a525", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152350, "uuid": "1be0a6b6-dde1-4c54-a283-f4fcd5ad2e2f", "comment": "Malware payload (Prometei)", "value": "4b26ec3efbbc82ac96af3cd833ace7f4eade2962", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152350, "uuid": "1bdf2b44-f913-42bc-a52b-8be197fe80ba", "comment": "Malware payload (Prometei)", "value": "be17e412eafbb8cfc545f24a26bd5f7aaf551833d62b749911089ccfa015ad59b9e29e52dc91e79d2eb49e51fce21c9b", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152350, "uuid": "73161c72-dcd4-4319-abbd-41df3974f5bf", "value": "T1E1B733BC20F8D0DC5C0519F12BC876F6BAF5F6D72A9410AB93AA1A7435F0BC46566F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152350, "uuid": "152675e8-f7ca-4f70-a462-604ea6637c00", "value": "786432:F0EvS8iMLEnT/YC41OXv8FpPoyouUf2U4OJl2aMSfu+RvDXJoLS28SVIKs+7rAfQ:F0Vdv4FvoRuU/RlFMS2qvDX2OSaKskyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785152350, "uuid": "d7fd59e1-9bc9-45e8-8566-ff47906eb37c", "value": 48586493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785152350, "uuid": "8f94e234-6a88-4102-9bb3-d5cc9c5ffe05", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152350, "uuid": "1030ed08-e00f-49eb-99d8-00ecec9dd7bb", "value": "288230376162125647.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450cf2f2-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158142, "uuid": "a6043f26-a78a-47c6-a579-a56bba32535f", "comment": "Malware payload", "value": "56de7e74a687ad9a4c37bc55181879f7", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158142, "uuid": "75d7eeed-1ef1-4943-b40f-30b3aafea6eb", "comment": "Malware payload", "value": "13e5d588804b938f0c3807dc194ee5274c475a5ae794815dcc910d0df5411c9d", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158142, "uuid": "288f91db-8b8f-4ed3-803d-98dd3a25e908", "comment": "Malware payload", "value": "551148128c95bb551e745afff245f46636268d57", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158142, "uuid": "0b2a260f-b823-4c71-a4a4-55afa75c68e9", "comment": "Malware payload", "value": "784bec52ac89402225e916d8e34aeb4a35597d7ebbea49e1fbebd6066331b1c2e5d26661e7d64c02d4befc1b117acb03", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158142, "uuid": "74361f58-9c7c-4448-b21f-3423bcfcac32", "value": "T1C247AE14E29831A8F5E7F634CA979232D6F178063775E48F068BC2052F73A91AB7B315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158142, "uuid": "653ca30d-ff5d-45e1-9715-511fdb08071d", "value": "f35cfcc6a3cb25841aefe38eee53876c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158142, "uuid": "d96f40f9-20c2-4146-8da8-57eae2775bd8", "value": "49152:+bsYes2pUopgkNoksAMTPZBDFDxFtS7n0yL7cgESOJJzS1gHUBD:jEb1gLKzhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158142, "uuid": "7529b6f5-3ed2-4db0-bef6-3efafd20de53", "value": 26927616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158142, "uuid": "1bdda1cb-4447-49e3-a0c8-f2542acb8843", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158142, "uuid": "56876cb2-c25d-45d5-9b39-af7907230636", "value": "13e5d588804b938f0c3807dc194ee5274c475a5ae794815dcc910d0df5411c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2e9ee6-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154421, "uuid": "88858f16-2a9d-4289-901b-f9517d754b93", "comment": "Malware payload", "value": "8f251d98e5ddc088808f3ecaf71364ea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154421, "uuid": "c700346f-f70a-4a7a-9b61-f05e72692ce8", "comment": "Malware payload", "value": "1431922cf87dd5e65476ef9975c60a7ba4f79466ff35ac16b789c62f8532eece", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154421, "uuid": "abe7b2bc-ddbc-4db1-b8a2-5065341a2521", "comment": "Malware payload", "value": "86db8c349a92aec75892158134906926225d99ed", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154421, "uuid": "b58f79c9-86de-4def-a574-1c9a9e9cc396", "comment": "Malware payload", "value": "26a24821483c75e4b5f85c7bacdb4f0add410426b5d763016670e22ea338d52ab724c0d2670c8901aafefebf72d91537", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154421, "uuid": "a7d82a41-589b-42fe-9987-a98287a484e7", "value": "T1FD2171F4C01DD368C10AC5B2B7A6508C279C61D45862A40EB7B8BA83FDA59CAC71081A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154421, "uuid": "2d725f4b-e829-4116-a6d2-24e22bdbb324", "value": "24:9zyBhHnZ7lIwGJ63fgwGxSPikdR6DQKgFmSPmq+Jl8yltYy63Ryd:9zCHZ727OgwGoPikSDQZFPF+7ltYZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154421, "uuid": "6ad3eb3b-c14d-4504-a89a-11193800f3b9", "value": 1222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154421, "uuid": "f0362bba-e47b-4e1f-94f1-593abccd7bc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154421, "uuid": "06d995fe-acb8-400b-9e4c-074b3432826e", "value": "photov_040252321148.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0796164-8953-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785112796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112796, "uuid": "94c9afb6-4d53-432f-bf1d-463f73d11a64", "comment": "Malware payload (Mirai)", "value": "64dd490fe20b776addc29f3e7eeb7ea7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112796, "uuid": "1d32f0b9-94b4-4870-96bd-c1d1c725bd68", "comment": "Malware payload (Mirai)", "value": "14acb457792a4857aa226eb7cc24bdbe8642adf896e3905a79d09e4dd9e9e511", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112796, "uuid": "dec1f58b-15b2-4a06-8375-9ebcb66a3695", "comment": "Malware payload (Mirai)", "value": "021ed91215b705aa2151e073ef78dbd6c2d6c04a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112796, "uuid": "fed9f01e-25b1-485e-abcb-be67171bff97", "comment": "Malware payload (Mirai)", "value": "ba80b12ce7e2cb8ed2a534e54b00ae3543bc0f011bee36aaa71650bc27e16fda697132651d95d96b71d4d96468c606ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112796, "uuid": "2f7bbfc4-2590-4537-b688-303462f726e6", "value": "T15FE026CB001AB3404B889E04FC5A883E78AB82D130329618B202F4F4C9CD109383AFDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112796, "uuid": "d6e5f2dd-7fe2-4a5a-8ad2-1958d9811ba6", "value": "6:VSLA3JP8khELVBQLA3DQ8ksWQELLcBQLA3cxh9yLcMBQLA3dxhbQxIMBUA:VSLAZPfhE3QLAzQ8ksxgwQLAyhgLcAQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785112796, "uuid": "5b321d54-8b35-46d3-8b86-01d812b99fe9", "value": 318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785112796, "uuid": "22f4e04b-7898-4fe1-b25d-feffa9ac5399", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112796, "uuid": "8ebade59-3c33-49f9-a3db-2b42b8c5ca1b", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7abad84-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133101, "uuid": "214de8e1-8dd6-482c-9baa-8960bbad585e", "comment": "Malware payload (PureRAT)", "value": "49f5b12e9eb46a4951706e16a2cd3445", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133101, "uuid": "5598c9a1-2ea8-4b28-836d-652bf9cac60f", "comment": "Malware payload (PureRAT)", "value": "14d126f9f662505855a12a2dc63c1cd641b3aa3a9364deb9e939524a7962170f", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133101, "uuid": "768f8382-a972-4bcf-8394-80e12261011c", "comment": "Malware payload (PureRAT)", "value": "6a4bb672a6b955ead1cc8f2bec8b00a2dfff1f7f", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133101, "uuid": "b5c7d15f-e01c-41ed-8206-4405846452d8", "comment": "Malware payload (PureRAT)", "value": "194200b61a1c5405263e797fd386f4d727dc9e5692fd644dc3b844879e64877cc45b2486c065d67d08a24f6487d4ad6b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133101, "uuid": "6d22129b-0373-4a2e-b00b-27a8beea3b4f", "value": "T1E221F5904632FE70C627C3BDAC5BE711611A73273450D2680A5CBAF8BE0386CB682D01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133101, "uuid": "74aa9b26-99b2-4db8-921a-5f9dd0d6b77b", "value": "24:9mBedStxTbY/zJoLPp2Z0+Kc3lRo1QQ99laxX5mSFjwEbLWqYDK5ir3FmCl9pEpH:9mBedS7AJoLPUKvc3i1fliX5PFj/WxD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133101, "uuid": "c41b3ff6-4982-4445-9589-aa91bc66dcae", "value": 1334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133101, "uuid": "b619ac09-9e24-4d15-af59-8eba0653c2c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133101, "uuid": "e7479357-de92-4f93-8f2b-1ce9427e518e", "value": "photov_719373273272.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b759a007-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132994, "uuid": "3cbcf264-0bba-4a0e-b495-546b87c7697e", "comment": "Malware payload (PureRAT)", "value": "d713f75313ba03d41f2847afab2762c0", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132994, "uuid": "9cc3c3ef-3630-4ae2-a1c9-3832faaf73c7", "comment": "Malware payload (PureRAT)", "value": "150383fafa419b858b608a58a953f5da7af6aff3a3ad0bf9bf0bc5a50c67fb93", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132994, "uuid": "77ff0e6a-c050-4f24-88e7-606e8048b2f5", "comment": "Malware payload (PureRAT)", "value": "e2d07bad9d768264cfb0cbf16cb7bb4bb5969d7d", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132994, "uuid": "a4bb18cf-e0e8-469e-a5f9-1c82e46443d6", "comment": "Malware payload (PureRAT)", "value": "efc17a99b6c53cd0a2af8fc0eac96ed81f1a80cc2b579cb408dafd37d1ce1a54e07b325d041897c026810c9b3ec892ab", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132994, "uuid": "f90df975-860e-42d0-9c37-abb5171ba137", "value": "T18321FB54D90D7F49C20BDF38F8568ACA1245BA75409D07ED6D66BD8C3F73D401945C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132994, "uuid": "9bd8b479-c43d-4075-b654-fca13317c24a", "value": "24:9f7PWvMzzoNJHwYU9igrVCkXvssBNXjcdaCjWy6mSmH4JMSPzJdf17DSyGyX:9f7wMzzoNJRU9ieVCsXXgdaCjWy6Pm83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132994, "uuid": "a5d57be7-7aca-4b5d-b207-a4b1c14c9e7f", "value": 1339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132994, "uuid": "bbebd381-c844-4989-9fe9-13eec57d3898", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132994, "uuid": "368eecc3-89df-464a-af01-380a93e2cfae", "value": "photov_053412124165.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7424990-89f4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785181929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181929, "uuid": "a48eba7b-6e1b-4597-ac27-33e3061304f6", "comment": "Malware payload", "value": "b9a514140e2d08a4fde3a8c866d700e4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181929, "uuid": "7d7ba916-ddf9-45f1-b43e-a8748cc029e2", "comment": "Malware payload", "value": "15d34471d464ff576aa1c6fdbed6821c3b38f811916770a7db2422c5a90d01c8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181929, "uuid": "1284ffac-82ea-4c1e-a1f6-39076d4f1f57", "comment": "Malware payload", "value": "206037c84dba718a3149c081249eb7238ad711dc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181929, "uuid": "c088dfc6-cc4f-42ed-98ff-9bbd9cc1709f", "comment": "Malware payload", "value": "1629f3efd84bb770846b276a663713339d4bb28d235cd5f9310ea34e6432dca08297308f1e2969650da60da4e5cb2dc6", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181929, "uuid": "ecd90f1f-d213-43f1-8afc-d5e58265b9dd", "value": "T168E633586FD502EFE973503CAAA15228F95478A213B2CEDB0794D7A1EC131E08D3DB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181929, "uuid": "2dfe2b80-dd5d-4cd2-ae73-710a7d65f2b5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181929, "uuid": "1897b568-e687-4676-bc14-178c0d38dbc4", "value": "393216:10jioovGyZjksWScEXMCHWUjX0cuI3/PGTAI:1RvjZj3WScEXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181929, "uuid": "d70cffde-fec3-4b49-8e9b-70990477d62f", "value": 14287977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181929, "uuid": "aed4feab-5265-4564-b436-239746174310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181929, "uuid": "46c8dfe5-e8ae-4827-8dae-ef8832e96727", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a5e816-89cf-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785165958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165958, "uuid": "cea96751-3bf7-40d3-852c-cf654f28b84e", "comment": "Malware payload (PureLogsStealer)", "value": "148d43b07def3619cf07a1d440892e6f", "object_relation": "md5", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165958, "uuid": "5fd56ffa-f6b9-41c0-a948-de1ad9c375b5", "comment": "Malware payload (PureLogsStealer)", "value": "169fd9264d4e5b84e514cd34a0e69c2c56667393546434282f8957bc045a091e", "object_relation": "sha256", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165958, "uuid": "b6512eda-c169-40ef-a2a0-5ec224c80a46", "comment": "Malware payload (PureLogsStealer)", "value": "8883ff5ff4ba025a42255ce0fa45ce7bf5c2c146", "object_relation": "sha1", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165958, "uuid": "7b2573b0-7b9f-4b0d-9dbb-64756f5f6849", "comment": "Malware payload (PureLogsStealer)", "value": "cb0e326e0dca692bbc3ca547e18ab523c548dfd1b1c27c2097fef8259ea64b3a6c5c7b5cf7fbe6b5216bbff2aa2716d3", "object_relation": "sha3-384", "Tag": [ { "name": "204-44-93-88", "colour": "#EA5F66", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165958, "uuid": "303c2d9b-36a1-450b-9813-ae03651e708e", "value": "T16B05BF2A72928E22D14A4773C1D7490087EA96477AABF70B328523D60D073FEDE476D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165958, "uuid": "6603a0b0-f7df-442b-9939-c5627f513c50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165958, "uuid": "fa0ad8a8-bfa1-41b7-87f4-ff9bba90d8a1", "value": "12288:mVYRgXmDsQhL7jnOed4Q9HyEv+Cp3QMvJe+2Qrr/TijA7+:D+X2sQhvd4Q9HyEmChZR1rrmjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785165958, "uuid": "5202c1c2-2237-4779-90a7-40d9c4566263", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785165958, "uuid": "9bf4c88b-97e6-4fa9-b381-712069ba2a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165958, "uuid": "6236ad54-0f65-4728-a370-10bdea70e5eb", "value": "Ztnhg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09aae42d-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167491, "uuid": "711f0038-a244-4533-bcb7-d9f8d95ecb99", "comment": "Malware payload", "value": "38e3c137f9ee93236783c70d476a8026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167491, "uuid": "726a923f-e6e2-43cd-a27b-75fd239e93a4", "comment": "Malware payload", "value": "16d5bc23e5b8806ac757ba1c7d1ca781de0744d3af247328792732a89769471b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167491, "uuid": "9387ecbf-99b4-4595-885a-afc22d933b7c", "comment": "Malware payload", "value": "5bf4ccc25b695d4565283e25f133d5d80e0e3074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167491, "uuid": "a0c2f8b8-6cdc-4ff6-ba92-740be1c25d11", "comment": "Malware payload", "value": "d3a4bf0b29b5f3fab89f76c1d76608d964a29d60915e30767a8b50d39e7d0fe44008dac3ac2c14cba97eda6f18714db2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167491, "uuid": "a35ff962-95fa-4d2c-bd27-c88b07ef151a", "value": "T1D285339B124CCA78B532AAF63244C225F85C6BBE2701C7FF94526A998543F5273EF131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167491, "uuid": "427eacc6-7a77-4c22-8109-6fa247e94e00", "value": "49152:stRUtGAjUDv7MaDHPhikNGZ3Ib7G/QN5wWJMTR9B9H:+RMGAuHPhVNGlIbZqtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167491, "uuid": "33395cc5-cc7e-459b-9a52-eb7310180827", "value": 1743844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167491, "uuid": "1fa59ff2-f607-481a-861c-94a8ad0c5665", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167491, "uuid": "73d3f43b-f58d-455d-847c-9309777b0ee4", "value": "16d5bc23e5b8806ac757ba1c7d1ca781de0744d3af247328792732a89769471b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbb8d17-899d-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785144577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785144577, "uuid": "415bc7ee-693f-4d00-98cc-a580735a87d0", "comment": "Malware payload (XWorm)", "value": "3c5ff0cb1626324a12eedd33ad267e33", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785144577, "uuid": "86792334-ae9b-4b84-8a01-d5e421754591", "comment": "Malware payload (XWorm)", "value": "16db959a668f19e432d94deea974094d55cff72d412cb873612d93fda54b6f18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785144577, "uuid": "c86eb728-7516-4ba2-b1c7-2040ca29cee7", "comment": "Malware payload (XWorm)", "value": "703137cb507ac24ebf932209e91645f541b16633", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785144577, "uuid": "5160fe82-96cb-4cf2-bedd-8da402bd3241", "comment": "Malware payload (XWorm)", "value": "b59111d154702f5b6d0a67979a13681efd41d70fddbad1000de80b8998f8c04ded43c1a7dd29c135aace31ec55c6be81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785144577, "uuid": "d9dafd19-5633-4e8f-b514-b3bfddc84b46", "value": "T14E37238D0D7F69AC7AFC9274B1B32D593484C25823E8CF88A15E7CBA59D899C30560F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785144577, "uuid": "1e92f38a-d591-44fe-9ed4-1bfd88de75d7", "value": "49152:EGMuzyVGMuzyrGMuzyIGMuzykGMuzy2GMuzyhGMuzyQGMuzyqGMuzylGMuzyBGMe:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785144577, "uuid": "04421fb0-4b97-4ab3-85de-63a980da8a5f", "value": 24272301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785144577, "uuid": "4777625a-a55a-4352-8b66-3d983200c33e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785144577, "uuid": "77965c9c-1588-4476-8f6b-3e28be39b008", "value": "invoice-6002958556.pdf\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78238002-8a05-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785189152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785189152, "uuid": "e9bdf59c-cb2c-412c-a6af-b9806284a5b6", "comment": "Malware payload", "value": "ce3376b9a6834ccfd743785dfec778a1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785189152, "uuid": "885b9182-2a6d-4e91-bfc5-ced784563cf4", "comment": "Malware payload", "value": "17c4da4a81155d233e6eaf6ef7cd2590d6fda76a46bacede4881ab3cd1bf88d3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785189152, "uuid": "4ef82f0c-4dd4-4aea-a26a-6b2124990ad4", "comment": "Malware payload", "value": "292fc63a1d767753790e78d08aec4bc97d19a5cc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785189152, "uuid": "2f262d53-03f3-4865-ab7d-3dc1c5a8860c", "comment": "Malware payload", "value": "40c40ff0e9bf0c21d503b4eb3be80c298cef0c959c6844e9f18d3d6ba0846770ff0d6650a950a1db12dc77eb25b04212", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785189152, "uuid": "7ac7a9b1-e65d-4095-b0ac-3a182987d5bf", "value": "T13FE6339CE6C005EDE5F382369DD28790F2AAB4750372CA8B5B78C6525D632F10D3C6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785189152, "uuid": "b21773d2-83b1-4bf9-85e5-0402a84fb29a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785189152, "uuid": "27bd7d32-12f8-4de7-b984-134a9dc26865", "value": "393216:AKWpyg4EgvzM7AykZfMNmQFVYuXMCHWUjX4cuI3/PGTAI:As9EAzM7AFkmQMuXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785189152, "uuid": "b9bd16e5-469b-4bec-a4bf-8fcb0e15db82", "value": 14317586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785189152, "uuid": "6c9a8482-c22f-4ea7-b310-ac8fdb6166ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785189152, "uuid": "439005d6-2c0d-4f1a-9a82-0fd7644b1aae", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660f82c3-89d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785170223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170223, "uuid": "0f93a532-4dee-4e08-b8f1-dcc4a721c98f", "comment": "Malware payload (Stealc)", "value": "deac2af8f25970ebdf88d617037f6b56", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170223, "uuid": "827bcbd0-ca15-4c59-9f33-389f338e075e", "comment": "Malware payload (Stealc)", "value": "17d5023a4778003af6f2d2a02d9e8b3719b9a3c78e314a25b5652e965e95906c", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170223, "uuid": "9b690436-53ee-4ba9-8e83-f8c19ac3de53", "comment": "Malware payload (Stealc)", "value": "7f41c5645853c5085c49ccdd4d035ce137a09762", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170223, "uuid": "71254a5e-18f5-4147-b690-fc30dd4921b5", "comment": "Malware payload (Stealc)", "value": "6f99608b473e2e90995ccee372a467659f6560e00c0ab30395bdd329c735b41652f8014cc1118679eeadbb8bdf45f274", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170223, "uuid": "068a9b1f-f6e0-40f2-bc57-dc36648c71e5", "value": "T131F6335927B9A528C14506B90E59FD434FB3B830EFEC53EF99A853CA4F629944DAC3C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170223, "uuid": "d9d49bd0-9f51-4a19-b0ab-d3504b859967", "value": "59e608f38629dea8770e1d4ba1afdabd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170223, "uuid": "3453ad9b-b952-4cd9-9468-91d085b60fbc", "value": "393216:vREqTLlJ3SthIn/S3iyMzoj73sYQJVGP5kZ9mz3hnYc2W2v23pAL:ZEqTLDzna3iytjoYoVw5qszgW2v0AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785170223, "uuid": "db265d14-a627-4435-aa96-951129ff70e8", "value": 16219709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785170223, "uuid": "d37b3bd6-6b54-46e0-ae55-2322edf56996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170223, "uuid": "249eac84-7df5-4b77-bd2b-35b99535a194", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88867387-89d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785166416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166416, "uuid": "f99c6938-e49e-4a66-974a-ddf4a0a05627", "comment": "Malware payload (Vidar)", "value": "97e69b9ef7bdb56475e676ab9b81b0e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166416, "uuid": "d69235f8-cff0-4981-a870-feb7e004001f", "comment": "Malware payload (Vidar)", "value": "1a0e24c66991f2ef18b8b6b697b0fe3dbaefe3d3bae4698e732fb220c7c22f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166416, "uuid": "b76b71e3-889b-4c79-8f2a-0e8c621074dd", "comment": "Malware payload (Vidar)", "value": "c9803b820b9f78adb1650f4423f41741aaa29cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166416, "uuid": "5081aa44-a1f7-426e-b588-2bcf16cd46b3", "comment": "Malware payload (Vidar)", "value": "a65a61f74719a2973e2ca8a5eec5eb4949497d90581d299f624b9811dde05c119054962d1cfd76600485bc035ed30664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166416, "uuid": "209f0804-ceae-4c44-b8c0-e5a6f52015dd", "value": "T1BD068D07ECE148F6D0A9A33188B6A1567B35BC491B3133E72F50BA782EB27C06D39755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166416, "uuid": "89eb1c5a-65bf-4b2f-a280-9a8039562915", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166416, "uuid": "4e24f62a-409a-4f60-80a6-009c77e22bfb", "value": "49152:gSKfS+XbqhAnSmt/IpMJExgAMX3+fEdzMA7Qk/kCIdxz:gBMmv+fEdzMAEk/kZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785166416, "uuid": "5b1ab65a-ecd0-4f49-b689-cd6e10b83bf4", "value": 3814752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785166416, "uuid": "09348bd8-3462-4b79-b105-b4e11ebadb1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166416, "uuid": "0bc06cc2-2a7d-4e48-9d63-d0eaf2f9296f", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cca4799-89ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785179281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179281, "uuid": "77d3fd9e-f258-4cbe-8c79-6b28e125bf64", "comment": "Malware payload", "value": "dd07b7f4449735ff5aeb2baa28e4f014", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179281, "uuid": "b8319ecf-1576-45fa-af1e-60d8ddee2f96", "comment": "Malware payload", "value": "1a19fa12c43acc758d6e6bdedeb9dc712b427c29e1f623dcdee9d2c36049eea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179281, "uuid": "f911c617-9103-445f-b6a3-a2a1f8414947", "comment": "Malware payload", "value": "f13d25a5fa532fff5c496e2e9ed8a720a69fbef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179281, "uuid": "7f7d7fb2-05fc-4ed6-8e91-106bcee9e4cd", "comment": "Malware payload", "value": "3cc0f26ad5f0fda05ae37151428c9c2b01414b911dd80f5881fb40cc10f53d849caa6ca26cc2dae193d0b93debfec059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179281, "uuid": "884eba76-008f-487a-a7ed-392dd7a177b9", "value": "T137A3E84AAF211DB7D85BDD3705AD0A4235CCAB0771683BB53934D828BA4A54F8AD3CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179281, "uuid": "a4c2ec96-d639-4158-ad31-f01f6a79951f", "value": "1536:Z+PFTB/7U+XzZXCB/o2sUM4SF8AP6r1cp2nT8cHVUMVSdgVNoJYWE7h:EDJXzZXA/o2c8AlYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179281, "uuid": "233e4bf1-fbba-4d74-a833-a5eaa8eb8aec", "value": 101452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179281, "uuid": "878ba6e3-cc8b-4431-8ba5-de28c74ca099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179281, "uuid": "d3d52b2f-850a-4751-b229-4a715f6f8606", "value": "uOa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c8c6398-8951-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785111715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111715, "uuid": "22bbed8b-b20c-4022-bcc9-789e6831d322", "comment": "Malware payload", "value": "45fd1e3e792acf04754e6a8acd10a943", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111715, "uuid": "189e6708-1a54-4090-abcf-392fa2e926dd", "comment": "Malware payload", "value": "1bd26a5f04837e6b58262c5cef3a2de052928414bc5bcc1106861c3792ab595c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111715, "uuid": "78823e25-0a80-42cc-942a-672ad3d34b7c", "comment": "Malware payload", "value": "fb3d80ffe54aeca1e6c44a3987416b3b87627179", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111715, "uuid": "ca7b50bd-76cc-446e-8739-8eb7a3a78001", "comment": "Malware payload", "value": "dd8f968c3a57999297f701f0408ac0f70e7515a3cdafe990a357dad2e9016c8ac8219bec3994f28ce68fe522ed27e0b4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111715, "uuid": "ba0269e5-6d2d-4c9f-ae44-88f94363ec64", "value": "T1D8C27D966A867C44BDC94A3E4CBE2B1D6DF5C3D1324942AC3D8A3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111715, "uuid": "f024a6ff-1857-460a-b66c-04e106366a54", "value": "768:58vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:58l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111715, "uuid": "69520cbe-073b-4429-9228-4734348907ce", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111715, "uuid": "55577c2e-a059-4085-ae74-2a56732118df", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111715, "uuid": "3d1fbd8e-af5a-4e2b-abb8-ee03b49cfc1a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b3bd5e-8986-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785134528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134528, "uuid": "42410f43-6ca5-471b-9cee-e9cf9463981a", "comment": "Malware payload (Mirai)", "value": "466803ba83663580c6add995b8ffd756", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134528, "uuid": "3ce89040-401e-44ba-966b-e33cfbc8a675", "comment": "Malware payload (Mirai)", "value": "1bf54c16b49f5b5c1186d6b9b4db2a21ff9cfe5692b482b345776ab0639a7740", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134528, "uuid": "844a0be4-a64c-430c-90f4-ff09af0c070d", "comment": "Malware payload (Mirai)", "value": "2322896c9fa0d639654799f2e70f0137b8e30d90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134528, "uuid": "a1d0ae38-049d-432d-b429-a54d46b90ad5", "comment": "Malware payload (Mirai)", "value": "c961b7b28755b0ea174c07b5424be4dce905db2f9a0f58de1fa49fd95445209b81fdf8b68962796a345ee23202ad2932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134528, "uuid": "71a2df13-051a-43fd-930e-c89a69de7b37", "value": "T1E541E08E5F715EF8F165D93C47374B35279B921843C04249E2ACD6405FC430D899E7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134528, "uuid": "f3aa13d7-6406-4283-a3b3-f586033c3a98", "value": "24:3u4dsgph8AmsiRD8AmyT/z2HdllPUqtWB4u37I8pa8+Ddz3N9l5zBkEp7ilAGnEe:exgpEuQ2H7C1ErD/9LuEp8nn2L3qxMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134528, "uuid": "49c32aac-943a-40f1-9c58-f65c12f27cba", "value": 1984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134528, "uuid": "2ed3893e-2d6c-4390-babb-7e2393ba17ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134528, "uuid": "3f0fd2e9-822d-4db9-bb7b-4bb907276550", "value": "dlr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5704e42d-89dd-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785171916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171916, "uuid": "937c6e77-5301-461b-81d0-ad46ee454b79", "comment": "Malware payload (AsyncRAT)", "value": "2643d603d7ab8745978cd1ee44f18a39", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171916, "uuid": "c2065292-d132-4b59-be68-ce67aedf0529", "comment": "Malware payload (AsyncRAT)", "value": "1c067af5665a62e9251484c94bd2e2cbc734f97cf1c7243f62199abfabf43d19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171916, "uuid": "d9739a59-d37c-47f4-a80a-487dfd4142f3", "comment": "Malware payload (AsyncRAT)", "value": "7d64a644d8a36da7188ed6ffd41e1db0cb9c35f1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171916, "uuid": "5d4c4718-4be5-45cf-84c1-ec688545832c", "comment": "Malware payload (AsyncRAT)", "value": "25d7038879c6a97e6e5ff3cf26de6800dbcca817251cb6142172db501d95fdbd87b8511d2fbd9982f0a7160a27016c1a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171916, "uuid": "574c23e0-c84b-4fa5-9575-6282c0c5fbb7", "value": "T1CD051246675ADB13E6AB1FF819B3E8701374AEAEA521D2064FC5BCEB75337189804313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171916, "uuid": "18f4f62b-6af3-4975-9740-b175a815eca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171916, "uuid": "78512716-b424-462e-bb2f-8249a51d8a5d", "value": "12288:yJqLPgI38zYLcnhfR+u/VsJLjcIGDv/wksyR50CeidRV9gRKStRiHAkY9mc97BeZ:Dgk8G4+muhjCDv/wkspWfIZ/E9b0BeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785171916, "uuid": "dfd44b14-bc55-4314-aa73-2ce8c420b8db", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785171916, "uuid": "99034694-3a17-4a5a-b569-dcb99ec407bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171916, "uuid": "5ed470dc-1d65-497c-9139-a8497d67b139", "value": "Factura n 679 del 24072026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119f5c71-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167505, "uuid": "542b1e92-677b-47d3-a1cb-d323d480354d", "comment": "Malware payload (Prometei)", "value": "c6492232d1cc3f1f07f89ab44b6ff61f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167505, "uuid": "c862796f-b39a-471d-a03f-30aa72f094e8", "comment": "Malware payload (Prometei)", "value": "1c3d6775c2b57d94e8b21b56859da3a1e5ad13a1e6a788ae99412257789edbe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167505, "uuid": "ae43881b-bbc4-4e18-b599-ed96f0ac9421", "comment": "Malware payload (Prometei)", "value": "454efb3ec8e3d3ca25d704b0f5bbead19e09466d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167505, "uuid": "eacd9a9c-d90a-4081-819b-48550ab5e5dc", "comment": "Malware payload (Prometei)", "value": "4361409d3e38e574be9be55899300f35a11169bbc43d6716d9af0d5e3a50cdaae1e01d0735c59fb1f0863c1a6f4cc69b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167505, "uuid": "7253ba7a-40e3-4fa5-b7a3-54e901f05826", "value": "T137A423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167505, "uuid": "68b7d82f-098e-47b0-a224-a5b40376210f", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdC:Fs6pyCC/Ya2hpi6T6N4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167505, "uuid": "34c62bb0-45bd-4f4e-b9b0-31364938e5ec", "value": 449088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167505, "uuid": "70914960-601c-46e4-a753-1f91d5707dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167505, "uuid": "0fd3d88c-5f08-4193-9d3f-f4b793d138e1", "value": "1c3d6775c2b57d94e8b21b56859da3a1e5ad13a1e6a788ae99412257789edbe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eac9f47-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785133221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133221, "uuid": "21a28bda-e5fd-4283-be81-9e5679ae1170", "comment": "Malware payload (Formbook)", "value": "a82457fed3f9f435778b6f89172ce519", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133221, "uuid": "96ad546b-d1e1-4852-abbe-ec7d5fec6fbe", "comment": "Malware payload (Formbook)", "value": "1c70d6c57ca876bbe39d09ef8c7a4293910271a13707109712543fe2a28e9bfc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133221, "uuid": "cf468a9a-bbe1-4fa9-ad97-95bba5d3e3e1", "comment": "Malware payload (Formbook)", "value": "41f7874c4287aa3005749be207fd41e934f3e61c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133221, "uuid": "5b5b653f-5332-4116-b314-9e812e54c499", "comment": "Malware payload (Formbook)", "value": "648a0eae0881ea3b2f2b89c8ae38735225ce0276bf093641ac55405dd2d95f6e0dca35ec12db324a1cf22e8c8e914f47", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133221, "uuid": "861650f7-53e5-44b6-81ed-3ed2bc76ae81", "value": "T1D3469F516E5859F5EF8C2A0E90AE6F1D87F042176A33706BFB41DF04BEDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133221, "uuid": "e7a52d6d-d7e6-4548-b262-d6b89a7a3eb3", "value": "24576:s+9fxoTL78pFibaIEazi9tTtcb3eugEboehk8OtxNjiq0sr3FOEZuGA/OUzmmsW8:RxwrKiK+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133221, "uuid": "d1ffcfc7-4b3d-45cb-84f5-21fbeca3210d", "value": 5493061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133221, "uuid": "676ce2b9-a398-4ec5-9d48-81ef14ff9aa1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133221, "uuid": "b7e21ba2-cfd7-49b4-a0c3-397595149d38", "value": "New Request For Quote Inquiry_2026.26.07.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c8c0d6-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154404, "uuid": "543d2682-7010-4009-b58b-410323aa3ea3", "comment": "Malware payload", "value": "a624cd5a6571ed9bfc8823be2da7ef0f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154404, "uuid": "d6484592-cc2a-485a-8f7a-2058119401ab", "comment": "Malware payload", "value": "1c77cb63396a26c426c338561ac21855c986ae0fd8a201c644275296158667f9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154404, "uuid": "ed0db565-afb8-4692-98bc-519f2d95b0b5", "comment": "Malware payload", "value": "81601c4b333ac59c8f8b521d4b346c3887fae095", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154404, "uuid": "969b6fe7-f987-4e48-9313-bd93f25bce6b", "comment": "Malware payload", "value": "1268231a06d8f3e7122ab87e8aa8d689ef2ddc2b07c431446840fc9e43882c11ec8a1712d3c31797ff72b76350fdc045", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154404, "uuid": "828b0bf1-8553-4f7e-a5e3-f0e7df917964", "value": "T16E21D7C7956BCAD8D17BBBF334486F086228B57C0104DACB21603DEC3F8B00CA326282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154404, "uuid": "3cb7f4f6-857d-477d-814c-68d2b5d53442", "value": "24:9xOSBQVlDJdatr/Y2M+LAOLeaNiJSOcklQtmSBh0S4SUyLtyQYD5ccd//:9xHBYDra1Y2bWSOFlQtPP7PGDy+//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154404, "uuid": "5cc67918-d926-4e2d-873b-ef112bede905", "value": 1227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154404, "uuid": "7d8de457-f5c0-404b-ad11-b6e3157cb173", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154404, "uuid": "fee0ed0b-f9b1-404b-b67f-2e5d9300e391", "value": "photov_273719554066.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b5e044-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132741, "uuid": "c7f7a865-335e-4826-a01d-75228b2b4e24", "comment": "Malware payload (PureRAT)", "value": "67ba4d34e82a882ce690555b1e82f702", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132741, "uuid": "2f22a01e-abe4-406d-8250-4a7e50483cbc", "comment": "Malware payload (PureRAT)", "value": "1d5b072be68eca8c089e8b78c404b3e97bd9cbc6506301eb0ba260e5c2aa7f3c", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132741, "uuid": "0148852b-0af6-4bf4-95c9-5f6332f25e0a", "comment": "Malware payload (PureRAT)", "value": "71a800f1f5db3ba7a8372daebb8a449f9e89eadb", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132741, "uuid": "037347a3-3070-49db-a92a-321dc0d0a298", "comment": "Malware payload (PureRAT)", "value": "549a60facab8c066022ac81fe6ed23cec11c200ed4a03bd3433599412bca83fd278138efb3cd2dbdf76a7499c9d4f791", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132741, "uuid": "2330cbd5-6cb6-4e2a-9623-ffebb0774a8a", "value": "T1A01175C48499D920D92DEA362543768D0A3201569D154AAF3271765E3E517E1E30E6C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132741, "uuid": "29790744-96f3-43cd-9ea6-1640b0a8d478", "value": "24:95o0ECT5IfA5cAwECzD/7WIEhZmS0MyplLuSTUDwZx:9y0W9LPKTPF2Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132741, "uuid": "4ec4b1d3-84bf-4967-a367-fb47148913a6", "value": 1073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132741, "uuid": "720889e5-1031-4962-bed1-5b0f06ca2aeb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132741, "uuid": "165ad12d-85f7-4a90-974a-a429a056f982", "value": "photov_465157745308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9494f5-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154321, "uuid": "8240edcc-7d46-41fe-863b-1d4eea8162a7", "comment": "Malware payload", "value": "c9e5b32f8f38a820b0b5303c902185bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154321, "uuid": "2c3a3bb9-5693-4a78-a62f-a36b014c0c50", "comment": "Malware payload", "value": "1dc8130b0b5d9516444e4a8d20dfecb47e3831222b5a3b6c1a852aeecd75e7d5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154321, "uuid": "b4565f3a-7e01-410e-af86-458e4f875ef1", "comment": "Malware payload", "value": "bdcf38174039175c2842f53176ef5204b41db6da", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154321, "uuid": "9ce5c02a-c16c-44bb-b0bc-e18947f6b7e1", "comment": "Malware payload", "value": "74b480ab0c9123a86fecce6ad92f902c6e716265ef940364e6b74c4c2d45be1abdad307658492417708ecbfc22b28990", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154321, "uuid": "7324dd98-3155-4c1a-b4ba-5602cc0c29b8", "value": "T15F21D7A4845B9AC2D0A21E32253CF30790BBF19480100177336CFEE876BB1DD4B2A550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154321, "uuid": "bb19104f-669b-4830-9d1c-8e28cdb78e4a", "value": "24:9RNntFeqyvaMTTrANqV3/Cc/49LSvHS3pYmSbjq4R8qLt1ITkn3A+C:9RNXeiMTTKq9/CcQxSKZYPb7jIT2w+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154321, "uuid": "867e8480-892c-4d42-ad73-3e0c721cf2de", "value": 1206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154321, "uuid": "6004d2e9-f31c-424f-a60b-537a8fedc3c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154321, "uuid": "b235f9d3-6118-4c4e-b0a4-0f5c2b6033fb", "value": "photov_322589669239.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7fe435-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132980, "uuid": "1d275ed2-179e-481f-95b7-05633dd90246", "comment": "Malware payload (PureRAT)", "value": "72b530af80fde3b379ce0c1a345fef82", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132980, "uuid": "96a91a89-12af-49a0-997d-6d479fbf5e6c", "comment": "Malware payload (PureRAT)", "value": "1e23e098322d0bb0085a7da23ed0dc93eb0538a96e146553cd1a384bdd7fe39c", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132980, "uuid": "43545699-b00d-44f2-a4b0-34c45257a7b0", "comment": "Malware payload (PureRAT)", "value": "4ff30e4847cc3f6aa3f3295a1e19f84cf67b2445", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132980, "uuid": "8e4d7c46-0d4f-413f-ac81-116ef18d7c76", "comment": "Malware payload (PureRAT)", "value": "bfad9fb53ae765a7313f03be16a3ae75bad8a39016afcfaf4b2773f61715bb0dbdf1e949d022e3369f4c72e8511e92e8", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132980, "uuid": "37adfa98-23a5-4b8c-9350-27e27b3c0fcf", "value": "T10F21B7B5A729A940F0CF823305129A1914BE09666C16087E27F76B567BD1C4C2A982FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132980, "uuid": "18d4ef1b-7d9c-44d6-95a1-cef1cd114354", "value": "24:9jv7TiiiW3aK9i/ZlqTJasjmSAEblZsWq/KqLBacFqX9/kB9mW7jl:9rPitdxlqYsjPkWSKr4qaDjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132980, "uuid": "07da5cc1-2765-4b35-b530-6eb158a24285", "value": 1296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132980, "uuid": "baced572-b3ca-491c-89b5-abd3c2f1bdf5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132980, "uuid": "7f696047-9265-4ee8-a18f-efbdd904f100", "value": "photov_541097563367.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409728bb-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158135, "uuid": "0b6c7f93-b965-4554-a56c-5af4d1bbbcfe", "comment": "Malware payload", "value": "1b5935fed85fc5c14a85c9bb8e7403a3", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158135, "uuid": "4749f9d3-ff66-41a2-aafd-9592cbb31962", "comment": "Malware payload", "value": "1e4c0b9ebe63dd50dd95c7b684ddc989c67e2172b49104512ec6b8bc59961ffc", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158135, "uuid": "6bb7e677-86f4-48d8-83cd-48e1291f6592", "comment": "Malware payload", "value": "1c435080cfb6db4bcb36f9eba7cbeaa8acb6613f", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158135, "uuid": "6bdf4530-ea38-4eef-9009-bf1dd5d9af02", "comment": "Malware payload", "value": "7486a354e25a52f07a5b301b0f088fc4821c6c5fb147bd9ffcb72c32f2673eae970e0d10a6b783050b86f31a83c44d27", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158135, "uuid": "8eb6e503-11ac-408d-96ed-d7d7b2ab9734", "value": "T1DA16332FF6B94049476CC72AAEC1074A34A2807BECE11975B8CF5DFC6CC992D7A31849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158135, "uuid": "bf4d4e33-74b0-4d9b-a326-3cc5f945c086", "value": "49152:7AnLVKSJvZo1wRIn5Gkt4pfjxRyw0UtJr2ehJMdKyEwwxCQNGi5apUsZvgfRxxIr:7c5Jxu5/tk7/yqKGS50Gi57sFgfT/bdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158135, "uuid": "da06a178-4667-4467-89da-e00b8dfab4f1", "value": 4384951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158135, "uuid": "65baa899-5114-4ecd-91f6-c2f5539f5e2b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158135, "uuid": "e5e65eec-58dc-4e54-b11c-fc98bc9b31de", "value": "1e4c0b9ebe63dd50dd95c7b684ddc989c67e2172b49104512ec6b8bc59961ffc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f40cc81-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143476, "uuid": "0b75a0e5-d3c8-4d1b-9e19-8329f44efd50", "comment": "Malware payload", "value": "da766abd095b417a1019b0e5dbbdbaff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143476, "uuid": "1db807d7-e106-4886-8471-fe6e57119334", "comment": "Malware payload", "value": "1e895bdc47c20de0b4480e1cf34a6e460c46698a42262252c4d0d97e153340f4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143476, "uuid": "0f28d692-b8b6-4c0a-8cb1-c26031c619c1", "comment": "Malware payload", "value": "6468ac015e3e7f53cd08585dcef16c9bd8813983", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143476, "uuid": "a32102ac-b75b-4218-8af7-e7db6a276903", "comment": "Malware payload", "value": "e391b632c11c4e38fc7cbdff4af16f77fe047360b31d3c2a001f39796dad849c98cf90e8038cb510734122f3ab7f5756", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143476, "uuid": "25c066b5-f78c-4a16-ac42-f0272f1796f9", "value": "T18011B52D0CEF8E13CC2AC5722683765AA77941D81B43D95B9BFC37A2380B5C48301D05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143476, "uuid": "bbb6ec61-64a3-4591-bcd7-724c3db1096e", "value": "24:9RSZ2zHds798BajYHs71sRa/WVa+FamSIlLuSKVQ5SQpVN:9RxG7u7sBsRDVfQP4HKVU9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143476, "uuid": "a915f006-207b-422f-a94e-43c7f6adb7f7", "value": 1080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143476, "uuid": "c3674545-65d7-48d4-b540-00cc42ed607e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143476, "uuid": "25a73bfb-40ae-4b2e-88fc-822110fc4001", "value": "photov_646531234327.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1756ae66-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167514, "uuid": "468fc92e-3624-4eab-873c-f63732da8790", "comment": "Malware payload", "value": "cf5dc765efba775aca1fbe01633257ad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167514, "uuid": "c77d1f17-9a0a-4c23-810e-30423b6e3a95", "comment": "Malware payload", "value": "1efffb886c745745d30174aae933f2385f5a74acbd626d4a38f34fbf200fe800", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167514, "uuid": "c3237339-f497-4fb6-8a2a-c0b7fbe60588", "comment": "Malware payload", "value": "9f5990e9fa719d2f8dd1373cd2cb2abf905e0d9f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167514, "uuid": "c6dd5010-caf0-40a6-bcae-5501a7227ad7", "comment": "Malware payload", "value": "dc0d6f4487ea05266bca506617dcdd5e8de6a8bc677ca56c3da52cba815e205a9f5e486ffc92cc2da5b07ee813cadf74", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167514, "uuid": "7b94f963-e275-4b63-af81-d601cc4e797e", "value": "T19022A470FC69C030379ACC6C96F79D801647261BCA993804B19DBAD5AF78078FDD057A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167514, "uuid": "23332dd6-bb92-4842-9cc9-6fa9108cc38f", "value": "192:2mDK5StyuMUgOo5xWJlgLFqEIjreYpoJ6NYnDDz/puoe:2l6oWJlgLFqEIeYpoJ6NYn3zxuoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167514, "uuid": "12348a59-d5fa-46c8-a600-92c8cc28697d", "value": 10305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167514, "uuid": "87edb0d1-f455-46ea-ad38-78d5770af19d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167514, "uuid": "7678a948-bced-4c3a-9b50-10937fdb756f", "value": "1efffb886c745745d30174aae933f2385f5a74acbd626d4a38f34fbf200fe800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70fea9a-8990-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785139087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785139087, "uuid": "884bb626-0f78-4b6e-a7fb-10d8193a6738", "comment": "Malware payload", "value": "5464deca228a90e4e4522e9fa15be80e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785139087, "uuid": "a79dbb80-36f1-4a5b-a76a-f5dee795e09e", "comment": "Malware payload", "value": "204562ffbd43dcd1a52b5ab7a2b033b587ca1281b06e72a96069e8a082783c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785139087, "uuid": "bffa4d95-91fe-4ab8-8b80-a40d9f123b33", "comment": "Malware payload", "value": "fd483433f6ce153784be1869e6eaec2fef5cabac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785139087, "uuid": "2cdfbe09-5ea5-4941-98fb-7dc23572a226", "comment": "Malware payload", "value": "83ef67f20795f3cb4f7cd925c6c1657bc8e0d8f3c5598ea6ebe7bb5034e2bb55929aaae2aea58e847dbaaf8818f08c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785139087, "uuid": "9fd29048-8ac5-49fb-af56-4257294d0a19", "value": "T101C64987F86101E8C5AAD131CA295613BB703C894F3063D76B51F7B82F36BD4AA7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785139087, "uuid": "30d0a979-20ab-4715-a580-c84ece19ad49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785139087, "uuid": "9e6afae8-aec1-4e9e-a719-acdc22e60e6a", "value": "98304:DguCzEic6VfHptwPfj2YiArSFg9UFr9+jvfvFviv2ELQBrvJPpyX5djye71MzSR:D6DJMrEHrcBdoJhye71Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785139087, "uuid": "70648a31-1f47-4dfb-b0b6-0697cdae03e8", "value": 12290048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785139087, "uuid": "ce6b2bc6-679e-4dc0-80c6-45d10f43f7c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785139087, "uuid": "65f6244e-a513-42c1-bf81-589787114885", "value": "dllhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f220fb9-894f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785110834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110834, "uuid": "eea06e00-c2b5-41da-8b68-944db0af3963", "comment": "Malware payload (RemusStealer)", "value": "b1b109827296c243ffc9e4583b9fd738", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110834, "uuid": "2960018b-5fac-4713-9f1e-8f2f0b2aaad5", "comment": "Malware payload (RemusStealer)", "value": "205fc66381b8e254508d40c693a1314c9fc2b94b8023b29483803c8b0e449c4d", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110834, "uuid": "7302fc51-fd84-4ff5-9a86-581416da30b0", "comment": "Malware payload (RemusStealer)", "value": "c9ac15d711deeb63b01f8c49738bbdd7d70f4011", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110834, "uuid": "4e049b25-9bba-4023-aef3-e73ceb3364e5", "comment": "Malware payload (RemusStealer)", "value": "8b15f7432d0fe3276f342360392d0eade49ee138461e1af92e635ea77611e2d98f4785f9e6848b3e6bb8865d383d6221", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110834, "uuid": "265f7a84-2a5f-4886-9ff1-8b3ca27c2a47", "value": "T1E424096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110834, "uuid": "7a05e1ba-9d48-49ae-86b5-3d7b08cfd6f2", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110834, "uuid": "dffc1726-52a4-46db-a90b-9f93f51ddfc5", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLF7l19CGiics:Qj5WUEBx+Q7PEfFnQU+tV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110834, "uuid": "ed1071a7-0cd3-46fb-ac29-d22197d127f2", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110834, "uuid": "b7b2ae6b-29b3-4ac6-9af6-ec05c3ca7d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110834, "uuid": "d596117c-81d3-4c40-bd9c-bac508cac11f", "value": "R5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ea0bce-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133451, "uuid": "8e04b236-caab-4c13-889a-66bfe820fef3", "comment": "Malware payload (Mirai)", "value": "29620bc82c8f45c448b84eaf1f934f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133451, "uuid": "5bcd6916-d9c5-4392-83bc-06cc9205f68c", "comment": "Malware payload (Mirai)", "value": "212da075160d4822800ad3b7a6eabfe77561b1efed9413fbac7aa985550efe1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133451, "uuid": "a3e788d4-6a8d-4f71-a79e-65ceff6c7d7a", "comment": "Malware payload (Mirai)", "value": "9586210edce225d4a1df4c8eebfec400ef2a1659", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133451, "uuid": "eb75cbc5-9556-4260-a9ff-c90262abe4a3", "comment": "Malware payload (Mirai)", "value": "4ef35e0fed08431ae63c18cc712b8003fc8d4dbab392e90cabe7a99678b92e688b9d414afa135a2f2519a79638f52aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133451, "uuid": "ab7d1a5c-42e7-4a45-999f-87536d92e8c7", "value": "T1C143294CF783E0F0E94A09B1116BFB7E96309E065124DE6EDBD8BD73AD35B126017618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133451, "uuid": "8184c7a7-6104-4ba4-9801-4b061f234b17", "value": "768:TMwoKeVbjkbl1y0ls+9v3OQoi8Fs8GMzG4iSV9UkP31ABA0xi6Rh42qD8oL+EQEr:Tg9X0lURx39UO31ABA0xi8BI+cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133451, "uuid": "57f5cec0-03ed-4709-999d-d4f3fdbc65c8", "value": 58108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133451, "uuid": "b29a12b1-f989-4686-a23e-3a0673f83379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133451, "uuid": "8102fd3b-479c-440e-9c5a-218f6efe8b05", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e7168d-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133444, "uuid": "24503908-92d0-4850-ad93-e5cc19764be4", "comment": "Malware payload (Mirai)", "value": "54a90406076af0bfa8d8adfa442a8b89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133444, "uuid": "fbf26243-3e75-488b-8d3b-b48da12e8ab1", "comment": "Malware payload (Mirai)", "value": "217ecebcd7218b8157fd7a64ec82943b88191dab7f04fa89e717aa5e9c8fefe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133444, "uuid": "d48c8379-2138-4913-9a09-ee114c4c6077", "comment": "Malware payload (Mirai)", "value": "cb415eca867540d8df5dbc553d1a0ee2f395825f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133444, "uuid": "2b2ee458-5a0e-4871-9567-fcb2703fee1b", "comment": "Malware payload (Mirai)", "value": "5f40a3041a02ee326cfdc96b349fb064a5ddfca10d0a0fdd5053a9491da04dc0d42534eb08ac7a22462575e665ee531f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133444, "uuid": "d10ee670-54d3-4bc4-8e69-ac5ac794b1c0", "value": "T1B5C31A45F8505B17C6C661BBFF5E428D7B2A1768D3FE720399256F30378B86A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133444, "uuid": "6a875cb4-39a5-4785-81a0-88b128c80e80", "value": "1536:kRulLQ+ro3gTPf8Y52Z4VktYTHLbryMOI9xrNAF2DUl7zKwyw+Q3UYyuUyTcSr5m:xlLPmCPf64oYzLvZhAMQ+qM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133444, "uuid": "0703eb4e-3f22-401b-bc96-c5e76aa75fe3", "value": 121376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133444, "uuid": "f0ec878b-15d0-401c-9ff2-01f8793ce18e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133444, "uuid": "b9fdbfa7-b5af-44f4-85a1-970d8f700f31", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288fe664-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154229, "uuid": "54d5c326-bc65-458e-8159-06db75bf7c68", "comment": "Malware payload", "value": "26a76a85db570d6392f204ea6dacf2bf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154229, "uuid": "ce56a981-117b-457a-853c-6fb32c42fc21", "comment": "Malware payload", "value": "21a2f4f76beea38c16f6c45d3ce97c8d8fd1ff038a5de66cec97e3efad69e942", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154229, "uuid": "6c4e2d58-ce55-4383-9347-01a3b2217795", "comment": "Malware payload", "value": "865eee3f2a6c866d381c4a90c1b1ad6aae7f7b13", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154229, "uuid": "3130b136-dc36-4a4a-a341-59e66f24c1b1", "comment": "Malware payload", "value": "91b26e0976082a5de50cac7023230e8c387c203d98baa8d1000069705c69ebc811d47f7852c7e73876d5bd4b4be7277f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154229, "uuid": "16578da5-db4f-4da4-804b-8cf6ee260477", "value": "T1422192F1D4DD8311C89CA3365DBD62B2236F614C2A29E4E350C3B6B2F024A85250CFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154229, "uuid": "323648d9-a1f7-4fd7-a352-c26344248fd8", "value": "24:9keI/vnkl9nS3B1cnrhlUwMDWmSMJJxMHKP0VmODRg:95I/gS3PcnrhlU96PeuKPmFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154229, "uuid": "e28276d7-18b9-4b3d-af1b-7c5f5df6022a", "value": 1258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154229, "uuid": "1799b333-a8de-43f8-9fea-02ec0ceed782", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154229, "uuid": "cf217dd0-c338-47f5-a381-232e30fe5621", "value": "photov_951377388727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9db0d9b-8a0d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785192751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192751, "uuid": "0209079b-2258-4e47-938a-0d9602767f86", "comment": "Malware payload", "value": "a9ff5612013f81d8ccb00c564e007290", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192751, "uuid": "d3bc909a-d0ba-4925-8ae8-f1a72d4c70a2", "comment": "Malware payload", "value": "21fa2933a5f8ecc157747f190d86762317d8b64f800f67287fbecf0169764b46", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192751, "uuid": "45536858-8d6d-4b94-b2eb-292b93c01197", "comment": "Malware payload", "value": "a0a2321a3f0917db7fa42e03a1296f95e40e7c30", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785192751, "uuid": "929446d0-f777-4ed6-afe0-658b247c229a", "comment": "Malware payload", "value": "70140f9ca24d531960793d647dda33edf6210ead9a7887294864168e7418de4e0ee3ecba42c2742e454f028c9f4b4028", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192751, "uuid": "41a2df55-6b80-4929-bd7b-bd9e885533cd", "value": "T185E633447AF001EDE7B3C138BDD298A9C15578B50BB2CD5B57B887A0AE972D08D3DA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192751, "uuid": "4c9be68e-e609-44f5-b3e1-4a8adc2dca14", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192751, "uuid": "f26cd8b0-f275-4c42-956f-cc6fba9a89b8", "value": "393216:ZNuETIBgJG3qNaGbAfoXMCHWUjXCcuI3/PGTAI:Z43gZdooXMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785192751, "uuid": "f65d3b0d-37db-43b3-8a77-54ce73ef4000", "value": 14319415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785192751, "uuid": "be2a2939-87c0-4416-8265-08a0f33fe0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785192751, "uuid": "939d7304-ea88-4e38-89c7-8a76f92430b9", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a9fda7-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167518, "uuid": "95512070-4909-4b2f-b6cf-aca6d73917f5", "comment": "Malware payload (Prometei)", "value": "7910bc84ebeb47d5e6d9c86d87f6b5e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167518, "uuid": "44321644-33b7-481e-979b-4e64150c5357", "comment": "Malware payload (Prometei)", "value": "23b7cba865e8bc974b09885dcaaba9574b6e124ef4df0f751a4b076b60b57eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167518, "uuid": "36257d24-ca67-4b88-9e2c-817c3b0429d5", "comment": "Malware payload (Prometei)", "value": "970df8270705d31a24970ac819662748fe359a47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167518, "uuid": "75de795a-bd4b-4813-a371-7134cac6be53", "comment": "Malware payload (Prometei)", "value": "df6624a2e2cc79e6e157b07ec35cfb2bd9389d7e8e5a6a159139b59ccb08db2a0405b54a19afc323c7a30aed500dacae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167518, "uuid": "9e8bbad3-d5aa-4ae9-a1eb-0d5d36accbb9", "value": "T1CDA423B4F9219E8F6DD769B91B24831DE181C172689D4C2313AE95A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167518, "uuid": "d8d9ad67-be8a-410a-8979-9f7c4ac6a1f8", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdF:Fs6pyCC/Ya2hpi6T6N43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167518, "uuid": "8c138a68-632f-47e1-95cb-539239c1dbb2", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167518, "uuid": "e96e4ff0-c4d9-4d6c-a5a6-d59781bbb7f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167518, "uuid": "364d62d3-e302-44e0-a23f-e6088056bea4", "value": "23b7cba865e8bc974b09885dcaaba9574b6e124ef4df0f751a4b076b60b57eeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4619f98-89eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785178113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178113, "uuid": "ca7fcbe5-b1d8-4ad4-a6d6-43486624e114", "comment": "Malware payload", "value": "b87df554eada4061ee3273a50f12632c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178113, "uuid": "9072ad2f-d304-482a-831a-04e44ab88736", "comment": "Malware payload", "value": "23ca56a8e65909151facf54a1c40ab3b015e752901d6d76bfae0a784b5c91a3e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178113, "uuid": "839379a6-ad11-49f3-9f4c-da4148eb954a", "comment": "Malware payload", "value": "e7e6cc2691049ace5012e7fc706a5f5c41fa71dd", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178113, "uuid": "f6ee0caf-bafa-42e7-94d3-46bef2e52f81", "comment": "Malware payload", "value": "0d1749ae5baa6aff5bb71dc6bdbb35a173267ff2da114f2104be1d8cfd95c1d36175970a544b9cf20e8d855de0dd92cf", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178113, "uuid": "a8ed7b66-14aa-4922-97ca-5025854276c6", "value": "T125A68D07BCE049E9C4AA933689A752A67B71FC080B3167DB2E50B7783E727D09E35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178113, "uuid": "bbbd8136-2e0e-42b1-92e8-0cbc851ca86c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178113, "uuid": "843ffa9e-aaf5-480e-8d95-554649d93c47", "value": "49152:W/HSv8NU8+8CG8HD3/ppd/Z4hcVthfy18fWK8uUCy2TuMHLJFBLOk0RakLLE4hku:W/g8EPNtL3PI2hjMY/woL/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785178113, "uuid": "fca79df3-7cb3-42b5-b156-1e207ab3f35c", "value": 10350440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785178113, "uuid": "5d749902-ecd6-410a-a0e1-daf245936cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178113, "uuid": "6cf5f0ad-8b3f-4b3a-ab83-cbf359122e95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8814c4d5-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181018, "uuid": "6efded62-6827-4923-be47-aa6864afb36a", "comment": "Malware payload (Mirai)", "value": "028aec3eacd25d4160f8506f948b36bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181018, "uuid": "897531d5-4157-441d-a47c-4fd6db6b742e", "comment": "Malware payload (Mirai)", "value": "2424f532db6b5f4dac152f0e6d28bbb93f3ffdb2a6f88902d1d00dfe7b1fd1f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181018, "uuid": "c655e712-6587-42a5-b2d1-825fa55d86af", "comment": "Malware payload (Mirai)", "value": "42f38c79695dc3514893a4d6e18f84318c1614c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181018, "uuid": "d778028c-2bc6-4ba4-b74e-8ac6d0043164", "comment": "Malware payload (Mirai)", "value": "573569e4c945e72490ab966c2f885de4dfaee3e9abc2930258cfe5446b17f64faa94393937a2c419d3113fa6e8203336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181018, "uuid": "21da4861-2891-471a-8d89-82a94feb7f63", "value": "T145631991BD815B23C6D0227BFB5E428E372653A8D2EE72079D226F2137C785B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181018, "uuid": "28fde931-ba2a-403b-bc25-ea21258619f7", "value": "1536:zGJ0nw+8oipadYTzCXCEkSHv0hyaRVTdC4s/wk:zGJl6dIMlkS8kaXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181018, "uuid": "55ab2223-8ace-4cbe-a4c4-9f8866e7e5a9", "value": 71684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181018, "uuid": "7558b2a6-3db0-45a6-890a-a1b5bc42e0ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181018, "uuid": "b5d38b22-5b64-486f-8e7a-14471641ecd2", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9680b5-8950-11f1-bd95-42010a9c0009", "comment": "Malware payload (AminOgluStealer)", "timestamp": 1785111256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111256, "uuid": "989473a0-5cc3-49cd-b69e-b29037b0f927", "comment": "Malware payload (AminOgluStealer)", "value": "39193161cbd1c22346210a6683dfb6e1", "object_relation": "md5", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111256, "uuid": "55037a30-cd9d-4e46-960f-e39e20cb0d47", "comment": "Malware payload (AminOgluStealer)", "value": "2489a7c56d832faf097303f8f495f5d459e62c83eeff43b39ab3a3e6a66b8c5b", "object_relation": "sha256", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111256, "uuid": "aa4768e4-1f45-4944-b6f4-0b488cb66124", "comment": "Malware payload (AminOgluStealer)", "value": "ba47f0247bd6c9ed15f24aa8b23abcbc5d8c6f06", "object_relation": "sha1", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111256, "uuid": "4e396fde-2d9a-4ddf-aee0-38c9ba06bd33", "comment": "Malware payload (AminOgluStealer)", "value": "8857ce9f0c0a890482abe889e4014c319ed2760c6f00796f22b1eb774500486832020abdcd614a58bda5a79ba37acd16", "object_relation": "sha3-384", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111256, "uuid": "400e250f-839d-45f6-b44c-2f034a2f6a9b", "value": "T114D512872EF51CF62293D76E465BEB7BD6012FB14572748F30C20BC3934AA0A5B96907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111256, "uuid": "d6e5023b-ef6b-4ad0-951b-3963b114bed0", "value": "49152:aZodoF2Fa+YTtwP5VUI2LIWVSDQmIPuuA:h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111256, "uuid": "aa52fd1a-4718-4f02-96da-8b597c1a9f40", "value": 2800529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111256, "uuid": "d8866219-9c2f-4a01-a4d0-65fdab39fd94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111256, "uuid": "20b30f88-12c4-4bb1-a3ba-0571ca06ba49", "value": "crypted.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea8bdca-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143314, "uuid": "f70c9126-6d37-414d-9dcc-663128bb37b8", "comment": "Malware payload", "value": "472ef8efb53396e90e95b888485e66e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143314, "uuid": "c8b9e1fd-5ee2-407b-b270-5e096dff44af", "comment": "Malware payload", "value": "24e9fa975d54e6a6fe818e9e4ab08f5aaeedb2a8fac019c0aad6e8801d368a47", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143314, "uuid": "74aae756-26ab-4b99-9e79-e1ff9ee70070", "comment": "Malware payload", "value": "7bdabaee4e08cec137646c1bf43e98b3648ae391", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143314, "uuid": "8182327b-dee5-4e99-86e1-c40d2c409fdc", "comment": "Malware payload", "value": "3a011b2eb96567eba30b29a335c9017c66bb8a8673e8a88d48f57816b8b50806c88113cf0c19354c73ab8de905802cf1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143314, "uuid": "a032338e-3003-43c2-9c24-81dcfd01d406", "value": "T1F1216371840DA681CC0A963FADA1D71A56BA09037099413B276826CD778DFE84BA98F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143314, "uuid": "035d5d3c-2915-47bc-ad78-3ca9297ee4aa", "value": "24:9seeq2gCucHtFGAurKXRDPJ5JmS8+FV8myPg4+J8Z:97RY7FgrKdrJP8+FIBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143314, "uuid": "2d83d349-a980-414e-b0a6-3d46e76bf198", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143314, "uuid": "e4ec62a8-8160-4e86-b096-6342011b95ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143314, "uuid": "8b947557-22f5-4e51-a2d0-d2a7c64614a2", "value": "photov_504705154244.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1843fa-89de-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785172515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172515, "uuid": "7259e223-32b2-421b-b472-c7f114879646", "comment": "Malware payload (WannaCry)", "value": "49272795f5841c4b742e247cfa9d2bc0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172515, "uuid": "b443033d-974f-4d50-a1cb-c56a118c04ba", "comment": "Malware payload (WannaCry)", "value": "2521192853e4857386d89f555851adfdebde3a939199f939f93068058718e72e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172515, "uuid": "ad04c510-8b08-4ae1-a59a-d53118f747e0", "comment": "Malware payload (WannaCry)", "value": "16b27e574fd32f23eb061fe1c8f699df9d338b54", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172515, "uuid": "ade6841b-4b97-49e8-ab97-5fe1d9b9640d", "comment": "Malware payload (WannaCry)", "value": "e48a1fa6395421751c6520f4fbefe90c9dc32c65ae7d23de0b3c1bd9ff45d4c72ab91ec73e86d920e57b0492dfabb712", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172515, "uuid": "9276b90b-5e15-4512-b7c8-8de0a3931a0d", "value": "T1C2A5235531A8C0B4D003557488BBCF62F6B6BC2A17BA594FBF904A7E2F23791E714B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172515, "uuid": "d3e2408f-caae-48df-864e-641924f4fba8", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172515, "uuid": "9b88beb8-77a6-4bfb-9950-75977c61b234", "value": "49152:jnsnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAARdhX:DMpyfBhz1aRxcSUDk36SAEdhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785172515, "uuid": "2e284158-c4da-49d3-b149-0f01c4422232", "value": 2189312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785172515, "uuid": "b12248c8-aa9e-4c1d-a675-7e30304d2d68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172515, "uuid": "8610f824-a4d3-4009-b3e8-b6377f56ae11", "value": "2521192853e4857386d89f555851adfdebde3a939199f939f93068058718e72e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f54e5a05-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132668, "uuid": "905200fd-0ea6-4fd2-bbef-e402e1c2cd83", "comment": "Malware payload (PureRAT)", "value": "212271969d69ed5db3df093d360a7390", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132668, "uuid": "574ca87c-ed9f-411d-a8b3-777a8f85f773", "comment": "Malware payload (PureRAT)", "value": "2652886be2ebb8b2ee6789bac6080219842bd0f9274cf969cd378b85fec8b8f7", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132668, "uuid": "c2cd02e1-4a02-4562-8d91-ab7178c470fb", "comment": "Malware payload (PureRAT)", "value": "6382e59ce1f55efde3f3619a188eaf3745249ce9", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132668, "uuid": "ff40b220-cb74-4d93-af25-9426299eb168", "comment": "Malware payload (PureRAT)", "value": "f71c9e67cddc964e19872cc512435d90a7a21c30a9ea2561a70ea433c18d6bbf8e5ae656c959a2d47221c695d25033d0", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132668, "uuid": "375333d1-2abc-4cdf-89ae-6ba78779680f", "value": "T16621B464F494C84DC693C73B318A490C133A36C09644E87B9ABA5DF179C6B0C4B4BB74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132668, "uuid": "40e1a8be-04e4-426b-846a-63733db1f201", "value": "24:9TU9hJvM+htJqfntB6do0xEhbQmSXb4/NVc0oKbzPK6//:9A9hJvMMtAfntB6do0xEKPXoK4bP//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132668, "uuid": "bdae4d00-f16b-46f3-8f25-f49f9d063c1e", "value": 1275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132668, "uuid": "7a68bcdb-cc86-41cb-97e1-179e2f523816", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132668, "uuid": "d728c7fb-0199-4feb-8c45-159afd60da73", "value": "photov_467272082686.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8034327-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154443, "uuid": "732ef103-a46f-40c6-91b2-8ee9f8fdbe3a", "comment": "Malware payload", "value": "cb837f1c643756a6162dcbfd1dc124e6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154443, "uuid": "572af2c8-e8a5-4119-8cf9-0a726fcda846", "comment": "Malware payload", "value": "267c933cf079155fbc54d217b9acca3f65db343ca03fe8f6e05f607c548c5138", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154443, "uuid": "06c8798d-c85a-4019-9a4a-212517a74ec1", "comment": "Malware payload", "value": "e5fa2a58fef882e8a2f6bc6b783552679ce78505", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154443, "uuid": "01abbd06-0a8e-464c-a2b6-3058f5aba2c6", "comment": "Malware payload", "value": "b9315976d23da9e2857e243d48267e4673ea991151c7350777e70074c661eca925df3259649d39f8e2a484f2466e0cb1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154443, "uuid": "2e179e1e-fb19-4ce3-a2b5-d32e08b46692", "value": "T1F711750DA6DA82D3C88B85F67A3694858328DCD43152F0BD630E71946EABE741B241A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154443, "uuid": "bc97aa2d-f167-4cc4-b6ed-66999b686418", "value": "24:9rcbdNSvNkOdtUWfmwt6kOYVmgmShqH0Sv46ZqVmr:9OGvNkWJfzdVtPkLQVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154443, "uuid": "000ac11c-a239-460d-9024-ab61f2e771e0", "value": 1092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154443, "uuid": "3e6e7494-f59e-4a97-a7e3-4b4ee8decf80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154443, "uuid": "d3824f90-a1ba-4833-aa4e-492fe002b2e1", "value": "photov_166169748705.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21430253-895a-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785115562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785115562, "uuid": "e25a09d8-72af-49a7-8fd4-7132ca5b8c2f", "comment": "Malware payload (RemcosRAT)", "value": "9b5a4db33036eaaa61bef098f0ef0541", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785115562, "uuid": "b4f4db28-77af-4d72-91bd-a2362aef19aa", "comment": "Malware payload (RemcosRAT)", "value": "268b8fdf9834f2c6ad8149b2aa56fad90403c91964ed813609a92b7454ecf34f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785115562, "uuid": "82c14236-a32f-470a-aa31-eb252abee334", "comment": "Malware payload (RemcosRAT)", "value": "efe58ef1e0e9dc744a701b51a70199b156dfbd12", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785115562, "uuid": "6f95878b-2b2e-44db-95ba-671863ce9efc", "comment": "Malware payload (RemcosRAT)", "value": "d293bec46c4687db7c3da1bbd3717768bb402a0da786fbc7dea27bac07144f614319b681b7158df5fe0a3fc1d4c9bf96", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785115562, "uuid": "39a1fc34-1cf5-4b19-9fa7-40b5c794f785", "value": "T1AD442820DCD40B3A0E57079DFF514A65C9FDC529863790ECEA9E072E50125ACEBBF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785115562, "uuid": "b4eea38e-2df4-4de0-b453-c4b530a0a8d7", "value": "6144:Fuptv2hXayOPIW5S0WvNpX52hWD/pLhkRmCKYRTd:i7yOPIWwh1p8SwYYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785115562, "uuid": "e9dd28b3-f3df-407c-9aa4-e3add106710a", "value": 276322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785115562, "uuid": "a3ada32b-0b6e-438e-9ed0-ca4c10758b6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785115562, "uuid": "e0afd519-14e6-4450-98d2-e5dff8b9fb76", "value": "QU20262707.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68823bb-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154118, "uuid": "da84b23b-e7d2-4ac5-94b5-8ffe37f67046", "comment": "Malware payload", "value": "795f476eddf58bc6f15225ef96364e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154118, "uuid": "6ce3d9b4-6d74-4a52-ae7a-10a425fe718e", "comment": "Malware payload", "value": "26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154118, "uuid": "42a98420-26dc-4997-a4f9-7af3ed6a44d9", "comment": "Malware payload", "value": "491269ed2d5f8086ea8f0dba785f298acef61d39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154118, "uuid": "dd1186ba-38a6-4527-8e1a-06bb82596150", "comment": "Malware payload", "value": "a118be29b21986e4921f47c5c46171ced35b86fa86de27e81e885d74a448f049ad9df8987156dba3b8a116c4296df79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154118, "uuid": "93a0d236-efaa-451f-97ee-636af2353aaf", "value": "T1EAC593C5FEA0CA94A85E19210FF04A7CB9945792276301EDF4AEEDC5F473A18708DBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154118, "uuid": "6ac0425e-1e21-49c1-94bb-076c44a2d830", "value": "192:2mau3NjdMuTeXhDjbLUl0LKhf76Ril3IfpDa9E1gncugi:2mauxdFeRHkCLkhl3DpcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154118, "uuid": "ebbb0250-daad-4614-9a97-d667d7575c7a", "value": 2711041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154118, "uuid": "24e9148e-413d-4ffd-8912-184d652850bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154118, "uuid": "0272b35a-43d2-4b1e-8a5a-8ccc86f61acf", "value": "Request for Quotation MK FMHS RFQ 26 07 27.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa137ea6-8984-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785133830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133830, "uuid": "2ad4c36f-cbc4-4330-9222-6da5ccdac1cc", "comment": "Malware payload", "value": "17e3c5b10106183a1b0ce9c118e7a99b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133830, "uuid": "261ca1b8-79f3-4d22-a1a4-d84a9fc58d87", "comment": "Malware payload", "value": "2725a1500f52a82974960a23290f901043903d45fef12441f46932233b98938b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133830, "uuid": "13fca7e1-86b7-4e97-a546-a2e548625fe7", "comment": "Malware payload", "value": "8f14cbc3a7df6960629ce47abcaf30dfd392eb99", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133830, "uuid": "ab84f840-89cd-42bb-8120-ccc353291336", "comment": "Malware payload", "value": "6ab2edfe78b7f0b0eef42702bb09f3f4d8067be5937120c14e7f62aa46a8718e62d63d93820600bfe9173bebcf3341d0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133830, "uuid": "7c230010-7b8b-404d-bfc5-c9cf8c7f1b9b", "value": "T1B6235C552A857C24AA98C8371D7F2F0CB9A943E6320452DE7FCF3CF68C4AADD910961D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133830, "uuid": "ecbecff6-0203-48d7-8b70-33544c138e1d", "value": "768:ZJFWzZx5G9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:jkz9cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133830, "uuid": "60b09e12-7e50-4f37-994f-9b0bbdfe7ff7", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133830, "uuid": "4b18022e-2cde-4fb1-8dc5-424f5f8251a9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133830, "uuid": "805da6af-71e6-4ba2-bf17-c38dafd44dc3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5674d5-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154374, "uuid": "da98d773-1cae-4642-a3f2-567102f15844", "comment": "Malware payload", "value": "45709b6dec09498d22fd8b70fcc9f073", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154374, "uuid": "5fc2d492-08c6-4741-a0e0-c13fcd4e1c9b", "comment": "Malware payload", "value": "2814db70bac4febf82bba54e7052ec91d3d926e157259a80ef9b77d4bf168095", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154374, "uuid": "f945ace2-36ba-46de-9be6-6bbf541f5df9", "comment": "Malware payload", "value": "58d840d4f26cf510ec357c938667df5b6fc0acf9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154374, "uuid": "603c40bc-7567-4488-a703-f8c42b842273", "comment": "Malware payload", "value": "d0311102d542892ff76ace33ddc7fe788e0f696245183953bfab23cb4b95b11585980f88e16f80d0e688ccdfcdee50c2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154374, "uuid": "80f0d331-ae99-4f4f-8526-31a455f779b9", "value": "T138219644C068DE11EC875337A869F160D136A3ECC01A90FB265D74783C298E5074E381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154374, "uuid": "3e37fc30-1a0c-4700-b667-d03594c8e394", "value": "24:9q+rjZWEix2nIYJXFinjW1+EKzuf3L6aQVkqmS/7Hrxl/+Y3Ttn:9qKjZ02eWEzuf3GbhP/vn/pTtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154374, "uuid": "ed03ff9c-3157-4149-835a-d08985aed143", "value": 1153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154374, "uuid": "0f60b60d-399e-4dbb-98dc-cadc779e2203", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154374, "uuid": "f2315a36-62fb-4d1e-a513-ce247d1eda24", "value": "photov_920857654059.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0c0db8-89d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785170319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170319, "uuid": "cdb50562-8430-47e4-8c9b-ca15b70c5d48", "comment": "Malware payload (AsyncRAT)", "value": "bd37be6c711b63c2ef91a37259d4563f", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170319, "uuid": "34235060-f46b-45ef-bfa8-2192f45bac8c", "comment": "Malware payload (AsyncRAT)", "value": "2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170319, "uuid": "3ed29e5d-a269-44dc-8d1c-f1bb07649973", "comment": "Malware payload (AsyncRAT)", "value": "4116f49a0f39ecb828c34215ea0b3701a380991a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170319, "uuid": "816e7218-4d59-4170-8b94-c6a579261407", "comment": "Malware payload (AsyncRAT)", "value": "77494854c55c4d26fce50711f688a3410a4d7a9ab28e3ad2ce3501139d89c1e359f3ca2df166257f618fd62fb2b77c3f", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170319, "uuid": "1dd2d700-b950-4d50-942b-b22204c1feeb", "value": "T14064AD16B76550F9D1A7C5B0C9434902EE33384A4B71AADF17984BBA6F236E49F3CB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170319, "uuid": "963c1655-235c-451e-8f3b-94cc701b538e", "value": "183388b096f04db8679b00d085f87f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170319, "uuid": "42106719-82db-4b61-b9d0-1f70ac818c70", "value": "6144:4cVp/3yrTNbbObbfme31erP/vUa2PjWXAsevg9TP:ZB365bbOnff1ej/sa2pg9TP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785170319, "uuid": "76b01d23-a0c5-4a79-aa65-4b6b7d10f6cd", "value": 319015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785170319, "uuid": "a753aed9-fe91-49b3-ba0e-7c922f734349", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170319, "uuid": "53107faa-ca56-4503-a555-0f7faecab6f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa0c4fd-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133088, "uuid": "dc721913-d11b-42f9-8ef3-7487d13da3a3", "comment": "Malware payload (PureRAT)", "value": "425c8107903e8952cb1ba41452041261", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133088, "uuid": "8311f2bf-36cc-43f6-8267-a9251a591720", "comment": "Malware payload (PureRAT)", "value": "29ddf065f609e990d04363cf96a963067a2c5ea7b727acfb016121b00b3d6afe", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133088, "uuid": "cf4c5075-13d7-4a2d-8ed7-ed57cec6954c", "comment": "Malware payload (PureRAT)", "value": "f99cb64e47127b4351618b16b593dd6e989f4f25", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133088, "uuid": "d86efc14-e0bf-4e64-b11f-c9f0f9ac9459", "comment": "Malware payload (PureRAT)", "value": "7656e1d10882b400ea5411eb719c8a7565f2d1cfa69f1e923ccd09fb7762beffd154c66e500431bde33e7ea2f9624941", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133088, "uuid": "54f8d628-2bca-41bb-b94f-032e5969ff9c", "value": "T12E21B49BC1638D70D1E9C97229CC9F14352643D47F08AA7B0AE990F62388E161708040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133088, "uuid": "851ae1b7-3f9b-4126-ba32-61c8d3801809", "value": "24:9xfJBhR7DFlPK0PlM7bb2oriCw4RRgmSpaMrmmFEZw0u+:9xBBBlPrYbKoriwRKPpDlGrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133088, "uuid": "46f4a609-f403-41c0-ba2a-a846d78b7a14", "value": 1234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133088, "uuid": "f94fcd85-c706-4ac3-bdce-b66c63a9a8b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133088, "uuid": "035a55dc-c890-4623-8b05-ce831dab0d53", "value": "photov_469702035378.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7189919-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785132966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132966, "uuid": "dd8dd30b-166d-4468-b649-f7c484cd9936", "comment": "Malware payload", "value": "af0717632a0fdbee9d67e63528f48e6b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132966, "uuid": "4b749ead-6834-46aa-b93d-ba684e29c27e", "comment": "Malware payload", "value": "2a0c538ab255516216e1d4fbf8dbc45c88c9eb14cc3d1d39eaa3de7584266596", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132966, "uuid": "9f12fdb8-816f-43d2-ad52-ae16d6315fa4", "comment": "Malware payload", "value": "252cd0303878642fd16bd6d4e40bd56f9e41d78c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132966, "uuid": "8ffe58ce-63ad-48ef-a06f-ab20114ed169", "comment": "Malware payload", "value": "654535c8e89cc65214af8c1d9c8d59239bbe7b507e801bb7fe2bdf15a2141e0a7c91020e496defe95acf94ae73bd4cf3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132966, "uuid": "a4e51bbe-1da7-47fc-991e-ec988d083e77", "value": "T1A3C28D956A867C44BDC98A3E4CBE2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132966, "uuid": "7cacf5bd-3ed7-419b-8117-f10f92c55dd1", "value": "768:t8vCB+25j6es8R99FYpMSUpi+20qUpi+20YQX:t8l25Jrd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132966, "uuid": "9d7e5c99-0c35-476e-be86-14a79231d1c7", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132966, "uuid": "7641d51e-2831-4913-99ec-e383525f88bb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132966, "uuid": "d0d1e7cd-c845-4504-b458-a3215a21ce0c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff791e0f-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785133544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133544, "uuid": "61428ef2-9b52-4072-a536-f7863cc3ec58", "comment": "Malware payload (PhantomStealer)", "value": "4dee8000b50bc2f57c0f4ae85d6982e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133544, "uuid": "68175427-0a6c-4a0b-a815-488355b06a24", "comment": "Malware payload (PhantomStealer)", "value": "2c025d944ae359c4140d0d041976e649523d435195418b8cc19d5f7936e1d072", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133544, "uuid": "12b386d9-4a92-40b2-8aef-f3e22ea7eb12", "comment": "Malware payload (PhantomStealer)", "value": "8918531987ff05662517d996ded06a72db6e3686", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133544, "uuid": "72015fa8-2095-42a8-ab4b-e11db9bbffd2", "comment": "Malware payload (PhantomStealer)", "value": "1038c7e8e515ed3943c400f787a878f81bbd6bb2e2a56123627413214a658c0233885da246ce62e8ad967883fee56618", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133544, "uuid": "7b053d6e-fb68-47fc-9259-2d50c007ab7c", "value": "T18436B6864F9184BA7768D78C1A7ADA50834D02A30EDDDB3630BEC9247B5DD47931CACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133544, "uuid": "502e5c0a-004e-4abd-8215-df730f6a8ab2", "value": "98304:xslaXMXYzzryufe4J9zJ46qU/AyRnLjscKA28RI6Mf3uWTqR6Cdl6lgptM6KJg7L:xGaXMID724vJwU/AgnLHwl6Mf3TkXLNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133544, "uuid": "0c9754d5-0aad-4104-8475-b06432a509b7", "value": 4940419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133544, "uuid": "755921aa-136a-4602-aebd-e682a3226373", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133544, "uuid": "8f68da68-3e80-48fd-a2a6-174ead2e2626", "value": "RFQ 202613527.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb3f442-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132732, "uuid": "99c59595-48e4-4427-bd27-d1331575e3cb", "comment": "Malware payload (PureRAT)", "value": "e0df1fb02fb903610fafc99c821a7ddf", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132732, "uuid": "cf49ad4c-4501-4b54-a756-0ac1ed527d01", "comment": "Malware payload (PureRAT)", "value": "2cdf415fe135fb4aaf7bb9c4f82eb6bced787580191f7b59d78b651e471da956", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132732, "uuid": "2f4ea0ee-6a84-4778-b1f2-800dc938ca44", "comment": "Malware payload (PureRAT)", "value": "464e3d25acf9b67ade06605601a6578da9d8c250", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132732, "uuid": "74dfdcb2-2706-4787-8c93-52b44705115c", "comment": "Malware payload (PureRAT)", "value": "122d2438b80dc25bfe6534dc1a3f00b714bfdcbfdf7e28acc3bbc1cf04d8aa37d09bd709187c34da8c284bd67e8e4208", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132732, "uuid": "56732483-c850-42f2-b816-ba419c085ee0", "value": "T14921C8D08968C26AF51BC4B2064E753CAF4230B0AD7D0923925E985957CBCB956554E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132732, "uuid": "23b5f3d6-e04c-4c0e-9b75-f094d37eccbc", "value": "24:9GPpu+Wx91BTYEdsb2s4cfjSqyJqD3aJbZ0W2XDmSr8+gWqzErB3IXhI:9GPhWxnBTYR2Ruza4W2TPr8+gWC04Xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132732, "uuid": "df551535-72f5-4bd4-9afe-899af0bf618a", "value": 1329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132732, "uuid": "877925a0-87d1-41b1-b535-d736e843127a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132732, "uuid": "16d6e827-856b-4ab1-a6e7-2d9f01513985", "value": "photov_504755941459.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b61f67-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154247, "uuid": "ee247d6a-a074-4d7f-b068-d5d1aa32f585", "comment": "Malware payload", "value": "d6f42f087fba8b0c34e0783d96f3b3da", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154247, "uuid": "ff3e952a-a0fe-4461-aa2d-88a28a2befa7", "comment": "Malware payload", "value": "2d288085e1516383b5c2948e36d294163cccdf6390a9009252b22f8bfa8d6fec", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154247, "uuid": "ccb40070-6197-481c-8e4f-0f08d298760e", "comment": "Malware payload", "value": "943399882c37948a204d8fc311e6465b9dd958a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154247, "uuid": "8b101edd-9c27-42d6-928d-81da590b70ce", "comment": "Malware payload", "value": "c0d8d810af30c06d7e272216431c213537001d5c9c291872d0c6cdfbf11a37041c8b39bd1be98a1332b21119a58b0bce", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154247, "uuid": "5d97655e-32ad-4d3c-a432-9ecf83dffd8d", "value": "T1EF21E950C09CE800C80AD0B9EC347A1403E8FD4529A365FF3F8AE2E1ACD8FBD9315188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154247, "uuid": "0398f03d-ff1e-4d99-a9f0-e1c7cdae1cb3", "value": "24:9YCbnVpVFDQRganQy2VX6yJVMefr/mSiYhGY7NWvVvml:9ZbnVFQrnP8blr/PikGY7NW9el", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154247, "uuid": "dd30af1c-1c3a-49eb-a2ee-695f4c6e4985", "value": 1147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154247, "uuid": "9dfe35de-2a0d-4c38-973d-f9d7c939e79c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154247, "uuid": "20ba6c9a-02ff-4b64-a97c-1765840ba397", "value": "photov_405332078002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aba6d30-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132784, "uuid": "2ebccb67-28db-45b6-b566-4aef86229ced", "comment": "Malware payload (PureRAT)", "value": "fca03aa5def8ca77bc6bb9e5cf4be2f9", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132784, "uuid": "1e0d1ed6-c65c-4927-b3ce-6743dd6f40c1", "comment": "Malware payload (PureRAT)", "value": "2d780f19a28cde84e1c0cb2a98a45433b77ff1e79a9610b56e64ecf334d9ce8d", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132784, "uuid": "655ae591-9f67-4ea8-ab1a-2054a48b8ba0", "comment": "Malware payload (PureRAT)", "value": "2ce8cdec9e71f84fedbcefad63747fb4f79ee358", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132784, "uuid": "28ceb8ab-521f-4b8f-a3a6-93c70b8712b9", "comment": "Malware payload (PureRAT)", "value": "759aca1e4b19da292b9cd191ae665fb6fd5bbea399160596e9a99dc65146242cb5df97ddfb1fc7ea810c784e4e036d5e", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132784, "uuid": "81082168-e054-4192-9dd1-69c0a481a692", "value": "T1EF21A7E69D2C8DC1C0F280F72AAC5D4541325A06D11508EAC2207273BDAA9A9738B1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132784, "uuid": "53292870-f7e9-4a17-9c62-11192b332033", "value": "24:9eSxGRZMJo7qxJJ2CmdC5QsRF1UNSBDoqVx9gBmSTjv/RWy4tm4LXDh+X89ec:9XxSZgoqbmklF1UQ9xQPMFdPhJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132784, "uuid": "93c934aa-4c71-4162-8397-4a902cf25f7d", "value": 1239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132784, "uuid": "c9895734-d57d-4b20-a6d2-375042039eda", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132784, "uuid": "444c3089-c6b9-4347-9bca-4247b95e2264", "value": "photov_242876135956.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc722d65-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133002, "uuid": "362b2c51-6361-405d-9c3e-98f6ce9599bc", "comment": "Malware payload (PureRAT)", "value": "873b46b95d1ee07c277da38f742408f1", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133002, "uuid": "4ae5aedf-eb15-404c-a89f-4288a7d4625b", "comment": "Malware payload (PureRAT)", "value": "2e061da469b1f077c974c72c75a8c2bea0ee023488e618f7decd450480566ff3", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133002, "uuid": "78fbf6b8-323b-4869-9f28-083727a7d9e8", "comment": "Malware payload (PureRAT)", "value": "33442ba7a1a9a03645f9f74fbc56174b109c4ee5", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133002, "uuid": "271d1be5-0131-4f98-a100-4f2f802b2e25", "comment": "Malware payload (PureRAT)", "value": "b5be1f8d0e6e8dcaaa6f0e366b26c11f411d555d8de6c41115f6ee2284989d50492eea6dd355a1d2dbb6a880f87bad4d", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133002, "uuid": "d226d88f-f35c-410f-bb8b-bbf0431927f0", "value": "T1CF21B4B0CA1CDE42D40BAD35504AE40612E0914339802153A66A1CB93FAA2B4AB8454A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133002, "uuid": "6be3d81d-54d0-41ab-b3a3-704abe19bb3f", "value": "24:9AgSaNbcF4pE5ZuOynA7wdG/lSUKGH+mSXG+Jl8LV88rUQQ7t:9AhauF4G34nA/tStGH+PXG+UNg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133002, "uuid": "a288b901-94a0-4097-8be6-d14f28cfc2a1", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133002, "uuid": "d55e095d-657b-410e-a02c-62dfcadc1d65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133002, "uuid": "21983153-66ba-4577-bc0e-ff0bad2cbdf7", "value": "photov_541074616388.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd915ddf-8993-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785140305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140305, "uuid": "946deb6c-c129-46cf-b3e0-d58ccd62df76", "comment": "Malware payload", "value": "0eabe61ecd88697efb1318ec6b3ef6d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140305, "uuid": "cd8724b3-2275-405e-86f4-12a1e10872b8", "comment": "Malware payload", "value": "2fdd106b92b92d7cea977680e9890f8fe2fbb3adde1628edbb1c2b1a5587e60e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140305, "uuid": "10acbdea-4807-4aec-83b4-734749a38bb4", "comment": "Malware payload", "value": "91d7490ae33ae2eda220c67e665fc8299f818304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140305, "uuid": "2692d7be-c17b-4f18-8cd0-570ce00123e5", "comment": "Malware payload", "value": "19c2441c8a931b449087dba3ae24dd6f3dccba3eae5db5f61292e89bddd49344d626c9c654f2709d8db9e758a9351e06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140305, "uuid": "ffaba67f-e880-4886-87e0-3eda321d8487", "value": "T1B5654B6DEF08DE57C5C5423448EF07243733C454A3039B1BA919A139BCAB799EEAED84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140305, "uuid": "c173e2f4-8c73-45b1-beea-7d50345f3a47", "value": "24576:Vz927JIFsAMUP66PPLsG29+AV/QHVCUG:F92vAMUP66HgG2cYIHQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785140305, "uuid": "4a94c483-209a-4224-b5ca-601e0e37812a", "value": 1471680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785140305, "uuid": "3797bb0e-3927-4492-9336-b8324b7000dd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140305, "uuid": "a3592a35-08a0-4e54-bcc1-d7b842e88e18", "value": "2fdd106b92b92d7cea977680e9890f8fe2fbb3adde1628edbb1c2b1a5587e60e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee81ef70-8985-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785134375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134375, "uuid": "13ca1d71-db7b-4e27-9264-331b0df665b4", "comment": "Malware payload", "value": "dca128b39b9e3355cacf5fb56ddefae0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134375, "uuid": "b6506584-d6e4-48c4-9595-7da2558734bc", "comment": "Malware payload", "value": "30a18c85fbf3beb4f8cd1940e9cc1dcd78f92f4e9e531f9f3cc615f67b53f582", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134375, "uuid": "e8b66a9f-4096-4998-91e1-81f14e2d48bd", "comment": "Malware payload", "value": "5cbfd6868d12d8995ff8751da253dffbd6446dec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134375, "uuid": "fd1d76eb-95d5-4d5b-82b0-ec67374d31cf", "comment": "Malware payload", "value": "37f529fd3853915cf39dfe577b2df12e5010d7bb0bc943ce6d91517bfa35fabd940ff6591ad077d0fd78386e4f888b78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134375, "uuid": "615599d8-c1ac-4ee4-a462-dd76be1d5821", "value": "T178C27D966A867C44BDC94A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134375, "uuid": "6dcb035c-9c0d-472d-9ac0-295615cc2f4f", "value": "768:z38vCB+25j6es8R69FYpMSUpi+20qUpi+20YQX:z38l25Jsd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134375, "uuid": "464f91f0-a70e-4340-8b1a-610ab284ef53", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134375, "uuid": "bd40bf44-d073-4aa5-abc2-9eac4978eb1e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134375, "uuid": "9c11a1d2-e164-49b4-a145-8ade758d17e3", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dd6fb3-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154041, "uuid": "31ea1bdc-fc58-45ee-8224-d35d1b59b901", "comment": "Malware payload", "value": "c8ea842fe814523fa637d0b3408fbd10", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154041, "uuid": "479e3f7b-f4a8-48a7-b887-b90abf7e73be", "comment": "Malware payload", "value": "31378116722a9f2b4fc03cc285af29ee76524aed1dddc46e3a2601040a1c2fb6", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154041, "uuid": "8ff86d45-d11b-4063-b716-ab07b1ac91e7", "comment": "Malware payload", "value": "4b03767d2aa503f191adf24d967f62ec3a492827", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154041, "uuid": "3438cab8-e602-4e9c-a5f4-e1f3afd83455", "comment": "Malware payload", "value": "43f4379ff4af520af1c9498484baad154929145edd98dea199fe800fcba26ce75ab015f803303ba81fd5326ce673a482", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154041, "uuid": "722ce7f7-b9d7-4978-beaa-4861b84d6c7e", "value": "T13121EA108713CD81D5D7E5FDA4B2074E64F09C5C792112FA231D24ED3D82ACE270CA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154041, "uuid": "3d6b7191-c8da-4836-9d07-07cea985891a", "value": "24:9HEZ13QnKfW7Yd3qMk5F5icHkKEImS70iQuHlzXm+5mqCOR:9Hi3QK+8d635F5iukKP7lQKzWPqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154041, "uuid": "fdcb6cd2-79a3-45bf-ac8d-7887b8cfe4f9", "value": 1276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154041, "uuid": "51de4239-e6a3-4eb0-b075-c952e611b86a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154041, "uuid": "d6bde766-cafd-4911-a5fc-1243658f6073", "value": "photov_768615723038.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f54933-89e1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785173785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173785, "uuid": "b75ad29c-94a8-495d-b42f-821bd2d30a25", "comment": "Malware payload", "value": "711f2a56a081e7c5e0726972578dea42", "object_relation": "md5", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173785, "uuid": "6662b081-dc9d-4f6d-a9ff-e2a14b473408", "comment": "Malware payload", "value": "315fa8d33d11b7a85de622b12f3584d5e4bd9c1befd257e8b66de9f14616dcbf", "object_relation": "sha256", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173785, "uuid": "9bbf161c-4e59-40c3-9120-9d2aef9f2ace", "comment": "Malware payload", "value": "7976f04167beabc1243ce6d9b3a02b0ee49b56bd", "object_relation": "sha1", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173785, "uuid": "9a911066-6ead-455b-9352-4e01006ac361", "comment": "Malware payload", "value": "6f72645a5340143ff1ae30eda7056c3f9d6f90858063eb64668ae59c1178423fa4daed1fcedbfb98abe2cd168890a8db", "object_relation": "sha3-384", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "pyw", "colour": "#281BA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173785, "uuid": "8d23e652-675f-4335-898c-fb17684cd231", "value": "T155C3AEBC76186DE6377F526BEA96BDED13A62663998794CC40A0B7C30463335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173785, "uuid": "c18279d7-d83c-424d-a62b-a19948c84029", "value": "3072:kjkOG3bExxVIuxvXLjfvtsgGwsfB7MoVRlAxFAA:WWbGIuFXLjfvtsg0ftzReAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785173785, "uuid": "d1a9f85e-2df1-4808-865b-4d013cfef094", "value": 128106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785173785, "uuid": "1e7cbeca-8129-4eb5-a752-d500528bb526", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173785, "uuid": "affda660-75f5-4e77-81c9-3a46dd9b7798", "value": "run.pyw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd60a76-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167820, "uuid": "d1b18b4f-aae3-4c12-8135-fbaccbf2adc9", "comment": "Malware payload", "value": "075432c3a87061fcaefab159b4f8c827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167820, "uuid": "80a037e5-3bee-4d32-8137-79492e124ab4", "comment": "Malware payload", "value": "318d66e1c137f9f3659954f2f9f986344e443a929abd3ff2518b1515e8f72227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167820, "uuid": "42bbb60f-acf9-4a72-985c-e7f411331a40", "comment": "Malware payload", "value": "43e3ca4df323bd53bc0888efec50f3295b7569de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167820, "uuid": "8b852811-3171-477a-ae85-a48fefdbcb85", "comment": "Malware payload", "value": "f928bee148b273dbcef9d7e0139b7b93805893c33dec5601c477852e17675c98c9b2d8586273c85734fdb1c7eaee95cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167820, "uuid": "ec861062-805b-4716-9785-6e521862b1bd", "value": "T13A844B2AE2B3E17CD103C0305BDBCAF25530B47566316DBF26C09A352EB9DD06369B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167820, "uuid": "f0d37e24-29c6-4c9a-90a8-f2e00103bc61", "value": "6144:iHSFF3ZgGxkyfAgdNg7vRvbM8uGnUTznvjR9P2N+6K5d5/mHSY76+7DWn:qglfBNgdY4IrdcHZ7jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167820, "uuid": "e2745f00-28ed-442b-9bf6-250c35ed7584", "value": 393856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167820, "uuid": "87c2e8d6-7bdd-4e96-9d06-cac089c566f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167820, "uuid": "d8a2cc74-b72e-47ae-94f8-34223bbd6a03", "value": "tmplpptzaer", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6febd9ad-89b6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785155207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155207, "uuid": "7a4fc6fd-a5c8-4325-bd68-777585e54973", "comment": "Malware payload", "value": "82cc9b9ac154cb14be4326a6638547b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155207, "uuid": "ac91fa7d-b482-4fcb-996b-76b4607e8c38", "comment": "Malware payload", "value": "322a4cb63a07255a57215adc91e99e14e43927d38be448a2d76c5b701c76d79c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155207, "uuid": "8351d503-dbf9-40af-b423-0591a7bbf6c7", "comment": "Malware payload", "value": "4cb118a63c4adeb98161541541e0c9622fe60254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155207, "uuid": "46a3abcd-a793-41f6-93be-7ef981392ec3", "comment": "Malware payload", "value": "3a0b6c7173631ebbff69eb2b782f2b81a9bc991cce9eee27c77040025d75a4d6f3604f429a08e45ed6eb83beab9bed1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155207, "uuid": "c6d7f503-b6d3-40fe-b977-1e831fd89647", "value": "T16208331CC3E1D96ADDF296BF4C142521D3A623066AB4B18D68AEF0D03C6065E56F87F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155207, "uuid": "fc5c2c93-de5f-415b-a66d-5cdb58fdaf4a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155207, "uuid": "8f3234ef-b7c5-46c8-8527-5ef023e2a1e4", "value": "1572864:+t9IKPyU07Yy8RWYZxU8hr8op7Zp0TIKU20BLb9cXXIGcbP7:+UKl07kRWseEWWb9qXIGcbP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785155207, "uuid": "d8273391-3cbd-4a03-b6c2-cc62b2bcf9e8", "value": 79023146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785155207, "uuid": "b116b329-9016-4b03-b1ab-94d4c8c5ae8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155207, "uuid": "3488f02e-d010-42c5-9bcb-6a5cf3cabe7c", "value": "Game_win_1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1716e80f-89d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785169661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169661, "uuid": "7b7a2a20-0503-4c0a-aabb-a3013e1da36b", "comment": "Malware payload (Phorpiex)", "value": "258b98ded097462bc668ee1ca8e56c60", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169661, "uuid": "88c3b1c2-044a-42ef-b8e8-bcec3055d9d0", "comment": "Malware payload (Phorpiex)", "value": "324a60acad30f9940a829594943d9e7a33ad1c32989b35ff6545e5a2df759be6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169661, "uuid": "c571417c-966b-4655-9c47-529463af4f81", "comment": "Malware payload (Phorpiex)", "value": "136eef90751334d3718816c1f16b37668db305ed", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169661, "uuid": "8ee48043-35f8-41b0-92bd-4ed93cdc5217", "comment": "Malware payload (Phorpiex)", "value": "5ffff626206e0a7e0e8925d855ab08c638f738da2492a157db3672b0165fe6ea4d0d1a2d668ffe94d1604e853e4cb3f7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169661, "uuid": "c386b5b1-bce0-49ad-bb0e-a5b9a21954f7", "value": "T1C1623A0AA4818035EAE04075827F526649FEADB623C4F9D7FBE0A8C94DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169661, "uuid": "44f23e81-ed91-4256-a5aa-307eba715137", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169661, "uuid": "ec8b6199-612c-4171-8bba-8bf438dd7c63", "value": "192:AW1SsGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthJ9ik:ASCScCRfV/ro6toB0av8U9czX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785169661, "uuid": "cac8d98c-0004-4534-9f78-b0dc41158f3f", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785169661, "uuid": "3f9b633f-77cc-4f17-a182-7f7c6bc5cf2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169661, "uuid": "be0fcd94-cd38-4b5f-9aa5-1867efcf8101", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17856f8d-89b8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785155918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155918, "uuid": "98ef3c1e-818f-43a5-9768-68b9d57530f5", "comment": "Malware payload", "value": "a9ef7997bbd637d467c5866f528840ae", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155918, "uuid": "dd33f750-5a40-49a8-8592-0da17da0c29a", "comment": "Malware payload", "value": "325577d0992787903200173260d99c345d5ee7c39edc864cca64cbc7e3366095", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155918, "uuid": "a5d7b3fc-be29-4086-908e-b3a646636bce", "comment": "Malware payload", "value": "ffad03e46f4f93ade098840784b17d870834ca19", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155918, "uuid": "7fe1a8bf-08df-4e38-b96f-62174ac04605", "comment": "Malware payload", "value": "11a7c09bf89c3183a9d8c7e03c2d215f8e735424ad3509954f30a2ba2ec8a40f7f170a4748df75f1ff60ec212bb96362", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155918, "uuid": "c2339738-fb3a-41cb-baf5-bee6037834c4", "value": "T15A236D6526857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155918, "uuid": "e4e89089-6a3d-42a5-85a5-d5e233f8bcef", "value": "768:vXRWNGxVj9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:Jlxecr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785155918, "uuid": "5b2f7655-7059-477d-8c1d-441aa6c10e05", "value": 50027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785155918, "uuid": "31d548b5-d9a4-499b-a139-44f51fa24955", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155918, "uuid": "1ef282de-f27d-4d98-8180-eccb4fa1f1c7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56efee3-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785133393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133393, "uuid": "03970806-05b1-4dd6-a9ae-fb415a915bd7", "comment": "Malware payload (AgentTesla)", "value": "3c2890b992cbf5466635d55ddad38bb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133393, "uuid": "2b6afc9a-cd2d-462b-b143-92804c0c4f40", "comment": "Malware payload (AgentTesla)", "value": "32ef32b69d85b37d61e8df05c555424bb7f5f8737e8ea1b23a6d41c7fba4536d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133393, "uuid": "406d5536-ad9b-4d94-8895-6b8f2ced2353", "comment": "Malware payload (AgentTesla)", "value": "17d59e66430468fd3637ef1c58ee3a8473ab3208", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133393, "uuid": "bd7b18e4-94dc-4d0c-94e5-e860c35ecc77", "comment": "Malware payload (AgentTesla)", "value": "6a96cfe5f915312169d1f050c59a5b29bbc6a0daad51c481d46570b9546a8f0748c34de91577d6ffc24a46a971865566", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133393, "uuid": "3b92b9d7-d468-4d0b-8c54-0bab76ced056", "value": "T16A26B5908F9188BD7361DF0C1976EE14C35D820384A6DB83B11EEEA4792ED47A31D6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133393, "uuid": "c82a3dc4-fbae-4201-9997-bb1a1743d240", "value": "98304:0AB/fDS34uSAXPfxGAvJEhqlP/JqoZE0devMHboBSbfUImU+GihguA:TBX6lRJGCvFRqsevMqSjUImU+G6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133393, "uuid": "b24ee7b8-9a75-44e9-a9ed-07948061de38", "value": 4444957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133393, "uuid": "af5f65e8-f1a6-4963-8f07-75b2f3facb44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133393, "uuid": "8e079aee-2145-4b96-b154-5bc9e76771f7", "value": "Purchase Order # PO-00014.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f9c91c-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143405, "uuid": "183ecbc8-535c-4a23-a4a8-1a379f898081", "comment": "Malware payload", "value": "c3eefecddafe3be97840897abea7f57c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143405, "uuid": "e9b86ba6-a10c-4b48-9118-eadf8cf7c59d", "comment": "Malware payload", "value": "33ddc013bc2da8877d129f1a617558fad621c222ed10a1dd157bc4daa948050a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143405, "uuid": "089a9e5d-9440-4fe3-95b3-d8bf99c1d3be", "comment": "Malware payload", "value": "a76693c1dfd0ff63d2dd36b9c911b9c550f08657", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143405, "uuid": "055c887b-afec-486d-b994-e52ab85d04fe", "comment": "Malware payload", "value": "69cef7b891ceb56dedd2b4925cf4b36bfb5024a7e755d40fb5135068580ff09890fd534eb55adbc5766d032e4245e04d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143405, "uuid": "fb14eafc-71b9-42ea-936c-bd4d88d50ccb", "value": "T10311355091DA45D2CC07C6F1BA6B2BE2622D1141951561DB2FE359C52C837E873654C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143405, "uuid": "2fa24c1a-46e5-4d7e-8a2e-c63889a088bb", "value": "24:9bv0CQtJuqiCwlyjGoVU9nZFPp3NuLD0mSvu+uQ8ERv61DK:9bv0CVjKU9nZFPr+YPvu+pvMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143405, "uuid": "39606332-03a6-4844-a217-5f1202173713", "value": 1067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143405, "uuid": "acfbd139-6bd1-4191-8f3e-e30d2aeef9b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143405, "uuid": "438b932a-77d6-4355-8dd8-722f9a4e4090", "value": "photov_143988352124.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a7142a-8953-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785112697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112697, "uuid": "4268ff69-b571-4c66-8a53-02fa3336abe6", "comment": "Malware payload (RemusStealer)", "value": "ea2b5a00e49d3a09f38eadfda23df277", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112697, "uuid": "ff180ff5-2dd2-4a8f-9abc-4b82c400e155", "comment": "Malware payload (RemusStealer)", "value": "35392a9849d7e9dfb4ee700a16700a94883fde859d57fdd891631bdbc6a75db0", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112697, "uuid": "66dd61eb-958c-4269-a27c-d27fedcd4117", "comment": "Malware payload (RemusStealer)", "value": "b61cf8e65e87dc9b3aeb4087d26696a107230f8e", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112697, "uuid": "07cec8a2-42ed-4288-8dfb-7868e17d93d7", "comment": "Malware payload (RemusStealer)", "value": "c6945a8a47a105169988fe01ab7ad6adbcd394aa420037a3af9e8a7faa50f952ea231d2cc2b192de325dbc021cf7056d", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112697, "uuid": "d3910329-b57e-4040-916a-fef55ef87494", "value": "T1C9B55A07BCE10DE9C4AA933289A655917B71BC084F3227D72E90B3782F72BD19D35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112697, "uuid": "357cd3ca-87bc-4140-b470-7d741f619894", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112697, "uuid": "927d9f2c-47e2-4c3b-ae00-a8753723b45b", "value": "24576:N4CW/BQLpamgRxdE0fQ5KtxK1oe1MMHUW7YkjLqJBele5r926CS75icYk:N4Z/+LjgRo04It81MM0wYJjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785112697, "uuid": "ec079777-091c-4c85-958c-6d403a0c6935", "value": 2375544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785112697, "uuid": "f6cd0a67-a462-4f51-89dd-068ecccf11a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112697, "uuid": "52a52cab-76b5-4b53-8b7b-15f17ab81320", "value": "crazy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f626626-89a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785147127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147127, "uuid": "9d42028c-c814-430c-b459-d9b5f8fcec05", "comment": "Malware payload", "value": "741264a0265a67ee70a9ebbf8d94b0fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147127, "uuid": "a18b1d87-002a-4b2e-b27e-8c292133a90b", "comment": "Malware payload", "value": "36bda34a29765be36c30ec657db558dcebc9ed013036f0da2f9f995322922acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147127, "uuid": "f87952da-29c6-4470-bfb9-918a076b81a5", "comment": "Malware payload", "value": "c25bf42a824aa11c90425a23ade286cf1bd5a06b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147127, "uuid": "6d4503e8-01a3-4d79-b000-bdcf5742b829", "comment": "Malware payload", "value": "5e73e1c484bec04b620efc94b830dccb7456b99fe833eeb18b59eac467bd28ca46b63c9b7d59cac1af666715e7d991aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147127, "uuid": "f25c4381-24d7-4b2d-a28e-1a51f69f36cd", "value": "T12C767E0CA9DE2C38F31EF4FCC049E5C5ABD7296BCA2641915DE44383D46BEDCA91681E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147127, "uuid": "0e736c32-d39a-4ce8-bfbe-003b6a6af751", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147127, "uuid": "fc245f2e-a8d6-4bc3-97c9-9f3098457837", "value": "24576:aARinWi2tux0eWmT4kn7vXD6o3sgtcKNEfPB1wQfpiX6ES12OeYao9HLDxp:fiWHlPfkihgwB1i+AYaurD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147127, "uuid": "071c53b6-73dd-4412-8171-4eea82907d5b", "value": 7485520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147127, "uuid": "d7710838-37fe-4a52-a5f0-ad1c696e3242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147127, "uuid": "3b018297-a77f-4be2-9881-dfde98016a74", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e929ad-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133067, "uuid": "b5d66e8f-b200-45f7-ba42-667abf2b2f1d", "comment": "Malware payload (PureRAT)", "value": "e8934bec683c5f1992988ecf9944915d", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133067, "uuid": "08d547ed-3f9a-4526-b486-82f7017463e2", "comment": "Malware payload (PureRAT)", "value": "372a65a8c8312643b88224e167709605f32a8c325415776086020e90e51aa22a", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133067, "uuid": "ec1d705d-0b2e-4dda-8c4a-40daa4aaac1c", "comment": "Malware payload (PureRAT)", "value": "f57b351aec499b5c1538d2353c70e945109d23c3", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133067, "uuid": "dc61f5cc-e894-4efc-a00b-e7a9d2c62b65", "comment": "Malware payload (PureRAT)", "value": "a7829c2f2a419253f4c1a3dff337ca8c00f2b87098b8fea66ae3004cdf495d69d67828345f2ea56810c891b990ce5423", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133067, "uuid": "69b9e394-40ba-47b5-8f38-465286dfdf3e", "value": "T115114298894ACF10C642CA752878E28451979EA6C1718A9B02E4E7B73E521E55EAA0D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133067, "uuid": "6865bb19-24b2-4230-9e7c-e9297ba2f49c", "value": "24:9XmKxd9zTBNbUCojOwQR2QxMXBBLUey0FjsOfamSGwwPgMrSRIfCvmPfT:9VxJXWORKXBqrOfaPGxJORIfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133067, "uuid": "9dcb0fa7-1910-4d4f-9b8c-3c2c4f8efab6", "value": 1087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133067, "uuid": "e68da73a-bf99-4156-b4c4-6f0118340d5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133067, "uuid": "c21ff21f-e726-4552-9ed8-31d873d8e205", "value": "photov_127567101143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2f47a3-899f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785145509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145509, "uuid": "6361f068-6fe3-4e2f-a5b9-4802884221c6", "comment": "Malware payload (RemcosRAT)", "value": "91c3a5e3842521b6957ce7db490da3af", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145509, "uuid": "f6c56ee7-42e1-4f92-9d6a-dd5be07b9f8e", "comment": "Malware payload (RemcosRAT)", "value": "3745a4fc21cdde77dde67e22f54a7cbd7b761e1b05644a1e93ec2551209ecf1d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145509, "uuid": "7d0a1666-0382-4e2f-8248-d390545dc297", "comment": "Malware payload (RemcosRAT)", "value": "c02f27b7c7bb546476a165a716f9e5b0ef274570", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145509, "uuid": "d8503aa1-373e-49c1-9372-b7b6d3a9ba31", "comment": "Malware payload (RemcosRAT)", "value": "e6bf2789f10711807fcb09a78a1518d8e6de5f6cfe3e1017e59baae79ab5d5631f82195659f4d70b66b28d12d7ab87dc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145509, "uuid": "d0a87edb-383e-4c77-8db3-3886810d7732", "value": "T12D55D77DCC29823EC2B7C629CAC78A07F95A1817321CFD4AA4D3735B9127193B4E256D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145509, "uuid": "aa593146-f401-4bc0-a999-ae4da99b7ea5", "value": "3072:YDUaFIG/cWVUtpe5iVxoDCieuUdEOsiKdIDG5FqKA3oMxoEbV7sOK5YfC7uJYjpD:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785145509, "uuid": "19429ade-c639-413b-825d-f899cfd1a494", "value": 1281582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785145509, "uuid": "04639852-33e1-4338-844f-e80adb7c60b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145509, "uuid": "c7746b67-6084-4682-a14e-a17ad43908a3", "value": "35.480,25 EUR \u00d6deme Dekontu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db70c9d1-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132625, "uuid": "90bf3203-5196-4c52-a9ac-8688fc7f22bb", "comment": "Malware payload (PureRAT)", "value": "50eea06e6d06700f25c8aa81632896a5", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132625, "uuid": "afe68baa-5e28-49ef-b8e4-cef47a44022d", "comment": "Malware payload (PureRAT)", "value": "37c59293466a0f8d16b0f6ab5c81777c8cae8cb14d041919553831b96b5122d2", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132625, "uuid": "0c33354a-7f91-4389-aa3f-f865ab084d6f", "comment": "Malware payload (PureRAT)", "value": "df365e5f4bbb22286bb4478972daa748272a80a0", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132625, "uuid": "3c9d5c37-dc54-48ee-a43b-287b8311b6bc", "comment": "Malware payload (PureRAT)", "value": "79b50b2af297bc4a5beae21ebcc75678a00fcf50d6ffbc3be266282a6bde74971e4a5956826e8c563886a91046a51b5c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132625, "uuid": "524c6ac7-2cd6-48e4-a2ec-120ae4f225c1", "value": "T19E219519C8679FCAC80ECC3C467CFE0176211D92C14E8AA6A5050A2E7524D9F99956E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132625, "uuid": "ae23a2ed-eccb-4143-aba3-658fdfd15cbe", "value": "24:9xsZCt9rW0Tr1RzjEsUtFt6+IlN6FRdRlPmSFpTbI4J9CRALBtV5Taduo7PtsRCB:9xW4RzgPtFXRJPPFRfVEdr7FJ21G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132625, "uuid": "8c5b42ba-49a8-407d-a487-b4f6c761f14b", "value": 1295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132625, "uuid": "65b2a9b8-c3dc-4078-a6cc-a2de47843e08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132625, "uuid": "289207cf-83a1-495d-a57f-e6fdd7b62688", "value": "photov_859384234560.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d74059a-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167981, "uuid": "0248fd89-4388-4f35-a450-d7bb5a6deef9", "comment": "Malware payload (CoinMiner)", "value": "d5c481507973874611e0df5fad002ee3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167981, "uuid": "a25d4d5d-aa42-4b53-86da-f10739e2bf6e", "comment": "Malware payload (CoinMiner)", "value": "382dc078f427e7a2e34bfd03c4d8634f4f2b93cba6e840bfca50dab7f7f7727a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167981, "uuid": "5cfb359f-fd87-48d6-8131-4f415959305e", "comment": "Malware payload (CoinMiner)", "value": "422d116fb5492ee5fee7ac6b0584f77e667d0367", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167981, "uuid": "414a0887-56bc-42e1-ba19-66a1e5563984", "comment": "Malware payload (CoinMiner)", "value": "d1744a367ab8467477819cadd769ac2deabe0aa31fc12d7459e53a4efd63de2305f1ed8a1b3da2d57e3c8a9e1b36a673", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167981, "uuid": "9721db02-7467-4bab-b226-0c0f9016b0a3", "value": "T11D365D4BF1A360FCC1ABC434475B9963B931786901247DBB66D4EA302B33F605B69F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167981, "uuid": "9fc6090b-1a63-48d4-99c6-197758429e0c", "value": "98304:jmuGqB07PI77UcVHpB4Lldybz6++iRDMT+wBS7Hqv2wwKFKoArC4pa/i+Dg+2:zB7B4WRtwBo6GCutv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167981, "uuid": "a9bf6ddc-a554-46f3-950f-f8cbb3523398", "value": 5060624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167981, "uuid": "9f35dd29-ab2d-4940-990e-8f05a5654d64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167981, "uuid": "31dbcea5-c361-4bcb-a9e3-0e2a000873a2", "value": "d5a0377ee9f1732a6f10372750fd638e081edf44a9703eda5d5ef53a2ab82f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996130ca-89ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785179758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179758, "uuid": "8c407734-b290-4a6e-98d7-6b34831b1960", "comment": "Malware payload", "value": "1b0c0a3cd79d1f0dca18e1f75aa5c1cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179758, "uuid": "1514410b-3063-4bd2-ac7d-942c759a37c0", "comment": "Malware payload", "value": "39cabb912975a2b1cda1c50d9b6c62974738e4d66ac6d804fcfb30aa2764240f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179758, "uuid": "d33b322a-8fcd-4249-a441-fc62b1331606", "comment": "Malware payload", "value": "d30fef99ba4020417db2f36f0ba8ba0c1b2c1a0a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179758, "uuid": "c3ae2512-0b9e-4838-81cf-fd37969599ef", "comment": "Malware payload", "value": "d566325a69d75bd0be48502419ef8b29bdbd9628f500b2ce0806b63ba74f8dcaef9e29bf2ab37ffa2752da8fd463e40f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179758, "uuid": "313b495d-c568-4c06-a203-eda711d2dd5c", "value": "T1C4C27C956A867C44BEC94B3E4CBD2B1D6DF5C3D1324952AC3D8A3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179758, "uuid": "8af4b12e-d215-412d-93ed-9001e90fe716", "value": "768:98vCB+25j6es8RU9FYpMSUpi+20qUpi+20YQX:98l25Jyd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179758, "uuid": "c5750e53-20ee-4451-8173-3da120cbee06", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179758, "uuid": "dc8380d1-e3f4-4308-b6df-c9876275a762", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179758, "uuid": "10fd371c-a6f9-42f6-aafe-f1c8054ac2be", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bf0066-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132590, "uuid": "74cef2fd-bf93-43fc-a707-2fafb25f1ccf", "comment": "Malware payload (PureRAT)", "value": "1a678f5df943e60d621b53de7718a4af", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132590, "uuid": "dfe1e712-ef79-4e4f-a067-cbd81c1f63b9", "comment": "Malware payload (PureRAT)", "value": "39cfdc496ae6958c629d30882cdd83ea93db4aa98a830c7410da849c048183a2", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132590, "uuid": "697e6244-ac0a-4948-80d4-ab7d4d8b4b70", "comment": "Malware payload (PureRAT)", "value": "eb737705bd072986dfd3ffbd2bc1187ca9705b37", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132590, "uuid": "e3d36944-1d13-465c-8c71-3e6d3c855259", "comment": "Malware payload (PureRAT)", "value": "9cadcb2cc5094c2776b04dbaa26aaf432b17bc183cd4c97baaf850ad578a4cf359037f5017856d7d678facf141f708a9", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132590, "uuid": "7ec04b44-d863-42f8-956e-b357a357a46a", "value": "T1AB21B720C00C8A70DEA3A375143503CC686232D8935825BA9378BA563FCEF13E6405C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132590, "uuid": "f5427d28-671f-45c4-a79c-bbbf9e7e7c8e", "value": "24:9TSliwEzi8qek494/82GlSYvD55Ys7mSI+xB8rU93rZ+BV501VsYsN:9O9d29cRAl37PI+yUFABRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132590, "uuid": "99e20cab-1b50-4465-b559-e7ba79bbb2d3", "value": 1278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132590, "uuid": "2465d549-517d-42ed-bdf0-d02dd781673e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132590, "uuid": "7880e5b7-0ab4-4d52-8c4d-194d0bf9765a", "value": "photov_677513852955.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01957b4f-89d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785166189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166189, "uuid": "5408fa95-0c5a-4093-918a-c9322f180a81", "comment": "Malware payload (Vidar)", "value": "6a68ab6943313c4d3a38803d5a8220f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166189, "uuid": "750bb6f6-a164-457b-9ce0-9147cf4e1425", "comment": "Malware payload (Vidar)", "value": "3a25c7bb48b995f62f57268c8ddfc38379d194cafb794832a00a0504649dc1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166189, "uuid": "d7a590ec-6d15-4ebe-b72b-952e74bf2bd8", "comment": "Malware payload (Vidar)", "value": "7f07e04bac9bacca611cbf17faeb4c51023b74c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166189, "uuid": "d5668b6c-3418-45fc-afc4-8bb26de060ba", "comment": "Malware payload (Vidar)", "value": "b0841b7b4d5f62b4def15c4672ad8a0119098ab84d88087cd5e8a056e575cf5d59bb39f6e727d9996d528c51ac06cffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166189, "uuid": "6a23f628-d153-4a75-993f-4c2f4ad34ea6", "value": "T1E2F57D47EC9509FAC0AEA332C9764246BB75BC491B3227D32E90B7782E727D06C35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166189, "uuid": "90d304b7-7e34-4cc8-84de-a0e5c60cf47f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166189, "uuid": "4252e22c-ba2b-4fcd-8761-0f125521e508", "value": "49152:TiM0n1Vqcb4eGs42RZmRvG9KyRB9DU6rGqlVGRou:TA/4RxG9bLxG6E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785166189, "uuid": "3db90862-79e0-4bc7-8a1f-24ef3a3b286c", "value": 3648384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785166189, "uuid": "8edb11eb-313b-4ec9-9791-62f18a098eb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166189, "uuid": "405154a4-feea-4697-9985-7d3917545733", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0d62b8-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1785156434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "70cc8f1b-5f10-46d4-97b7-6c87e6af55c9", "comment": "Malware payload (Gafgyt)", "value": "7eb3446ff275f10c3891a521205b285a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "c6b4fe8a-9a9c-47ae-ac9b-839d5cbb8058", "comment": "Malware payload (Gafgyt)", "value": "3a77856bf1fc04bfd7e3df7ce7a001f8d5ba7698d34b2adfe67d515f2828c2bc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "839dfc5e-d2e4-4b5b-950d-cca73b9ce3dd", "comment": "Malware payload (Gafgyt)", "value": "d468296e4ec913ae2ef6ff57df49ebc3b431d7a3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "41785b8f-835c-4806-bc3d-ae3ef400a449", "comment": "Malware payload (Gafgyt)", "value": "ab3f7082e186f169cecd406b2b78a593e0676a9ebf50fba2cc6e2a731fff4102b2e2f1caf9c67bc18b62bb17a05ec32d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "66cf43a1-9fba-47cc-a9c9-4c64ec925692", "value": "T18933C805AF614EB7DC2FDD3301A90B4535CD660722B97B7A3934D928F25A50B89E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "e65c65d8-e25b-4c3e-9917-07bd9b4ef8bb", "value": "1536:23+B2tc86CQlbpmFt3pZCvpW2CPHZIE6/sS9o:23+BV8GbpmJPHg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156434, "uuid": "a2419c55-644b-4ad7-b890-5183b619434d", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156434, "uuid": "474f0f96-8bc8-472e-befd-4317f6e4b887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "abe1e12d-3ca7-4816-b04d-4d420467bc2b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d299329-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132815, "uuid": "245b6e68-506b-4282-9111-418c9463325a", "comment": "Malware payload (PureRAT)", "value": "721232a8eac445fbaf7361e5bf0d7565", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132815, "uuid": "71a8708c-fc4f-46a3-aa58-e3d265195e2a", "comment": "Malware payload (PureRAT)", "value": "3a9e31c66898f1544999584937ce497a117989f95eb5531f03d0098a1de1a919", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132815, "uuid": "960c709c-8702-4529-b9f6-6d00897bb2c5", "comment": "Malware payload (PureRAT)", "value": "82f179741f3bc37df92bf2cf745091dd607cd6b2", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132815, "uuid": "673989f3-2eac-44b0-8847-09d633ad77d4", "comment": "Malware payload (PureRAT)", "value": "d16960b77f3927bdd7c920e50ca96f43e4f3be37bc53ca607bf28b5f9b2fbef6cc47df19d1402efda7ad65eef73d8e22", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132815, "uuid": "fb0d26c2-0ea6-42ca-884b-a571156403c9", "value": "T15021EC5145E49045E9D5C1352D0B0A0CD030B1F97E0CC93B7704527B3D13FDC9B088C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132815, "uuid": "6dc2b484-610b-487e-a941-d3a00284f52b", "value": "24:9UaEKZLSXVuEGyOxI+9caqJ1NqLYX7VkmSVzhGY7tTIL7ism/:9UMOAI59/qsXxkPnGY7JIf9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132815, "uuid": "ed0eb62c-c2f2-4490-8347-a156d3df7179", "value": 1137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132815, "uuid": "669af629-870c-4c79-b8fb-26733cc27607", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132815, "uuid": "c49ddf34-8af9-4937-8bfe-4f599228b6af", "value": "photov_460772503095.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637c975b-89d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785166354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166354, "uuid": "97536d07-ad1a-433a-8784-d35aee9c4c17", "comment": "Malware payload (Vidar)", "value": "00dbca757e6417308d3fc080010a6ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166354, "uuid": "a720bc13-3835-4a79-b6ee-0c06402810dc", "comment": "Malware payload (Vidar)", "value": "3abd369c9c2e1473522baf55605a5e81cf3943d8131c6d85fa66b5a247b44fbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166354, "uuid": "cd3fbcad-4558-43b5-a8ff-fcb00f98cf96", "comment": "Malware payload (Vidar)", "value": "d46536ea19b177f95ea4e0568f901ca24cfdb42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166354, "uuid": "303e7d38-1d40-4059-ae65-a9ddc8453a07", "comment": "Malware payload (Vidar)", "value": "76ceb811e4ffabcf0b5608fe0d367c12c2a118df0eede0de178c84b8a0a87b720906abe9b8d3dbdda74109bf9c3074c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166354, "uuid": "c25e8183-9811-43f3-a19e-0f508dd136b5", "value": "T14B068C07ECD248FAC09AA331CAB35256BB347C491B3627EB2E51BA782E727C05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166354, "uuid": "8aa4e661-7e43-4d62-9fd5-b1ef634e584d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166354, "uuid": "da068858-c96a-4125-9b92-b443d41a5efc", "value": "49152:RqrxMHTCWCgLdbOoMxonO5lckHLWOw1tzWPs19VVcoX+h3/C+nQ:R4cWxonOXcjOw1NuwjVcoOF//Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785166354, "uuid": "a157fcd8-bf4d-40ca-9fd2-8e222d44fafa", "value": 3820376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785166354, "uuid": "4244d9a5-116e-4e84-95cd-ab15f6b314db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166354, "uuid": "bbfe1cf4-f33b-4446-b1ea-507318bdaf82", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4abea22-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133445, "uuid": "138be6ac-8b46-40ef-8a43-639fb5703fad", "comment": "Malware payload (Mirai)", "value": "81317b9792db263e88f1459e75b6faa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133445, "uuid": "4507d28e-e821-4f49-bc56-f3118f908596", "comment": "Malware payload (Mirai)", "value": "3b1399d8b25d4997def28ed4e902dcc3d9fcea6d24fcc95712cb132fc4ee5b36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133445, "uuid": "431c3b05-e0de-4433-9ef6-6c4216387326", "comment": "Malware payload (Mirai)", "value": "353b884eca39a90b35c9f6ed7b42a043fe957747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133445, "uuid": "f9f1a4cb-4fec-4c98-9535-c19b93788756", "comment": "Malware payload (Mirai)", "value": "53f3e7483adaed60fd030915074b4993b2da52f18efcb72be8b50158a34e36515b8977568d7c63d8068194688442c28f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133445, "uuid": "c2657e47-83b1-444f-b29c-74977d552551", "value": "T1ADB36AA3CC296F68C665D5B4B0B18F792B53A950918B0FBE156BC3B58053D8CF9063F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133445, "uuid": "701c5e50-3c94-457d-8de5-92c12de8e3e6", "value": "1536:4vBkew7VfEe7tYn5FCpKi5yk7mNV53Dg/hDnW+MzA7ocYPkDx:45keO7OnHpiVU53De5nWJzAU5kDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133445, "uuid": "ec4159d1-0acf-4624-947a-5cd69de1befc", "value": 109152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133445, "uuid": "50fcfacd-ed0b-40cf-ba5b-277e72dd4e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133445, "uuid": "0812cd62-06cd-47b9-88db-27fb33b89e17", "value": "zero.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5075d387-8975-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785127237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127237, "uuid": "176b9089-4149-4857-b0ae-3a36f20e2a84", "comment": "Malware payload", "value": "9e4d0677fa7e5996bb0558558f8250e0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127237, "uuid": "acd37855-c326-40b3-a181-2a7cc6e929c4", "comment": "Malware payload", "value": "3b9a3369e4fbc9f4336247ea11cf5df3b4c44066987ff20f5f6895addb052036", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127237, "uuid": "1500ab01-a169-40a3-a87a-a866bad45b23", "comment": "Malware payload", "value": "9b8bfbb4cb8bd2ba0e9b0c16957bf54936ee254a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127237, "uuid": "7a571c63-9f01-4203-b3f8-984da07fec00", "comment": "Malware payload", "value": "56c7b1560a2ae9c2755b1b8491ca9e9c1e5597b204bbd964697320258cbae6b600593a58127f93fdb7339770d0acf285", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127237, "uuid": "df93a41c-0112-4df3-9da4-7658de02a77c", "value": "T121E5BF55A3D859E9D463DA349710E332C2B279634B75E08B0A9AC70A1F77D924F3FB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127237, "uuid": "8df06952-6551-4491-8700-b658fbe7e45d", "value": "b1c022f21e313c400a3bd74350a836c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127237, "uuid": "41300c34-c75d-4298-87df-e2fa3bfebe98", "value": "49152:TCKosFyJxIG5oPVWk12JVB6iPQTUrrzAP11xy1rBLcyRGzaFjKWE5wtpFCzro1/G:CmOVnPQTUrrzAP11xy1rBLcyRGzaFjKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785127237, "uuid": "3d5a244e-6ec8-44a1-aee7-cc0d7a9c0890", "value": 3116032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785127237, "uuid": "e1a20a1a-c200-43d8-9fea-17ec9c49bf9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127237, "uuid": "9407c95c-631c-44eb-bf6d-d889f42ce03a", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84abe488-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143216, "uuid": "e6bf9601-874a-46f1-a730-41b0fe5b8346", "comment": "Malware payload", "value": "081d2a828974df9f46a833fa43a94116", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143216, "uuid": "76f6ad0a-ffc2-407c-a2fe-da335102952e", "comment": "Malware payload", "value": "3c1c9377a881ff2db157796e830853caf4444aac4d63fd9354f95279940dff79", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143216, "uuid": "2244db25-6d2c-497b-85b2-2b06387ab502", "comment": "Malware payload", "value": "bb8361195984e936e25cfb25cb4df54894352eb4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143216, "uuid": "59a2548b-ca8e-4552-ad61-0ceb0f499bee", "comment": "Malware payload", "value": "4b3830a2c22bcca9c0e70cc7fae172923f5f9459485ae94cb80d24e24c62056f934861afd39633dc6267e8b6f9ce6e08", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143216, "uuid": "1de198f4-021b-480b-b3ca-1d328b380bb1", "value": "T1FD2193A4C8444A82CD4B4579984790B5A2274A47C72E95CA2BA5B0A63E467A02740B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143216, "uuid": "ab3c1717-1c8c-49b0-b1c8-26640e31fa91", "value": "24:947EeJxgcL/53F60QLR9APeYpZmJq4kmSTqZJJxwV913Um:94IeJxgcL/JF60uAP3HtPTiG91l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143216, "uuid": "f00f67e1-8061-44e1-b430-927747e6f4ff", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143216, "uuid": "eb079844-0cee-41eb-a346-34d53d83cd97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143216, "uuid": "1963891c-054f-41fb-aefb-9f3ef867daab", "value": "photov_823417553540.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d4e4f1-89a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785147651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147651, "uuid": "9bd5f3da-e27b-457c-aa66-07a8875a23b5", "comment": "Malware payload (RemusStealer)", "value": "f314c88111069d8dd5734c6984ad34a7", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147651, "uuid": "fc09a9f2-fd8d-4f88-8711-0f44c6287578", "comment": "Malware payload (RemusStealer)", "value": "3c87f0ccaceabc4b920d064eba1fda7c87c7cb434798c02f86665b225eaf95a5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147651, "uuid": "cbae8c93-9dcc-4276-9ed3-c19c124a644c", "comment": "Malware payload (RemusStealer)", "value": "21f5af837cf76313c93a5d64f5e425c0754c7e49", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147651, "uuid": "cb80fe75-21bd-4af4-83fe-3fe71c0cc695", "comment": "Malware payload (RemusStealer)", "value": "776bab4e83d09cfaba4c0b5d2a500d17820156ce17ff60a8092ff92a6c2c0cf5ebbff56b50c0eba1cca5bac2526b439f", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147651, "uuid": "7b79dc60-30cf-49f3-8beb-182f6f01fbef", "value": "T159A58AC78AC21D86DDD508386C7B0FB05B61C8AAF912CA538F32A7699FD7390DC5A14D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147651, "uuid": "e15b8623-fffe-4a71-b017-4659bc557429", "value": "24576:poINajXCNf2t/Xmg8aQ6NdxhKz5Qew4MytHssTRa0MCVcff:pxUGf2SV6NdxhI5dR5s85MCMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147651, "uuid": "64b8554b-ffc1-48ce-851a-0834ec14009c", "value": 2141805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147651, "uuid": "f27dfe39-a540-4603-8786-50e3cd81bd37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147651, "uuid": "ab207d87-26da-4bde-968c-8aee69c47af8", "value": "Bootsexec64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8c81b7-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143503, "uuid": "335999aa-7fd6-48a0-91f6-2fb3bfeed78d", "comment": "Malware payload", "value": "ed93ae9d8305ecb14d6cf6a8f318cfc8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143503, "uuid": "9c22957a-9029-4927-904f-17790b11ddd1", "comment": "Malware payload", "value": "3d068c9d616f57834d56ed20ece442ae6ac1e3153ab66d514a7c7eb4d9665c30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143503, "uuid": "8bd11ef4-9dc9-4ecd-a7c1-eca54df4be32", "comment": "Malware payload", "value": "9d9dd1133670e221d896ad5a903d700b518de141", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143503, "uuid": "264181be-f1ba-4c9c-abdb-e05bceef2867", "comment": "Malware payload", "value": "a57d87fe536c14ba7ae5b9c33c12c5b49469d4393716c1f429ae378666eec1f02ebd35b8a16a9dc30c228e78f238db23", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143503, "uuid": "b95fe731-4f4e-4d22-9668-d712f56fc3d0", "value": "T19021A7D5DD0FCAB2CA2A993CECDAD69C642649243F08220B7E30380D5B5A8CC77060BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143503, "uuid": "40801f0a-8a58-4e06-a790-aae6e89b7969", "value": "24:9URSd/kduD42E097u5tst4ImFy95mSjc4mhHEDVCPyf+WqokI:9U8d/Yuk2E09tYK5PjZqyvq/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143503, "uuid": "7df6a594-394c-4a73-8c64-a734619b1f0f", "value": 1218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143503, "uuid": "5db52ec7-2f0c-4a0f-a406-8e83658e6822", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143503, "uuid": "f8453c78-07b3-4f39-a9d5-d9b35ba09096", "value": "photov_461767630759.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befa1dba-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132577, "uuid": "effd13c3-c8f9-4023-a5ac-cde57c8fb281", "comment": "Malware payload (PureRAT)", "value": "8d368ccb41293d03147c95b1411bf78a", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132577, "uuid": "4ce74837-3c82-4764-9c9d-039872195260", "comment": "Malware payload (PureRAT)", "value": "3d501a0db508d2e5513dd46acb868ac21cec75a515db58d9ba2dfe38d5eeb829", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132577, "uuid": "8ce5b802-507b-4b31-a1eb-57817a1c0ac0", "comment": "Malware payload (PureRAT)", "value": "9a195a6701b1ac726c78306add3701e047b17205", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132577, "uuid": "f589efc1-0071-4dcc-95a5-c829925aa493", "comment": "Malware payload (PureRAT)", "value": "54b519b69f1e5e3fd84f456cc294f68b8a67a86fa8a78b3ba79aefaf8fde87f62329065254598b045f04326ad71d3682", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132577, "uuid": "440970f1-4211-4110-9c10-41c5cf29b3bd", "value": "T17021A79256858861ED07C277BC024E68A2DD606C2706E56433F936F03C77D4C27A4C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132577, "uuid": "e9d5cbf4-8855-46aa-8291-d718d6543af2", "value": "24:9IFHkA41UcyY4YemEgFhb15Z5LnWmmS6h8bdWqDmDBE614dp/d:9IFHGUcyBYemEgnvZ7PE4W+mq6OLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132577, "uuid": "e920e769-97b3-4996-97dc-77ee183d3483", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132577, "uuid": "8425e648-fc32-4dfd-8c95-558aa7487174", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132577, "uuid": "48a6ceaf-baf0-453a-b498-7b20d086bf89", "value": "photov_062007669295.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a3da59-89da-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785170761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170761, "uuid": "5bb6a3ba-a807-4854-b034-83ab0e523e71", "comment": "Malware payload", "value": "ba6ec557783db47a708608af920cc9e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170761, "uuid": "288f3530-7dcd-468f-80bd-5e06d4b8ff7f", "comment": "Malware payload", "value": "3d745b502431544073c1b092516c743f4037dc6ec921d41dea5786093cb08a68", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170761, "uuid": "b3327175-4feb-4af7-bd87-40a468c1764a", "comment": "Malware payload", "value": "7aa2b81725b094a52d7e2a79c0c5ee44dbe86fa3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170761, "uuid": "31bfd47d-256f-4e37-ae2e-3a12836bafa4", "comment": "Malware payload", "value": "254718815430f138ec30ade041b09a4a2d7911a98c4722032ca1ab0e97887c56636004844657bc2b8b96bc616bca7bf1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170761, "uuid": "be3fc2b3-cfe3-4567-8261-a58e2e9acddf", "value": "T196D7333B729B713EF8296E36BD72E620953B776065078C128AF0D81CCF514711A3EB5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170761, "uuid": "78e31bb7-1e97-41e3-8eec-de0ff9f17f2b", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170761, "uuid": "1a5898ed-8b84-41d7-920c-704fdedd0bee", "value": "1572864:s4J4rMkeGF1+4bzfQLU742SC6g3uDuoGwT1rF0VlbFW:sxgkX1zfQI74tT1+lbk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785170761, "uuid": "4e04543b-22b5-443d-90c1-7daebe465895", "value": 60841096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785170761, "uuid": "0dbbe94d-cf7f-485e-a6d4-cfc4374f7a3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170761, "uuid": "c8bc2da8-deef-4a95-bbec-d26745d606c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18dbd5b-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132581, "uuid": "4cd72db5-ff69-4d65-b6d4-582105376e19", "comment": "Malware payload (PureRAT)", "value": "7cb8d3064f4df6dfba03bd758f992551", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132581, "uuid": "c242c3d2-a103-474f-aeba-0265690afecc", "comment": "Malware payload (PureRAT)", "value": "3d9ac6ff03df1e10c2022b59e1834e5a24c52c5293259aaeb82f862f8082ff2b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132581, "uuid": "bf232cb9-7d66-4314-a9fa-d3066ac92977", "comment": "Malware payload (PureRAT)", "value": "84cbc7d5945334b3a59c527ce94c00753cf9453a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132581, "uuid": "5b02a1c8-487b-47ad-a03c-08aa9a327d01", "comment": "Malware payload (PureRAT)", "value": "aea3c93ceb46e6c7920548faa13baa5178bacd181051b52a75dc50178702b443d4e211452cbc94b8ac5f56a6e24f8b03", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132581, "uuid": "54f3b467-bbde-4e71-9d61-4d34d5508764", "value": "T1B011A57992988CD1F806D837116F336A21379D980808A8EF675B74E76475F96F300450", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132581, "uuid": "90bef941-8f93-4b61-8da2-2c6607392651", "value": "24:9cQHlR+yMq07EtKbXWDLiEqimSD4R8l/5KRYCStX:9cQfMqOUKCfiEVPHNVtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132581, "uuid": "73927bb9-90c9-472a-8e63-3cb4232a1f5a", "value": 1050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132581, "uuid": "cf28d28e-42cc-4d10-a9cf-fec97e7238df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132581, "uuid": "60812aae-0c9f-405a-95d2-21f24ee50125", "value": "photov_512422260286.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfc4d50-89c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Adware.IObit)", "timestamp": 1785161108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161108, "uuid": "0627756d-805f-4910-ae17-48e4d2d541c3", "comment": "Malware payload (Adware.IObit)", "value": "068fe402eb8cdbb0fe21f972ac4a23fa", "object_relation": "md5", "Tag": [ { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161108, "uuid": "972921cd-adff-4f72-9e18-b74e6899021b", "comment": "Malware payload (Adware.IObit)", "value": "3da1a4045d67c272137310c4df4ef6dfd0fbae684ac8c0fc76b4f2e31eb8138a", "object_relation": "sha256", "Tag": [ { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161108, "uuid": "a5655f5a-c93b-438e-b775-19d3b55eb9af", "comment": "Malware payload (Adware.IObit)", "value": "c71045ed086daee981779b0bd7f63ca426040b80", "object_relation": "sha1", "Tag": [ { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161108, "uuid": "b0403519-97ae-450d-b177-1156d4cb8c63", "comment": "Malware payload (Adware.IObit)", "value": "a2d6e2bf2f77a5167b738194e15b9dce83ec929af59a0e0a83183e008b2d771978d20ec25325affb96a124fd5cb9ad16", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.IObit", "colour": "#5E7841", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161108, "uuid": "b73ab892-d9a6-4afd-ad28-cb9d2b975107", "value": "T16F872231768AC46BD56215B01B2C9AAF912CBE250B6158C7B3DC7D2F27B95C31233E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161108, "uuid": "afb0f91e-9d50-4943-9e75-9efb50a71eee", "value": "262f7b623746b414d0e9c48c1d61145e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161108, "uuid": "7f3d6dd7-ece8-4ecd-8af5-abca69863c3e", "value": "786432:FFxb8yuOgTc7wbnl6W/46HIwFVfpkYS7auPSgEVn/I88Cjag:FFxb8yuOggMlfFV+zauNI/Pjag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785161108, "uuid": "ba7c00b5-b80f-4f00-84d9-8f847c94c024", "value": 37555107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785161108, "uuid": "253f920b-efb6-4c1b-934b-9fb36619b700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161108, "uuid": "6b5853e9-410f-4638-ab2a-77f19c92aeda", "value": "068fe402eb8cdbb0fe21f972ac4a23fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca5d138-897c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785130506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130506, "uuid": "9a699825-5df7-447a-9c7f-1299966164f5", "comment": "Malware payload (RemcosRAT)", "value": "ea8f03c93bacf4f1d2afc259e2073c8f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130506, "uuid": "cf7118c8-b894-424f-8941-6da051af86f3", "comment": "Malware payload (RemcosRAT)", "value": "3dbc051e39388c63bf4b1c35cd54ccc62745464feae42cf8755d57c401ecf5ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130506, "uuid": "0c3a0a1f-9bac-4c27-afee-5b7b2c537154", "comment": "Malware payload (RemcosRAT)", "value": "936f8bac3b75e2898d06526d37dc9e68dc62f2bb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130506, "uuid": "358c7424-2a5c-4222-9f8f-cef03556a287", "comment": "Malware payload (RemcosRAT)", "value": "b62911c82456e22fdfebae65fb835d15784117b6014b8f557056d0133592852ba7bfac4eccecca868fd7fa50aba96617", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130506, "uuid": "347974cb-16ea-4fed-9543-78ee839d418e", "value": "T19D362B82429498F4E66D970CDC76F6E1C75D25030549EF1E36FA0228BF82E4B678C9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130506, "uuid": "1500a446-345c-4784-82a7-61c0e94b4553", "value": "98304:p2jcT4REiQcnmJhS260+Dep/B8DBV+LJVNxnM08cPAD/QsMdcg30eLRWx8T4g+ss:r4RhQcm2ND4/Bc7+LfnMzkAD/QVP30eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785130506, "uuid": "644f96f2-3650-450b-9c1a-550b62817013", "value": 5311591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785130506, "uuid": "5d8069a6-15ca-4a34-abdd-4ca182784d5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130506, "uuid": "f68f0d7e-68c0-4e21-b746-881f0f396fab", "value": "2026???????????,pdf.JS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a42fe8-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132674, "uuid": "50b2f481-9ce9-449d-90ff-26335cd8515f", "comment": "Malware payload (PureRAT)", "value": "b1aed4a2d8b219379972cb3293a5fbfe", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132674, "uuid": "446331fc-13d9-440f-bdee-18295d923004", "comment": "Malware payload (PureRAT)", "value": "3debdd47c84ecaa2b07e41c5db24fb9dd071bbc0db04abdffa6fb64f65f7b89c", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132674, "uuid": "ec965daf-28fe-41b6-a7d3-e6bad6eee141", "comment": "Malware payload (PureRAT)", "value": "75bd1481c9996981151c181580a8e84ce62b7541", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132674, "uuid": "99b1a458-8879-4012-b937-7b7dd7b70673", "comment": "Malware payload (PureRAT)", "value": "26181a75ff212dfcf2ad47b75ea45ef86962b26934c820f49c855b80ac8ee2d25cac6231694d1b15f5b57a93f9118b9c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132674, "uuid": "30d34e26-1fcf-4e52-9664-15c13009e04d", "value": "T10321B7BB9539D90DCA9A837135464BC9C973ECB0B1114189115C3DA6BD10FB4FB9B5B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132674, "uuid": "6a62eb33-6170-434c-b5bb-442c7b8d2384", "value": "24:9xpcPYg3VYDl0Rkfc+TlzmSynWhheY7J3qe1tbKrK:9xpcgg3VY2uPVheY7J3Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132674, "uuid": "61a235bc-0af8-427f-92f9-9c400b4e6d30", "value": 1287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132674, "uuid": "098e937a-c944-4960-b12f-6924143e35fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132674, "uuid": "36777f65-a98b-4dea-b021-67ac1995d0b1", "value": "photov_152822937441.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4d680d-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143177, "uuid": "2a430114-2161-49d1-a1b9-699565f5cabc", "comment": "Malware payload", "value": "8bf05ae203fee79d3b369ab86284f4c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143177, "uuid": "80440e18-0720-4eb2-9015-3deb1ccebb0d", "comment": "Malware payload", "value": "3ebf53b08ba2da74aa9662829c293fae86abd7891ca66cbdee1776cace77e89e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143177, "uuid": "202ad063-d872-43ae-88cd-3acfffda4946", "comment": "Malware payload", "value": "c43282f448e693d5d5d7d9649a23b49ab979d332", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143177, "uuid": "59ce368c-e14a-448c-a123-8e9177afcdfe", "comment": "Malware payload", "value": "1d336370d622cf34fd180c4df810f8dfb0682a52815bb919222f2dcdee6e54d4d516052acd27a6b69790903006aa7167", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143177, "uuid": "dbc5dc62-160e-4a16-9716-dc81cf8bcd58", "value": "T1A221B950C929136EFA01C4B767311F2A7045634504AE78F8B5D46E84757DFCC7F964D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143177, "uuid": "57b896fc-1572-4b13-b87c-03804696fc56", "value": "24:9cfcfCFDBPVhjDKjmQW/jTl9KFJYur3kwOTKmSwX24JxMlffL9fCMbwOcAX6t:9oJTum/FqYEUTKPwXNMl7jX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143177, "uuid": "8cb6998b-3f85-4504-99e8-c616c4d45baf", "value": 1165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143177, "uuid": "b3102483-88dc-45e6-bba2-90e4e0d708ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143177, "uuid": "f52e4e53-eb37-4cd3-a99e-1c5945f7b56a", "value": "photov_711408659490.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bebb96-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785135118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135118, "uuid": "1ddc30e9-a4e5-4957-b956-2d9200ec77fe", "comment": "Malware payload (Formbook)", "value": "d62739dd92c54d194150ef0638c01895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135118, "uuid": "a3af199f-3c3f-43c7-bf10-345060fa3d34", "comment": "Malware payload (Formbook)", "value": "3efec8bc14ce292b63dada6c63b890a4c9d1598e4534dcee069ad3136ff82375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135118, "uuid": "934b0d9a-7267-4772-a229-21a8457c6bb5", "comment": "Malware payload (Formbook)", "value": "7d20a39ccf699d20e2db54aaf6d712ae05af6020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135118, "uuid": "21257f41-12f2-414f-9247-ce90cd59664b", "comment": "Malware payload (Formbook)", "value": "6ed8f4f72b6a6b6d65d1d466e44a358842ba6c29f0c8027d474f9e0fb7196b83d931144fa392a9238935989aeaa4560b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135118, "uuid": "63f8fa32-4fc0-44ad-95fa-35ffad52e47d", "value": "T1E23501152257DA82E0D697B6B9B0D33432755DCFB9E2C3D28FEA5FF738283811954282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135118, "uuid": "4ac06a4d-8d2e-4867-8417-c836f6c6b138", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135118, "uuid": "65c7306f-17ca-4730-a3b6-39051a2ac2d7", "value": "24576:ZP37p50fyqzCOpJBueRgPDvTI9/jo0XORV2aMW8tSUzUtr15:ZTps3zCOpGvPDcGRh/8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135118, "uuid": "6daf59d9-f62b-413a-8ee4-55737536c1ef", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135118, "uuid": "bfa58b2c-f76b-46bf-9b4a-02da4f78392a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135118, "uuid": "ffc1d4bd-39a6-483c-9129-7cd956121b47", "value": "854f1e97-5dbb-4a87a5PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6697dba5-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180962, "uuid": "0b7b3e58-a956-457a-b342-6d5e0611f1dd", "comment": "Malware payload (Mirai)", "value": "06a0e7b8052b6f4827101f4fea7f7a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180962, "uuid": "e612cffb-6fee-43f3-8e50-2b204374fd8d", "comment": "Malware payload (Mirai)", "value": "3fc30b1df7c5fde1acb66eed7a784cceddb38c6607843343ead274e0a49d568a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180962, "uuid": "f0e3f30e-8544-4483-8116-d9ce48b22f61", "comment": "Malware payload (Mirai)", "value": "deeb9a3a38b1bfd3e5337581df16a240fe0ecac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180962, "uuid": "ae4358e7-2a82-4d25-af35-cf7725a4a8a9", "comment": "Malware payload (Mirai)", "value": "456906bb477e50fbd844311666b9f6a6e64e5711a71037a51b13310fc6045625ede78519a42c78f0b6ef4dcebfeccfa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180962, "uuid": "dfb89889-5c84-489b-8266-c1ea8936e1c1", "value": "T1E803E17022459262DB703032C9688D826ED71FFDF0FE2111079646BF9E978A5FD7C892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180962, "uuid": "5de514f3-1c6f-4bdc-a2f0-f115a70916be", "value": "768:DhbUpgfK/AwKhplB651GT8AnRTGS3DIFssAYG0kw7VF6EIlXP49q3UEL4w:DxUpgy4Fhl651u8STGST8AYG0hVF6EmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180962, "uuid": "88a9135a-2525-4c2f-82b9-0607584ac81f", "value": 38008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180962, "uuid": "a713cf05-92f1-4bee-bdd2-acbf2bce5835", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180962, "uuid": "8fc792bf-aa18-4241-82d5-92f24f3fa45c", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2f5241-8a00-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785187011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187011, "uuid": "148a27d5-58e1-4469-850e-9b1910dd4aa0", "comment": "Malware payload", "value": "f5236d7bb0342a14ab7eb986c6689d2b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187011, "uuid": "ae16ee3e-68d1-47b7-995c-cfe133f5aec7", "comment": "Malware payload", "value": "3fe19e12a6c3054ca089010c5da14867a4e7ccbd72560dcbe8cdc99f44e36f48", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187011, "uuid": "54f2d046-7374-40b6-b2e6-dbd719684836", "comment": "Malware payload", "value": "0f00fe36e2a6cbc7dc9fb11ea8e13e1a9e853534", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187011, "uuid": "ca07ac12-ccd3-4314-8de5-34444c03fefb", "comment": "Malware payload", "value": "c3dfdd43f581eecb3ce524a7411eee14e05743b09a001a78eecc95806a675f48964e64f25465ef64f0044171573ba48c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187011, "uuid": "ec3531d2-4187-46ef-a56e-80c54121c345", "value": "T1C7823B0FB8424316E1E110B4966696BFD9B9AC7633C414EBF7D44AEE1A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187011, "uuid": "bb4f4409-db45-4782-9518-7f8ad097d110", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187011, "uuid": "38c6d023-466c-4060-ac5d-5a89ef6998f8", "value": "384:AdZbmcmhzwEUaUu94gXTP+av8U9c+L4P:F5UaF9Ka0U12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785187011, "uuid": "824d8f85-8afd-4daf-8c3b-c8461829e775", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785187011, "uuid": "d1685641-a133-466c-adf9-915283e4bb1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187011, "uuid": "a158784e-f8f4-4215-992a-37f671bc1717", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ad6e91-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154382, "uuid": "f424e352-625d-4819-8637-fcfdb75be3c0", "comment": "Malware payload", "value": "3c0ab56fa6868d7dfc0fed8df5c1f6d2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154382, "uuid": "aa07f8fd-03a6-4c86-b9de-d4230dbe1ebb", "comment": "Malware payload", "value": "4023488492800c228db387272548e8036f08b347e927d6a1533413d4f41b9ee2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154382, "uuid": "cb81191c-0265-4491-a472-ff24d4904c46", "comment": "Malware payload", "value": "edd1cb34a6814dbc4e40435ca60fde3987532541", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154382, "uuid": "a69cb10c-d37e-4381-86b7-d1b313c20377", "comment": "Malware payload", "value": "36b2975871b80e5403b7e0ef38836a99903eff90df8cf056ad332109d2c208c8674af6ac4080085c9646259b33889136", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154382, "uuid": "acf1dc44-8adf-4ba5-8836-654c1adf7890", "value": "T10621BA70D11C7B02D256077450967D402F372E7A1344D7A6A37F50D5BBAE3604758996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154382, "uuid": "cd522a71-d9e7-4f2e-913f-b3c0832d2ff2", "value": "24:97ZDKJeW6oE9WjA7yOcKgTlYRg6I2US0XWLmSafq0FWyXtKEZG64mX:99mENoEQM7yMgkv/cWLP4qXOMMGLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154382, "uuid": "8fbd2918-93e1-4646-ad44-424e4665b332", "value": 1283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154382, "uuid": "a90f7a28-14fb-434e-959c-a32c6e4c2f50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154382, "uuid": "4cf64858-bbaf-4bc2-acbd-3fe03bbb6c14", "value": "photov_815344310912.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb2cb1b-89f9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785184111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785184111, "uuid": "63d273c7-b673-44df-a2b9-7adc5378a7a7", "comment": "Malware payload (Phorpiex)", "value": "00dee4b7bc493f6c89e9e5dc9467f892", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785184111, "uuid": "d09febd9-721e-4e29-9b39-9f3de99fe17f", "comment": "Malware payload (Phorpiex)", "value": "405904c8a9ec04b73ac95b7e43a4c9c567b526d178257b56e4a8d812f478ddc3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785184111, "uuid": "f95997ca-1dc3-41c1-991b-75c433bab127", "comment": "Malware payload (Phorpiex)", "value": "449e042db9b793c224bb1fbdf024e3ba8adde226", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785184111, "uuid": "ffbc6298-a0b5-406f-980a-35d78dda10fd", "comment": "Malware payload (Phorpiex)", "value": "7d5439868670c043ca2ddd962318aa0b18ef935695ba8f36d55ae176f049eb3ce076da15f99132385c60f81b784ef983", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785184111, "uuid": "f605a6eb-2fe4-4086-8173-fbfbd48dc638", "value": "T15B823B0FB8424316E1E110B4967596BBD9B9AC7637C414EBFBD44AEE0A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785184111, "uuid": "6c8c9e7f-a1d0-47cb-9655-cb5cb21ce385", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785184111, "uuid": "bcd45fdf-a2c3-4989-bcd0-c697942a6d1e", "value": "384:ApZbmcmhzwEUaUu94gXTP+av8U9c+F4P:x5UaF9Ka0U1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785184111, "uuid": "167bcc83-2c65-40ca-95d2-fc6a6b55051f", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785184111, "uuid": "a81c69ca-8f39-4c1f-9bf8-d3abb1524a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785184111, "uuid": "965ea39b-a8dd-4527-b40b-f89107f56186", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bca8763-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785156435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156435, "uuid": "c53db652-5827-43ea-b466-f6e970fa6b50", "comment": "Malware payload", "value": "9ff4a9b1bb868cb5c8a3e9449cc8594a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156435, "uuid": "4f48b7f2-66b7-4705-a6c6-8e4c20ab498c", "comment": "Malware payload", "value": "413bccbb24fa7a2cc9b72c9f600a5ab4d0bb96deb537e7c8a5830dfeac7db759", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156435, "uuid": "6b27b757-cdf0-4d7e-901b-0ec2894ccd04", "comment": "Malware payload", "value": "0da125eec825ae1a19b05900342e8f82e9d5826e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156435, "uuid": "d883f1f0-fe61-4075-a3a2-ca5f2fb43b37", "comment": "Malware payload", "value": "c9ea0eca97f3208c9737abcb3ca1dafe5e555d73c729086fd037d800f3f629139a37d091c16b6648a1a24dfb5dbadf26", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156435, "uuid": "b76aacbb-4e37-4561-b427-0cb93d449897", "value": "T14F33B5496E328FEDF76C833047B38B32A65923D636E1D684E25CE5006F6034E555FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156435, "uuid": "1a217782-cbd0-4692-a0e2-e6b9b466deb2", "value": "768:aVWTQ261NeVaaLVZAodbHkC+nQANlC9jdGsHpfyHl0cxoiOxk:aVW02ONqaaLTA6w9nQGC9gS20di7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156435, "uuid": "6a54d2e6-9e68-438e-871f-52dcdfc6acdb", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156435, "uuid": "a9a7761a-545a-4ef1-b38c-8779aa407178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156435, "uuid": "64fb929b-6e19-4977-a448-db086c2fdd3c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c373c9d-89fc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785185320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185320, "uuid": "f3715745-098b-474c-99ad-0e2f21b99aba", "comment": "Malware payload", "value": "9ed39d4187f83ab46780543e7cb9b964", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185320, "uuid": "9fc5b464-1e37-41ab-914b-2afdfd5ba1eb", "comment": "Malware payload", "value": "41d4cb022a1e382d26b6361562d75d4d8a03150a8d089c3dccae6b4b6c1061e3", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185320, "uuid": "d735d8d9-0f3c-4f66-9d79-7b54c9839ad2", "comment": "Malware payload", "value": "af69d56bbbefdc9b46b34178e9ee9a09689a9693", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185320, "uuid": "84b971db-b808-4284-8254-43d46d1ae2d6", "comment": "Malware payload", "value": "a238eb5dad35ecebbea63d5fa7d1885e97db7dca35f0838feb4365c67f9a0866cac15706a4f778e62950da15183739bc", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "BB2.file", "colour": "#618127", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185320, "uuid": "22f3fd95-63c3-48c7-b381-56b3a13feb0e", "value": "T12C469EA9A6BC00D9E86AC1BCC2865227E772B41553B057CF5A648AF60F63BD01F7F740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185320, "uuid": "b800d891-8d38-4318-9687-f404fa8f5a68", "value": "3a19e190a452ebfefeb6537a827838a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185320, "uuid": "25466d31-ec49-4acb-8887-d14aa3960965", "value": "49152:4VwASOuGtlqgXPSI3YAicNzYekvruCGxU0SOGRnUYGhLCRKCiNHABrFb1kFnpCR7:63vN0sxzKZPBUCRut3et0ceswz+ndaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785185320, "uuid": "bc2fdc19-aeb9-4a21-99d7-f618bb1ea929", "value": 5418496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785185320, "uuid": "4075222c-ca97-446e-b82f-778da080af61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185320, "uuid": "63eefa5d-2857-4117-a18e-186fdc829436", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae8cfcf-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132651, "uuid": "5cc61c8c-e673-485a-8a9e-3c51716edf24", "comment": "Malware payload (PureRAT)", "value": "ad4a780b03798952035137306e48d5a9", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132651, "uuid": "a978e898-62f5-4f46-a888-0f75cd767a5f", "comment": "Malware payload (PureRAT)", "value": "41ff02a13f17fb28f4efd444df660ab079873c9fc90b95a57a3526fd057f1130", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132651, "uuid": "ab5ea33c-6201-48bb-80cc-2578e5d873ac", "comment": "Malware payload (PureRAT)", "value": "d9a5fbff8275823997998605d74fd783d5a5c132", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132651, "uuid": "f48b53b9-ed34-4c56-b00f-a3a8c0552dcf", "comment": "Malware payload (PureRAT)", "value": "6733c76855f6ea9455197b74779e073a623eb1874295cf99ca080d0e22f8a291b1044f6058c96463fe4874a676cc7320", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132651, "uuid": "cb5e1db0-5fe0-4652-8c65-a7d2cd51d6f0", "value": "T16321A5299D11CB20F829C0F34CA3D970E276EB0F824461BBA2A41C287CBD96D3352089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132651, "uuid": "16aed987-48ae-45dc-a3c5-c6c27d6bc89e", "value": "24:9cEM4VIBoNAG5BLl2/SA7IGmSjbpWqLR6caYhwAaGOw:9cpo+6B+5XPpWGR46SGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132651, "uuid": "8235ac51-b892-40a4-84a3-58110b2d3eab", "value": 1322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132651, "uuid": "3ea423ed-afa3-42be-95f2-828e2e718c83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132651, "uuid": "2086c7af-0352-405f-ae48-6cf918d6e99d", "value": "photov_110491754455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc6c05f-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154238, "uuid": "efea6ee6-3b2d-405f-9183-de94c4538b54", "comment": "Malware payload", "value": "0a21125e5d8fd1c3711767f667914711", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154238, "uuid": "66a5f1be-c81b-4103-a8f8-0926b8764bf4", "comment": "Malware payload", "value": "42c47ea407dc3c6e5f9b0daccc3c493e6a14fb65f9d4040e76884e4e64d052fd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154238, "uuid": "52d0b344-0d14-4386-bba1-d6a03d847df4", "comment": "Malware payload", "value": "d5b788cf8883dd4ea7335d2888dbbea05cd726e4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154238, "uuid": "05829dae-9c9d-4362-8855-8d39a2a6716c", "comment": "Malware payload", "value": "5cd2153a8c10ac8cdaca6ff121657a98687c9fe10e6262e541cc483399ac4720b3cf2a9e13e388f1662152dfc57ed158", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154238, "uuid": "b109c8f2-2db0-498b-ae63-c510f9748d4a", "value": "T16911728CDBBE5626FC37C23139C8A2969A31B8D8536513133338A0EB1CA04D8D788F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154238, "uuid": "5396cf69-3d1e-48d9-9cf7-4a6510dc463d", "value": "24:9DiTD0Rlb/TB1Av7y/7mSfaoJlLuSQli3uD3Ni:9KalnA07PDXHQE+7Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154238, "uuid": "42846904-f785-4979-abd9-0b80e8413935", "value": 1062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154238, "uuid": "424d5978-dbc0-4766-b0c0-c09816a653af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154238, "uuid": "13b73401-3fd3-453d-be91-195b416ae405", "value": "photov_757156596810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382885f7-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132780, "uuid": "ad67295b-6c61-4e43-96fc-5f15f7303f93", "comment": "Malware payload (PureRAT)", "value": "3ae5f003a47bf8f38ed5ef0c8830d129", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132780, "uuid": "7928b24b-9fd2-4075-9450-d88710e49871", "comment": "Malware payload (PureRAT)", "value": "452d3086d68d0d58ac69f50d1fca990cc09d677ed078898502c31e69afe4cc47", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132780, "uuid": "4d7a761c-df36-48cd-b1cc-bf85700fa490", "comment": "Malware payload (PureRAT)", "value": "549a3cda02a6578951405508de418295eecc7b0d", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132780, "uuid": "048bde30-4f45-4724-b37d-9562dba24d3d", "comment": "Malware payload (PureRAT)", "value": "00bb894352916f0ee2c2c31e8c99b8c369efad8111fe8461f6bea2d0a5bb1cb43df1de70a8a1817aefb482333d063315", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132780, "uuid": "38eea312-0c97-4bf7-9336-e03d012a16df", "value": "T1EF11860460AA8610CD0F8E33F95A26A6543F235893015517FB5875FB1512DC4BF46A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132780, "uuid": "ab9e3c07-f925-41e3-9bc0-53dcb1cf263b", "value": "24:9LxKwALPqp/czQ1i9KK8G/K4ZOS+8RpQdmUMrSlenHSI1WYt:9MqwQY9v8h4ZJ+gmoOQnys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132780, "uuid": "035076ea-507d-4315-a1ea-634614b099d6", "value": 1093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132780, "uuid": "f2dae074-1c23-4d07-a96e-3f0d3a6467dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132780, "uuid": "b8c7970b-8dcf-4eb9-b945-072ddcb924ae", "value": "photov_399399323489.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5779dad7-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143570, "uuid": "b3e6f8d5-230a-4934-8d39-31c9f7099304", "comment": "Malware payload", "value": "0f780eb6e67f2acbfaee3c5693ef910d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143570, "uuid": "c22397a6-6dcf-49aa-b897-d077a1673fcd", "comment": "Malware payload", "value": "4598791d57616e612bde1395983c7f8e26b0fdef729e31ec0afc5d566c2f5874", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143570, "uuid": "5525789b-ee9d-4770-88c4-ece2dbedf139", "comment": "Malware payload", "value": "2cdd7b603fd8ed1adf9c5f5b07c0ca7ec9278a14", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143570, "uuid": "a695293c-1e9e-44ee-906e-cc8b5054b7ef", "comment": "Malware payload", "value": "06a4208f8108b7119ec0800c1996ad7dddfef9dc7cd8c9967812301021f9810edd3bb7e958f34de9a45ce836942351ac", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143570, "uuid": "68681fcf-da90-454a-a226-b58aaf4a7f15", "value": "T1ED11A5E8184AADA2ED8355327CE27F22A2365E50063163D93B5E529B2F3BC095352489", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143570, "uuid": "073a4690-73c1-49fd-b0d7-71d8fa4ff2cf", "value": "24:9Lh1CeVZLTKcPFeAfSnxGwx6XxpZTUH2XtScykmSPel4JZ7w+dhCDCQXtFvcIVl:9/LTbPIgicLUH2Xw1kPrloXzv3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143570, "uuid": "10524013-ecf6-456b-baff-65c5ee575286", "value": 1052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143570, "uuid": "fcb15aea-75e5-404f-bf07-325d354d6506", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143570, "uuid": "ace15042-9ea3-4411-9038-2787e570b814", "value": "photov_343841063005.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885f4808-89da-11f1-bd95-42010a9c0009", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1785170710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170710, "uuid": "1c3786ed-2d3e-4011-9b95-80151ab2af10", "comment": "Malware payload (Socks5Systemz)", "value": "c04a9778333a061ce8b2f3fee16d8cbb", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170710, "uuid": "cf070287-40b4-4549-a1d7-ba2be3579b17", "comment": "Malware payload (Socks5Systemz)", "value": "45f16a66c72637fc6b473f23896e73b7a8a3e88d564ab1541a7ee39a5b41e441", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170710, "uuid": "061ac102-4dfd-47f8-9379-284b593b4473", "comment": "Malware payload (Socks5Systemz)", "value": "357aec6973f9593ed518771d638f589d860565b5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170710, "uuid": "3f052a53-2f70-4f4f-9e78-97de1e1a1766", "comment": "Malware payload (Socks5Systemz)", "value": "237bfb2fb540b0b60be5564a5aa5f03544a57f61471b4f48fd0486459a5cce9b7e14e985090e1f45ef08292891abcc85", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170710, "uuid": "f210437b-bda0-4930-9c86-ba219cce285d", "value": "T1E3163334F5E339F4D0D086B459A0A50C6F53A9771D3C506E33CE97A86B22484E5BA3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170710, "uuid": "90dd6b40-0392-4d12-a361-9ddd45da0183", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170710, "uuid": "d1cb98d4-084c-43d0-917b-9766de919c13", "value": "98304:IeHogiVI36frK8OVKlQz+QelVmWK7QUHzqz3IeL5+wCqV+SNo:hIrVI36fse56WKQWm5tN+Yo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785170710, "uuid": "83381fea-2559-4d7d-8e4b-c0c4c2119488", "value": 4284933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785170710, "uuid": "b6785402-b6ee-42a3-9df3-9541b7b57399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170710, "uuid": "1afc68ec-769c-4f95-90a5-574610960ad4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5234bc8-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181067, "uuid": "75d9701a-6d57-4cb5-93c3-ab9ed563291e", "comment": "Malware payload (Mirai)", "value": "4ffe833afb86e0a705539d8f1a7ee9c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181067, "uuid": "7cdbbd8f-9580-4593-806d-6d6315ad62e8", "comment": "Malware payload (Mirai)", "value": "4605e809be293537ef4f2aeb8f181ebd840b450dccc69507ea918a3918a6cd42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181067, "uuid": "a3e1af96-5a2b-4f69-b4e2-187da0d2fdee", "comment": "Malware payload (Mirai)", "value": "50ae25e7862660f28ca787e5f9ed3e5f17daade1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181067, "uuid": "9422d268-0f5e-461d-80e1-e0459c0d0aab", "comment": "Malware payload (Mirai)", "value": "6cc710d95b1ee4559e1c76a4adba4184d8f20e51390970d5622eec58c9b84ca4f9979cf1ed12014aec5b24dffbdb1f4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181067, "uuid": "be03fceb-6cf3-43a8-a523-6b098f926e39", "value": "T10CE32B46E7814B13C0D6177ABADF42453323A764D3EB73059928AFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181067, "uuid": "f62bec2e-f0c7-44e8-80d4-aec0dadabd41", "value": "3072:U+UgFG8B0UMai0U456g/2lHhXRHM9h/P+keLUM/9gSh6VF:U+UL8BLMai0U456llJRs9lP+ZgM/9JMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181067, "uuid": "391f4730-7886-4a84-8863-beb360ebe304", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181067, "uuid": "bfb476f3-59ce-4b7e-9c33-98d010d2069d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181067, "uuid": "4daa444d-2dfe-464f-810a-6874cf1e0dd7", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74915c2b-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143619, "uuid": "04884a18-ce53-47e5-bc90-b3a710eb8215", "comment": "Malware payload", "value": "54690ab040a23434a2644d03baf2c209", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143619, "uuid": "d5b5a626-7205-480b-8d0e-6a5f84f7a5fa", "comment": "Malware payload", "value": "4651f6fd78cb8dce882e6a480f90bc3d4d7f9fb0954934595d376ca640010c95", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143619, "uuid": "4f490466-459e-46b6-a629-36b22dea404c", "comment": "Malware payload", "value": "b20009a07d9e33eb509581d652c40d57c23d2f2d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143619, "uuid": "de3668af-4f14-4ab9-9ef6-1f83dfe0e837", "comment": "Malware payload", "value": "c85c9eefe97f22a58e573d31dda79dcc6659edce5f3f99081c4ad091248f8e3e98c44f32336f237b6f40186f26022962", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143619, "uuid": "40afac82-da10-46b1-9291-470c48dfcf67", "value": "T13711B9B454E29989CE0BE07F3BFF4A053710A6A76610615A1BCD7BB5FC8EC48E3C6040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143619, "uuid": "8b129481-9e1c-4028-8cc8-d909e8eb0970", "value": "24:9knh3kYWCh2D7ZnZAAy0v3DHpwCD3F0kjImSsJJxmEWL3mjkAg:9kh0l42D7hes3Nw23F0kjIP+QLWj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143619, "uuid": "5746be20-e5fc-4c83-8dd4-b2b615962635", "value": 1109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143619, "uuid": "f13dbc04-df82-44e6-9e9f-248be9ffa5ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143619, "uuid": "51005690-912d-4dfe-a6c3-2508b61f80d2", "value": "photov_434468963769.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2940d37f-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167544, "uuid": "9e7f82e9-4097-4dcb-879f-57ec32c15947", "comment": "Malware payload", "value": "143f3087236f0e6aa0527063b35acdb4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167544, "uuid": "c6f14565-8b4b-4759-b7db-97621f66b479", "comment": "Malware payload", "value": "472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167544, "uuid": "010a4b6b-0d3d-4f1d-b5c5-db75bdb0ff54", "comment": "Malware payload", "value": "516fe79b38b0aca0ab500a0571792f2d99d72682", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167544, "uuid": "b1a4f738-bc34-46a8-9c1f-8bc1421a28e2", "comment": "Malware payload", "value": "15617fa13f857c6f97fe5df7e551daaee753d17342bd953cc694e200de3b8f4f50ce1c46bfac675b292ddd32bf66b286", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167544, "uuid": "648e5420-b64d-40b9-9cb9-c8f09156e58e", "value": "T18531609B01140A755313DECE73A3319CB11C92FBA88BC791DD8C0EAD868868CB171FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167544, "uuid": "77974e43-0e4d-46ed-b5f5-f8665be8191e", "value": "12:Ur46rQlr46V54xzx6zcIFMSjjK6KxVycZDM60fe26eJ9WDzDBCi6BCXDqXI6XYdN:TxEIvUvbEbW1DOnwXD+ffT2DNCT+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167544, "uuid": "e682c4e6-bfaf-48b6-908f-4299bffa7d1e", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167544, "uuid": "2bb6612f-7954-4e6a-8a91-37a5d56ff1fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167544, "uuid": "df3ea362-7d7a-4087-8732-b360f5fe00da", "value": "472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26481472-89d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785166251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166251, "uuid": "a18cb29e-c612-401d-969c-e68665ce5bfa", "comment": "Malware payload (Vidar)", "value": "ee9b4e39dc11f3d69fcaa4cadb4d5877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166251, "uuid": "5ae37211-b79f-460b-9fc6-65ebe938c5ca", "comment": "Malware payload (Vidar)", "value": "47619d7345812a0d9238054398fb88bc1679562a7421c1b59927fa67768df03a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166251, "uuid": "3c038313-4e7d-4c74-b459-ef9ba3f30663", "comment": "Malware payload (Vidar)", "value": "de7058158b7d66c52628a644de65948e95319409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166251, "uuid": "b44ba7d8-3f38-47d7-8f3a-4b1e16d86332", "comment": "Malware payload (Vidar)", "value": "6d505ec54c9bbba43219856c349180edbfbf338c64548ad9ababab4807a3cdbd764988605ece3a0aaa332e47268aba09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166251, "uuid": "76a80dd2-0433-4775-a8a3-8bc6a13740b9", "value": "T1DC067C07ACA148F6C599A23189B39542B736BC490B3537E72F60BB783E727C09D3A754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166251, "uuid": "8a524684-d1f7-43bc-803d-1617de10b349", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166251, "uuid": "cca8f8c0-ddc1-4820-80cc-fd465f788335", "value": "49152:/gKAMQbvPKXreAAi9KHYZ3GebHT43pmuEqLKAHM08jx5Z+cCk8nozL:/n/UsGmuEaKAHM08jTZ+cT8nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785166251, "uuid": "dbdcddfd-844a-4756-8253-1ca52599ce06", "value": 3776872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785166251, "uuid": "7219fe79-04ec-4027-94ca-0bbc4daf2c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166251, "uuid": "9e232337-1eab-4dcd-9d1f-5ebc1c99b4d0", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d03d21e-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143606, "uuid": "aa15b042-0ce0-4487-99f6-0c13ecb0434b", "comment": "Malware payload", "value": "984438987a9a84da25fcc5b477cdb3e0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143606, "uuid": "fe03589b-ad42-49f1-afc9-177a89911611", "comment": "Malware payload", "value": "47cae4804d625e4bfd1c502970162826443f153c20d60f158610cb8ae52aa712", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143606, "uuid": "0b032ac8-058c-44fc-8f24-d8022b6ef7a4", "comment": "Malware payload", "value": "e99b769a7a1dfd49232dbc469e5ca714223c324b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143606, "uuid": "a40e1d1e-8aad-4b9a-899e-3ee10484898b", "comment": "Malware payload", "value": "f63263730e07bbe10484c29162c072e8054d2baa4c3bb6197af1a3e55b1c3f0da002e79f7e446d37329151558ff49171", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143606, "uuid": "46ecec1a-796e-426e-a51d-300aa762e1f0", "value": "T19421CD469083C00CDC4D8D726DBAC501B3343E5975D6F34B4DD435E6B498BCC9F04484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143606, "uuid": "57f43cdf-16ba-41bd-8e65-7e513761d96f", "value": "24:9vO6dp09008RF3GM1ILiSoGeuQ+f4mS3yxMrS7Q6yetQfd:9gOF3GCSKP9O7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143606, "uuid": "2b76941f-eee2-4cc7-a1bd-b9eb68e833a5", "value": 1202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143606, "uuid": "3923810a-e997-45fa-a614-eabb0737a353", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143606, "uuid": "d8161512-00bf-47d3-9952-340e57023caa", "value": "photov_142177907826.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08268d90-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132700, "uuid": "59f2d6df-86e0-4902-a68d-536462cb669e", "comment": "Malware payload (PureRAT)", "value": "ba0e6b2803470a769a0fbbcef4e0902e", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132700, "uuid": "5c0af400-724d-4ab9-96c1-e65653216fde", "comment": "Malware payload (PureRAT)", "value": "48a34014da3a472c643e06a8036d5e7daf3ed1a89b4f23a6570a5ba8eddcc337", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132700, "uuid": "bfd4a1b1-88e9-4366-a7a2-5272818780db", "comment": "Malware payload (PureRAT)", "value": "a5f9ab3ef7a293440d572782c1753f60e28ed8ca", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132700, "uuid": "7e5bfb28-04ce-420e-b26d-aba92e1823af", "comment": "Malware payload (PureRAT)", "value": "9188e1d056a2a569c26f42b998dbe8bef7701aa54aaa9ae55e23215b59d10a2b20f6063bf7734ad7e39b1a399b50325f", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132700, "uuid": "7457ad2e-62ba-4272-81b9-f9dae3158a37", "value": "T1D021CAD0F6554C02E58C933BB602DD4C255DD23A944ADEA7C30D32B66D53E683E0BAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132700, "uuid": "13ed3cf9-355d-43b7-9476-6447b7c464af", "value": "24:99z3mAICd5bOazxZpKlONbqTV+sTUSeBciNqL8PhgBT+mSGphDY7gojzCBgApTbX:913D1L1bqTgsYBuiQwgcPGnDY7gonGPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132700, "uuid": "9b6cea62-7d7c-4d23-8a4a-600fea8e488e", "value": 1211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132700, "uuid": "78f19bac-d4f6-40ac-97e7-511547064d01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132700, "uuid": "edd672f1-6e5c-439f-a557-5aba99e4f613", "value": "photov_772758764440.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8180e0d-89b8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785156295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156295, "uuid": "71c3db01-f512-4927-89b7-a86c6ed052f9", "comment": "Malware payload", "value": "85f64589d8aaaf914c6c38837e3a1f6b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156295, "uuid": "3f1dfa4a-03c4-4f7a-ba1e-6d155c783287", "comment": "Malware payload", "value": "48e421597ab357fae3b48ba01910dcabb5ff07e4b1a0412b861b9a47895c4d59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156295, "uuid": "a70e7dac-3df9-4a53-be9f-98da4de7bbc9", "comment": "Malware payload", "value": "b1c52aeafff2df9e4412118f9e09a8187ffd47b0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156295, "uuid": "771513f5-9ae0-4207-a6fb-f9dc24ff022c", "comment": "Malware payload", "value": "aaf7248f49907bc48e91f99381247de9d27d8d64e2e241b6208ce5bb033c94f14af2d64b37bcc24f38a22f068b390e24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156295, "uuid": "f685be79-2dc9-425b-85b9-31eafc352907", "value": "T14C010AC531903EB2EC489F08FBB605586087AED9ABCF07E458CB5F149D9D600F953D08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156295, "uuid": "9dbe1aef-0a5c-40bd-aebd-9028ada4c203", "value": "12:ECinw00BDzcyjeyZCaBQy2rEffL3OTpH8FZd:CcxzVBkES0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156295, "uuid": "a938c111-909a-45d8-8ae6-6329486f2350", "value": 847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156295, "uuid": "bc928a7c-e7d6-4c8a-abf9-06d07c4510ef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156295, "uuid": "c7d8bd39-b377-41bd-b3c9-239cddbb5a5b", "value": "peak.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba040b5f-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132998, "uuid": "83f2d46c-98ca-475e-960f-6bf2762c121f", "comment": "Malware payload (PureRAT)", "value": "95d1a4e8e7bb8e04a21d6576376a3b38", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132998, "uuid": "aaac681a-3830-4b10-a894-1486d060b5cc", "comment": "Malware payload (PureRAT)", "value": "496201127e12ad5f22beb46a05622914f8756d93ec74c98e7e652868f62f46d5", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132998, "uuid": "6454e408-0cd4-406a-bb1f-3c943d170e5c", "comment": "Malware payload (PureRAT)", "value": "00d48537a87f653b1e014f62db913ba12fae9d23", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132998, "uuid": "6b12b971-98c2-4983-8442-4840e9f421b3", "comment": "Malware payload (PureRAT)", "value": "7764b4f883658035384bef39810b2a89722db3e5d57b05ad1750e19f07696b74a67a900fed05bddb43649efdd75fef11", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132998, "uuid": "27952cd2-3703-4307-a5d1-99fb0944f1e6", "value": "T1CA2184D5C76C7039CE0B8E323A3195D1321D86F1985182DD52AA2BE03FA9B982B54D99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132998, "uuid": "4e950e49-ce91-4629-82fe-1f3486bb9464", "value": "24:9AFYtTYVMGWfS5MNk7rx2bnQhrHYgFmSRY4+HQcZEBGM5:9J1YVDWfKHiQN4gFPRYtpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132998, "uuid": "f5bc4fd2-bb67-436a-b258-94bcb3b873e5", "value": 1260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132998, "uuid": "1e85f838-326d-462b-922f-cdd669c4fe57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132998, "uuid": "d6097c22-1e4f-4b04-bec9-80c8c1bdf14e", "value": "photov_724368231120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f27cb58-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133141, "uuid": "cf3269d5-1a6c-48c9-b60a-a86e2461850b", "comment": "Malware payload (PureRAT)", "value": "fb8751301e46f56481aa68976cb0773a", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133141, "uuid": "45451430-2b5a-495d-a1c9-b2132b462f6f", "comment": "Malware payload (PureRAT)", "value": "4a14bb16ca3fff54a62affe01069772b1abde8722308ee9d07c0df6e85a43c6e", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133141, "uuid": "fa6dcf41-1a74-4de0-9dc2-cd18900e23cb", "comment": "Malware payload (PureRAT)", "value": "55d6ff88945b58510d7772cf66f358e541548c48", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133141, "uuid": "8375cf5a-6275-4c2c-94e3-5d12a5873284", "comment": "Malware payload (PureRAT)", "value": "3435714f588e69e6619eadadb5b69dbfecd81215ca3052ae4fdd7ad217d049e626a033cfd9743fe045ebc617f212b741", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133141, "uuid": "b4c8eb72-93d4-4bbe-b056-ffe864f50444", "value": "T16521E7DADB848460EC0703FE2D1ABEAEB0319B3C644681166B5567AC3D97F1D3B86170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133141, "uuid": "d6cfed60-6587-4a76-a527-0c7872b9524b", "value": "24:9cdDvwMgzHE7AQDsLssy1KwPnKjsOiAH+mS1bdWq4ODciDX:9cB1grE7A4s5y1Kw/KjsOjePjWVOgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133141, "uuid": "3d1463fb-2993-4976-8ec7-d6b03808f13c", "value": 1283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133141, "uuid": "eba7c5fc-1cd5-442f-90e3-688bb8335fdf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133141, "uuid": "94576d24-e560-41d5-93b1-c536f1803d97", "value": "photov_726532253506.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c86213-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132691, "uuid": "315a647d-a6fd-45f0-b08e-f2f9ce7cc5c2", "comment": "Malware payload (PureRAT)", "value": "295a727bb11648153680ab80fbf1eccf", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132691, "uuid": "42a50347-63fe-446f-95a0-9b86667604a7", "comment": "Malware payload (PureRAT)", "value": "4a21cbcd057bfbdc797aadc72a13b329a17cb9ef2831493017c643f5ade4fdf4", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132691, "uuid": "6dcd5860-5cc0-40bf-94f1-3b811afe638b", "comment": "Malware payload (PureRAT)", "value": "4b6abb6f1b9b39d5fd5850e3312506f7dd253cbc", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132691, "uuid": "f4995678-6432-4a18-afda-01e50a7b9b0c", "comment": "Malware payload (PureRAT)", "value": "0f73f86b5beb78b20ef3008ad8b90eb7d3ad70e4c89b8533532da9f6692d00bb736e326e0c56712761ab760d00d3bbeb", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132691, "uuid": "db240ba9-5674-42ec-ad40-9b6105e7d542", "value": "T16C1179E694868DC6CF09CD727592A18A5134765086111076575577D2AF33C4CF345CB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132691, "uuid": "35f4a504-0651-4e4f-ba95-6662230ca614", "value": "24:9eGw7GHr+FCgKbmLvTTs/G5D53mPmSyXJJxwcL5bt4Btn:9eGw7ybmLrz2PPGvLpSBtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132691, "uuid": "c4d8b06e-cf7d-4319-ad85-22df0edff009", "value": 1105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132691, "uuid": "06c26e5c-cb10-44d1-820c-d04ba1149491", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132691, "uuid": "a2902ce5-717e-4cf9-a255-6151d3666767", "value": "photov_702577130689.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65d6462-89d9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785170439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170439, "uuid": "4cc137c1-c6df-43be-a0f8-386194b85f36", "comment": "Malware payload (Mirai)", "value": "5240d5c601906582a96468d27b3b6f14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170439, "uuid": "e38ac7a9-c4c1-43f5-bb64-0f8078fd029e", "comment": "Malware payload (Mirai)", "value": "4a9665680fe3a301eb6d2a0f63a3e4e7e656bb44380450cc24e0162fa5915211", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170439, "uuid": "c30fea57-83db-426e-b382-57d4e1784930", "comment": "Malware payload (Mirai)", "value": "9daaaa1a7216add77a52aac77ffca2bfb810e482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170439, "uuid": "022e71a4-743b-45b8-9a1a-94bbfd5f3b8b", "comment": "Malware payload (Mirai)", "value": "a429a3b08ae56bc01ef60df911daca5da02de27f609baf206079abc771b2cb95137fc56214f42201b69f5914d9f98292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170439, "uuid": "bcc18b2e-f54c-45c8-8f38-e19dee513c01", "value": "T1EBC312DA905B8B78CE4AC07E271871C6DE967ABBC73AC32B022135BD3DC5C965613523", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170439, "uuid": "f7b89d0d-f810-48da-9fa6-bf6afd438e4e", "value": "3072:HkHGaKri/9fKF9OeZUV9/jgcT5offv7FdlFGlTmd:Hk3/dK7MccifQyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785170439, "uuid": "6a8aca39-4336-4ef7-a3f9-af4525d10c17", "value": 127988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785170439, "uuid": "bc57bb4f-f708-4982-bc0f-6f6d0a29737e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170439, "uuid": "73b9745d-868e-401d-8e8b-10d1b92eb7bf", "value": "4a9665680fe3a301eb6d2a0f63a3e4e7e656bb44380450cc24e0162fa5915211.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f4797f-8993-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785140111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140111, "uuid": "b2382bb3-6a78-4781-96f2-b9785967483a", "comment": "Malware payload", "value": "5397d935f89da936fe739139a99c7b47", "object_relation": "md5", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140111, "uuid": "75d35f19-98fc-44f7-ba87-3770207b7c73", "comment": "Malware payload", "value": "4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9", "object_relation": "sha256", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140111, "uuid": "ffe6d3df-7d78-4ed2-9ae4-8c3e82193399", "comment": "Malware payload", "value": "27adcb8fc4c6685c35819569895a8afac75f1b1d", "object_relation": "sha1", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140111, "uuid": "52067737-62fe-486b-8bb2-7bd9383cf209", "comment": "Malware payload", "value": "be04c5e2e84be27f81c883e499566f592d8ff3e69236ea17c89347376d6c8f817d3e5bae65891b5947f977a8e11887b1", "object_relation": "sha3-384", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Donut", "colour": "#D418E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140111, "uuid": "1f8d5f82-0e1f-407a-bb15-063c6f528ac7", "value": "T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140111, "uuid": "047623f7-765b-4d95-9773-ab00c1dddb50", "value": "8c28c1d8d4f05a3acc2fa65d54252437", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140111, "uuid": "323b16b0-abe6-43b5-bd3a-9ce8706e90ef", "value": "12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785140111, "uuid": "d770d7a4-640b-42cc-9ca0-be94e9d8bc1f", "value": 1127424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785140111, "uuid": "47f4d222-2f25-45cd-a1a4-70bd20367976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140111, "uuid": "f64bdceb-4043-4844-ba39-8c94ba2533b3", "value": "4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9.LoaderInsightAgency", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9cd379-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167552, "uuid": "636f0da7-d690-4f3c-9de6-38d8b263ae7a", "comment": "Malware payload", "value": "fecf8a53ca8292ab5f592dd8201ada5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167552, "uuid": "7c734e99-f03a-41ed-8977-0676d1115c3a", "comment": "Malware payload", "value": "4b4e7fdfce62e8b23aa9a236143e90092e17ece819b3d7e4529555000abd72ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167552, "uuid": "a33c2655-5d29-4bfa-8778-33ab981785f8", "comment": "Malware payload", "value": "aaeddf44481ada2b78806009541c1fea56747ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167552, "uuid": "88c4de72-3f5d-4aed-80b7-bb267395c83f", "comment": "Malware payload", "value": "201bbbcbd2151baf3c1f5f9643a6e3616690684fa01fec7c37d22c4675e2c8b83af7269418a90056dc51c9ea3d385e40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167552, "uuid": "d1ba0a06-80dd-4bc5-a6dd-bfd4b2596703", "value": "T1EF564A47EC9454E9C0AED231C9669153BB717C696F3123D32BA0F2382F72BD06AB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167552, "uuid": "483834e9-831e-4286-b49f-593e0993fb45", "value": "49152:1SFtnhG7/DHJdWmytjBLB0z1HVpQGlkY+gcyKH18Lexr5VrLKlK1Kc7qK5E/:1Sm/jp0YfHWxv175E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167552, "uuid": "f7cfee64-8355-4b34-b6be-c7a34b9051c9", "value": 6033570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167552, "uuid": "6bb93813-0c3d-4465-8154-da8a784e5b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167552, "uuid": "e78e05d2-22ce-41aa-bab0-44e5896813a3", "value": "4b4e7fdfce62e8b23aa9a236143e90092e17ece819b3d7e4529555000abd72ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efe39c8-89ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785179338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179338, "uuid": "132c33b3-244f-4732-8948-c7718c2d8346", "comment": "Malware payload", "value": "983fe9a16ed2f3b7e057f08a3ca95e51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179338, "uuid": "a3dccec8-b1ad-4373-8fe7-e68c22bb332f", "comment": "Malware payload", "value": "4b59c11f363a5bf3ee784e63da1c21cad0da71aebfe39d20b727a2bc6194ed3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179338, "uuid": "4ec76feb-eff8-41e0-86f5-c55422f67bfd", "comment": "Malware payload", "value": "dee566a9b164bfb8c69f92428cc883561d2ecb51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179338, "uuid": "f4a72962-12d2-41d4-9a1a-3b5a3c4459a2", "comment": "Malware payload", "value": "bbfae5dc058c4c8d9deb444b30bd883b771f403343c3b7a9466ca785a72413cabe47798ab89dccb9b039d971015dfaea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179338, "uuid": "25cc9a49-0b37-445f-89bb-c5f073c1ad06", "value": "T15BA3B71E2F219FACF2A98634C7B74B349B5C23D123E1C684D1ACD5012E7434E595FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179338, "uuid": "cad17061-1c71-44a6-9ff9-4a314110f1e0", "value": "1536:H8DlMBc9CnkFuc8mgE4A/1uHmdsM887b8puFSbr0auc0G4W5/w:eekFuTmg9O1RdsUeuFS/Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179338, "uuid": "dd4f39fb-a183-4d78-bc5c-5793c47127d1", "value": 101452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179338, "uuid": "a02d8c0f-4565-4143-ac68-7b3f3896eaea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179338, "uuid": "392fa05d-20d9-4e1b-830b-9cf43bfa4004", "value": "LSD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c747085d-8950-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785111545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111545, "uuid": "1d48decf-ad88-43c6-9c3a-484b81ccc44d", "comment": "Malware payload", "value": "e2579f2830672b13fcabaff7564806f9", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111545, "uuid": "45af5947-bee3-448e-b088-1d8fe8e23d48", "comment": "Malware payload", "value": "4b7ff0262fe7d98cfd1c3ec38cb17d1aa7b66524be8fa2de0ce7a30a3d81fa38", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111545, "uuid": "ceaee47a-95b1-4ef5-84cb-6db0813b17b7", "comment": "Malware payload", "value": "c12f2993e618a1ae1b9964876facc196221371fb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111545, "uuid": "72f4429d-b799-4b90-99b4-14651ed5ed2f", "comment": "Malware payload", "value": "c99cb60f09587e0d6211bc5eb320dc8e8d7ec1c6daf684b2e79b6d04ea6f9ab94e927f8b20f9b0c8aea3ffd064a9be9f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111545, "uuid": "6c111249-74f2-45bd-b4a1-f1a834c0c651", "value": "T12F216A9192CF3D982743249A3D66310B21707A7782FAC6D498FFC656D511D4089BBA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111545, "uuid": "04a16691-5703-456a-b2da-890611b00fe7", "value": "24:0wPsgZbEyDaGSg29gCI4hvor/s1+w7w/3seXr+vJqw/IFnXCA:0ksgZXGkzaIkW0eX8TnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111545, "uuid": "16c34f15-4470-47a5-addd-e469d633ea83", "value": 1383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111545, "uuid": "299b2ef7-b085-40b0-a1a9-65b88baae7f4", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111545, "uuid": "e9441019-a139-4641-a41c-ea9922790545", "value": "wp-static-cache-fa39743a.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62fbe19-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133448, "uuid": "87c54711-8cc5-4257-a6d4-7cd7dc4a4db1", "comment": "Malware payload (Mirai)", "value": "6d0505e73a48526c0a913bb4cb5cf97d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133448, "uuid": "955557d7-ca56-4b76-b5d7-fa4bb016ee62", "comment": "Malware payload (Mirai)", "value": "4db3b8c50c29eabf6363b0040f53703bb02a74868ded9a807a283e688dd79fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133448, "uuid": "3e4a4870-634c-4124-bfd9-eeb4e9fe6d03", "comment": "Malware payload (Mirai)", "value": "cac245183f4dcf07048fe935b3fedf5bc455e89c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133448, "uuid": "2abe2431-07b0-4bdd-a2e5-2cda9dd64348", "comment": "Malware payload (Mirai)", "value": "2339d56f0b30e79593aa78d794e93758b120f6348e9dbd9f05f3ec6fe28aeff2d43e041db2411deeefd1b51cde72983d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133448, "uuid": "cd12d44a-f9aa-43f9-9372-1f968c76d52a", "value": "T100D34B1B75C1D0FDC8D9C1B85BEBE526D972B4291138B21A27C8AE275E4EF205F2E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133448, "uuid": "d5c062e4-0039-4d49-bf20-b671202dd227", "value": "3072:R+nYoOH0aA0TPrT1NHQSKkQ/d2SWjisIjCBQ:joOdP9XYpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133448, "uuid": "e4b3d963-4c3b-420b-93ad-7df35b9119f9", "value": 130952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133448, "uuid": "254bd79a-afb0-433e-801c-495e30e49fe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133448, "uuid": "da15e374-17cb-4083-9f64-2a002432158b", "value": "zero.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac0b101-89ff-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785186525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186525, "uuid": "1afaaef7-280f-4e98-abea-cca9707a72f5", "comment": "Malware payload", "value": "5b033d3a4db05e99ae970ffe77f0a55b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186525, "uuid": "4b9496cf-0ae5-480c-af80-67052cbf2cba", "comment": "Malware payload", "value": "4ddf530a9ced8cb042c88e3fdd75933a08cd1419a1f3bbd7a3e6b8f3e6b6260d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186525, "uuid": "11947d67-bcd5-41ed-9def-d32715fb12d1", "comment": "Malware payload", "value": "b06b43205f0102eb735da12a3198a10dbdd0af5d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186525, "uuid": "62d8486b-b9b2-4684-b12e-a82a77efafc9", "comment": "Malware payload", "value": "c781b1986d3a3e2217d018fd1b4e59776d5a2c788e4a024ce76095ef7d36f3c99a1c0bfa7f2c72636ecff3e59a6e853e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186525, "uuid": "2bbaeefa-9784-4e78-b122-0f53dd06f2bd", "value": "T12E823B0FB8424316E1E110B4967596BBD9B9AC7637C414EBFBD44AEE0A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186525, "uuid": "c64f94f7-fae7-43d4-97dc-3a25f1e95511", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186525, "uuid": "e57fbeca-48c7-4ca1-957d-93e2a7000336", "value": "384:A0ZbmcmhzwEUaUu94gXTP+av8U9c+F4P:w5UaF9Ka0U1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785186525, "uuid": "e52b5c8f-b86d-42b7-823c-1be9a0e3c083", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785186525, "uuid": "312bfd68-6d1e-4852-b41c-aab6c304dc4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186525, "uuid": "59195da5-502f-4ed1-b0e7-8a679ffc777a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e990a7-8950-11f1-bd95-42010a9c0009", "comment": "Malware payload (AminOgluStealer)", "timestamp": 1785111253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111253, "uuid": "b3e3e5fd-7552-454c-8681-f104e1364523", "comment": "Malware payload (AminOgluStealer)", "value": "357b903fbfc7c4bc6590a92f3e07aaf4", "object_relation": "md5", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111253, "uuid": "ebbf3d1f-2798-4799-8754-8739854a99ee", "comment": "Malware payload (AminOgluStealer)", "value": "4e40ac262149dde5d453c18cf700c384c846aa51dfcc5dcb9d57eac720b06d3f", "object_relation": "sha256", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111253, "uuid": "4cf58e33-4773-4437-8f43-efd840b6863b", "comment": "Malware payload (AminOgluStealer)", "value": "6db44b1c145e570f446118d63afd66055190a3a8", "object_relation": "sha1", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111253, "uuid": "effa5696-f39f-4bd8-b7d0-779b8d25331c", "comment": "Malware payload (AminOgluStealer)", "value": "af4a81478bd6c9f54fb7b013c16eae78936d3481d94bb0c2b4ff3d61c74b752e37b45922c2ba677100ce162efd2f28af", "object_relation": "sha3-384", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111253, "uuid": "24b034b4-8adc-4ba9-9792-003fced5d690", "value": "T118083383DEA5A5B3D4A59E7F1405029E1A5EF243CAB53118ABEC213FD3E7D8946F00D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111253, "uuid": "234ce7f6-9479-4d15-8a9b-6f4c10f99c0f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111253, "uuid": "9f5186fa-76a2-4317-803b-995aa3f5e145", "value": "1572864:2r2u7dc2CNOuxPgaIz3XfDayhjhJTxWqqxZBHdX9vrKDeeQcz5bivwKOv:2rTJJuxPeznbaShJF1qxtteDRQ83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111253, "uuid": "f2dc4ff1-a465-4782-9023-5fb7e76f2b24", "value": 78957986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111253, "uuid": "da81f6a8-b960-446d-b122-0f45492ecfc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111253, "uuid": "13f59e8a-d176-4abf-8bc9-d1820143945c", "value": "BlossCraft-Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2061d0-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143549, "uuid": "3dc41213-89eb-4d4e-9c6b-fa42c931ff25", "comment": "Malware payload", "value": "6cc50c05d731ce68a785b401b24fe47c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143549, "uuid": "46411a7c-554a-4219-84be-9b2b1652c214", "comment": "Malware payload", "value": "4e867c0477b48c1c765ed5c98a4da8229a6ad2b95c60d529809a7c8b0abd9778", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143549, "uuid": "51c70583-7c6b-4b5a-92b3-15b42f7a1bf9", "comment": "Malware payload", "value": "250a30ba3299e98fe22c02c935e5cc1dae4e1f43", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143549, "uuid": "4ea1db36-3fc5-4f2c-ad65-a1396007e1e4", "comment": "Malware payload", "value": "edc99a6068bef511b55d4cf911d6a8a082bb7e623951d6e2f6254be9d4a8457832b026e145c209a55bbab796e6a5c91d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143549, "uuid": "93a1c327-e97a-48f6-a0f3-fabb9117bf65", "value": "T1EF218658897088B2CC0FD33B69A61B9E623712CD14039647A396A493F7E7000AF185F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143549, "uuid": "bb9ac0b9-d4d0-40cd-85dc-fda08b3fd250", "value": "24:9EVP8/6UtsdhJ98NCy9XDGuvr4oZ856Fj8BYjrmSa4R8Tij3rmKVP8/13GkjV:9Q8/6fzoF9XCuvr4o+bajrPv8/ZxjV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143549, "uuid": "03eb292e-e766-4a57-a180-de9469eaca1f", "value": 1135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143549, "uuid": "c1b82ec1-9c34-459c-9653-f670f29c2f88", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143549, "uuid": "a1ceffac-fd01-4a55-878c-7fb271557cff", "value": "photov_921900597579.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b30397-89ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785178380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178380, "uuid": "d161edff-70d8-41c6-80b3-7c0dcf456171", "comment": "Malware payload (Efimer)", "value": "80bd4cf388f4109cbf2ec1433a1813aa", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178380, "uuid": "7ba33de1-5443-48d3-b6d4-93b06901f8f7", "comment": "Malware payload (Efimer)", "value": "50421a15ad2458ac9518a4c8fe3b5c8341ac87d7838327d2eb55fa94fe334a39", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178380, "uuid": "256e99e6-0033-4f3f-a2b0-b7556b59cfe9", "comment": "Malware payload (Efimer)", "value": "f5f2634f60b18f0eddb9edd155f89329d85315a1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178380, "uuid": "80c37344-ad15-445d-9bfe-2abfaab41a0e", "comment": "Malware payload (Efimer)", "value": "ec27ec62141b8bab8505ce7dddf88adf4946cc44027f19e2d4f01ff3cec5c9b5afbfce726e46c3b444e0b8bac68fa451", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178380, "uuid": "d0bd7fd5-80be-43ae-98b3-b6636cbbb3c0", "value": "T108E633586AE002ECE5B38138A6F742D6F9A834361B71C9DF47E853215EA73F0593CB16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178380, "uuid": "6c4d4fc2-a34f-4c01-b9d5-56d497a86826", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178380, "uuid": "40af24bb-7013-4ba8-a429-58d436c1b726", "value": "393216:f8fOx1dQb7LbJAqC70isxaAb55XMCHWUjXscuI3/PGTAI:f+Mcb7LbA70ia75XMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785178380, "uuid": "664be16a-56af-4400-95fc-b4d6a6273981", "value": 14311584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785178380, "uuid": "45abd2e1-4d22-4ea4-bdf9-1d02e7b069dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178380, "uuid": "3e9469a7-86f8-4e03-8bf0-68d12ce3fab2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b65ba7d-8957-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785114478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114478, "uuid": "2f9a8fad-a75e-4ab8-9bca-c31e668379e6", "comment": "Malware payload", "value": "d81cf06defd1e349fbe3ae41e8b2dc60", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114478, "uuid": "2c4b5242-4eb5-4819-9e41-d864f153013f", "comment": "Malware payload", "value": "51403e760e00cb8ad725cc3404154a324c604204f061e285c513d03011f1ac2e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114478, "uuid": "f62d7069-3f1e-4337-a381-26c7e425525b", "comment": "Malware payload", "value": "b7229367139c5e40080f3e71a687b82c7fbdabe8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114478, "uuid": "98d9f465-58e2-4a07-81a5-e5549bb4ed32", "comment": "Malware payload", "value": "33dafe0686bd7f68843df16b8ea8e3d739f3e956e46e6c01d5f1ad505158ceed2ae5d98cdead441d7f51686aaff8f667", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785114478, "uuid": "7808a762-2778-4023-8752-bd3c2dae40ae", "value": "T19BC26C966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785114478, "uuid": "7eacd29d-bf3b-4684-860c-ae45a93720d3", "value": "768:g8vCB+25j6es8Rf9FYpMSUpi+20qUpi+20YQX:g8l25Jpd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785114478, "uuid": "e148e7d6-303c-4a6c-919b-9a15e494bd5e", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785114478, "uuid": "589e8afc-77b6-4088-826e-030638b7148b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785114478, "uuid": "859e4137-fc84-4474-bf1d-d3cd2186750a", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32110ae1-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167559, "uuid": "768483e2-7532-4f8a-880c-e235bd2f5d73", "comment": "Malware payload (CoinMiner)", "value": "15ef7a5b00529c7a5f6ee3d16532f53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167559, "uuid": "ab5a827a-5c5d-44ba-96ed-1aba3737bff8", "comment": "Malware payload (CoinMiner)", "value": "526c040bb853b294f4fb55f8301fa8a03d2bea9dc1877570fc98cc04890af440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167559, "uuid": "2a5c366a-fb28-48a0-a0c6-46353e3279a9", "comment": "Malware payload (CoinMiner)", "value": "3b8b55e3d35c977bcdf65d88c9aa52b50c87f168", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167559, "uuid": "24187d2c-8af8-4482-a36a-ae5a495fe45b", "comment": "Malware payload (CoinMiner)", "value": "b869639a5f6e893e6d8682e94915841c73c16d8392a79f68ff11df20d3b07c347595949a5fa357d04870063cbf0c0757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167559, "uuid": "c2df0375-442b-495c-b324-c9420481cc67", "value": "T136753381428DE6D8B61E7947EAE168400B298C0C3BD9E70DA461E8A5BF1F75B79FD021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167559, "uuid": "3e4a0055-7918-4f4e-a071-f9d234dc437b", "value": "49152:QlLfL95eb652jHS5tXG/ojMHctU36plnjx9/BYS:QlLJajy5VnMH9qppjr/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167559, "uuid": "cd76eac5-699b-4d2c-bf71-fe82bb1771b7", "value": 1684796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167559, "uuid": "4afb0d37-ccba-4f0e-a21d-78b8dd0f3187", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167559, "uuid": "b3028e59-7d80-4cbf-a569-426210e261e3", "value": "526c040bb853b294f4fb55f8301fa8a03d2bea9dc1877570fc98cc04890af440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f0443b-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132775, "uuid": "8a05aa6f-3576-4898-acb0-fbe6869f0ce8", "comment": "Malware payload (PureRAT)", "value": "a23b062188a55ee4c028e3ede0456e53", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132775, "uuid": "846069e0-3d31-4759-9c9d-4e628e737971", "comment": "Malware payload (PureRAT)", "value": "52d4ec113f7961ca559a861125f907c035cd72ea95adfb44a151e801b7951432", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132775, "uuid": "540aabb0-f3a1-46dd-a5df-348df1e8ee91", "comment": "Malware payload (PureRAT)", "value": "252c18891cff7eba2d3d3ce8c97569de439cddc8", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132775, "uuid": "0288c538-f75a-4938-93cf-26991da7b088", "comment": "Malware payload (PureRAT)", "value": "ca32f3d520645c37d1a1f4cf3b69505834883f973fa831d8978fa7cc1b27b5b76a71f1300b9fc6bcd15c10a81ae1a33b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132775, "uuid": "819af9f1-edbd-4ebb-b7c9-0b5d7fa540af", "value": "T1B42187E9DA33BB48C90B8532A4897B58AB45416D5204A11ED6D265B72D094CAC40A45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132775, "uuid": "b7078701-0f93-46a3-81a0-9b4e8eb213fc", "value": "24:9Q3VNLzeD5eZEjOQqcpjk9t5bNgNhGW7smSNBzplLuSe1U1uweO/Kc9WVNLlc:9Q3zL48NQVpjq5RgNhRIPNBrH3UPOScv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132775, "uuid": "90097503-ce81-46bb-b6d6-962a39276b8c", "value": 1262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132775, "uuid": "f276586a-19ee-4811-9c10-25f2aeb8b916", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132775, "uuid": "630c098c-5443-4c83-afe2-047350dba301", "value": "photov_248712063261.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d31f8c0-89ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156894, "uuid": "fea10d3e-14a7-4ef8-8e97-3a7968e145da", "comment": "Malware payload (Mirai)", "value": "4fe4c7421dbcdc6561bf54f10013b405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156894, "uuid": "7fce14da-025b-47d4-8582-1c92962fa198", "comment": "Malware payload (Mirai)", "value": "52e4eefaa703da375bb310e06c1808633344bafa6e825aa09d843749a9a9c92f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156894, "uuid": "3d58bd39-4411-4e3b-a72a-ffa6c5e30646", "comment": "Malware payload (Mirai)", "value": "499d18d27db385753f306fe1d133682d12d34c62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156894, "uuid": "97a24f38-9434-43c9-976f-02995704af19", "comment": "Malware payload (Mirai)", "value": "c1b26cd600fbe19116c354089c6046e1128a7fe731e8159765125e85d87b05d34c61aec1b025783caf4048808961be00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156894, "uuid": "8ab5a9c6-bd83-4eed-98cb-7089f2d98832", "value": "T16053F27ECEA619CACF1D6E3CA528764B8D29A6D4754E8FCC30507D0CC057BEAAC4861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156894, "uuid": "4855a189-cdf4-49d2-9011-4f16854b167c", "value": "1536:NOc73xooU50atEIN5nxiTF6NvxgcwdLYt8KyWbZNq:NOgxo45INlxkIJgcwdc6Krq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156894, "uuid": "a426a92c-eed2-41ef-80fe-8f10216c7feb", "value": 62432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156894, "uuid": "10758990-8a5e-4a1b-9aec-fe2bf598a0c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156894, "uuid": "28ca6b38-87e3-4a9b-b151-753066ff18f4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00163463-89e5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785175206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175206, "uuid": "73ff9e95-53f3-4c68-b87a-94bbb76a8f7d", "comment": "Malware payload (Formbook)", "value": "a0995e073911c897ff2b5652a8bad3a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175206, "uuid": "ece85fb6-cb1b-435a-81f0-fc08e619e479", "comment": "Malware payload (Formbook)", "value": "5326cd216b594557d92a20e67d1074e532c4817ebc078ca41e9d92d315c160e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175206, "uuid": "91e79dbe-17ec-4164-8565-d465ffd0be0d", "comment": "Malware payload (Formbook)", "value": "b36cdaa68a18962e07f3d9c862b4f0bf17c16345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175206, "uuid": "ecf90f07-1fc1-458e-a419-eb263f45dade", "comment": "Malware payload (Formbook)", "value": "11a2809476e4b69e890e128ccfbfa8d3b05e3719d2cb9decffb6ab9e95ef6b645dbefaf3167d6cd40ba42acfbb025f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175206, "uuid": "06b4acc6-00a7-4269-8d00-a36052fa9530", "value": "T11C35016A15234703D8B66FF04E71E1B11B7A7CAAE635D21A5EDA1CEBB97B7003C05312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175206, "uuid": "8e875adf-1510-40d6-b971-82ebdecdb94d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175206, "uuid": "f8e94e69-a1f2-47fb-b008-79923a42f755", "value": "24576:Fy5Sz4Hg7b3TPIp0SLeVC8owN8gZgAA2KvDzo8Di0no4zOzjK:Fy5SjbPJVC89N8/HZvno8SGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785175206, "uuid": "7e702ede-4695-47c6-aa4f-582abc295108", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785175206, "uuid": "ec1339fe-64c6-4404-aa9b-ddf749db4e06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175206, "uuid": "30475572-2b3f-4cdb-a174-8b8c0068e8bf", "value": "z9QUOTATIONORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8a24b4-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181025, "uuid": "f015a2ea-0167-4be4-9a98-d847337bd5b8", "comment": "Malware payload (Mirai)", "value": "3db5e9c447d5b6e6e9d8fb9adbca8f40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181025, "uuid": "324c6441-69fa-47c4-86b4-c55f04d001a9", "comment": "Malware payload (Mirai)", "value": "53385d7dc9bf143d4fc2e5e5fc0ee63695dab54b1d5457bd6a2fbd2c611c5b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181025, "uuid": "9db1f311-cdbf-43ac-be48-851ec6748a68", "comment": "Malware payload (Mirai)", "value": "6e10c3600ade9892dc2e4da38b4e3cfcbad64ab1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181025, "uuid": "9c973ebb-9d30-4d01-b934-b15a8bf1a37f", "comment": "Malware payload (Mirai)", "value": "fc8afdaea97d5d89ac0a053d5c7a44dcf5eaed9ac670ec603f7d5f153861ff303bab5a846166708a3eebf37b1b2bfcfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181025, "uuid": "a760a8b3-eba1-4dd4-aa8f-27e5ac4af486", "value": "T1E7831895B8814B12C5D512BAFE1E118E3323177CE3DE73129D206F24778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181025, "uuid": "399ba6f7-61a9-4ce5-b10b-7bc1d6712924", "value": "1536:yjna/CzPC7fSnznv1sUrfar1FtQtMMiE+cG3if737meY52Y0s/wm:7wP0UvCUrfarY+cG3if73ieYwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181025, "uuid": "ed5cf519-ff8c-4277-98bc-de0087c680a4", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181025, "uuid": "940cfc9b-37d2-4af6-b535-b346204b7df8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181025, "uuid": "6bfe8f97-dfa0-4433-adaa-27a8882cebbf", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34599fa5-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167563, "uuid": "53936c94-d75b-4b69-b85e-95cb79a52cef", "comment": "Malware payload (Prometei)", "value": "3549f1fba922f40330aaa081ce71fed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167563, "uuid": "1b985ca5-4c58-4967-b505-af868f792877", "comment": "Malware payload (Prometei)", "value": "5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167563, "uuid": "90eb1338-bf6f-4e24-a51a-660ad8a353dd", "comment": "Malware payload (Prometei)", "value": "f9ec500cc050101e0e2f45f94e6906edd9fb8d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167563, "uuid": "fe936b8b-a83b-4ad1-8fd5-ef0f6e9c9c64", "comment": "Malware payload (Prometei)", "value": "e66d92beb9c56ee6d558c380ae91c33c9522f02087593c53ffdd94ae791474b2c107db3757334281dee7bd6b584fe283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167563, "uuid": "2c614900-4c0f-4090-b31d-383e82c373b4", "value": "T10D74D07775B8F15EC88517328F62C7C293993F908993806F7EB4530F29278A91A35B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167563, "uuid": "af8ae1a5-3b93-427e-b82c-6d58a7e2e0a4", "value": "551920a564f0da077e7c568c1940defb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167563, "uuid": "0a2229b1-865f-45cd-b125-e2b0d05d1762", "value": "6144:fRzeTJQJfChxxTnECpq9XkCnNNCoo/iSq9opz5Pv5Pi12dwy9:fJZJfChLjE4q9X7HGqZ9opzvi1y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167563, "uuid": "a2441345-df87-4ed2-8d70-1ca77352edd2", "value": 342004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167563, "uuid": "f73cc9f0-fa22-4e3f-830c-52bbb7b2e183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167563, "uuid": "057d4920-34e2-4e4d-95e7-57e29b2eef8a", "value": "5395ef7901731de4f83aaacf2757416a1830aa608ee38d70d4da8caf466fbff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7bd77a-89cc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785164627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785164627, "uuid": "a5663fcb-f401-4648-8e5a-6d810b4f2631", "comment": "Malware payload (Prometei)", "value": "00b613234448433d2aa878aa979c9f7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785164627, "uuid": "f803d98e-60ae-4e76-b8d2-2a169e19ca45", "comment": "Malware payload (Prometei)", "value": "53d667b17ea6a5f03abe1dbbd09cfe51c27b758ebc936bbf41af55bf2768f543", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785164627, "uuid": "1f5ba34f-0863-4b5a-88be-397ef3a66bcc", "comment": "Malware payload (Prometei)", "value": "0be1308a128833dc35126e930c7c73262e864c63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785164627, "uuid": "186f38a0-a4b3-4f16-8bda-e8e7c3aee574", "comment": "Malware payload (Prometei)", "value": "3cae5e5dbf838b20d24c08be8686716e4ad26470c7f9d4de6adbf05d0b057792e0ad5720e99a8a063c74fd8224322da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785164627, "uuid": "b9aa3616-7390-406e-b699-ecd5e220d6d9", "value": "T10157DF77814338E9E5B98DB4D01025416DAC388B5778A3C7BAC871E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785164627, "uuid": "06569694-185f-4883-949d-9d6f0e066038", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQI:cqYUQuVDt0TZE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785164627, "uuid": "01cfc525-febb-49e2-8938-b124ab676efe", "value": 27099136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785164627, "uuid": "29949e23-2e0b-4840-9b44-cf9085f9326c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785164627, "uuid": "ed5bbb8d-da09-4c03-a9ae-486e417ceffd", "value": "53d667b17ea6a5f03abe1dbbd09cfe51c27b758ebc936bbf41af55bf2768f543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365e78dc-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167566, "uuid": "11da2752-21cb-4404-a4b6-4436afc51d14", "comment": "Malware payload", "value": "925521dec971735967846ef5137bb559", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167566, "uuid": "81dfb3e6-f6da-49a5-93b9-755a26c08066", "comment": "Malware payload", "value": "543ee6bb14d7015bea58a34027bc481af5818eaf6b8620bb2172583775f9ace6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167566, "uuid": "299be4f0-586c-472b-a4c2-70c37a4317bf", "comment": "Malware payload", "value": "f0ac6249c99f5a498ba90040ba4bdeb2ebefa5f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167566, "uuid": "70970f9c-2934-4d31-83e9-e36b4e382f48", "comment": "Malware payload", "value": "9800f62f73fb97c32770fe9f6b473204bec05f12d5d64b89060c55ac6d647ce361c756ad3e0be5d6a07e7cb0dd49f558", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167566, "uuid": "1688d1f6-aedd-4620-a2d0-2498ea5eedb8", "value": "T1A9311AAE45145A391307D9CDB3723648B08C8AFB2C9BD754ED4C1FEE52894DCB262BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167566, "uuid": "c7a0380f-294c-4d99-9139-e78d830f841a", "value": "12:U36eqyG9L69D9zlcZEq0J6R5jJrBx6B5pAES0Jjh076qt6/ZWE1c761G32KZKwNU:Mq+5cL31cp5Jgzj32mPhvnXVgF+E68HH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167566, "uuid": "7d79ec16-dc04-4c5e-9fd5-d36d7cf4eb59", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167566, "uuid": "cd13f32e-2ce3-48f0-b470-45ac88acd96f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167566, "uuid": "976f44d9-bf61-45d7-8424-8370d23a5151", "value": "543ee6bb14d7015bea58a34027bc481af5818eaf6b8620bb2172583775f9ace6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4accc4-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132789, "uuid": "76e29260-7eaa-4573-8b3a-90074ef8c38f", "comment": "Malware payload (PureRAT)", "value": "e89ee7ba58d7cc283959546981a84588", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132789, "uuid": "7d18e0b8-df29-47a1-a34e-d73b6e2d2204", "comment": "Malware payload (PureRAT)", "value": "54536ae68da2f6cc9c90d02b057a9e67d845d62efcc7990a85b80c65676d3d3b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132789, "uuid": "4455c4f7-f19b-44f7-aec6-50a72310ba9e", "comment": "Malware payload (PureRAT)", "value": "d9c78f56069ca7a59bf8df237936406af315b1a9", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132789, "uuid": "6f162e48-6652-49cd-93a0-b1fb3716b354", "comment": "Malware payload (PureRAT)", "value": "3f0ca19a224787e7b801794db0856e9de12fa6369d290886f32147be5cee0f567a234d7e93ee1b3e04d92be87c9d009b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132789, "uuid": "de5fb0ed-ffb8-41d3-91be-b96510f646de", "value": "T1A521C684D04AADA2C51781F84AA9258E4173CA1C630BD1035EFE6F5F295857C8DF8E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132789, "uuid": "5f3367da-fd1e-4846-8ec4-68e1334d04a3", "value": "24:9VRSTESbaiEmF6ILOuYG4Z6vJ51ZmSe69MrS/jWsd64Pe:9WQoaiEmAi4IvJPZPZyO/jhdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132789, "uuid": "cb2e7293-3750-4f9d-8b7b-4207dd92d2c7", "value": 1190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132789, "uuid": "25dd12d1-2f22-443f-93b9-7824caa9ee9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132789, "uuid": "e2006ebf-9df0-4f3d-9b43-429fc1ace490", "value": "photov_150471622163.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e99672e-89a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785146508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146508, "uuid": "3e262663-4e7e-4693-982b-4fb2f7fb3cc2", "comment": "Malware payload (SilentNet)", "value": "7759d943192d2df2542c0a62496a3c63", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146508, "uuid": "fa6b6ec1-87d5-478c-af71-ac8934fa5489", "comment": "Malware payload (SilentNet)", "value": "54954314f1a5f5dbbfbdaf301c7e301f7b6ebec940d84b9979f8d84f936480f6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146508, "uuid": "7f5b2366-35b7-446f-96ff-7d58984977c7", "comment": "Malware payload (SilentNet)", "value": "c7a72caf4f8ce7364727a18eaffbeb143c059a45", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146508, "uuid": "3d8bf06d-0500-46b8-9990-bc87b5802017", "comment": "Malware payload (SilentNet)", "value": "21ff2c851836dbb09999050a203d9d07f3cdafdc90929ca606a9c9b30da4c2d809cc51bfa148fcf3d85ad8cf96d9f7bb", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146508, "uuid": "eda43b01-b26b-4fee-8a37-fd9fbd5517f4", "value": "T17AD42363CE97841EE93F6A3642CA8609369BF861C312AC50A5F0768E0975F9DF7D3181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146508, "uuid": "41f7cab6-bfa5-41b6-bda1-6e1a8fed6675", "value": "12288:ZXnw3irELtKQf9ISWNXP7tOkP/2CkdqvMZ2A4S3agjff8WORlYJ:ZXw3ir4EANWd7tOokdqkZt4SAD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785146508, "uuid": "2802a7c6-17fd-4577-9364-b8d47e621639", "value": 612306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785146508, "uuid": "51709e03-06a5-4c65-9f98-8b97a9a9d61c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146508, "uuid": "0fd2ee44-4da4-4249-acbb-5085cd28cef1", "value": "KryptonCracked-1.21+.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8adbf1-89ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785156782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156782, "uuid": "7f05c4b2-08d1-4504-9b8d-ce76e6f37c78", "comment": "Malware payload (Efimer)", "value": "6afcaa8ef95e2867087f41d30b3e3e1b", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156782, "uuid": "41bd0768-d49e-452f-a918-801baf0e8ff6", "comment": "Malware payload (Efimer)", "value": "55328cd52aed6e375338b394b1bb8c4a1438e52d3ddf079c316f05e764b6f72d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156782, "uuid": "0d886f55-44a2-4ff5-8131-ed0a89e62e8a", "comment": "Malware payload (Efimer)", "value": "29a21b6970cf47fe514bdff500d8b1d326420024", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156782, "uuid": "cf2f9a3a-fcc0-4627-b4c3-71f6b6e73857", "comment": "Malware payload (Efimer)", "value": "82b965a8d56e944d3e02652becbc38b6ff7135eb55e05874ae9e14ec43442d4b821f295a1a85f818ce403c8438644673", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156782, "uuid": "1fc5a851-c4eb-4346-a140-e4ecbcd85423", "value": "T16AE63308AAE506FFD97750389DA38491E2BFF0350BB1CADB679482A1BD532D08D3D617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156782, "uuid": "f0801b47-c0ad-4a75-a54d-0146ddd3f34f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156782, "uuid": "e523e8cd-ff61-4625-ba3c-ab314fd05175", "value": "393216:HuKq/I8AhiMztXMCHWUjX5cuI3/PGTAI:HM/I8AhvztXMb8XOH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156782, "uuid": "eeb5d9fd-e7de-429c-bdd1-c21c80326da7", "value": 14313001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156782, "uuid": "ed81f762-8a68-4ea6-a622-7fbd418c66fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156782, "uuid": "dcc78544-f769-4e7b-83ce-d42e72651a6e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "185efec2-89bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785157208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157208, "uuid": "cb9aa87d-a77a-48dd-bfe4-08365b6b062d", "comment": "Malware payload (XWorm)", "value": "3f9f67798b462cbe3ca6179e3254eff7", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157208, "uuid": "f05b36bd-1ebf-4109-85b2-5899ce78a15e", "comment": "Malware payload (XWorm)", "value": "559fa1abb4d65c7c9bc942e118a20c5d470d1f336de41f3367ae9a61abc9a293", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157208, "uuid": "56971d46-ca24-404e-8b20-456871642d68", "comment": "Malware payload (XWorm)", "value": "c4f0c26a699e81f53da6b75d04496984a1776802", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157208, "uuid": "dbd985cd-cccf-435a-82c0-5231d723cb91", "comment": "Malware payload (XWorm)", "value": "b175279d77cb00741ac639373a56599828040dbb28e0558d09dd5a8d88931b190758e9abf68222c629af3b838ce4fbcb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157208, "uuid": "4b40a965-68d2-4e99-8262-e382f1977084", "value": "T119C517B21C0D324075A7A95FE13FCADC51E4BC6680C3B6E97B3A3FDD1836121E648666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157208, "uuid": "07dd1ef2-f305-4f56-99cc-528d07a033a0", "value": "768:w44444444444444444444444444444444444444444444444444444444444444x:P3zaswpR+wIJwHzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785157208, "uuid": "db6c0490-def1-473a-b166-13cbab8b9374", "value": 2576650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785157208, "uuid": "a5c7fad5-40d0-4176-a208-44a30cb1cf9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157208, "uuid": "ef26c45a-4899-4d76-bbf1-5aba5793a15b", "value": "z93RECONFIRMBANKDETAILS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228ec0f1-8988-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785135321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135321, "uuid": "afb298c9-5f7e-4a95-8dae-d3bc7ab60101", "comment": "Malware payload (Mirai)", "value": "a2479a0109b3d28e9816933cf8a90e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135321, "uuid": "5a8f5f4f-4354-46c0-bfeb-29a42f04a23c", "comment": "Malware payload (Mirai)", "value": "565caeeefaa72be236775725c1c3c464ace8658564de2932bd296377b9afe72c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135321, "uuid": "7045d968-e9f7-407c-8d6d-193f779aea73", "comment": "Malware payload (Mirai)", "value": "b853d6b43710daeaf4102dd5925217da7c9d6f31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135321, "uuid": "0a1869ee-ee51-4592-9c16-e131cdbf2418", "comment": "Malware payload (Mirai)", "value": "0f15ba4013776ecadb64b360fa3e71bd2d574716dabe5ded59b8d232f8dd25589e263a68a72f3dfb462c76ec3827daf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135321, "uuid": "6080fd1a-f080-4469-b000-a6a18e72e54a", "value": "T11531DCA1A7D09EBDC4F451BE9E5B0310B3799F00E1C77222870C63696D1AE3C9D27446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135321, "uuid": "73d03712-4dbd-4735-ba76-4a11bde534e9", "value": "24:uTcRKGpa7Urz/jlfBXK1hZVev3gRGaJ9ixBBuLlTO9gjSq:uARKGpa7UrLZGs+JCBu1OZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135321, "uuid": "5c4eb5af-1fbf-4496-872e-a70f2bc33591", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135321, "uuid": "3e8e73bd-63b7-480b-8a7a-f4d599073e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135321, "uuid": "f5d7decc-37f9-4990-88c8-8d4f4d1141e0", "value": "dlr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11844843-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133145, "uuid": "2055f735-5326-4f88-bb50-fd18626ccc8f", "comment": "Malware payload (PureRAT)", "value": "dd99d9f0e53c1924eca733d554e262c4", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133145, "uuid": "5b23f0d2-329c-4c53-a01f-9585e43db8d3", "comment": "Malware payload (PureRAT)", "value": "56934e430a2db7f8a54278a4dda96d9d9c2df8edda55281ae77eebda0436e07c", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133145, "uuid": "7e40b01c-cca3-4c58-a4f6-6f5ce640287c", "comment": "Malware payload (PureRAT)", "value": "ce31ac2c83c7cfccc6a70195f38f7f29454befac", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133145, "uuid": "0105db21-db9d-4ec2-898a-7ef580d8069c", "comment": "Malware payload (PureRAT)", "value": "a5560e9ec3ab409e06b02afa6c64d1039455df85884c02c553af2928826b863208a43961af41c6816b77d231e8bede7a", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133145, "uuid": "9126c470-c95d-4afb-a810-3a43205eab53", "value": "T1D121B7C48064D6C2C947E232E83F8AE5140D1BEC53968BFA435C3A1A066CC1E115C4D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133145, "uuid": "5dc7078b-7caa-4b7d-bf17-4df4fc05cbcc", "value": "24:9MNcbH93J578K6FudN/KChEhmbD5j7C305mSa+gWqbqrxvNNFA:9MNYH9Z5oKW+RphumX5j7CE5Pa+gW59i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133145, "uuid": "73c2e048-656e-4fdd-8459-08ee635eecd4", "value": 1201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133145, "uuid": "6c0256cc-dc94-468b-ba29-e7c9f93aa6dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133145, "uuid": "702b44d4-6830-48df-8da9-72666819204a", "value": "photov_758641778182.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02794cdb-89e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785174781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174781, "uuid": "b111cc8d-5aea-4dc8-ab57-fbd530778e03", "comment": "Malware payload (LummaStealer)", "value": "5fae196b68afca48ce650acc79e25126", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174781, "uuid": "dcfa5d44-b585-41a7-935a-91f61ffd3430", "comment": "Malware payload (LummaStealer)", "value": "56cc93be915c0d59943d0bf3c91dc1956b0af95939b812679197d3607829713f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174781, "uuid": "b1e186b7-a7e9-40e6-a569-8f7d52a5d1d9", "comment": "Malware payload (LummaStealer)", "value": "9d0c78e7d08e01fe65858d1e2c690af0c79cc209", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174781, "uuid": "0ddbcbe0-68a4-4b60-acb2-67d884945784", "comment": "Malware payload (LummaStealer)", "value": "5dd51ba49cdaf8558eeb3b105feb849c2b5de672f4e3f3e6912a21507477aa3683b06b753f66d0283e1e504ecfd53b99", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174781, "uuid": "fc82b7bf-24ac-4e97-8bce-6269caf8774d", "value": "T189B55B00FDD745F6E406263255E7A2BF2335AC090F32DB97EB443A79FA772A11836249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174781, "uuid": "b1123c9c-5d62-4a2c-a077-4b5de78866b0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174781, "uuid": "3f333f51-830c-4ccf-8fe1-d2d7de211d81", "value": "24576:NardcB0UZkg/L0UXTxs0f5RWHo81AWhcLwIaNMBzVqpj3yGyCYSINF06kFlN5vdh:NAdz+FsK1yiGyRNF06CvdHr+6bsJPJ1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785174781, "uuid": "5c6f477b-cbf3-4f8f-9107-5a1a2623628f", "value": 2483552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785174781, "uuid": "29d32b8c-49bf-4dd2-8853-81460b7bf2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174781, "uuid": "52400364-7e7e-464e-a8bc-15f1f2bf3a06", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59006fac-895c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785116514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116514, "uuid": "ff780af5-318e-4aa4-bdf8-5bc5a4ca6acf", "comment": "Malware payload", "value": "0df3e348d3cdbe261bad3914aab84797", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116514, "uuid": "5595161e-551a-4379-b1da-4c8bcd807360", "comment": "Malware payload", "value": "56f8e042eeb5e75508be62a8add15ea8552b08fde09a112cc7acfc67d49fe7c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116514, "uuid": "84a5387b-7834-4f71-bcde-f7d02bf9f897", "comment": "Malware payload", "value": "93381ddfd28c8ee0f38fd3a363999b38a589b790", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116514, "uuid": "6972e70a-3a87-4117-b985-17bc7fbf84e6", "comment": "Malware payload", "value": "0d30ab3cc0c06bb0fefc9261c9ad52e5eef82c01f8717f547ef07b2dc686abe1b7551eb81bee3340e6ecdfb4fd030fce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785116514, "uuid": "2e2ab3be-fff3-426b-8fb2-da34efcca2d0", "value": "T1DE236C661A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785116514, "uuid": "c4db0c32-554f-46f0-bc34-a6654a39f67a", "value": "768:4XRWNGxVQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:slxfcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785116514, "uuid": "f7142387-5190-4e45-9311-78c7e204a9d8", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785116514, "uuid": "e86a8d92-91ab-4199-9428-f03173235b91", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785116514, "uuid": "05e72f51-02ca-47a9-ad8d-677b53782406", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b8d917-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167570, "uuid": "119e63c7-7118-4d8c-84ba-010ca4917504", "comment": "Malware payload (Prometei)", "value": "5638a6ce75718f872720c582b4149865", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167570, "uuid": "3a4acfc5-289a-4104-8a7d-9d98095908f9", "comment": "Malware payload (Prometei)", "value": "5716037c0f23247c4baa92c9398fa8ed89166d38e826a528f2ad62abaff968cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167570, "uuid": "ef4b4bc8-e6ec-4db4-b576-739cb9cff1e3", "comment": "Malware payload (Prometei)", "value": "72844ef8b6afd26fa84f7a3d3e1beabe9d8140e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167570, "uuid": "f31ca6d6-7d08-46f0-967a-b6a2668737a6", "comment": "Malware payload (Prometei)", "value": "a28b689e6bfdd0dc98e023aab58ccc8f8715ca5767061fa88ed993e99876493afe317618058c93d9dd90d597db389e8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167570, "uuid": "905d3e28-3625-4250-b794-a8884fb8ca3b", "value": "T1349423FBD6C0430FCF16117C277A6E22D2C6553539AD6AB0C62CF8AE0E792075944EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167570, "uuid": "bfa49fe6-933d-4769-99d1-b167c6eaf700", "value": "12288:4h/taqLkdfH8ytYiflIw0BEmWVeygFurhCj:4YdkVLwKvyaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167570, "uuid": "7d71df5a-e019-49c9-90b0-d017ca48fd47", "value": 436277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167570, "uuid": "2e141ac7-529c-4fea-a0db-4d6097380a31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167570, "uuid": "ee98ab39-54e1-455f-b761-853211d42ed8", "value": "5716037c0f23247c4baa92c9398fa8ed89166d38e826a528f2ad62abaff968cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8027d223-89c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785159530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159530, "uuid": "29a12a05-0a60-4c13-8cf1-ded63cc35e13", "comment": "Malware payload", "value": "9d63e17ee66d55ff20f8467717e4fc91", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159530, "uuid": "0597b593-4371-4858-a19b-65a598d495c7", "comment": "Malware payload", "value": "57726a55e900f8e0237dfb3d6d3b5cb54acb5f88d19a30be3207f4f4575c4964", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159530, "uuid": "ee03d12a-c0b9-4492-ab3c-552e6d0325d0", "comment": "Malware payload", "value": "5f504f1090edd7d357ba92fd9d9615524b8345a5", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159530, "uuid": "f8f16273-f345-48b6-a8f8-2f8fbe3aee1b", "comment": "Malware payload", "value": "87d0f4fb5d3135e561618c402e499b5a2827050392a3024cce32eaf99706df15a7a8a751fa43b0f8610eec8d0a0b7e4b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159530, "uuid": "429ce700-db7c-4423-a022-5e6be7127f5a", "value": "T1E0363313D242F54BF0F2C33A2D73A36B60BA6050C72AD723A4B4672C95B7AC56B5D9C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159530, "uuid": "1b9232cb-7e5f-4a56-a964-3fb347e2b0c1", "value": "98304:6R/k3FhzZXUdzCdWaxICwjdylKnbof+0eGQ/0/d60uc:ZhzZXURCEaxIXylSbom0ACuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785159530, "uuid": "4344be76-41e8-4704-b6bf-324f83374afe", "value": 5017827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785159530, "uuid": "80812f4e-f23e-4482-b41a-f01b61f2b50f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159530, "uuid": "b74f07a0-94c0-42a6-9e47-ad7326e7fc71", "value": "57726a55e900f8e0237dfb3d6d3b5cb54acb5f88d19a30be3207f4f4575c4964.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8340b12-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785135116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135116, "uuid": "febc933f-9fe9-4f1d-a9f5-6433fd838af8", "comment": "Malware payload", "value": "522af011e2f4d1dd43f3611cd0c9e161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135116, "uuid": "01693f4e-4162-4d4f-ac5f-70636adc88ea", "comment": "Malware payload", "value": "57db9ad079bb09157381c3100a9c2842ac30fd087caa5da862c05e1415d7ed2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135116, "uuid": "bd8f83cc-8604-4313-a1a6-fb7143ecb469", "comment": "Malware payload", "value": "befa441bac2752a495f179408705c2c3639e533e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135116, "uuid": "4ab0c518-c930-48f5-8f37-298a50f53cca", "comment": "Malware payload", "value": "bf5c610c73df171a9d0034b09d8f9f85ebb950ee2b6a34146ad3ad207528cc2e8d8b1133d7143d007c0f0888e696bfd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135116, "uuid": "018c8b43-30ad-4969-b082-1ef86541d610", "value": "T1E99533E13504DD42DAA41CB77475DBB6C825CF869600962F472BB72F9B060F6BA1E383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135116, "uuid": "395bec0f-de4e-48b3-9d8d-e97d48d055e9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135116, "uuid": "2447195c-e8d7-4ee0-84c2-cfc46ec7bcff", "value": "49152:5ogrfS7iprgJdEE71U2HBSJh+IN0kJoqVjdc9UxfmFMMFj6:lCiaK21U0Y+RzqfNTMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135116, "uuid": "190edccc-dbe4-4c87-a758-1f6667b49b17", "value": 1899386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135116, "uuid": "5aa079be-e183-4c00-b685-3d09f51b5486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135116, "uuid": "91ad4711-df8f-4089-a06e-17362b5b7052", "value": "522af011e2f4d1dd43f3611cd0c9e161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c6fd2e-8977-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785127976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127976, "uuid": "529450ec-1bee-4a8a-8019-8902aa01e6b4", "comment": "Malware payload (Efimer)", "value": "7d3b80cea19400db61de4bc0d888678a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127976, "uuid": "97b8da4a-eed7-4018-998c-32de1b0c0a05", "comment": "Malware payload (Efimer)", "value": "57f1b48c51f1e97c3cc0c484d3ef005922128505cfbc297321d7a8f7f6ce1380", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127976, "uuid": "9f1f9c1f-1c40-4b8b-8240-5ef1a163e30d", "comment": "Malware payload (Efimer)", "value": "97dd94b8b74804d710d76d62f3e8837be24280e0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127976, "uuid": "997e3047-a88e-4aef-8eee-c62faaae6442", "comment": "Malware payload (Efimer)", "value": "9fee2ba433531976dd3458b371670eed702695ed7819a340e31b7fa143d6b9fa077582b94b6c7cde8de4b762ccb329e5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127976, "uuid": "4b3b5675-1cad-4f59-9e1a-44e762f65bb8", "value": "T1C7E6335CE4D012EEEC638139ACF2929AE27538714B31CFCB47749A65BE072A15A3D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127976, "uuid": "cde27481-10f2-4faa-abe4-723b3f4c3474", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127976, "uuid": "926e8880-74ea-46d6-bc49-47196fd06c86", "value": "393216:xdbRpGQQJefNMi9SIu+KUXMCHWUjXNcuI3/PGTAI:xDpNQ2MiLLKUXMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785127976, "uuid": "c64304d0-d0b7-4a3f-8db6-14ddf5f55665", "value": 14287369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785127976, "uuid": "435ff980-e999-462b-aa24-cf098576d0d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127976, "uuid": "7da230a6-8068-4c7d-9f3e-ddd07ef1f1b2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e887df-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154434, "uuid": "4990c0c0-a17e-46b3-9611-d662f522fafb", "comment": "Malware payload", "value": "878e4fea4fa330b38e991f2b1d1e4a4f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154434, "uuid": "a9b17df5-40c9-4fc2-b7f5-9e7050591c10", "comment": "Malware payload", "value": "58b863840db9aa4883e287502641409ddd1144038ff8717de984d60831bcf314", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154434, "uuid": "3fd5c2ba-6b61-4100-9541-eafbf4fe938e", "comment": "Malware payload", "value": "30b929795440c24991309e76c87646b58e85d019", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154434, "uuid": "c3f2e106-7c24-4215-b93d-27bc05556227", "comment": "Malware payload", "value": "70767fb844c6e07fe12cc3eb69d667d5fcf2bc862847d387823d548862043edcc2049586ddaa473f5c1785b5c153b699", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154434, "uuid": "5bd82994-719b-48dd-90ec-d0b36252f5be", "value": "T1D0110C1488BBC2ADF9D7A732F9451CD93513311A800123B71343E5EF2E09D631F02385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154434, "uuid": "b978f8ad-27d0-4887-a5fc-07dd152a5460", "value": "24:94cuQ2Cxk1SLDTh1Go7Uje8xcSSyoHgdh5JAzZmSRWhheY7IE/Vfcuevql:94coOHh1hAzcSSnibJAzZPUheY71/Rcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154434, "uuid": "5ff0949e-bc1b-4391-b6a3-5646baa4054f", "value": 1077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154434, "uuid": "69180ec6-4438-4924-b80b-3b467c40ab8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154434, "uuid": "5821e5a4-622f-4146-8a57-f70972271b58", "value": "photov_004120339608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4337ff85-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "d8988478-4d51-4eb7-bdc5-b67a01bd52fa", "comment": "Malware payload (Prometei)", "value": "bb4df787307b54b489cfa2f954873279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "76ffb816-9f26-465d-8b18-f42457deddb2", "comment": "Malware payload (Prometei)", "value": "58d98b94e804faa1bf528e3e4ad7923ad118b045ce9effd637721bc0704a009b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "37d0cbca-0b4b-4acc-9698-6bf2eef87f77", "comment": "Malware payload (Prometei)", "value": "1930994fe980c88f031b914fe35d57049f102ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "0e528b8d-b005-4fa9-9b39-383550ed4202", "comment": "Malware payload (Prometei)", "value": "a3ff552c92b9c58f4122ba8243abbe36cc1cacae261018a1beeb94a2631fbb0e3a773d64404cbb8eb366b581e75b8b10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "c9ba9d18-a236-4ebb-9463-64d77c158f83", "value": "T120A423B4F9219E9F6DD769B91B24831DE181C172589D4C2313AE94A34F3D732AF2CC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "aae98fbc-b463-4e06-9cde-0b7c364b6e1d", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdn:Fs6pyCC/Ya2hpi6T6N45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167588, "uuid": "cbda66c8-cf11-42ca-bc21-a9c3e68b7ac8", "value": 449086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167588, "uuid": "8628e4e2-2c27-4b71-affa-470c71e9e90e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "576ce27e-18fc-4945-beba-c78f98e25688", "value": "58d98b94e804faa1bf528e3e4ad7923ad118b045ce9effd637721bc0704a009b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc616fc-898e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785137969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785137969, "uuid": "948b576b-184d-4890-a89b-1a1cf8e6e6d3", "comment": "Malware payload", "value": "40641c81208a61e314451a180d1045e4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785137969, "uuid": "da5b8237-fb72-402a-b26a-4a4b9053d567", "comment": "Malware payload", "value": "59ac855c083990195fe49948635a2522cc973841c8fdc49800561f982d4dce2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785137969, "uuid": "761c6600-7957-4752-a6fe-a9baa6a55325", "comment": "Malware payload", "value": "9da17e13578fd53894e3bbdd23945e2bbcecd672", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785137969, "uuid": "ce3ae4b3-1184-46d9-a735-008606973be2", "comment": "Malware payload", "value": "1618ee96188241b1182d128775227f97491c693d41de3174a3404606dd6f3eb99d86ce8d28379c9c05572ad3f4c99f47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785137969, "uuid": "7757db04-5ac2-4a52-bba0-2f466385a1e0", "value": "T1CE236C651A857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785137969, "uuid": "2fc132f5-cba5-4ed1-b002-df264599a1cf", "value": "768:3XRWNGxVp9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:RlxUcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785137969, "uuid": "e4da77a3-8ad6-46e9-b611-e269c4ea6fab", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785137969, "uuid": "466e494e-03af-434b-887c-0f1f5ae3697f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785137969, "uuid": "c27b2f5f-70f1-4721-9e4b-16b96bd5bf49", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7b2b41-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154207, "uuid": "288aa383-a3cc-4e4a-95c4-372d0edd011f", "comment": "Malware payload", "value": "952939586db8d13d74d7eec53af8c3e0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154207, "uuid": "3b09c794-84be-46c8-977f-328b0e709f0f", "comment": "Malware payload", "value": "5a5403f3f8ccd034877300bc2f98d8859bbe52cf74a6a26203a60d68a59ef1da", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154207, "uuid": "2bb4914e-aa7a-4694-b889-9dcd76f05bd6", "comment": "Malware payload", "value": "fa4e60f75a20328994e4a27a6b6dc357950cdfe4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154207, "uuid": "23759384-b59e-456b-856e-2276d067138e", "comment": "Malware payload", "value": "582e53179fba79658d8df2aa2b467cbf5f11acb0bf0dd91eec9cf4236da563f54174b746df0aa0fcaf70eb68e0973110", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154207, "uuid": "8dbae2d0-c473-48fa-8552-bc18bc6cb350", "value": "T10A21B786AB1E8B84C903CF3924C62E4F02182D1CA81503EFBA032910AF62EE4E722354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154207, "uuid": "44241282-770f-4320-81e4-ea815cb11d96", "value": "24:9iIGgKeWs2Aiw2wF0TFP0iKoQ0/kmSSNp4mhHxq+RhwKbIGHXX:9ijgKDAqXAxPYbCKjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154207, "uuid": "b6689ac3-8f3f-479e-aea3-6104bf23893c", "value": 1267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154207, "uuid": "8aa0d6f3-7e88-4970-8246-05111da54db7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154207, "uuid": "34a29bad-37aa-452c-a3fb-e54eed6b1e12", "value": "photov_702888562349.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47236d1a-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167594, "uuid": "e2b02d86-3f5d-4319-bff7-3a80b579465b", "comment": "Malware payload (Prometei)", "value": "5f31264fd0ff12d16e2bdc00ca1aa9bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167594, "uuid": "4d81557c-92a2-411a-8b9a-5ef373e685a2", "comment": "Malware payload (Prometei)", "value": "5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167594, "uuid": "e0b197b7-dd00-4775-a952-280bb06aba93", "comment": "Malware payload (Prometei)", "value": "64ba56ced1e0e90c8d4452705796474c8ebb1704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167594, "uuid": "f74ec46d-0a36-49a7-a0d0-4c488dc79742", "comment": "Malware payload (Prometei)", "value": "00c37f434966330c1638350c5571d79bbf17d4535b2871f72ac0c2e6fd6683a56fb7506b98cd168262f0ce7133ae09ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167594, "uuid": "68abd175-b139-4d17-adfc-c2d1a5564af8", "value": "T14334BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167594, "uuid": "59141cbe-5c94-4f02-8c29-b24b05e10377", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167594, "uuid": "cbc82986-4f24-4b98-ba95-7ec496f83a72", "value": "6144:HGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOW:HG60BpL8jk1FGjDc8GVdOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167594, "uuid": "c7e29e1f-d32d-41fb-b7b6-a05c1bbc6221", "value": 245864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167594, "uuid": "aa091ae9-a521-4b74-bed1-a4b7ac949dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167594, "uuid": "d981e1f5-9cf3-4d0c-a7bb-bbb5d99ad34a", "value": "5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc219078-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143309, "uuid": "c5c1abb9-3494-4f62-bc94-e4b367e98371", "comment": "Malware payload", "value": "f757d5b909fc217bdfc3a1e973ef2f5c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143309, "uuid": "334f08ed-f4b5-4a6f-b991-76c39ff63845", "comment": "Malware payload", "value": "5b8477011d8cb25b61fe4b75cf04aae6b960c8b0bca18678a755a729f4288d41", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143309, "uuid": "20adfd98-5f9d-4c7b-a760-6de51419c978", "comment": "Malware payload", "value": "e395231ccea43fca0faa1264377cd30acb6a8f54", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143309, "uuid": "9995ca3b-7a29-4c02-b32e-bbde9e916c53", "comment": "Malware payload", "value": "831d028dc64b18cb6222491c6092cbcbc2e62d20d197a0d3d70ff7519f87e00a81601951689cda1867fd5969f1055917", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143309, "uuid": "88ea652d-281f-474b-a6d9-4fa23f106553", "value": "T15C21A37E49609818D9905AB268B67FE8366AC61C66857EC2020A7ACEBC8045A3757202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143309, "uuid": "75ab50e6-ba9f-4542-bad2-54039e94e532", "value": "24:9g75//fTvtvCVbBLJh6hdNAZtmb3mR7mSDu7Bv/DYJJxj7F1TdcqFmcccpYoRO//:9gtbvtqf/istkmR7PKNKjcD8bRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143309, "uuid": "567c0498-0f36-4d99-ac64-7d53bc29ba7d", "value": 1203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143309, "uuid": "2524a053-4d35-4902-a40c-7f3bfd2ae1af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143309, "uuid": "8664a653-f2d2-48f6-ae8f-a186f80a81c2", "value": "photov_866793662571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed55e5fd-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154129, "uuid": "8d616c2f-c6d4-4adb-8446-53099e83564e", "comment": "Malware payload", "value": "d03af745fb915a315215a6924bed6833", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154129, "uuid": "64d42056-74fa-4aa1-9653-86f5037577c5", "comment": "Malware payload", "value": "5b97c0b4d40865bb1841ef9b72bffcb13139958dca8df63e44a120fb09e42e5b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154129, "uuid": "7b49cde2-3d44-42f7-9ae2-46822004037f", "comment": "Malware payload", "value": "081ad50b3a4eb87ecc369fce566903f6d7cccef5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154129, "uuid": "693889ff-8943-4e91-8759-ab2b71558429", "comment": "Malware payload", "value": "4dd7ace10767ddec2d8626e8a22dd40a2ca0198f8c7e33cdd0996f434c8f8ecacbd10d8439562676d8539df2f3270e2e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154129, "uuid": "babfaff2-daf8-45fa-aa52-027f354fca38", "value": "T179215100C324EBA8E319A2B2D4F50D161119386C111E7E733BA77C99366E694A62D647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154129, "uuid": "867fb81f-d626-4eda-8b39-6514769c5c14", "value": "24:9P2IkOe5Co71NQgpzn5OrinB/452eTamYWIl54J0QZ9aJKJCpPnO21ZmaX:9P/je531vn0riB/452eTaj7lRQbawChR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154129, "uuid": "fd7ebb3f-160e-43cc-88e0-1bae80c1515b", "value": 1235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154129, "uuid": "fdc94223-588c-42c4-a060-86b5f3aea3e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154129, "uuid": "93c5da41-8b60-4771-9f81-95ef3cc2440a", "value": "photov_217639253336.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe69dc8-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143262, "uuid": "e1d45ac8-ecdf-4d4d-814f-ea3432dfac80", "comment": "Malware payload", "value": "4c12894895f3aa3cda7117c9457878b2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143262, "uuid": "a927d6d3-bb6c-4f39-bd81-3150f9753d6a", "comment": "Malware payload", "value": "5c425981b252fdf26baccf0202e966f8d1562332581bd0a138ded0631121a024", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143262, "uuid": "9b258182-6c49-4771-a136-2b1db324a56a", "comment": "Malware payload", "value": "b749862c31087762a818566a9c227da716324542", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143262, "uuid": "94aafdd4-c20b-4c98-a66d-09a8501d71a5", "comment": "Malware payload", "value": "21f81833ff59ef346924864bd143a3567e3b731971a2bbea242920ae3acb95f75e7e84826f7577d9b4142d65e513ed90", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143262, "uuid": "743677d5-aa82-478f-8ef8-39239c98c850", "value": "T16F11829C4819920CCCA29A77E853BBB215C903530503804B4AAF76DB3C09E86CB708E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143262, "uuid": "b6a72684-b62c-4185-aa8b-2e24e2999168", "value": "24:9H+I11bd6plFZC/EVP9+GCcW3mi7yuyAGmSvo+Jl8pN7bAFymJveh6CC:9HpVQE/EVkGVwmEGPw+kbAbkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143262, "uuid": "3f4e94f5-b770-479b-8b02-917d8de02d53", "value": 1110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143262, "uuid": "8adfc1e3-6810-46cb-b46d-6746547084ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143262, "uuid": "b86d3d84-37d4-428e-84ba-b72bdb56ba8f", "value": "photov_126470504990.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba1edf2-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158153, "uuid": "de6ec198-90b1-43ba-aa96-f913909ec869", "comment": "Malware payload", "value": "a94697d175375c0a73be4ad399f7a9ec", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158153, "uuid": "5637dc71-bd64-443c-92f7-4ed7e20d34b6", "comment": "Malware payload", "value": "5c97e46294f909275a1c63ba2d9e70570e60fca73faf21dd71b6ddb9472f26f7", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158153, "uuid": "5ca258b6-e325-4bbb-b86c-ff4621627448", "comment": "Malware payload", "value": "9a9cf147c42aeecc22cea9576cbeaabe987fe80e", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158153, "uuid": "d0262447-804f-4c20-b2f2-d87bc41e1ffe", "comment": "Malware payload", "value": "0694ce2c08d8b81b67ba831b75ea4bf5dd58e57bb6355e0d639bb5ab7bd3155551abfa0fb3237470e8047ba16abafa14", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158153, "uuid": "88b6a141-7aff-4fb7-95b5-766b73df7eb6", "value": "T1FDE38F6962EC560DE7FB4279FCF513844EBDFD713202D22DA49251916E00FE66E222B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158153, "uuid": "04d09e3b-d1a3-4e37-a92d-ad884838767c", "value": "3072:eW//sSed/T4pxzNiPXcLizVGwPKagTbTICPg:BsVd/T4pxzNiPXyihG0KagTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158153, "uuid": "46223181-f9a6-4291-b304-d1d015b00553", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158153, "uuid": "924ffc4f-7e11-4467-a4ca-78a132b76b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158153, "uuid": "96b33324-e1fe-4599-b516-d91d46c66905", "value": "5c97e46294f909275a1c63ba2d9e70570e60fca73faf21dd71b6ddb9472f26f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fade78d3-8974-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785127094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127094, "uuid": "7d9dd4cb-0195-4c98-9a4f-d08b021a2214", "comment": "Malware payload", "value": "27b642761139e62d105e2da0f3df341a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127094, "uuid": "0a000f55-1301-4059-8fab-7474e8743b6a", "comment": "Malware payload", "value": "5cae7777da045d7c7d9b921e83a92e3703e39c0d489204564d037c3634170537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127094, "uuid": "2b098e22-9834-4c66-984b-da19e4dcc133", "comment": "Malware payload", "value": "9f8ca8e0183874708a2082ac028f86e5a084b84e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785127094, "uuid": "dee0f561-af14-4850-b364-69fcdff9b6fb", "comment": "Malware payload", "value": "b95206a4c4c876e82bdb4b465248627b5ae688c49b4af0d621baaa5345c21a552d3d85ce3f5aa46341e9dc627f5722fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127094, "uuid": "c0924766-f1f5-436c-aaea-25d42f6471bc", "value": "T10806BF85B3C469E9C452DA399714F232C1B2B9238B76D0CB5A96C70A0F7BD524F3EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127094, "uuid": "94c8b9b2-25d6-4fd6-ba77-e49a195716f7", "value": "eb93bf99c90456554bb3e67caed24dae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127094, "uuid": "63a5a424-4387-46b9-bd81-0e01ff3b6a5f", "value": "98304:QlezT6H9h9mT/qoewrhV8HGCbe0a3ND4nP9DAg130HsOVZHZ+rWuYZAgkhjj200G:WezE9h9m5HZCK00NeP90g1EHV4WuYZA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785127094, "uuid": "e3b4d502-965a-41ea-87f6-4622c5504002", "value": 3880448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785127094, "uuid": "28ec6539-4d44-40ff-84df-650563173b8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785127094, "uuid": "dd450679-a4d7-4d98-b7f7-1d5ff21493f2", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b55aa6-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143211, "uuid": "d6cb3b34-5325-4304-bc60-95cea213d908", "comment": "Malware payload", "value": "68f132823b3163838616c91c4f8216b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143211, "uuid": "89b2bbf2-2221-4f1d-b9fc-f356db5664a3", "comment": "Malware payload", "value": "5cf6a143522f1147aacaac15e5c8ee5b2ae9b4d2e3dc196cb20ba9cd709a241f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143211, "uuid": "3bfa007b-0806-4c72-af23-1aed8b5136af", "comment": "Malware payload", "value": "b5d88c4555f2b6ae999962ab94311f1406a7e354", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143211, "uuid": "77a06f38-b279-43da-938e-a3f00349f841", "comment": "Malware payload", "value": "5e4b56ce25369dc217b259824f55e5cde345f0e27a1a03c5a8d037379c23bb48305617d986bd2f9d7ed7c081afb59963", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143211, "uuid": "acd44787-bede-4757-b9e6-aad834aaa6d1", "value": "T17421A388845DDC00E80DB179BD399C286C7BEAA72B088B829B1D74763F8AB401B41D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143211, "uuid": "a150e784-b17b-4db5-a5a8-a332767d248b", "value": "24:9W9MnucA6rJ/qSE8Cw9L/RQRwHmUyBXk7mSDHIctxi6HBO1afh6wITY5:9W97cAGdnE9mL/Rmf07P0w+Sh6g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143211, "uuid": "f1601e3d-550a-4cac-b4eb-85436b1b630a", "value": 1218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143211, "uuid": "c491c704-c320-42ed-87ed-12b1dd99e6f7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143211, "uuid": "a3d7bd3b-e1b8-4076-8499-fe2eb9918f7c", "value": "photov_642473740476.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c1f9e5-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132959, "uuid": "f31b835a-0522-4e11-b1df-39c9553b22bb", "comment": "Malware payload (PureRAT)", "value": "fcf6cb9b438dd3ef10082cb7491d4b03", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132959, "uuid": "1a4c0313-cc02-45a5-8788-f60687d2cbf9", "comment": "Malware payload (PureRAT)", "value": "5e0cddaea1be9e3fdea48f04a50b7596886218247ec427cea5288c7222a2a971", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132959, "uuid": "615ec018-a680-4e8b-8994-71c53ae025f5", "comment": "Malware payload (PureRAT)", "value": "962793a998728764922cb46cb888c228dee9b162", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132959, "uuid": "cba8d029-4552-492c-8b88-de30b2410d18", "comment": "Malware payload (PureRAT)", "value": "b7896c2faa1877e2303dc8309ff08be86d09bbcd509cb1aee724f80337cd8ad83e51e60dd87891ea8f29cdb0c8b21b7c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132959, "uuid": "a5e96fa7-43bc-4c68-9481-ac0d288a665c", "value": "T1441186B39789C807C747C07A394655593127C0118508B8BE07B2E1B23C56AE8EF68891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132959, "uuid": "2405191c-6512-4736-b685-f822869c1184", "value": "24:9Jrqy0oRdOnmlaBtLcAfz/SZmSH/vuQ04NWyYDxlaeaQtt/zTh:9Rqy4BRpzmPfGQgNlpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132959, "uuid": "771a43a6-a826-492b-a8ad-f2235c22d08f", "value": 1101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132959, "uuid": "33583914-bee7-4abd-9eaf-80e3010cfd2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132959, "uuid": "3a9f3c28-70fc-4905-bfe7-0926e79aff80", "value": "photov_751211658502.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd21dbcf-8986-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785134748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134748, "uuid": "e0f1fbd0-103a-494c-805c-27b9aa1e39a6", "comment": "Malware payload (XWorm)", "value": "b586161099457d15be4b9197bef2a69b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134748, "uuid": "1b9ae2e2-76dc-4b38-9255-c85f9eeda06b", "comment": "Malware payload (XWorm)", "value": "5ebb6029b2a15632ccdd3255cd7662f347443eb3018d71f215eb26ab9b905313", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134748, "uuid": "d8e7f353-90b7-47a6-8fbd-b63774d69004", "comment": "Malware payload (XWorm)", "value": "5be27bef29e7fe8d58dc315549bf7cf6cba298be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134748, "uuid": "bc23d0ac-74d5-4d03-b0f2-fb0d778c4c86", "comment": "Malware payload (XWorm)", "value": "112227da37da9a16cc990a6acc851210e1df71ff91132128f8499803da1a61fc9e64fab783986ca132c0a139f92fddf5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134748, "uuid": "1ec1c4a9-f1c3-4deb-90de-83144b3334d1", "value": "T1E775F9F78F7910428F31A575C90A6548F917165B08FB2C0978B6CB487B71AD70A82EFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134748, "uuid": "bd63b017-95ca-4022-9a0e-c0f451a607b4", "value": "384:eXj9sZXOXdBCNXfmZrMqplMFNl9Csc3Tul+dbaOzGikwj:mskyvEIq4FdA3Ts+dLkwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134748, "uuid": "6a194041-65ef-4578-b27e-cd6f9d3f0b07", "value": 1689611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134748, "uuid": "32196547-5c80-40fd-a95f-766a757a70ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134748, "uuid": "7b6e4e36-bcd3-4847-8b37-0ca262747677", "value": "Recibo de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec52ae9c-89f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785180327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180327, "uuid": "67af90cb-0e5a-46bc-93f0-3d1dd49aa660", "comment": "Malware payload", "value": "1e17f54abf748ebc9edf992c331b5bad", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180327, "uuid": "819f6ea8-9e2f-40e0-ab9a-9d60eed81081", "comment": "Malware payload", "value": "5f608a5c28bf9ed0f844d755d7140efd584866c0e8aae84ac15021e93b48059c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180327, "uuid": "70db2a32-cb79-48ad-bf6c-b184d35956bf", "comment": "Malware payload", "value": "e1bf4387221b994db7c94d9571862c231721a8e8", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180327, "uuid": "3ff9d946-0650-46b4-bb07-d614fd0e780a", "comment": "Malware payload", "value": "54acef35593b7dd173148a9fff0f9156c87214801b5f59d702adfb66c21b8054502831077a32255e5a849cc422c8555b", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180327, "uuid": "a8199fd9-c592-4cbc-91ac-7e94d067a254", "value": "T101F58C077CE049E5D0AE973188A666957B31BC494B3273D72E50BA383F727D09D3AB48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180327, "uuid": "f5cea73f-702f-4181-8070-6c3485b41f1e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180327, "uuid": "7b4e8ab2-e62e-44dd-a097-45e434b83c59", "value": "49152:wffgUtk0taRLM/xuWpHZb1hr0+cIqIVajsy72k3kGZPLeXcl:wfoUR7BZb1hr0+cIqIV5y72k3kuPLRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180327, "uuid": "3ac09d5a-9bc8-4fe9-9022-402e13fcb2e1", "value": 3370864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180327, "uuid": "5b708901-c024-4419-8eda-267ada33c08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180327, "uuid": "27a73ed8-649e-4eaf-bdd0-f58fb45bb404", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8180ff7a-89db-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785171128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171128, "uuid": "1167a81a-898a-4ae3-9486-c897a217b455", "comment": "Malware payload (RemusStealer)", "value": "653498f67781d06904988a7c36d7097e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171128, "uuid": "94bc7c57-ae85-47d7-b5f9-de5e20ad183b", "comment": "Malware payload (RemusStealer)", "value": "600cf8533d43cc3b073ab18ed728cb4c9c037870c53ab8f0eb66bf225a3ac7e3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171128, "uuid": "583028c6-cf51-4758-8f9c-b0c04e955cff", "comment": "Malware payload (RemusStealer)", "value": "91b31807f78c59ac463c15e2a4a94d3e4ec85958", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171128, "uuid": "94c458ae-2741-4b7b-9afc-65b42152e45d", "comment": "Malware payload (RemusStealer)", "value": "5ccb8e09033b69834430bbc67283a26c930e6291d6994ecb0bb88a16a2fe869ed7f8e57e2eaeb53c258a18a5f5ee8a3c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171128, "uuid": "cabc769c-4961-49a7-87d2-428a33b88a6b", "value": "T130A58E203BEE1558F2B77B35D6E26955DBFFB3726A06CE8B0102434B0A52602DD8F935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171128, "uuid": "368309a3-be55-4780-a67f-ef78bd4dca54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171128, "uuid": "e994f313-ba9e-4d1c-9ac9-9c3b9d7fb263", "value": "49152:5NMad8ywF2luB6Eh99VAtqT0AOnHwoxdQ:5NMvXrnoqQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785171128, "uuid": "601177fd-0291-4d40-bc3f-8eb6953f2cf5", "value": 2199040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785171128, "uuid": "d4b23d99-001e-4b1f-b7c3-57f8a970c2ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171128, "uuid": "17237370-9054-4f9f-82b7-43ec23965d53", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da05b4e-89ee-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785179282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179282, "uuid": "051566c6-99d4-4728-b5c6-d8b0cd6f2cbf", "comment": "Malware payload", "value": "8dd92ead7a71b6e80f7cf1530b40b35a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179282, "uuid": "44531ee6-86ff-45a9-a67b-976771de492c", "comment": "Malware payload", "value": "60a58ace3a7f7f4e64651307b54980c888b39afccbc36c08044e80919ca918f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179282, "uuid": "4b473ac4-209d-4d17-b307-ed3d50ba5687", "comment": "Malware payload", "value": "759bc85d98efb432b31f772e30c09a36420850d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179282, "uuid": "0033b4a0-5185-4c13-bb71-d24d3db5ddf7", "comment": "Malware payload", "value": "cc7958a310e8c2630968ed75d23890dfec58a5a23257dd4f483bbe348e0e68ab31777a4f127b9a881c18ac0e85df55bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179282, "uuid": "a4143490-44d3-4edd-ae42-f84288f6ded8", "value": "T1C073075ABD419F05D4D526BAFF1E438A33536BB8E3EEB102DE145B2527CA91F0F2A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179282, "uuid": "57cd6984-ae9a-4342-8a33-a469241d35a3", "value": "1536:QknVtg3U4TU5gE3BGfBC4ofvNWsVVRgb+V5txlKR0+kdlnji1WOBS7Je:ttg/1Ex5vwsTRG+V5txlKBKsWOBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179282, "uuid": "af3a9f46-50f4-4d85-a3d0-b027af658137", "value": 80712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179282, "uuid": "11a291fb-87b9-40ee-a2a8-9cf9c427d25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179282, "uuid": "5b3bd381-5be1-4d0a-a820-8e0619efe5bb", "value": "BHRm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6213e20-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154144, "uuid": "13b51a3b-a939-4635-8cad-3880c6ec5832", "comment": "Malware payload", "value": "90f84f3647e2384128a16bb2814cdcf3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154144, "uuid": "b952bca6-d0c3-467a-ae34-d48c531f6eb5", "comment": "Malware payload", "value": "60a9d7ae0ba39157a6e701c95369749f5599ee8831a7b4c52526a83b40df519f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154144, "uuid": "973af621-5b9c-47f9-a3a3-76193bc2c334", "comment": "Malware payload", "value": "4fc758daaaf9dee0a251378d6bc63d1eb8cce020", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154144, "uuid": "58c06c68-9e03-4507-9859-f4434b78f440", "comment": "Malware payload", "value": "3720de76c3f5e4b2dd7a4aa5a88dfddb072b1c10915f9be773a17b4b410b0bd163f55f61ae16bb03e574a0f1a0b2a7dd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154144, "uuid": "6656a2c7-321f-40f8-80a4-9f0ff754ae50", "value": "T18C1175DD44A96C11EC0441B2BEFA66403E61948D718855DB3277FF834FB54816F5C5D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154144, "uuid": "eceac873-7781-4503-9cd5-258f53dd2423", "value": "24:99H0RcQ/SqyHy2SHUc6JtLBuwRW9463mSI0FWyheRfU9Av:9q7/MjJtlu394iPIXWe6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154144, "uuid": "e3b2d35f-394c-48db-bbd6-60d4068fd51d", "value": 1084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154144, "uuid": "92de6fb2-dcc4-4c65-aaee-1b4280742174", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154144, "uuid": "baed0bc3-d19f-405f-8499-961f62887acb", "value": "photov_995715268199.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e85d8e9-89d5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785168573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168573, "uuid": "1be8abcb-9701-4a4f-8f8d-e6db75f0ab8f", "comment": "Malware payload", "value": "9e0ce52338351211fec9443046441d03", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168573, "uuid": "ce8de47b-b073-4f3c-b37b-a9063a79b2cf", "comment": "Malware payload", "value": "61351d869940b9875400bf4ebd1bdc29f972813473a823acc85db242487212bc", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168573, "uuid": "250611f0-0515-4838-8f27-6655f111fe29", "comment": "Malware payload", "value": "adb10affd67132d102a5b8a5ccb3282fd65c579e", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168573, "uuid": "30695cf2-6451-4597-a792-72eed915c9a8", "comment": "Malware payload", "value": "34cc563078d04d64b12926a23a58a856a068c16a2753fe26edaede91c3521cf5c92f9b5e29c6fd1ac1feb03063d75b30", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168573, "uuid": "e9185e2e-ee55-49a2-b789-d8a269e663e6", "value": "T1B8223BA7FE254880E5CBE992086D6EE71F56D227280DC4C8B00CA46E4FD13D0563EB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168573, "uuid": "6e339b77-9399-4f16-bb0b-1ef2bf643ca6", "value": "192:wgxCP15F6XA171xfM9Vu6p6K9nTOvR/SgP/ZLaRJ9RgW:w8CPdfMUZJtZLaZKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785168573, "uuid": "faa8453d-34cc-4b67-a767-2a18f3bfefb3", "value": 10771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785168573, "uuid": "3e189954-aca2-4604-91dd-42f3f7af0b1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168573, "uuid": "d586259c-269c-4ab1-ba11-e36dcfb56128", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb8add0-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132954, "uuid": "7ec625b5-4529-4fa9-8f04-29df4102a8aa", "comment": "Malware payload (PureRAT)", "value": "ca06129db04047c4068c3c415fefb127", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132954, "uuid": "cc63c0fd-93a5-41f5-9ef8-6efdfdf2747f", "comment": "Malware payload (PureRAT)", "value": "627cdc705609305e06e5a852d840457636517650ad17cb13f8e8b5b0fede07fc", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132954, "uuid": "57be6673-a55d-4d46-92d8-7f27d1959119", "comment": "Malware payload (PureRAT)", "value": "845a74495e4febbb96d8157bea58c45639d45204", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132954, "uuid": "40949ad8-89b8-4178-b7f8-f3adb9e4dfd1", "comment": "Malware payload (PureRAT)", "value": "77c60bb936ad2625b94b526627fd77835577e6abe6fff07ec02bf5c505025839eafcbd6c60387359a0766b9476299852", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132954, "uuid": "6b6e7120-ad7e-41c2-baf1-7fcb60528094", "value": "T102218648C54F8FD4EC3D933555B0CF1055302023E549D69E37925646F717F9A5705361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132954, "uuid": "4cd2017e-09e2-4a4a-99ec-1f3655558524", "value": "24:9Eekduq5j7FMjOzwbEfWQjIwZt3xmSziHO4JmZXTA+tl:9w5vFMjOzwcBHxPk6Z0+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132954, "uuid": "c050d74d-d84e-4afe-a81b-7def0fed957b", "value": 1130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132954, "uuid": "1fbf6252-695c-41ef-8ae6-be9df84d6143", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132954, "uuid": "8a24c149-26ab-4d97-95d7-b8a652536302", "value": "photov_775397014933.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b60f572-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167602, "uuid": "62b4c725-0d70-417c-bedf-35fe6700181c", "comment": "Malware payload", "value": "1812760de7bb4c55af21a471bace2b69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167602, "uuid": "19b38345-4b67-4896-bdb5-1d1a1451d35d", "comment": "Malware payload", "value": "62aa24a3c6db58a1937ec12790ac107625f70086f7a87e4a5eb2f68bcbe56af8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167602, "uuid": "5bf84c5c-f6e3-4e40-a0c5-4e33c61dc1c8", "comment": "Malware payload", "value": "89e486407970bd8c13130b08f244fa0238b76132", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167602, "uuid": "b5f02692-60cc-4182-b312-682c0f23c2fd", "comment": "Malware payload", "value": "814adf5bf6a144127872b3f7408bd6acd9f2639bfc1f180edd512f02e9c860502584331931b5f1bfb94e47f73592d93b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167602, "uuid": "de4b0dc3-a966-44ee-a709-22eae5f44293", "value": "T1D1D5E857E49590E4C0EEE174C726A213BEA13499073437E36FA19BF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167602, "uuid": "3dd3385f-0163-4d06-892e-367f66596f5a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2I:cqYUQuVDt0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167602, "uuid": "591eae97-af54-4a43-b407-f368865d31b1", "value": 2752512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167602, "uuid": "fd4abb57-b2a8-488c-8c70-ace43e8dc009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167602, "uuid": "5d2ab46d-02d8-4280-85c3-ec6f640fa3ea", "value": "62aa24a3c6db58a1937ec12790ac107625f70086f7a87e4a5eb2f68bcbe56af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30606bb-89e6-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1785175963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175963, "uuid": "1dacfcb3-874b-48c8-9cc5-f21c8819255b", "comment": "Malware payload (HijackLoader)", "value": "17005c9a5f2a9a57fe71ced46712c688", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175963, "uuid": "b57c145f-4971-4eeb-88cf-1b0bba0145e3", "comment": "Malware payload (HijackLoader)", "value": "62e631c68ba9392dc91e19cdc4f5e00bc0e303764c9f5c27ce2be6bf40bcc933", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175963, "uuid": "e611a7f5-32c0-4a7b-ab31-16130f134d36", "comment": "Malware payload (HijackLoader)", "value": "58a7e2f5ca176afbdeffc8634bdb5bc105b91dde", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175963, "uuid": "2c997317-c590-4714-bd40-7f2dffa4790b", "comment": "Malware payload (HijackLoader)", "value": "6d321aa4609a2372365c50938bcc52ee36a029b858cd69a8a8ff516dedff6920da4e8ac2dab034154116753b6a733b29", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175963, "uuid": "8af77169-6597-4828-920a-a13559144211", "value": "T121B63319B7CF46B9F185703D02A6C48ADE1779250DF4B09B0CB8E61E0472B866B7D7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175963, "uuid": "492382ac-4a04-4068-b0f3-e9bd8b3414eb", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175963, "uuid": "9bae3be1-8335-4653-843e-d95486bef5fd", "value": "196608:b7q9w+v4f6LnwYtbPMF++FAQZKgjzgmcK7gkmP2sZ9ZObwWa6zXUCd:y9wZAwCrQHzA6g52sgblzXUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785175963, "uuid": "a0d4ff78-6b56-4ce2-beae-4ca76f99e86d", "value": 10788275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785175963, "uuid": "e9928512-747b-4da8-b3cb-84d5e9df5309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175963, "uuid": "25d63b7a-3047-4544-b251-07c7bf3506c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bc5e66-89bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785159294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159294, "uuid": "c16ba4f9-ad53-4c84-9e7f-1092667a6017", "comment": "Malware payload", "value": "df004359422fbbb6f2a77c726ca9d73b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "storage-googleapis-com-protesto-att", "colour": "#9A7B4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159294, "uuid": "910ee5a7-d3f0-46fa-a85b-b252c26ebe41", "comment": "Malware payload", "value": "62fb998ace58145aeff084000ed602365cecc9c449beb06d092ddce7b9ce6f41", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "storage-googleapis-com-protesto-att", "colour": "#9A7B4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159294, "uuid": "382b7aee-0721-4baa-a3c1-cb29df89e33b", "comment": "Malware payload", "value": "76ed09c9e3ea04417551eb4bd277e5dd2ec6fecf", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "storage-googleapis-com-protesto-att", "colour": "#9A7B4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159294, "uuid": "b90912d9-aff8-4228-ba47-a8b1bbdf10a2", "comment": "Malware payload", "value": "35f0dddf1951f72e598cc7e9181f110837e45418c6710a82cd10b53579f0e1ee7e4e4681d20a1583d4336f71692826ba", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "storage-googleapis-com-protesto-att", "colour": "#9A7B4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159294, "uuid": "8eb5abf0-2e87-4055-a3b1-6f472859b921", "value": "T1D9441A17B3632CF8C667C0398697D771F432B8590324EE6F0A98C7332E61D950E6AA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159294, "uuid": "22f9c228-ed28-45c4-b0b3-c7931688e67b", "value": "664129dfcabe243142bd5f85fde224d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159294, "uuid": "ebb571fa-be85-429f-a4f3-fcccc96f46cd", "value": "6144:1tnY0RjLbfB/oOGBHKnTJPjhHAPtUNThp0cZ:1BYqb6BHKnxhgPEhp0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785159294, "uuid": "1562e188-6b91-4e04-8417-52a97959b6f2", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785159294, "uuid": "99dab3bd-93fd-4164-abee-71874a23bc29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159294, "uuid": "699fc583-79d1-4467-bd7d-a494ddd2e9e1", "value": "62fb998ace58145aeff084000ed602365cecc9c449beb06d092ddce7b9ce6f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738c2d0d-89c2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785160368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160368, "uuid": "6adb7106-27d4-4f6a-a23a-3951bc23c626", "comment": "Malware payload (Efimer)", "value": "fe1f23de8bd1e84ad1a33939638144ee", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160368, "uuid": "5e2bff58-bdf5-44c3-9d54-b3acceb9648d", "comment": "Malware payload (Efimer)", "value": "6342bad7408a482326ff663f94f092e5c8e7757f83a6b4a3c39b80e113338c0f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160368, "uuid": "2cc365a4-d813-435f-8f99-b40210b2835b", "comment": "Malware payload (Efimer)", "value": "ed62786497220ef110a774aebe24e400f0ed8517", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160368, "uuid": "0a86882f-dbac-4b3c-a125-19509e8bf3d4", "comment": "Malware payload (Efimer)", "value": "4e60d4ffefe237c52cf07ac2b9f58f3514ef1d0cb88fa3574a67d0cb29246e7bd75345031f38b84d8a99ac5c137aa943", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160368, "uuid": "1766910c-5033-4e1f-b4d7-fa0aeed9591e", "value": "T1CDE6330CF6E012F9E777913DED9265A5D0A874276B35CADB43A853613D4B0E08C3AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160368, "uuid": "abb3498b-cadb-4405-8aeb-fda16a6f4587", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160368, "uuid": "8e6f1157-1e32-4be5-b644-a3ba633e9586", "value": "393216:8pY1mwDCC8ERWbcsXMCHWUjXVcuI3/PGTAI:8pYoQFRWwsXMb8XiH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785160368, "uuid": "0b67ab3d-3f15-438d-b48a-545daf881c41", "value": 14289442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785160368, "uuid": "229e13aa-2b83-4396-bdaf-8ca513111e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160368, "uuid": "6a1113aa-9b39-4499-a0d8-94cd54c84f04", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48924d3b-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143545, "uuid": "383166de-efae-4951-80e6-c9fedcc01f50", "comment": "Malware payload", "value": "0aa4106d38302f055ccc67d8f09df260", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143545, "uuid": "1cbcfe77-bb94-4da1-8ca2-4a3f6686828f", "comment": "Malware payload", "value": "63e0e543dc693406dcf5319974da6a0ec1d200e756b54c6d4736ff1021742c74", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143545, "uuid": "879e0c8b-8b8a-4757-916c-5bbe283c0f60", "comment": "Malware payload", "value": "4c92e0ecc2ecf3ad4759f59576ef761c753878b7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143545, "uuid": "07801ed4-be8b-42b9-835c-f3ed2a5c06de", "comment": "Malware payload", "value": "4518efec8c72ea23e219046e6e27eff58dc01354abe7fdd39489d50b57b9883e4494e878bfd896d78de0a8ee2af2ef93", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143545, "uuid": "8c4c4420-e55b-4671-8d22-1d9a71f31604", "value": "T15E219590F0B84C72F5AE663B4824FE94920426300959B86B27C9329D7F64EFC27C8785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143545, "uuid": "55c2a2ca-2c40-46cf-8503-18f50b94d1f0", "value": "24:9XPdTZqtSZQ+N8tzAaDw3CI8c3z2jNjyuYZmSefJWhGY766kIdBYwGPmryjYa:9XxzZaO3CIBz2ZmuEPKcGY7rlTdGjjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143545, "uuid": "5eccabe3-7628-45c6-8853-0bbe4fdc87d1", "value": 1325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143545, "uuid": "15ddf8a1-b306-4669-94be-6a473f7abf08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143545, "uuid": "4947f40f-f7e4-4107-8af1-cefdf562e603", "value": "photov_985193696220.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156929ec-8985-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785134010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134010, "uuid": "ae8e5636-15f2-4ebb-9ab7-88c8dc4e7090", "comment": "Malware payload (VIPKeylogger)", "value": "b213dd96c7133c5cc62f1183342d6874", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134010, "uuid": "125e3504-18eb-4330-9bb3-beb9016574b2", "comment": "Malware payload (VIPKeylogger)", "value": "641e47f36c91a4ce819a2bd2bcd54ab000363a8c1e3f17273f04b58a2c4e5e73", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134010, "uuid": "28c6f55d-7e70-4df7-864e-d0469786f091", "comment": "Malware payload (VIPKeylogger)", "value": "ee24de0f16a82862c97b767e872a407e0f3b2847", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134010, "uuid": "88109f44-6792-4836-87f6-ae3e662ce27b", "comment": "Malware payload (VIPKeylogger)", "value": "31922e92901d3542f000d64a41f03419a4a50d4a922f4af6319a635d9f17c71c6e2ea9be6110278ba3b718878e85956f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134010, "uuid": "34a13240-e1f9-4a75-9bbb-e123e06b2d82", "value": "T103469F606E5859F5EF8C290E90AEAF1D87F042176A33706BFB41DF05BDDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134010, "uuid": "bb73f07c-7e1a-4a8a-8803-dab20c33a497", "value": "24576:u7jFe7R7l8UkJCbONMHeZ+2u3RtM2qaDtIhH9NaZlK+65ZaL47HReAZxVYmk5DKh:vVY+D93O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134010, "uuid": "cc8987ab-0051-4973-ace1-c714224f93fc", "value": 5506178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134010, "uuid": "18aa9617-161e-4dce-8ecf-2738fe87bd8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134010, "uuid": "00aa762a-1f36-4988-92a8-c963c2dd4f31", "value": "Order_description and specs..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deff04c3-89e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785177298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177298, "uuid": "7752985d-fb2f-42ea-a13f-20b8ac455fe4", "comment": "Malware payload (Mirai)", "value": "f4ef04adbc770071a5f11b3be1072592", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177298, "uuid": "50d7bd22-6461-4443-b649-f76f4b5264e7", "comment": "Malware payload (Mirai)", "value": "662cd578323fc9cfa37332bf9148479a99e67b61c0315e09feda63ac9761878f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177298, "uuid": "bedc6e21-be23-468c-9ad5-4e43c59051d4", "comment": "Malware payload (Mirai)", "value": "aa9220315c22188a4478e2fbc5ab16f6ce33936b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177298, "uuid": "ec3165ff-9f95-4c78-8938-b326c1f31cf9", "comment": "Malware payload (Mirai)", "value": "8a5e65b8c9c742454c0e283d078b3dbd01d570c668df4163d396530dad3f2d3ac24577c611237926dad236e18a0e5209", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177298, "uuid": "a9d8b493-d8b7-4d59-89f7-fed147aa430d", "value": "T1E501AFC6D224591040DD992C31976855F872C3C6168BCF74BFACA43DBB4CE14B027F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177298, "uuid": "ef891c26-ec8c-4f79-a45a-ee7743ca5d61", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaSC5FhV8CQyhJSCLfX7nQCrjTECHoBX:kXCKysE2hi0ziQvZohaSMCxmsfGCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785177298, "uuid": "b79162c3-6f9b-4aa8-bafa-92143218b032", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785177298, "uuid": "eac51716-6d20-4669-b5ac-fb515a790d6d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177298, "uuid": "583cdd5b-bfdc-4fc6-a32c-82b2df3213d4", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa567866-89a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785145991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145991, "uuid": "bcb6b577-44d8-45a7-8487-bc7811d87331", "comment": "Malware payload (Efimer)", "value": "7e542902d164df31090dfdb93c7f7486", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145991, "uuid": "1913f232-36c4-4c9f-b7c6-aa380934d0aa", "comment": "Malware payload (Efimer)", "value": "66f2a666a7985abd1dfe98e4053ab5d8876a3db7d1c18b3b999b6c9491b3cd73", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145991, "uuid": "0b53fbbb-53d1-42bb-b52e-58d2b2a21693", "comment": "Malware payload (Efimer)", "value": "377bea168a63f8d7b2e13e249755cf895d683b6f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145991, "uuid": "ec9c86e4-6967-4e7d-8b54-7e8a5b55ac76", "comment": "Malware payload (Efimer)", "value": "52336be4de98f8d743a2c0d6508410e446d36c6d38e6fec0807c510e9c7d0adc17d5ea6521377024a061bb985c508175", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145991, "uuid": "c0eb1d4e-9a67-4f72-8f8e-134ac0a340c3", "value": "T12AE6331C62D002E6DAA74178EEE25292D57974BA0F31CAD70BA492523F673F1CC3D726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145991, "uuid": "f5c624a5-a806-4091-8074-e16876bcc8ae", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145991, "uuid": "d55419fc-9dd6-44a5-969c-adb1536b3c90", "value": "393216:hhtAKKifpnA2KkkXMCHWUjX6cuI3/PGTAI:hwEA2KtXMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785145991, "uuid": "606bf575-f943-4881-9c28-1deb4b6b1e0a", "value": 14260308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785145991, "uuid": "8177b66e-d9e4-4092-a3c9-93ca08108dc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145991, "uuid": "3eafa215-d5eb-4c3c-942c-dfcdf8916308", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be9a66b-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1785156436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156436, "uuid": "3705bd6e-5a3f-404e-b171-3deec4ef86f0", "comment": "Malware payload (Gafgyt)", "value": "b69ad80bc0b46c5f61cd45d2321d4122", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156436, "uuid": "75cca99a-4674-450b-9aca-e69595e30bc3", "comment": "Malware payload (Gafgyt)", "value": "6704d9f607de485227d377b79840e59f65ad8e5a47883c08e86d3bdfccc91b3a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156436, "uuid": "7c780a7c-a7c5-432f-8a2a-9f9cdad3bc0d", "comment": "Malware payload (Gafgyt)", "value": "a7f92824e0155fd5f603a20f67195d02dc985e5d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156436, "uuid": "28d378a9-759a-45eb-a1a3-0ef4ef7f694c", "comment": "Malware payload (Gafgyt)", "value": "75be5365e36d6be0f5fa1e384ff61ee9f2b8e19771ac841b24b99f36f9bba1a9bad69aae92ed846283ccd9bd41ca1fe5", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156436, "uuid": "290c6ada-c8fd-44db-9fca-1d35b30e67a2", "value": "T1C4031953269290FCC8DEC13446AAF63ADE72793C1335761837C4FA27AF9EE125A2D150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156436, "uuid": "f7873354-fdc1-4566-858c-bf2e16857f88", "value": "768:iN/I6VP2u5+fWmNmsvVfLGcSfYMXd1hX9eesyCJfH23xoQzH:y/3uumvqfYM5X9eeafH1Qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156436, "uuid": "cca7b227-9086-499a-9b91-c13f839bb799", "value": 38600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156436, "uuid": "6d387686-223f-42a5-b1f5-e7649045d098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156436, "uuid": "e73efea5-ebc9-4445-80e3-3aee14e946af", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a678161-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154286, "uuid": "00d43787-d579-4738-99bf-6a8ba9954df2", "comment": "Malware payload", "value": "03d4f9b1acd8dab9ac0c7d1624545e17", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154286, "uuid": "cab0b55d-c063-421a-ab52-8318ba399118", "comment": "Malware payload", "value": "6805bd82246d301195abd888f2d0c1d01b942f89daf0db62dc84b9a0827eb931", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154286, "uuid": "47117978-75ce-4c39-81de-88e821c334fc", "comment": "Malware payload", "value": "7f2cbe9db680aa026f5615249a0a616bc4c14a17", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154286, "uuid": "20c72a3f-94ba-4a2d-a9bb-74871520b9c3", "comment": "Malware payload", "value": "29dadcc81a8b992639d0367848588c31aca4cfae636fb5507101bbf487708f9f319bd05f8c1c04e4e3481b3d3d84bbde", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154286, "uuid": "f4ea55bb-9e7e-43e3-9900-75497b0bfa88", "value": "T1002186D0CE8A5855C8DEDA33B7362A2658452295247780F317572247BE8ED411B90FF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154286, "uuid": "10c6ea1a-c36b-4665-8b6d-f38f5b255716", "value": "24:9FT4i0thOIo9UvXYJDXmS9mq+Jl82EBGTpA:9/0thvoJTPX+lE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154286, "uuid": "09b1e378-9ff1-451c-825f-53de0c8dc9d9", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154286, "uuid": "6e2d773e-3408-43cb-840a-24b274bf86be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154286, "uuid": "ed648e23-6811-4fd5-a618-4254664f2ac2", "value": "photov_527458961268.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe6ccf8-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785154080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154080, "uuid": "8a5eddbf-e5fe-40ca-bdec-473f9b77b3dc", "comment": "Malware payload (Formbook)", "value": "8b16078368b07fad3b2a533d9182532a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154080, "uuid": "4c41e63d-07e7-4a6e-8a51-4a5f7fdb51ac", "comment": "Malware payload (Formbook)", "value": "68105f85b33f67e9a989949a4aec08a2c73fae1d8c90e0b42987fa136e9f1635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154080, "uuid": "3ae00a4b-7e31-47d5-b431-a579789bb9d5", "comment": "Malware payload (Formbook)", "value": "7317908e5c6faa2621d710a1be527350f23d2346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154080, "uuid": "5a143522-866b-4574-9c05-01658aaf05fd", "comment": "Malware payload (Formbook)", "value": "64a0d01a3ce06c7ae28b98094663da553491f51d3f579008a42e028636932a3d6b0ce4f7fb335165411ecc33382ed5a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154080, "uuid": "e340bb57-a0dc-457a-8e1c-4e5980d07ec1", "value": "T16B16F8884AB875DC56ECCF0DC96BE758437E226B07247A0E377E25D8768DF0A158C09B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154080, "uuid": "eded942d-33a8-4849-b8fd-291ab03acbc6", "value": "98304:mr7ISewXvHZstFfMAz3yt0Nn3ZTh1bbNgxS9FTEUYyP1c6k7791:sZXvqtFfu2TbbNtxbpk7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154080, "uuid": "d3179ef2-bdb8-43c3-b700-fafb38be58e7", "value": 4151392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154080, "uuid": "f8f92418-4b52-4137-a35d-93b89bfb0d49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154080, "uuid": "62ccaad0-e8eb-4150-9045-69edf38451f5", "value": "Quotation.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c572db68-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133447, "uuid": "1a1a9230-eb0e-4ffc-b6c8-9f56a6b89550", "comment": "Malware payload (Mirai)", "value": "4d6998b61bae381550213894668b754a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133447, "uuid": "1dd52333-74bf-4326-94ae-e8a88f38eab0", "comment": "Malware payload (Mirai)", "value": "68114649a93b8efd5bdcfd264a35506e6a598310ee1161fc1e91dcfa6e917e78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133447, "uuid": "d977f16a-5813-4b4e-b72e-ff70e0c03b29", "comment": "Malware payload (Mirai)", "value": "de79bd43deb29e61d33a890a51c74b94a5a62501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133447, "uuid": "9df2ccf1-8758-41c3-a8ba-1494ed0b9e57", "comment": "Malware payload (Mirai)", "value": "87edc0c50db2fadbb66e615d573d63dbab9f28b4f30fb119db7561906f93c4319ce7d24203d2e71735f1951c1ed0693f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133447, "uuid": "e7083798-df2d-4218-a9f4-2434abec7727", "value": "T1B3D32A46F8819B11D5C151BAFF0E124E77131B3CE2DE7212AD24AB357B8B8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133447, "uuid": "03626230-e8dd-46c8-ac5a-0528b3eb963b", "value": "3072:Gz17YOkMJXJNEapF3nD8hopVrJFwb66I7a4:GdVfXQaD3nxpVjF6IW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133447, "uuid": "1d006311-eb06-41e3-b127-22b633dd6276", "value": 135228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133447, "uuid": "f1eff8bf-d515-4d69-8ff6-05f1d3f6134c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133447, "uuid": "224e50ea-9dc9-409a-b8e4-60d53122d93b", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4021aa5-89ca-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785163965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785163965, "uuid": "d6bc6f2d-aed2-4ccf-a60f-1324352422f4", "comment": "Malware payload (Efimer)", "value": "8a5bc9290195e29bfc9214ffa8e13126", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785163965, "uuid": "9facdcec-8f9c-4f1a-9302-46b8a7a39160", "comment": "Malware payload (Efimer)", "value": "68891e60955a121e092f5b987100b85f2f3c75af0a7636161dbab9ca2ec04848", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785163965, "uuid": "8389d962-a83b-496a-9687-6e753a2daa50", "comment": "Malware payload (Efimer)", "value": "aca464ae81f26c415a65fadd91cceea55716d617", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785163965, "uuid": "6fe174f5-2dac-42fa-959f-7c08463dc841", "comment": "Malware payload (Efimer)", "value": "7c737748a28c13fb2e502257daee71c94a68bb07579b300ce31aa6210624327f7b6eb32a797fe49822424a6801bab355", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785163965, "uuid": "837830d3-e955-48a2-9f9c-a9c148deac73", "value": "T13AE633587AE015FEE9730139D9E2A196D594B0FA0733C6DF07E813A1AC732E19D38227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785163965, "uuid": "31f93938-7203-4720-be9c-b8e617f90fa9", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785163965, "uuid": "e9d8c971-f6c1-4fea-8518-94f3cbc38922", "value": "393216:9KHVDTU45poMK1/3UOJMlnhcXMCHWUjXBcuI3/PGTAI:9KZTNaMK1fIhcXMb8XWH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785163965, "uuid": "cc3c9cae-8cce-43eb-81ed-e2cf40967c2f", "value": 14322167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785163965, "uuid": "c1d03e7e-d39c-43dc-ae36-a107409d843f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785163965, "uuid": "85735692-e92d-41c7-9477-847ab008923b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953d29ae-89ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156988, "uuid": "e6f0466e-8dd2-455b-80db-4fcb75c71d69", "comment": "Malware payload (Mirai)", "value": "85d07a866569446be9c45168c3435440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156988, "uuid": "7a214dbe-8d1b-4a9c-8d52-47f4404a34ab", "comment": "Malware payload (Mirai)", "value": "689df9bbc03e864174e8f5637ed158746d540d534207ad1dd53ea856ca5619fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156988, "uuid": "ef25f432-6536-4a0c-97f1-43986e0704c8", "comment": "Malware payload (Mirai)", "value": "72eeaf8d410332de7c05ce38a46572b8fe5c1ea5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156988, "uuid": "db27c1eb-ce54-4e64-8226-dfdbc294428c", "comment": "Malware payload (Mirai)", "value": "746da7b4314c7534edde6826660841c88588f5904f8e16f91b27b66d72b616d3475958987bd5a4faba9993655e36ae15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156988, "uuid": "2021e558-1bc9-4f52-b35a-630ab2116320", "value": "T1DE14D819AB650FFBDC7FDE3702EA060539CC544722A42B7A3674D528F54A90F1AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156988, "uuid": "80098e11-de02-443e-b0b3-ee56e1c6dd08", "value": "1536:6n//iQ0idudERi3vfzfUka+mFU2qP5liPW7PT+l+IobiJMLRymtNZxIclxLKTpSf:6SW2fjUD+eOJb3LRbNrICP7nR4nO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156988, "uuid": "36d40181-c9cb-4840-8e27-453bc6e666d5", "value": 199640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156988, "uuid": "3803db8d-03af-4de3-8ff4-20dd72ea2dc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156988, "uuid": "dd03cb69-a06e-43e3-979f-e25bdd41dae8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8a4f3a-89fc-11f1-bd95-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1785185106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185106, "uuid": "65f8fb9e-a6a2-4413-8638-f42bced15825", "comment": "Malware payload (NetSupport)", "value": "4124a167cef576ccae119247431709f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185106, "uuid": "1cf5e332-5efd-415e-bce1-7c4644288808", "comment": "Malware payload (NetSupport)", "value": "6a12f1b9d531003b507b251a6fbbd9fc8c3673bb386852749c161730fbc312d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185106, "uuid": "35d333e6-049d-4731-bbfa-13d8e6f77cb7", "comment": "Malware payload (NetSupport)", "value": "b77d5d846a70f979b1b4d5761bb4967f037ea841", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185106, "uuid": "90be234c-8370-4553-8069-5746096983b7", "comment": "Malware payload (NetSupport)", "value": "0ee7aa7da3a22c74ad92d6f227dc54e0379dfa4aa2e5cb7f64f8fe904d97455f82db3487e9db9c58313bc9c8cb7a7b3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185106, "uuid": "abe550a9-89b2-474e-948b-ac501fee07b4", "value": "T172462983591F5B56F1EF803DB9BB73656814E18B22D386B460727B726C8A304BE4F913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185106, "uuid": "53737853-af33-40a5-ae85-095d3bab9725", "value": "8dad295e2b72b58be214193a8206d67d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185106, "uuid": "3cf0cbab-4e9e-4457-a758-47ded634487e", "value": "98304:WMsv2n6Wf9XrEjqHNqYLAvoPkz+vr6wss0CiiNklEM9n:WMe2n6WZdNRAVz+vr6wC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785185106, "uuid": "4c16e7be-98ee-4f75-ac81-bd0d1421fc2f", "value": 5867008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785185106, "uuid": "417dfdd5-b997-483a-ac28-1cc37913cdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185106, "uuid": "8aee9a9a-3596-4c08-9ac2-9acad19dc923", "value": "4124a167cef576ccae119247431709f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e04587-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158358, "uuid": "d0544a34-ad8e-4350-8c7b-c243c1588ead", "comment": "Malware payload", "value": "923545ac1dd8fd372863a02cf14f4308", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158358, "uuid": "ed64dbc2-505e-45c7-8e49-078be56be9f2", "comment": "Malware payload", "value": "6afb2014d4bf787cc1be6ab92971762b183bb6a2085f6541a27621af8ac34816", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158358, "uuid": "fd2f6721-109b-42d8-9b8b-707be8cba5c7", "comment": "Malware payload", "value": "b2852912d7b36bea65221072937daf29c5ff0f4b", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158358, "uuid": "1c82cf4a-e416-46b2-b40d-ade8ba5aeb4e", "comment": "Malware payload", "value": "0c0b2ab61d4ca6899c121529029c24cf408b959f9b66d75d8d7819c4e2ea83faf9a1041335d12573b3c24843cb6c8a57", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158358, "uuid": "c5f4c24d-c63e-4e44-a091-c528961cacf3", "value": "T14D577B12E3D00FA9D1268A3CC6779632C6B17B51C765A58B157AD60A3E33BB05A3FF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158358, "uuid": "a0f02992-62b8-4f0a-bf93-cdc6dd78bd99", "value": "449963a8ef999a3396eb6fa434920cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158358, "uuid": "ade53933-7c7f-42b0-870d-087336998a00", "value": "49152:3Fb87eqEL8ERMQsd5NFXIgNCvEPQTUVCd4qf7XqnUK7rbsr4CNj:3FkXEvsPQTUVCd4qf7XqnUK7rbsr4CNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158358, "uuid": "98193096-741f-43d9-b686-8eedcbc6eca2", "value": 27204608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158358, "uuid": "2dd77577-ea91-48de-805d-e14b3868938b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158358, "uuid": "499d92f6-88ed-402d-83b8-86f12e741a15", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938880c4-89a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785148395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148395, "uuid": "b8bdc213-5346-4fd0-af72-8fa2fabd9fbb", "comment": "Malware payload", "value": "f9780ff062fc9abbfe8b2c385ed551e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148395, "uuid": "1a17aa37-14ab-4586-823a-168095ce5025", "comment": "Malware payload", "value": "6b8e29d928a0ea6f297ab9226025f905d35b436ce480d2bb1de74150e23ea899", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148395, "uuid": "8da4a65b-0529-46a2-a4c8-d42d16dc3485", "comment": "Malware payload", "value": "3cf49518dd5cf3b7894c717038bd0f709d8e1249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148395, "uuid": "f1a7e93d-f261-41cd-9822-72dc9306879e", "comment": "Malware payload", "value": "179d6be4aadffb66e85e6bb58924e2458c0216da2bf3e9521597c8f147a93097536c12380204154d67f54dba3519fce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148395, "uuid": "3d18bc73-a178-4916-8f53-44c5d39c9e98", "value": "T10D2833BF2299A11FE32DC13AC2D29F94793770B21B3389E799941269EE075C45E3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148395, "uuid": "492070bf-5372-4820-9aa9-39bef6e02206", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148395, "uuid": "4bc51a07-8a94-49e8-8943-e52f4a4f7d33", "value": "1572864:mXqgR72V+4v+XUV4VG01NmnxCbE3+9R/3m4a4S0UFAZmvS5xa0LRo09peGo52Bs+:3472VFKUV4VGGAb3+Lfq4IFymq5x1e0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785148395, "uuid": "5b6a13f5-1a26-4691-bd95-08db6ef80b09", "value": 95374799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785148395, "uuid": "b619bd87-6718-43fe-bec5-33e4624e7390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148395, "uuid": "80aeb09f-d3ee-4c4f-a37d-c0b29f30351a", "value": "hrwsInst-V5.6_7.23_xvozm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e41617-89f1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785180662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180662, "uuid": "d845dfe0-7420-4220-b3bb-aab119fba79d", "comment": "Malware payload", "value": "1142cf80e4a58c20a46230025144d22d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180662, "uuid": "d4126b23-63c2-4b5c-9e5f-e91ab288beff", "comment": "Malware payload", "value": "6c0f965a69154c6d1b58082c5483ca6fdb2197720ae4d1bbb99d4f3ba31b795c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180662, "uuid": "8287818b-5150-4ed8-88ab-4172b71ef2d8", "comment": "Malware payload", "value": "af7e7e27f2b17aa22221d56e1ba09a6f31c12b51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180662, "uuid": "1391319c-a1be-495d-ab84-bb36ebc3955a", "comment": "Malware payload", "value": "14d0e928c39b90dce53d88c09f2ce81c591bc14f96cb3499a1f1640ecd596b416e15798b38bccc7aecb87cb156327019", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180662, "uuid": "8e9af19a-1fc4-4be0-aedf-e76664e4d5c5", "value": "T169236C6516857C14AE99C4375C7E2F0CB9AD43E6314492EE7FCE3CF28C4A6AD9208B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180662, "uuid": "e10f843d-e0e1-4a01-a32c-4c52c4cea06a", "value": "768:dR9NyXsZztCL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:zHusZJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180662, "uuid": "d16d7fb5-1746-468d-b057-48d92de3adaa", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180662, "uuid": "d0e96b92-5f14-43a2-aca6-013d30649957", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180662, "uuid": "882873a1-d8e0-4d7d-8ec1-7254fca2fead", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7feb519-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132646, "uuid": "7234d292-97d0-444c-b688-d360f462def6", "comment": "Malware payload (PureRAT)", "value": "5c5a28dca540b2c610b71d855f9c284c", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132646, "uuid": "d55a44d5-3ea4-4a64-bc69-745f00e5aa4b", "comment": "Malware payload (PureRAT)", "value": "6d1ce368ea595051e5d1657e6dd212f07f04fb5d1440159b135789f1a8adfe15", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132646, "uuid": "396a762c-a341-4ddb-a852-8ce46c6ae805", "comment": "Malware payload (PureRAT)", "value": "745661f9a82ae50b40aeaa6e3f3eb427e2f8b76a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132646, "uuid": "0c96c284-b667-47d8-be2d-ec0cb65e94cd", "comment": "Malware payload (PureRAT)", "value": "9d600667982e015efd3ca7b0719828f0ca7e00df1787ce6317de6f2c4f1e54f47060a76286f2b2d52f9f6178a0c466ae", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132646, "uuid": "f84bc1aa-002b-46e0-be37-ca1a9673562b", "value": "T1292177DCC1EBC148E0E6F5FDF811FB0DB3715651C225221431D266F57CA5986BA04369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132646, "uuid": "24f59e3d-ec26-49d8-b0fd-ed63757488bd", "value": "24:9cISmFUeTlyhlmReQ4iT4UTRLazKose/0mSO1hGY77ehCJhsWVXbNfCph:9c53W0pi7dde/0P2GY77eQUWVFgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132646, "uuid": "fc0ce45d-67ec-4a0d-b14c-7459d21099cd", "value": 1231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132646, "uuid": "8c6a326e-40f9-45d2-b0d7-ac333774ac76", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132646, "uuid": "797bbe75-8e80-48a9-bfdc-d93c0c1dd5d0", "value": "photov_751927479364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398bc9a1-89a5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785147815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147815, "uuid": "0beadcd5-71f7-4565-ba93-069690ed0914", "comment": "Malware payload (Vidar)", "value": "4bf11589985675d20577e3a8e1b84819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147815, "uuid": "8265f524-e7ea-48d4-aa0b-ebec6c10ec44", "comment": "Malware payload (Vidar)", "value": "6d8d3f1ed3dbcfc7470bfdb7814b049f2dcd5248773c9ebf2c554892bb3011c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147815, "uuid": "95d1040c-647c-4b1f-8dc4-c4d2196669f3", "comment": "Malware payload (Vidar)", "value": "4793486c9fee140382dee47c02dc2ca2816da340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147815, "uuid": "39ed7da0-7cc7-4223-b503-8328e69069e6", "comment": "Malware payload (Vidar)", "value": "469f99a46752caca554d9155ac70b58cfa433163b57c25937cec7055929b65c09652836d9b374f7fccd5a049a0232ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147815, "uuid": "7ebdd2cd-fc25-47a8-88b7-e0f0ef96ea70", "value": "T11616AE07BCE144A8C4D5973289A742417B6CFC0E4B3673EB2E61A67A3F723C19A75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147815, "uuid": "650422f5-4b69-4c8d-9ad3-0b76057fcd60", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147815, "uuid": "0b93e3c0-cfe4-4f37-ac48-a9da47d11979", "value": "49152:+Ncgla7UfpBVPCz27nqFPg+j/j7oBssjdVuDIk9vpV6JI38kcnxNdTcd2Y8PRqFU:+NprpFLMmbtRdaW9Dt1yXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147815, "uuid": "943bb979-87b5-4fee-b48f-49168f1856ce", "value": 4283032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147815, "uuid": "2a0a4e21-7f84-4371-9200-37694b584915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147815, "uuid": "a75ac8c1-b5cc-4a48-b17a-f94248e3b132", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140b04fb-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133149, "uuid": "f75001f2-6f63-47c3-93f5-2740fac30e67", "comment": "Malware payload (PureRAT)", "value": "49756d7ae51dffae068675ac9a232cfb", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133149, "uuid": "cce616aa-f9e2-454d-8806-3b902063b6ca", "comment": "Malware payload (PureRAT)", "value": "6dd27a2c1857074401f1e377869260713056e8f95d08b1e6b3cdc5ac98143acb", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133149, "uuid": "4a09762a-925e-42e6-b22b-0f6cc4223c07", "comment": "Malware payload (PureRAT)", "value": "52a640668deef2b32d8b98801252b01bc0e6957a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133149, "uuid": "75516345-d0b1-4c76-a5a3-c3a03881aaeb", "comment": "Malware payload (PureRAT)", "value": "234d4a4cc5f07eab2483891ce91e71ab452b942044166c7fd6609d1d04e2f406501dac72323eab1847378964be32a621", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133149, "uuid": "92c030b6-066c-42ca-925a-00c1e97e44a3", "value": "T1B72163A40BDDCE95DC8FC27AFEA98140306E4B5B8851E11107866B2C3DA7E9E731A652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133149, "uuid": "94eef92d-29fa-4f81-96e3-e31090f01dc7", "value": "24:9NUySxwha/5hOjhJdr2XShiL9rmSb5s+gWq/T7T+UuU:9abxwh8vCLdaXShy9rPbe+gWI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133149, "uuid": "585f1496-9ac1-45e6-b21b-97f54189ab12", "value": 1157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133149, "uuid": "5b9e2289-b4ff-4cb4-9fab-54c426a26854", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133149, "uuid": "d91d4554-19f8-482a-86fe-bdc030e83c91", "value": "photov_145078426722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab9a920-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143173, "uuid": "2080b165-737d-4547-8cd5-6cad5f4bb9a2", "comment": "Malware payload", "value": "1b5e3a23d13d34a12e9c1fa795e0c1e0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143173, "uuid": "cd4232f2-b97f-4605-a579-fd29d491c5cf", "comment": "Malware payload", "value": "6dd314a755e4c7af6d4330ed9dfd0d859edc63a0940852cad14a44ecca1f7ccd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143173, "uuid": "d42db4a2-546e-48e7-9bc9-a75d5921d6f4", "comment": "Malware payload", "value": "7d6c439682451a5f61ac4cfe7f2fd4ecb90ed9c4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143173, "uuid": "5085c117-4f74-4ded-87c0-8be7679793b9", "comment": "Malware payload", "value": "fba816264cfb5b32ad8d1d6b5922bff1ad490d6aa07057862c013527e713753558bb843e3d7b98a706d78f40d26c6d74", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143173, "uuid": "1e7831d0-b3b6-489f-80f7-079a2ff32185", "value": "T10511D844A15DC5C3C84FC0BAFBB0E7DA277C400AE110382227CDF5E07E89A490F4D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143173, "uuid": "7f92dfd9-074d-4fcd-a3f8-515aabd82527", "value": "24:9jbYretzs+xZTsGaghD8k/7b+pABU8mArOgmSKcHZhDbMIrP4i:9HsmzBxZTsGaghD8k/7SFdIOgPKUhPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143173, "uuid": "737f79a7-22d2-41ca-a5ff-9506e01734f8", "value": 1072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143173, "uuid": "c7a29023-787f-469c-a002-dd2bf8e9348d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143173, "uuid": "4f77fa04-aee9-48ba-a7e7-1cf79439625b", "value": "photov_965353453128.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b853a7b-89a9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785149563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149563, "uuid": "22d420e1-0081-4d21-a9a9-9a71c24341dc", "comment": "Malware payload (Efimer)", "value": "c1739f5534af72d63d41e0867713ee5c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149563, "uuid": "c5a1b28b-bf36-42ec-99f6-c37b7562bbda", "comment": "Malware payload (Efimer)", "value": "6e2bb817075c9b03a609e015d7c9da645195f946e08074ea64290cad09875a2e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149563, "uuid": "8d346583-2c65-4362-9d67-b8d0511acf81", "comment": "Malware payload (Efimer)", "value": "c49fce513db94952c674a89bbf4f72822587ada8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149563, "uuid": "0df3e20f-89de-48ad-806b-94209d256ef9", "comment": "Malware payload (Efimer)", "value": "e9aa42ebf4ec9adc4dd02b1876f3b65b94ca12a438b6f16cc173febd9a10a03f7fc45bc362487defd01f726b320122ea", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149563, "uuid": "f8b9f0bf-19fe-4e5b-b02d-7308d707117c", "value": "T147E6334865D142ECE763013CAEE155D5E8B9B0BB1B32D5DB07A887827C2B1E18D3C76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149563, "uuid": "b9274016-b683-47a4-94f9-d1118c04f33e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149563, "uuid": "747e78ea-e2ce-4aa9-8f63-e5dd22678c8d", "value": "393216:Jn0wr80rmhPA5xvbcnUrisYHgeXMCHWUjXwcuI3/PGTAI:JnxSFwTckPcgeXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785149563, "uuid": "21d8553e-8aaa-48e8-9a30-6ea5a0aafc11", "value": 14299664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785149563, "uuid": "a814c7c2-17fe-4a53-94c4-2b83520c7285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149563, "uuid": "a63a93e8-7f92-4122-82f2-98267a7a15f8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7049b8bd-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143182, "uuid": "3bb75e43-e44d-45ce-93d3-2b87cac77149", "comment": "Malware payload", "value": "46b6502d464df3e092a9573917ea308d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143182, "uuid": "d75ae242-2f2e-47a4-b277-7cc5515f1d52", "comment": "Malware payload", "value": "6e86afed736f21bd7b2f55ae388477cfcb26100c7bd2cd087d9e05e5f8836472", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143182, "uuid": "254aa8e4-5dc4-4065-b7c5-4cab2d4c3bac", "comment": "Malware payload", "value": "97925bff6816e826e3d2b3fe4c7bfd5b679a14ef", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143182, "uuid": "c8001be7-876d-4d9d-ab8d-89cab0c15532", "comment": "Malware payload", "value": "e458582d67b1748ba29d6c3d5002f09d27eb064ca81d6019b05e6c7503ae620e48de59a52e4ebf9bce193fbbf8c68b7b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143182, "uuid": "445aed7f-1d4e-48b8-89e5-7d86acc3570f", "value": "T11A2196A0009E9140EF03D236AD2D7A636479A5EC3D29D71F3B5D24C33610E9D6343935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143182, "uuid": "13d7c7a7-336f-4cc7-9c30-71038e24eb94", "value": "24:9lxaEtekQXokLEWKsUSzH0SAJ7kZ5mS6yo4mJfJO4kIoiZ3:9lxa2ek0zEWFzUSAJIXP6hkA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143182, "uuid": "538a7a54-ded4-4a3a-a2ce-7abd33ed440a", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143182, "uuid": "8428bbf9-6dc3-4f55-b154-e6a21c44370f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143182, "uuid": "9ba5f852-014d-49e5-80e6-bf7c39496ab4", "value": "photov_335312493306.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49994af-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785135217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135217, "uuid": "2d52c965-5f06-4292-909a-12974378ed0a", "comment": "Malware payload", "value": "65b5dc09cd943e023df0aec49a2a8536", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135217, "uuid": "15fcab22-fbea-4fa3-9f8e-4c1d23a003b5", "comment": "Malware payload", "value": "6efdaa927a001c11938b482122966ee41e0feeb4aee221e137fdce58c49f2c5f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135217, "uuid": "88725ca1-2884-4c3e-bd91-0c1dba361012", "comment": "Malware payload", "value": "3ce5309060de6228ea232c1b3e020b570d013ba5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135217, "uuid": "a59d7678-5601-4a99-88eb-526a1a6c707c", "comment": "Malware payload", "value": "ab83d79d2c26f934de16bebd09669b20283079eeff54b8650f8109d2afaa2e5d4c8aa4c2ed3bd1ca5d7707f8d7cfcdbc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135217, "uuid": "75a96523-4fc3-4af8-bd25-6af0d0dffda7", "value": "T170E58C07BCA148EAC0A5A73188B351527B71BC085B3633DB2E90BBB82F727D19D75B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135217, "uuid": "751fdbc9-2fd7-4d01-84f6-4d7be9062bab", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135217, "uuid": "3e8108a3-59bf-448c-90d3-9bf2110647ee", "value": "49152:d+YXtcG00j2xGvyrDlqqHqt9yDGMbgwWiODFu:d+u+Sygt8KogwWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135217, "uuid": "14b67031-aa16-4f96-86ee-7e8e4ee5df65", "value": 3264368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135217, "uuid": "8dfaefa4-c8a5-426d-88c5-46d52dccc763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135217, "uuid": "e3578e0d-3e2d-4ab5-a972-254bb2b963df", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4390c2f5-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785167588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "32195c43-045c-4530-8489-2f317aa084e5", "comment": "Malware payload (Efimer)", "value": "7696f9286237810feb2fcdce7eb6b953", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "b9e8a7f3-4682-47ae-a66b-b247aebf43d1", "comment": "Malware payload (Efimer)", "value": "6f23c7805963d98f57ba6497f17168967545e203774f383b23807f0dcb86e0d0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "22b628cd-4e33-49e1-98c1-0c5453ef1bcb", "comment": "Malware payload (Efimer)", "value": "8057152364fdbcbd18811eb09baabae1a32b2db5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167588, "uuid": "d5027a11-84a2-46d4-bcdd-58929e721e23", "comment": "Malware payload (Efimer)", "value": "5e1369990e093b0a76d51a11e5a705340a505cba6c1c0e01deb675a7d3708929cbcf848036e2a005eb705bf94b981648", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "deb3298b-0ad0-4e81-a6ea-28922a50b2de", "value": "T180E633085AD107FADA73823C99E2539DE2A5BC720BB2C69F1ED8D3652E471E04D3C653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "46a9158c-b30d-435d-9d0a-4dbd90e7547f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "2bd57bd3-958b-4007-ae96-78d5f9fa1166", "value": "393216:Oq0Ciuz51iyGC6WR/XtXZFXMCHWUjX7cuI3/PGTAI:OqVDZRRzXMb8X4H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167588, "uuid": "43bbf266-0aea-4bcd-887b-60f4ae3420ed", "value": 14324507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167588, "uuid": "735410d7-d620-47bb-b8c7-bef3373776f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167588, "uuid": "5c169dca-1417-4492-ae09-ffd9b61a7215", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07692ca6-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133128, "uuid": "06de86f0-4d74-4179-ad4a-ca876c1def24", "comment": "Malware payload (PureRAT)", "value": "7b010f2b33d76144ef3e9bc2118ec4ca", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133128, "uuid": "546df47a-19f6-4a2d-8f24-d0a17a72b003", "comment": "Malware payload (PureRAT)", "value": "6f664f9f5bd83ee32dfca8ca54487ed54c511a2ac756585e9f33f477f05e7920", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133128, "uuid": "dc717c99-d0f2-482e-a413-48dc00f5df3c", "comment": "Malware payload (PureRAT)", "value": "baed85089de8df9e9ff28499c413249b29dc39ce", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133128, "uuid": "85e8fc15-8391-4954-a2d8-95ba6432c2fc", "comment": "Malware payload (PureRAT)", "value": "9544c6eef175c1a2ec41a7c6c8a648db9d8d7d8c4a07e9b887f75dc06c705e766863596aff68b53f4a75281d4a6e030a", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133128, "uuid": "69f953f7-c878-422c-b4e5-d5bece7ed8d2", "value": "T1C5211A78A818A1B8FF1376331C4B314E16142340DA4006893203DF6EFB33DC44724196", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133128, "uuid": "5af75fb1-07a5-459e-b466-7a0206d5137b", "value": "24:9KkXJlUjv8oqbsWjjYmKGIcEZPUcuoq+/v9UmSic4R8uIQ2D/bp3a1d//:9KkXTUT8JbJ4mKGIcEWcuohyPyID/VqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133128, "uuid": "e8791a95-5511-4b78-9fb8-bed95975f6a5", "value": 1275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133128, "uuid": "39e2c90f-f4c6-4dca-b16d-63eb115a0518", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133128, "uuid": "29381652-6c80-49fb-b597-a82ebaef9b90", "value": "photov_435787845227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e76d0c3-89d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785169727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169727, "uuid": "95c43e5e-f98b-4fd7-a510-cd7086e1c5e4", "comment": "Malware payload (Phorpiex)", "value": "0cade3a07d296e0e228a45df3657311a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169727, "uuid": "a4f1face-7779-44e3-a2da-9b76e4a35f07", "comment": "Malware payload (Phorpiex)", "value": "6f941dfcffe99df17e9f8a5052127d0b42ae5ed6e4636a7e4ffe0b89161acbb8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169727, "uuid": "5e85c30b-47fc-48b8-9880-7748fc636840", "comment": "Malware payload (Phorpiex)", "value": "f04b1e5629e167d21f16eac25416c316472af070", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169727, "uuid": "340edfca-8912-407c-bf3d-9eb7237a9843", "comment": "Malware payload (Phorpiex)", "value": "b02992bd152b81b89292e07d14a096cebb88de136b7cc5e4bb371ae3ec4b192a2aa96ba05b577c1863cb7aade95f68ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169727, "uuid": "0571028e-b67f-45b8-a694-42eb60fa243f", "value": "T1D2622A0AA4818035EAE14075827F526649BEADB623C4F9D7F7E0A8C94DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169727, "uuid": "cc23a6d6-5008-4ce1-b005-7a916a5f872c", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169727, "uuid": "00e501f5-e80d-4438-b443-c6543d26260d", "value": "192:AWtsGnjXgjk8LcRI+Q1RDMlYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthT9ik:AsScCtfV/ro6toB0av8U9c5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785169727, "uuid": "1e071e66-2c50-46fc-968e-4b99ec5503ff", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785169727, "uuid": "d6d3c4e3-4f04-442d-bfd1-e6e8cc10c9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169727, "uuid": "033f711e-9299-4c51-80a6-5d9085a11cc0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3439f64-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154139, "uuid": "29d46f72-9d80-43c4-8c89-9a759f508c1c", "comment": "Malware payload", "value": "bfaf90273555d8678de0fbdc5937c5d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154139, "uuid": "9796bc00-a994-4da5-bf96-82eaa71a3aa8", "comment": "Malware payload", "value": "70c606816f24bd1b4000bbec27441ef1ad48ceb110d2dbac1bd41b271d3a08a0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154139, "uuid": "89432886-8bd3-45fb-b685-b918cd795b4d", "comment": "Malware payload", "value": "ee690f8ff9dfeb3e969839032e2673dae9812f55", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154139, "uuid": "b91f7792-74c0-474b-8d39-96224ab637b3", "comment": "Malware payload", "value": "3fff7cee4db104cffa6b7665237fec49f3fcbe012bba23099b3bb85d3e49371b3e13272fb4911b9d3fc64e449aaac26d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154139, "uuid": "b4493080-276b-4066-a5b5-6d1630242dda", "value": "T1C521B6BCDB55DAB0F89580BD28DA4A8BA426482C9FB001F77B93B3825C52DC7130439A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154139, "uuid": "a60b0a11-5304-4e0b-b4b7-d7ca575d8b20", "value": "24:9CoPYDID7n593eZDNXCX6cDO+RN7mSvYbMH1Tl4rs+g:9CoQDIn5ZghXCqGO+RN7PvMRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154139, "uuid": "2360c0c3-2148-420d-8d51-724f891e7e72", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154139, "uuid": "e3616840-7d65-43db-9dad-6165aa2c3f63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154139, "uuid": "f20de91f-2fd3-4e3b-aab4-413d1b403ab7", "value": "photov_411734832236.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c03e774-89ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785179280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179280, "uuid": "9976e13a-f69b-4674-85a8-362e67f41951", "comment": "Malware payload (Mirai)", "value": "05fb13333c59fd15a7ebf86d92b39442", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179280, "uuid": "2ab88808-290e-46cc-b276-b601c891b12d", "comment": "Malware payload (Mirai)", "value": "70ca605f6de6dcbda5f2374923a10b60774aba2d33c23d17ffbaff5889546dd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179280, "uuid": "cff6a745-1166-4b8b-8011-9f06c2ef8c8e", "comment": "Malware payload (Mirai)", "value": "80e47bb1cd51f0fc660cc24f8af62bf8847a9a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179280, "uuid": "240a2494-4162-411e-a063-4df77076c41c", "comment": "Malware payload (Mirai)", "value": "91590611540c2f12a24c15ff7397a01505f9bde220203b8173a34fc13673a749291c5c9036a04460f4e678b37f4bdf34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179280, "uuid": "2d7137c1-8c1f-4fc1-9ddf-e2e83884b997", "value": "T1F5632966B9419F16C2C12777FF1EC389332663E8E3DA7203DA142F6937CB41A0E2A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179280, "uuid": "8a7e2ea6-4511-45de-ab22-2a2d1ca4e4d1", "value": "1536:d2cjKQ+TvjGZc6QY7dKkhrUBEvJXsE8YhRZcF5WFvEoXUc/+Gi:d2cjd+TCUrkhUBcJ8ER7ukFvEAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179280, "uuid": "1eae789e-d330-411e-8b44-2a19aa57b3bc", "value": 68376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179280, "uuid": "45373a0b-6d2b-452b-8c35-2dac4d10aa3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179280, "uuid": "a3727a97-d3c0-4388-b4cb-007cbf77a72f", "value": "rWH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3eb004-8a0a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785191147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785191147, "uuid": "f8565274-6b63-4e28-95e5-f67cf79dcc1b", "comment": "Malware payload", "value": "4fef8581b198c27c37f06137df872d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785191147, "uuid": "2e4c1811-1254-4ba0-a6d2-bfc3b8c085fe", "comment": "Malware payload", "value": "712ca31e2937bf843579e0e782ac8bc33ae84b4d580a3c69aabd531ff416b5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785191147, "uuid": "b6c74ee0-9fef-48c4-8659-905f64d9bde7", "comment": "Malware payload", "value": "a4d3c3c8cfe0cf04e3de11277d27d211c8ad1b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785191147, "uuid": "b619d0f2-1b51-4683-b949-c76cecfbfc39", "comment": "Malware payload", "value": "ab189034b4905fd9e0b225e806f0b8e0ca945d65aa4225af31cdd72d5e6f98ef4041438bddedff51ae2b70654edfcb76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785191147, "uuid": "d7e54ad0-71b2-4cdc-9d1f-de994499b1e9", "value": "T1AF0512562A68DF23E36B07F506E2E1B013FA5D4FE532C2084EC95DEF749AB245A15383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785191147, "uuid": "4229d76f-b470-46e8-b6c2-c56443b1c832", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785191147, "uuid": "0aeccad5-413f-469b-9e87-6ecb948c33ba", "value": "12288:LaqWQ/COQ/KliT3qWALzeApIaF1+C4Ujk6Yz2OkqWkEd2/L8uHxoLqUfF1l:tCWigneWTF1+6Vh3qWKwuHZUfXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785191147, "uuid": "1f0ab60b-aaf1-4b01-8cee-eb819821b7dc", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785191147, "uuid": "00fb6841-ebf4-4002-abbb-a94e5e014584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785191147, "uuid": "df78dfab-5f47-4019-b14b-9fd8d4e5ca57", "value": "QUOTATION KKTP - #PO996574620775800000 A105N.pdf(786KB).lha.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82ace30-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133049, "uuid": "1a168a5d-ef0a-4e09-a6d5-d7a7f7e45a4f", "comment": "Malware payload (PureRAT)", "value": "3dcec1b21e1dc2fa5544d411993961e2", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133049, "uuid": "e4385e37-b928-463f-ba98-881055eefc01", "comment": "Malware payload (PureRAT)", "value": "72d10d63e42edbb159596aa691af96430b0ab4f1d6428d148bad842c0bcc4c04", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133049, "uuid": "e24d97c1-dbfc-4893-af70-78f8a18b7cbf", "comment": "Malware payload (PureRAT)", "value": "19d8fae28fbf70f6b0c297edc1b99fa1bd8c9416", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133049, "uuid": "d346a602-6034-4a87-8f7b-9602a7707bd0", "comment": "Malware payload (PureRAT)", "value": "f2b30a2ed741897bff211be57499aeb9b5a0098035988da86d1b09afc1b487d38fac70ee8b5025ad0c6646edc2c3a19b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133049, "uuid": "5e441e05-1dab-498b-bac3-ec323b62c4e8", "value": "T11F212683553F8D41DD0AC97B29C55D574C1816406D46A3D353FDB8B968E1E4FB3C94C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133049, "uuid": "779fc8d3-ab8a-41b8-9a9e-b29ba26cce5a", "value": "24:9bGUGRX6om2/NO7FyYAMZe2VzmSym4ZlLuSxbNkqPNL2t:9ba16H2JWPym4HH5NkIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133049, "uuid": "13448557-50f3-4db4-a76b-cc554c2f9717", "value": 1141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133049, "uuid": "893eb040-bd26-414e-bb8b-6123904350a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133049, "uuid": "77ad9101-e144-4ec1-a060-b4f9adaf1240", "value": "photov_539210466520.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8f928c-89eb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785177883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177883, "uuid": "e59173ba-6b67-4f0d-9c2d-e67a8cdfa9e1", "comment": "Malware payload (Phorpiex)", "value": "8347c0d21537e847ab3572dd45ba17d5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177883, "uuid": "eb1e5f39-25d3-4cf5-ba8a-6b4c4c351a44", "comment": "Malware payload (Phorpiex)", "value": "72da1a3abc1230fdbb9a1a7ac21b490b6482e14cbcfa9b8f5913af03d99fabde", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177883, "uuid": "d86cbaff-d56f-49d4-8964-f6d5018ce191", "comment": "Malware payload (Phorpiex)", "value": "34c6e16bc42a5af390991d61f78a98bc6ed87c2f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177883, "uuid": "7e07f8c2-a25d-4b74-88ca-deefca81be8a", "comment": "Malware payload (Phorpiex)", "value": "b1279503f238d0f2673c80621c7a6c1ce0d15b7ab28b09e7c97aaf20a1f34b619db66c899765c03a5fa01a36e57b8b8c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177883, "uuid": "a44220ed-7695-4148-a9bb-340d01c2da73", "value": "T152822B0FB9424316E1E110B4967596BBD9B9AC7633C414EBF7D44AEE1A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177883, "uuid": "84fd8069-0956-4932-aed2-1240d5861080", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177883, "uuid": "1717d32d-9d2f-49d2-8728-0bd87885c589", "value": "384:AqZbmcmhzwEUaUu94gXTP+av8U9c+O4P:G5UaF9Ka0U1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785177883, "uuid": "5141b883-16df-462c-89c3-d1e3548e5732", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785177883, "uuid": "d5c0e1fb-f7ac-43b8-a9c4-c1da0c037d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177883, "uuid": "92acd291-82db-4181-bd5d-43886a0dd40c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bf977f-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143589, "uuid": "3e465d52-5e41-4930-bdeb-7abf98101991", "comment": "Malware payload", "value": "560868956aa8479f9cbb0e8ea592982d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143589, "uuid": "bc413b55-cf7a-4027-a0b6-5d6fe9126559", "comment": "Malware payload", "value": "72e912ae8db4fd029743b733c7309b9619e0ef13d1ffb09e367315a91a7d7417", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143589, "uuid": "37e08861-ee67-4ead-8e15-6b80d97c5437", "comment": "Malware payload", "value": "4a48290e3de3bcc731bf8eb66d4654d5abcea7df", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143589, "uuid": "2c2be255-fae9-4981-bab8-77a52446c25d", "comment": "Malware payload", "value": "3db172537e6baf1dfd6869dfd6429ed5ae8919d692b515c6f918c711f41c0ecb0129d86e036947cf02e68964c736907a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143589, "uuid": "95cb4465-0b09-4cde-8b81-3cbf94b8781b", "value": "T1E121A7A0910BDFA5DC93D3365C85AA56735E1182A770B42B978C1F226E4AEC8770264F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143589, "uuid": "21b91f1c-56f4-4199-b147-4dae4758cc9d", "value": "24:9SbT547838/MIjx5/DwoyS9w6NmSgmq+Jl8xjIa16Ia:905b8/MIjx5cPGPW+HKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143589, "uuid": "878b1c23-8afe-48ee-8698-ace38d66d53d", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143589, "uuid": "e68a297b-a69a-4573-a6ae-41da6127e964", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143589, "uuid": "153b314b-16c3-48e3-8b95-be87e961928f", "value": "photov_791717306049.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd82eaf-89fb-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785185051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185051, "uuid": "04a53148-4bfb-4534-8c45-40ee48ee89df", "comment": "Malware payload (AgentTesla)", "value": "43926adc184af67b9fdb2f047cec7fcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185051, "uuid": "50a2974a-d805-4284-bac2-75d292888f4e", "comment": "Malware payload (AgentTesla)", "value": "7366ce5e9a87b1371152bfb689a0b55a04de7e4f2a718e7d5f43e3c02e32381f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185051, "uuid": "98678e5a-0f85-4461-9a17-e082af69b392", "comment": "Malware payload (AgentTesla)", "value": "156930254156a7af0f54f4b537d2aedf29d33966", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185051, "uuid": "c78c9496-0b07-4760-83ff-273604d4740f", "comment": "Malware payload (AgentTesla)", "value": "0dedb040e9e420009a24816534734da362572a774e022b10481681d17a49c0986bf6a56438e61f79ec17f3c4e848e822", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185051, "uuid": "1c06dffb-b39d-4434-b4f7-e75f31e18578", "value": "T1E3F54A089118FBD7909CA32ACC5DBFED8F0E80536E24DB84356D89B9954DFA973103A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185051, "uuid": "addfab9b-2421-434a-a094-2d2258f6b52c", "value": "98304:ehWFG6EIiRtvTGXO5bLb9/LujXSNaHpnbhjQLDTyd25+ybomx8fkPo8CvUJzfspM:ehWF7ErtxbcFVh0H8rk9M74M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785185051, "uuid": "f3447ca8-ed73-45b2-94c5-4bc376e55b58", "value": 3591147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785185051, "uuid": "19ce338d-878a-4e7a-9180-5dc8af7a7d8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185051, "uuid": "76c4b30b-7db8-4ffa-8afc-b80fecf49452", "value": "New order Aug2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4871b9-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132708, "uuid": "50a9c5c2-889a-4295-87d8-33d2fe74ccee", "comment": "Malware payload (PureRAT)", "value": "c696211155ead3b8f54be535f68aa925", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132708, "uuid": "591b66b2-e96c-4f2e-9eb2-d960e26e4acf", "comment": "Malware payload (PureRAT)", "value": "73ce6dec11d8f4be64e7a79f82b47c505be8f3b5dd0c5a2715eaa32aeaa68b3e", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132708, "uuid": "f08eb3e9-7929-476a-95ac-cf406a09a71c", "comment": "Malware payload (PureRAT)", "value": "0285a51ffb97b18bdababe3ab706696ded3fd2fe", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132708, "uuid": "aa1dca22-53a2-4660-87a9-98cc35a2fcff", "comment": "Malware payload (PureRAT)", "value": "760a0e0c779a208b74bc2de3bf654ab9e4af63d71aada3588c957ed5490735afa26c38b84b1e45c005db87fd4cb6010c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132708, "uuid": "f7ea0b87-059b-478a-acf4-7d521ebb3ec8", "value": "T1A621DA6BCC15C724C741D175FCC3D52C153A50B0E58D21CB95993CE7746284CBD5E360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132708, "uuid": "e007ca82-fe57-44e6-b3e5-34276cf4c1c8", "value": "24:9U346tgjwMMNcM7ZKuTXIG7XyCs+I0aIjiO2NpoimScY4SH1HoBneV34CQgpoDL:96gjWVKcXfe5+SIjiDrZPc6HgnedIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132708, "uuid": "7036405a-a0f5-473b-ac0c-978ab7a2ce97", "value": 1209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132708, "uuid": "89f052dd-c581-42a3-9e0c-05fb298f4328", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132708, "uuid": "25b877cc-1906-4697-93a9-92bafa95cd89", "value": "photov_190026442150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1137d5-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154399, "uuid": "922c674e-f649-46f3-89f5-172d15033a27", "comment": "Malware payload", "value": "f7fbed8735964ec0c599fa142e942163", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154399, "uuid": "340c558c-1e4e-48ec-b1ed-83adcd4c7457", "comment": "Malware payload", "value": "7400f7aac37cda0c5d39195928cd89a48039ae12a4910260b2acbef79cb20997", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154399, "uuid": "91a8a9f1-d6f8-42ec-a6ce-49e44b4b929a", "comment": "Malware payload", "value": "fa3704d9bb18fb0e480c7313d015608f52005375", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154399, "uuid": "b8fd8510-9269-4e03-a4d0-b6673850cccc", "comment": "Malware payload", "value": "113295f745dd18e051bee30a8d1e8053a5664019924ee787254be3b4cfe67d68ed94b1624c485197e961336c8faf8ac5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154399, "uuid": "79ae6eda-1b33-4713-80ba-5ffd0203646a", "value": "T16321B7D9482DCD96C6268EBB5E22490621386446570062A1F38FAAF12DCE14C726A364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154399, "uuid": "df81303d-ec7a-4945-8597-32d3c2064c72", "value": "24:9oDghrS2SkdC7uRQg5FRDpZnFcmScWH5G3Adj3:9oIrrSkEWQgdFcPmST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154399, "uuid": "1a05ce4c-c9ab-4070-851d-2f425f06b4b1", "value": 1279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154399, "uuid": "0ca554b5-d8e9-41b0-bdc4-64a6ecec5953", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154399, "uuid": "47f0ee7b-49d1-49be-961d-9cab531a7e7a", "value": "photov_698290322043.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5542a7-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132762, "uuid": "f781055e-0700-4520-afe8-9c2649248bc5", "comment": "Malware payload (PureRAT)", "value": "de9eda33012163fd5a2493853a220ef7", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132762, "uuid": "3c250cda-b084-4d3c-9c16-38e8a2dc0060", "comment": "Malware payload (PureRAT)", "value": "744ab5b5880cf989a6e5ff6fa1a829885a4a8adc8d03f9c2c1314916423e47f5", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132762, "uuid": "3a66477e-6e66-4084-bcac-0d70ac8b9d39", "comment": "Malware payload (PureRAT)", "value": "c9e16651d3029fe107a7d816db1aa6aa3010c981", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132762, "uuid": "15570538-b06f-4f1b-bc11-4455608b252f", "comment": "Malware payload (PureRAT)", "value": "2f9cd5f727dec34097bad054efc7e41c5eb4f9e45f6f206d3a883986269ad69ae03669c2a345b8ef6f08df3e295d59a8", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132762, "uuid": "6981f4b5-7097-4c49-af8c-cc438c00cb87", "value": "T11421797E7198CD51C0C6E3362A29F55A6C30A176ED04B60713C83C333ED57DA6A415C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132762, "uuid": "cdb749d2-e6f8-44a6-bd45-f13218e2ba91", "value": "24:9mSff4Rz8C6iaGPpfVSAS39kzmSvl9hGY7WXA/:9PX4Z8waGJVc9kzPBGY7cA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132762, "uuid": "f8049646-fc98-4617-9385-d25bdfb3bfe0", "value": 1113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132762, "uuid": "8368364d-f525-4752-996d-28ab6a88b8a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132762, "uuid": "fd0b83a0-8029-4027-bb3b-c32961fdf8c3", "value": "photov_472234427270.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80709bb-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143303, "uuid": "8fa2d013-8a6d-43df-85cc-15d149e7daef", "comment": "Malware payload", "value": "e3d575b671a04bd820a3278e341fa9f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143303, "uuid": "02982106-e7f8-46dc-8a0a-7484f2f4ff3c", "comment": "Malware payload", "value": "745e8dd9fb8a067ded62c071980ab743ba3e9dd089b44e29b76ea7a66520a0ce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143303, "uuid": "dc004e42-8f8c-44c5-9e5a-a21271913018", "comment": "Malware payload", "value": "92e7ef4253fc167121e6e910f03edcc8dbcc0f23", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143303, "uuid": "0b0f8046-034e-4b36-8495-69ab45d6b8ac", "comment": "Malware payload", "value": "6df10c782d7008c392f8d83f45c6b392ee3127c48aa0332a0dddd8eb1b93860545b6def0dff6d517cbc42c69c24af9c7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143303, "uuid": "91894caa-76a9-45bc-a188-754814d14b36", "value": "T12E21A365D09CC080C87680382758B9E4B4764AE0668371671A8AAFAD3AA3D9EC7C0220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143303, "uuid": "a48ea9f3-a544-4f17-8e5c-6240a7035c94", "value": "24:9RlgXHpo+3U9L+0HUW859wpST5wbGnibKAmSzwJUhGY7vG8UPpuJmlg0Ogxt:9D4HprafUW89M4wb84PE+GY7vGBsSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143303, "uuid": "678e4b49-e5ea-4f89-94c1-84091af677e1", "value": 1165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143303, "uuid": "e260653b-63fa-47aa-aeaf-83c30169e3fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143303, "uuid": "52b48bf8-6441-4d8c-b69c-985c2b649222", "value": "photov_590362908233.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "137167b3-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143456, "uuid": "a5549dfb-86ec-4d4e-91fe-92fa2ed01f80", "comment": "Malware payload", "value": "638decf071baad2fcc3e30d221b80a88", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143456, "uuid": "54d09b99-995f-4d22-ba4c-521a179e6928", "comment": "Malware payload", "value": "750e4332cd62710f03e8c343662e047e5ec8f50d66fae39e4363758873dd80b7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143456, "uuid": "5b94fbe2-c4e1-441f-8e08-235cdec4e6f1", "comment": "Malware payload", "value": "e4260848e6133106364280fa95dd16bd6022d1e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143456, "uuid": "47784015-fdda-4479-81ee-a7386e83d65b", "comment": "Malware payload", "value": "aa6ca758dbe9b0994980d7d4117652833df7cb8ccf17285a734712066d5f9ed72d099756322f49da4a1ae9b6f2a3ad46", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143456, "uuid": "e723df7f-48d5-438c-85ab-91f072e702ee", "value": "T1CC11A528E1AE8044D85FD772742FCF8811511282C811E24B13EEE1CABF06DA08A919D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143456, "uuid": "b9edea78-0be6-45c1-839b-5253e1fe5a27", "value": "24:9GIt4IMcZjNLSDuPzR6RMnGedjqh4TKfmSQnhheY7W+I1NKVe:9GIVTN9uMGAqh4aPQhheY7W+Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143456, "uuid": "0e0349d2-97aa-4870-9f48-17087e4fba00", "value": 1080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143456, "uuid": "24af61ff-a489-4234-a729-b5c7a6f2e3a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143456, "uuid": "e2cdec25-9359-425a-bded-55e309bff8e4", "value": "photov_630455380339.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07aaf413-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158039, "uuid": "7885d2e0-173b-45c0-8c29-6f4ed62d6550", "comment": "Malware payload", "value": "5afde53a33a853c83b6b1cf3fa9a8690", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158039, "uuid": "53d0976a-d805-4fe0-bf1a-a3822cb7097a", "comment": "Malware payload", "value": "757beb610410f58fb83577fba8dc8721d1d17bff5173d9b6a00bbe4a2092ca1a", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158039, "uuid": "b23828c3-fb76-4aaa-a29e-96e0629eb550", "comment": "Malware payload", "value": "d067a94396be4acb3244773bbb440e4e6bf15d8a", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158039, "uuid": "90d9c927-5f41-4dd8-b194-dee9c8dd494e", "comment": "Malware payload", "value": "a939e15a91ba66f8bd9852d8d8c53ea0cec030d31c264c78a73f5cc6558e16674f27844f0a6beaf81f8b2550e894ddbc", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158039, "uuid": "e6605233-45b9-4031-b4b8-ab7fff8d01da", "value": "T169563391CC30A3DDDE4DAE74927EF2684259BC164C8F23363444B69AD4F7D879A02A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158039, "uuid": "eb5cc33c-4116-461d-815b-9ebc8b3f752f", "value": "196608:1N5FAcc5JUlXz9xwMVWOGrvlFt0WzGKws:H5FAfUds3LLTGNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158039, "uuid": "9a52acc0-a42c-49c3-8beb-c824918ac11c", "value": 6409573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158039, "uuid": "4f2efeb0-975e-47b8-a0bc-fa8a6e2842ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158039, "uuid": "0c0412c5-2e17-4262-ac99-b52abfcc94e8", "value": "757beb610410f58fb83577fba8dc8721d1d17bff5173d9b6a00bbe4a2092ca1a.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24c34e5-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133092, "uuid": "1a914603-ab08-4ed8-b6a4-8e50cf65a49d", "comment": "Malware payload (PureRAT)", "value": "d530eee6984def5a7ba6eef0931df0b1", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133092, "uuid": "6feb3e5b-5261-451e-871a-9414ab35061b", "comment": "Malware payload (PureRAT)", "value": "75b5f8d1403c65cfa676cada57078a44c64eb40ef424ed590fd40ee8dea571e5", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133092, "uuid": "6a419a35-92bb-4ba3-8178-6739e46287aa", "comment": "Malware payload (PureRAT)", "value": "1f757a2977155be9f5289148b421b758b9fe3140", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133092, "uuid": "04f25867-a8bd-4fd0-ab8b-341d60e2cb3d", "comment": "Malware payload (PureRAT)", "value": "694a9f44d6ad0a9540e387c707fe259ce984ba6b42f184e7f0f62f0c45c3164b872a58b38d6535d93899fe36a11e007b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133092, "uuid": "54622e60-3b8c-42cf-91df-fc36b81c33f3", "value": "T10821C8D647249112E2C68632F42AB75FB41B34C491C0A2E90B10EA571EE3D6CF3185CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133092, "uuid": "2288f146-653a-4fd6-be05-e49aa06c2623", "value": "24:9ZM3Dpwh9BC+vP44c3IK7xzDGT1ipKwBy/MOXkmSl+gWqBd5+tnN+gEqNw1kMXH:9UDpOBC+4hLx41ipVy//XkPl+gW/nNuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133092, "uuid": "22b4aec7-9de1-410b-bfc2-c4ab99f38a34", "value": 1321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133092, "uuid": "db859a3f-e80b-4326-9e4e-8ee7f22c385f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133092, "uuid": "603f7c57-94d0-4688-a38d-ad78749e01ee", "value": "photov_985150979772.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b456f2-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143297, "uuid": "2d6e7545-e887-46ee-b349-51ee7954a435", "comment": "Malware payload", "value": "0f2dccaafd156f81ff472c2b0cb49575", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143297, "uuid": "80c02153-6720-4a3b-bf5d-90aee253ddbc", "comment": "Malware payload", "value": "76441cd634d32a17b46b11ecb0eb850d932b274e395cb4c7a12a3683fd9fae07", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143297, "uuid": "476fd0c9-51d3-491b-bbfb-2b5ac066a4b1", "comment": "Malware payload", "value": "c63f3c347f03c6770cae74b78814a99e5635b2a9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143297, "uuid": "84470b25-a3d1-4f8d-b581-42eec9e70258", "comment": "Malware payload", "value": "9a77c8a6b804a48bf83f9aad1274ba9ac96edf20056895a8941c782357b57197238a0039ab3ac55c27e27324c153a303", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143297, "uuid": "951b1391-dd3e-49ef-a126-a147e00a4188", "value": "T10921B4F4D0D552B3C81BC039BA83EB5C00A710A0EA801AD77629BC463DE7AD73F95192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143297, "uuid": "d4948e42-b34f-4a3a-b683-199199ddcf42", "value": "24:9r7JN5t7gEGttwwEE4ksMjAJy6mSZ5+xB8XC7tupf+v1V751b1d//:9rj/gEAtFJTAJy6PZ5+rU49V3bf//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143297, "uuid": "b3686529-dec2-4ae5-8108-ed8e60802971", "value": 1227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143297, "uuid": "4251147c-5275-41ce-b297-064df25d38a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143297, "uuid": "28993809-f298-4661-8a60-22b3831ceaec", "value": "photov_249215723277.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba27d8a-89bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785157348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157348, "uuid": "b3de6252-b797-430d-920e-0c3c2b48d04d", "comment": "Malware payload (Mirai)", "value": "44cc9f0f3f3ff67b5998604ea067444d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157348, "uuid": "9ae1eb0f-d930-4614-8af5-8c93b8d364f7", "comment": "Malware payload (Mirai)", "value": "76bbb74f6a4e4bc992bbf40b828b740a7167ee5449db3ecf882b6a2edb7460a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157348, "uuid": "15e791a9-c04a-41b8-95f7-953442fce101", "comment": "Malware payload (Mirai)", "value": "e31e65206651c575b769e05bd1b3cb52791dfa45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157348, "uuid": "a4005922-50b8-4033-bada-322abeb426ea", "comment": "Malware payload (Mirai)", "value": "bac0c2470198b9326cf1ca1ae944aa38d1be99f1ace2a44545852ef24a4e5c6da435bcb319b9a18d24c904a42f29a619", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157348, "uuid": "c562de85-c989-4091-8fdd-5decf0add040", "value": "T1E0F2DF91C2884793F42E453F09FFFC4E0482D72CB6869AA6DBD0E076AD25F1D5A5C287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157348, "uuid": "705c5966-3e7d-4b89-9c0c-e0f0113d25b0", "value": "768:KzbGjwng3vdycRLSe3ZMUikVZhHbk0J3mAnbcuyD7UHQRjZ:SdnAdFvZgU3HAOmAnouy8Hy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785157348, "uuid": "8941d457-696d-43bb-b308-2fba77417adb", "value": 34912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785157348, "uuid": "05ce1349-4a1f-407d-8ff8-eb69a81090fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157348, "uuid": "1857264a-255d-40c2-a985-eefff1cbe45e", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b688bbd-8986-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785134638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134638, "uuid": "302239cb-56b1-475e-9897-f4cf81dfc6b4", "comment": "Malware payload", "value": "f85efe9aba9bd0500ec72271334fe1da", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134638, "uuid": "ef9900c6-8024-48b6-9f87-05e17a555925", "comment": "Malware payload", "value": "783d3493273876d8759753c9643aa04d8bb53a7b28a0518a7d7f27dbb50c1e7d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134638, "uuid": "db6918ed-bea5-46bd-bcb4-b8ae7489c92f", "comment": "Malware payload", "value": "3d1b6800a060584dfb618769afff952acbbdcc3b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134638, "uuid": "213b541a-1894-4232-bc2d-9ed7991299d6", "comment": "Malware payload", "value": "ce93b763cb7b0420ca94742880c065a138c9fc1ba1b3f0fede182e105fb5ef6b21e49d2a470d68e606f43df919f95d6a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134638, "uuid": "d348176d-86fa-40e7-9117-62f5719abbce", "value": "T16FD423E9A493BEADC63B8FB15E720C0987C87580BC1B51F846B70CD7A198EEF56D0491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134638, "uuid": "0e2c0152-bba0-47e5-9757-827ce0b4cd5a", "value": "12288:zLuYFAvOQRTpwXEOfWnJJhNEvyr98YdRFns7WX/dssUJQQGG:XbzsIbK/Np98g5X/YaQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134638, "uuid": "6c701d50-8831-4f54-9355-8357da9745e9", "value": 609747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134638, "uuid": "ff7edcea-b562-466f-b148-8ba8660d8d32", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134638, "uuid": "ce854d0f-435c-40c6-8b4d-2d2364c9e561", "value": "AvisoXdeXpago.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7deb10-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785168172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168172, "uuid": "9c9f2572-f407-42a6-813e-14360c91ef32", "comment": "Malware payload (Mirai)", "value": "2a6a0036c05d55272b2628e446ffe533", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168172, "uuid": "e2cc5570-bafd-47ab-808b-5dc602e56803", "comment": "Malware payload (Mirai)", "value": "7966290a654525ef4770fb92c96d3eefab07de4df010a53e5139153ed6810930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168172, "uuid": "302c3034-1767-4d80-8629-170d4f13d80a", "comment": "Malware payload (Mirai)", "value": "d1fcfa8821e09f56164fc5c51ed044bc1956477c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168172, "uuid": "ca7de2d3-ea96-4434-8255-bee5c48053a9", "comment": "Malware payload (Mirai)", "value": "a197fc32b5b56c712b3c42ad2053bb24828d9e439bc4d4f103872fe66643ed240134102614b173b0efbeaa908282e3e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168172, "uuid": "5f818778-ed5b-4796-a91a-1a3a5020a67f", "value": "T145C33A59FD819B11D5C622BBFA1E028A331357ACE3EF72129D205F2537CA96B0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168172, "uuid": "a7cd75f0-87eb-4db2-8ad3-5638632d6543", "value": "3072:LkUhW6FtxBaE6pcFRaebXQdcXmAULBc0lmPhO:LzhWutxBaORaebXQd+mzBzlkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785168172, "uuid": "96b397a5-fbc8-4439-9500-6184ce588e86", "value": 124752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785168172, "uuid": "34c22b2c-620f-409f-8581-6aa460665e70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168172, "uuid": "8eb538b5-5c91-4a3b-9658-46428ff3c6db", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faff2a1e-89de-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785172621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172621, "uuid": "016b7d05-9de9-4251-b234-e0b1f925caf3", "comment": "Malware payload", "value": "6a6eea061c8ede6fb552a15f83014d6d", "object_relation": "md5", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172621, "uuid": "84b62622-ba0a-4bc7-9752-a98c0ad3c50f", "comment": "Malware payload", "value": "79dd36d63a0be08b3ad2e0c5da9b5badf41ffc6c087244bd17428631a8d9d973", "object_relation": "sha256", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172621, "uuid": "2355fafc-5304-47c8-a3cb-6312879e6999", "comment": "Malware payload", "value": "705ce5826b18310bc1d9dc2e972d35a02f5030c6", "object_relation": "sha1", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172621, "uuid": "f1ed1b5f-4dac-4e9b-b4bc-bcd7cb578693", "comment": "Malware payload", "value": "f49a9d5dab8bdbaf3911ac26c27c21edcf402ee271c5e6f9ade363e1c208e6e0368790eb869e291637b540405bb54276", "object_relation": "sha3-384", "Tag": [ { "name": "Clixflare", "colour": "#792B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172621, "uuid": "90451552-567e-473c-98e0-da3ecc4ef9ab", "value": "T1DFB6233BF28B653EE06D1A363A77E150593BBA6165128C1396ECF48CCF254701E3E693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172621, "uuid": "f49f22c7-01b9-4b61-96f6-4dcf99801aca", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172621, "uuid": "9849e2de-c0c8-44ac-a44d-497f73cec4b3", "value": "196608:ccigH4kiY48zSXR2iAMT9nfE8G9R4YaHF39m8pcqTqIBS5T:ccUkiY4Kmw1YWN4La8pcbIKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785172621, "uuid": "bcc8b32d-63f9-49ad-98ec-c03ec648f1e4", "value": 11408093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785172621, "uuid": "3da6dc8f-152b-4928-9cd6-e9cddb9f2ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172621, "uuid": "fd12f055-db19-44b9-a1f6-054f4639f679", "value": "IntelSoftwareUpdaterV8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ee0cbe-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154281, "uuid": "06f13a1a-0232-42e1-8c6e-b5382c89c3be", "comment": "Malware payload", "value": "875a418091e9caaff7f40210e9778ea6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154281, "uuid": "f0cfc2f7-ac5e-4758-b51f-22de4befec15", "comment": "Malware payload", "value": "79e58c65c58dcec7bc58c988399dcb096832af423d8a4f55d9fddd24f06b420b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154281, "uuid": "3ccf2edf-0601-4f41-af2d-e7f5ca85a9f9", "comment": "Malware payload", "value": "bc595c83dae4eb0b0140d1dfde3408864068487a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154281, "uuid": "4ed04302-de32-4d73-bd11-c83583c9d17e", "comment": "Malware payload", "value": "0d10fa82475e32fd6858d1afc37e6fe368136aa627671a18a7805823800cd0188692634c95fdab0944bd92375106f847", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154281, "uuid": "cca80b9c-df1d-46df-824d-8a4c0f463d7b", "value": "T1752184F88316AD6CD70081355E94956926658494B406A2DF0EBBEF8EE4B192CA7463C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154281, "uuid": "62f91f74-525b-4d0c-8e6d-4a87ab3a1956", "value": "24:9yPdm1BZ3jXeECANvD0I3Xz1mD4bkmS/AplLuSXtJJ9x2XP17mh40:9yPAfZ3juaRr5mD4gPQ9XtJJ6Pdmh40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154281, "uuid": "86bd5dbc-1911-428e-840a-0312752f544f", "value": 1276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154281, "uuid": "64882630-0901-4414-8a21-e1c8f9319e23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154281, "uuid": "9fb8a679-af76-4d1f-8611-87cc633b9cce", "value": "photov_194689927276.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d337580-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158129, "uuid": "98b6171b-5680-4f76-83be-d5fc8ce599a1", "comment": "Malware payload", "value": "0977db988aac47da07a9a430911bfa02", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158129, "uuid": "d91d9e5a-9e2d-46a4-934e-69dd0ec64117", "comment": "Malware payload", "value": "7a0874b39ab9ad9a3ef22f910bc8a256df1a71aceae9fbbd9c8c5ee73e5984c9", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158129, "uuid": "b5c3b818-dd2b-44cb-8c2b-5a11688f26a5", "comment": "Malware payload", "value": "02ee12acadbfc4448412bf1a8ad3c20c738d6620", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158129, "uuid": "b60d7c25-2179-4a4d-91df-284b4e5f3906", "comment": "Malware payload", "value": "286b3339f1d21952be54238c76edc159ff9593721fa92b3d24a302610b417a4f8e18b70035260d43e89d4f18077d9b99", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158129, "uuid": "84e0a6eb-61fa-4110-8e71-d084e4e59994", "value": "T1FD573870D251A065D1A7C430CEC60FF4A4A1343B5E36691F1BC7D81A25EBE61ABAD3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158129, "uuid": "e530c45b-f5dc-4dc7-a88a-0e7d6585dd3b", "value": "52fc4cd1f0148f6789c566674a94e859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158129, "uuid": "0c8adc78-6c82-48da-a3f7-a510cfa4677d", "value": "49152:ZDho3SIGTXsrX+PTMWU/YAN4ET58rs6p7pCVR1Vl9MZBKpxvoyzJGB4wH8RjX+QT:+dqCRPdKG7xZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158129, "uuid": "3a3ee626-7831-4013-bbf1-e17aeaf3c1bf", "value": 28619776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158129, "uuid": "0560f60b-f930-43f7-afa0-f7382a87fdef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158129, "uuid": "8abebce8-c265-49e1-86d1-d118d09096c3", "value": "7a0874b39ab9ad9a3ef22f910bc8a256df1a71aceae9fbbd9c8c5ee73e5984c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614d9096-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167638, "uuid": "07080901-77d7-40f5-95fc-831b1d3972b2", "comment": "Malware payload", "value": "3c8d41e6951a60150a140f91e704cdf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167638, "uuid": "0b5b7072-fe57-45a9-9207-f03a3fb300ff", "comment": "Malware payload", "value": "7a958a6a5bb08a6b7f9592a5534cb024412ad402c4c8e6b4ee9839a2cb280e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167638, "uuid": "a494f675-5a04-42aa-9492-c2495254d68d", "comment": "Malware payload", "value": "3920a844c427c4fe60ef71f51503b67b094828cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167638, "uuid": "0db233ef-ce9b-4781-99cf-44e52d79b271", "comment": "Malware payload", "value": "a420d7aa14db25574fc8a3b1fbc22e1ba8affaafe530e8a69adff05f3cb7c83a5c63ef68f2f9a801187e4a5987ff0343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167638, "uuid": "2a800af4-c778-4c6e-8996-f7964d7e77f7", "value": "T18534BFA3603CBE9FCDE91F379C8E891753A52FD5C880107E1D94750EFA672082E3A566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167638, "uuid": "0a19f7c5-8ba9-46a5-9cb6-a3a290f508a1", "value": "4776e99a40d8b72668e173a43de71810", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167638, "uuid": "c7224127-13f0-4fed-bcaa-eda6cc075ee9", "value": "6144:EftXfOMEuiqMwSBxWj/Fh36jsrQqarDXmdeyYKNiI:EfB6wSM4gEodfYw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167638, "uuid": "4dfa1f05-1a78-449b-87bb-3305fde32b2d", "value": 241769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167638, "uuid": "4077d185-14f0-4a3a-8690-88152159b776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167638, "uuid": "9e531129-cfaf-4869-bdc5-9b683cdd3749", "value": "7a958a6a5bb08a6b7f9592a5534cb024412ad402c4c8e6b4ee9839a2cb280e2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d98367-8953-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785112855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112855, "uuid": "2a64d774-be56-46fe-bf66-dff7d3bf2f82", "comment": "Malware payload (RemusStealer)", "value": "fa928a93d7521a60e5ced8454d0120fd", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112855, "uuid": "a05ee181-3b65-4ebb-a169-8ecbb9cd63e0", "comment": "Malware payload (RemusStealer)", "value": "7b092a35e70113f5165a653135cb3a7ca29312ceb0b4a874c160473d30830a60", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112855, "uuid": "10da5326-eb24-4ba5-9853-32a883b74ceb", "comment": "Malware payload (RemusStealer)", "value": "40d9de85f33decc66b4b9df6cbfea867c82887fc", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112855, "uuid": "f9515838-5df0-4ede-80e0-ea4af408abd4", "comment": "Malware payload (RemusStealer)", "value": "10bcb9ac5ac6a8e80f2a02e65a91a9f3b33ff87bde3b545ae4c7a7e143e3b7730701f2b4c9a5a8e8f6eccb0268ebaaa2", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112855, "uuid": "4486443e-1dd4-4bcd-8f8d-b2e0583448ce", "value": "T167B55A07BCE009E9C4AA937289B656917B71BC084F3263D72E90B7783F72AD09D35794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112855, "uuid": "723de2f3-6f4a-45f1-92ac-76ca4848b2d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112855, "uuid": "8203deaf-3ac2-42ab-9380-6b280575bee8", "value": "24576:ZN2WgDCQqMQ6jeCHytr8j41mJo4AJU2Ba20LqJBele5r926CSo5ibJt:ZNtg6MfeLtrNgJorJU202PJgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785112855, "uuid": "c91a9adb-cb20-4a65-81aa-f1d29dc2d94c", "value": 2374512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785112855, "uuid": "7681fdf7-05bc-4850-a9a4-39cab2f7ce65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112855, "uuid": "56cc472a-b00c-4bc1-b3a4-55a91673cc69", "value": "R2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11056504-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154189, "uuid": "c68a7d6c-603f-404f-8b42-63eef829e4da", "comment": "Malware payload", "value": "0ddf717194d706486c814c8d7090ec83", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154189, "uuid": "c75285e4-21b9-4212-8c6f-be80a5565642", "comment": "Malware payload", "value": "7bde75cb95fc8d78ad5579e9baac8479aa2abffea21b7f3a977328d45b1fdb26", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154189, "uuid": "3a4984bc-6fae-428f-800e-40112ad652e5", "comment": "Malware payload", "value": "857bffaf0f6828b47196829a2ea0cdd3eb561741", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154189, "uuid": "91d31ba8-70fb-43f9-aad8-8c0213f774b2", "comment": "Malware payload", "value": "18d81c9b7a4aecb7ebc8f1ed957c5a7abb3d97e3bd47782ea198670cbac7302df633d8814eb90ec41bba666e59d02ba7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154189, "uuid": "c06d5744-53ff-466d-90ab-ee560c31b378", "value": "T14C212195E05FD904E7450F7D79AA3A6830A7A49442C001A32343BA85BE9EBD576527D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154189, "uuid": "cf2a02b8-137f-4de0-87e0-1661d9ddd322", "value": "24:9dbn7PzHEAUpCP27ZLiuNX/VGGBehWkmSnd+j8z+XylzDv/wNxNZsn/x2X:9dbn7Pzk1K29GuNvV9eBPd+ryhTwNfmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154189, "uuid": "9d19034b-9ad0-4719-a994-44e1e078bef1", "value": 1211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154189, "uuid": "8a0ad6ef-b28b-4c23-96a2-8103adff37e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154189, "uuid": "ec0e797b-54ba-4d67-adef-77676f648778", "value": "photov_727385855966.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb4a565-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132682, "uuid": "b023d49e-d766-4361-b85e-3a0a6e2d1c94", "comment": "Malware payload (PureRAT)", "value": "d4e433e70ca0b42906f8707ccc487ebe", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132682, "uuid": "1a2be775-a2f0-4bbc-be3a-1de82b5560da", "comment": "Malware payload (PureRAT)", "value": "7c1ac2988b9e52a911e3ebce684282ef682602b5ca449647a35adf6262b17b82", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132682, "uuid": "05e3ad64-e72b-424c-99a7-5dff661ae91c", "comment": "Malware payload (PureRAT)", "value": "ec2bb1d436a9f0deac7a42531af5839c9c5a24ec", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132682, "uuid": "f437d4ad-f027-4d7f-8dc4-30ec08e68039", "comment": "Malware payload (PureRAT)", "value": "ae5a59a9ebbd1d96ad085f2661db15d700ce84c3e42a9d8d95789f4c903ac7a759c80bd917cc48d3ccefeb686b917d2c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132682, "uuid": "8209bcb7-6fe7-42fb-a778-560433fc7044", "value": "T10421B731C577EBD4D543D9B6E88D919C00298D1DC099C769FFB330903B78960AB42334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132682, "uuid": "4f5eb728-1ea9-46a7-b046-f7702381c619", "value": "24:9nOSzTtRXVHD8l4+owP1/VKpF7LanuemSSrfR4JcyO0NdHMnmApnufg:9HlHD8f1tKnyHPigM/ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132682, "uuid": "80260193-16aa-4672-a369-cc6eefd07843", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132682, "uuid": "fb3dfc95-9e59-4f92-99c1-53dbb35a5043", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132682, "uuid": "4577aa5b-f2ba-4515-af64-79a9a340ef20", "value": "photov_675057253184.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd59ab2-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154426, "uuid": "12f78c6f-b1f1-48f2-a2ea-40c763e93be1", "comment": "Malware payload", "value": "7793b015e5530086322b312685bee9f1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154426, "uuid": "022d660c-dd4c-4296-9854-ce4633bad309", "comment": "Malware payload", "value": "7c6984cc3da35251a0ab9cf732d192f51ac99df0d848500b2c02ea0273f0cf2e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154426, "uuid": "c0109fc3-1d7d-4a6d-b0c8-b8c9ce9b2b69", "comment": "Malware payload", "value": "354c4abb97fbca599d09bcabdd65cf726d41b18c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154426, "uuid": "48a2d66f-f872-411d-8656-0da9dadae142", "comment": "Malware payload", "value": "ae61f54ff33ad0d7fc91c8604683a37be230bb6ca9bbcc8551b0d708eb17a26da2ecf96db064d3fb83ca6432b060c1d5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154426, "uuid": "da1e096c-6a74-411b-8896-57c4610ac901", "value": "T1A521372C98AC9943D856D5BF32EB0D40D530535DE406D85F6B0752D1EC92B742F7534B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154426, "uuid": "d8a85697-4d29-48d6-bad4-408b3efa8d91", "value": "24:9SJQSWZ+unUdBU3bCOJusaPG/Ta4FmSqoHrNIGJd+M:9SJQSWYoCbiuovFPqON7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154426, "uuid": "2811c06e-9416-450c-bf2b-76e814655dd8", "value": 1149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154426, "uuid": "fafbded8-2694-4a49-9044-047d8e84835c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154426, "uuid": "6188bb3a-8c31-4c77-bba7-fa1587ed677c", "value": "photov_598498738916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ded320-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154243, "uuid": "ea708095-1e5d-4a3e-beee-0d0ca4035c18", "comment": "Malware payload", "value": "ef06182d12056d6a735b85241f65ab7d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154243, "uuid": "c5e9fbd3-14c8-4f8a-a7c8-12ffc9aff25d", "comment": "Malware payload", "value": "7c74563868bfed37727123ca79d117bd65438143662e9b8641f0ca83502708b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154243, "uuid": "64d94ed3-0efe-4e17-91f0-09d6529b010a", "comment": "Malware payload", "value": "07f5d6e33b44a924ef2f1adaee9531e6770191f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154243, "uuid": "4ac6869d-dc68-413c-acca-88d42361d457", "comment": "Malware payload", "value": "0ac8be82ea057a4974062186fab1b799cdf7870e707c78a7dccc5cc52796e16e6c780aba47466b2fdc358f770d0cdb25", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154243, "uuid": "8ce6472a-b035-4e30-89d1-bd6359ef0722", "value": "T15D21A3B8E54619DED73B89B35C2F6C7613AA4458255C01F7721B28851B6B82C02C92E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154243, "uuid": "5f947f6d-9f5e-4d4e-b2cf-71f9f4a4f88b", "value": "24:9INiiByYahl8ZRYnzVjgcS48T/4z7ctzrbmSQsZyblZsWqJuyvFLyHcPv1:9CfW88zV8l48kGHPQQWyuytLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154243, "uuid": "6e5758a6-bd0b-4b7b-a641-7d19e7be4e74", "value": 1190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154243, "uuid": "b88c9be0-0920-4483-8da6-054adc5310e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154243, "uuid": "825acc53-002a-477b-bc28-789f76834b9d", "value": "photov_827986166260.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674b15e4-8974-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785126846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126846, "uuid": "8cc2d199-6715-4c53-a27e-780b2fbd21b4", "comment": "Malware payload", "value": "b4a72c3b2a2addfcc5dc56c13601c0be", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126846, "uuid": "335e71f6-2636-4705-a195-6a836cabe1f9", "comment": "Malware payload", "value": "7d85ed9fb87c23f6d1a638b99d19265bd30bf981277d4fdbc3cfc3e5c3e0081b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126846, "uuid": "a535ef57-cb8e-4b69-bbf8-ae0cf09281d7", "comment": "Malware payload", "value": "5edca41a51bbacf2a5bf048f82e65c919eafba56", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785126846, "uuid": "b19eb427-b35c-4f16-b3a7-50f22a6a37ac", "comment": "Malware payload", "value": "d18038c7b4b02cd7db8228e5f4b7d3a432b0510970af6a870d10d83749dc75ceb7481b356dc126e7799ad86cbc5fc251", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126846, "uuid": "d7465b07-05ab-4d3b-a411-4c74839edae0", "value": "T104119427B842C0E8CD5FCB77B88992C82965E09C3FD1DB8B439A35C77D595A2634A2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126846, "uuid": "4babbfbd-b107-46ad-9cab-e9ca6b2b1695", "value": "24:9DPiA1Mx5S1X2TT53BEt9GqxF+pZIwmS6QplLuWhfd+pzOIK:9DF1Mx01X4nO9GqX+fJP6oXl+hOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785126846, "uuid": "bb801359-23ce-4bc3-b419-a7268fbdcfa4", "value": 1039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785126846, "uuid": "da283ede-5720-42ce-92f6-9d7a25039bdf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785126846, "uuid": "eeb8a532-8fb7-4117-8544-f6ee7cd800e1", "value": "photov_909683014997.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fcfe59-89e4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785175132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175132, "uuid": "8b39f0a9-a94a-4e22-8f52-472f8d393d10", "comment": "Malware payload (RemusStealer)", "value": "39763d60e7122f64bd38797e83ef7977", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175132, "uuid": "31027d5f-e969-4be9-a69d-ace9401b43be", "comment": "Malware payload (RemusStealer)", "value": "7d98375b03ed4def16841cc9b749a9297701edf20cba2f6f64bf96fcc995c79d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175132, "uuid": "af9569ce-d252-4681-b83e-39da3944d313", "comment": "Malware payload (RemusStealer)", "value": "6dbce49761da2db96277b1c7cd65176ca9b7fa58", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175132, "uuid": "3457b785-4940-4776-aa8d-1bf6c120db80", "comment": "Malware payload (RemusStealer)", "value": "084655a293d7ab1783e28980a9346df66aae6c00b5915add86fa0896c601b8f53b32398e9ef12f109394948ce4ed7a7f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175132, "uuid": "ffb467ea-746a-4792-b2e5-b73af435f934", "value": "T171B55A07BCE049E9C4AA933189A752967B75FC090B3263DB2E90BB782F727D09D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175132, "uuid": "e64a258e-542f-4d9b-9bf2-2e52d686b706", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175132, "uuid": "d7841fde-3b26-44f4-a159-84d334878cc2", "value": "49152:kJaSXCpOB87Oij5k/sr9Th5Lq3rRqO+D9NsWJW2Zbh0mYkPXuDqF/x8WF2nz8oR9:kJDCO9EdKRoWe0BchK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785175132, "uuid": "dbe5ee08-c45f-4f42-9c8e-736ad7a55c3e", "value": 2430800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785175132, "uuid": "235848c2-572a-449c-a825-deba91d219ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175132, "uuid": "8dcc9e07-5aa1-408b-9181-fa0278fabbe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e77bc5e-89eb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785177968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177968, "uuid": "98d1f57c-443b-4823-afbc-0bd688c90672", "comment": "Malware payload", "value": "48ef5568dfe139db17891e9b8f8e659c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177968, "uuid": "7f0fcf3c-67b3-4d4a-b7ac-da9253464cf0", "comment": "Malware payload", "value": "7defdda6602cc54c73ad8cfe2e26e9465926795d6f73da1f3e3b7296be471916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177968, "uuid": "7db94290-3f4a-422c-8d82-7ee1c946a9a0", "comment": "Malware payload", "value": "65ba94495c65b78ebbfd6d59908cff81e891bba6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177968, "uuid": "39dade49-7fe3-455f-8d87-73ffb0ec7606", "comment": "Malware payload", "value": "1b5cc2d3c6f20191fe1dc74a311018ce74648e4b6300dc7eb677c309499549bddfb0c28f706b0cedac2df0ef11d66893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177968, "uuid": "033113e8-242f-4954-b1be-b63df48cc09a", "value": "T15828CF02A3E88599C0BFD138D57B551BE7F2BC695331D7CB1180596A2F73BE04A3A362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177968, "uuid": "80ad04ad-f421-4d01-839b-2aab0ef48431", "value": "1572864:52Jzw1t/z+l1zAxJorsgdnen9qPsniUd:4Jzw1tal1z0ysge9qUiUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785177968, "uuid": "eb08500a-44df-49c7-97ac-962579c1b6f9", "value": 95282176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785177968, "uuid": "17181398-42f5-48ad-8086-e9060b9e11a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177968, "uuid": "38e38ecf-5fe1-4581-96eb-f9511217a587", "value": "Exhibition_of_the_Heart_demo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e6ab28-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133097, "uuid": "dd54dd8e-3996-4582-9ee3-68dd0e0e0eda", "comment": "Malware payload (PureRAT)", "value": "21e4deb6bb9d67bcd920d3f1f5c13b10", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133097, "uuid": "86f8c62c-d443-42b7-96f8-4e08674d2c8c", "comment": "Malware payload (PureRAT)", "value": "7e5de4602e024c3e33f42212ab0ecee6fa35278beb9de50e56aa34c8f67a9bdc", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133097, "uuid": "27bfa714-577b-43bc-938b-ecbf4603ec54", "comment": "Malware payload (PureRAT)", "value": "0f8226c80c0d7e6cbdb5815022e0bbd6fb90e9a7", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133097, "uuid": "801bc9f5-6942-46fb-9aff-d21b7989d095", "comment": "Malware payload (PureRAT)", "value": "80005c3dc74d9e74fad33285407c1d4e2b528f94031fa57240edbd8bbfd1f288a4286dfc9df3db6910059d2cd36b384b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133097, "uuid": "59789468-2127-4dce-a019-89ce830681c4", "value": "T1952196488117ED02C18DE235689AE95B701E73A56100845B5AAC7B363B1049E7F4D6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133097, "uuid": "0115363a-f91f-43d1-81ef-825baeffc078", "value": "24:9U7OShlwFso2pVRye9gh3HawnknGM6F4EjIi4HmSHa+FV8i6mRmc9MM7O9nhM5eV:9YO4lIsV7RT9g90nKFfjIjP6+Fb6mRmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133097, "uuid": "489d0e20-8844-4e39-8ef4-47b659bd0fa1", "value": 1161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133097, "uuid": "07b38969-51c7-4075-9689-30c6b1ad3b85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133097, "uuid": "f2d5cbb2-0dd1-4fa8-bc23-9dac6eb396be", "value": "photov_565527363742.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca9adc7-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154370, "uuid": "2aeaddab-95bd-44ab-ad83-2952ec0571a1", "comment": "Malware payload", "value": "e21c4ae20338afffdb1c9c382e37907b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154370, "uuid": "ea9d7450-ee80-4baf-abf2-50b56be1177d", "comment": "Malware payload", "value": "7fb6c1aaeb9402c71cf13a90bfafb08c02e03161901203a36537fb29d6eeeef6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154370, "uuid": "63b9ee56-a1a1-4d9a-8569-7bb6b7f01feb", "comment": "Malware payload", "value": "5c3d6dd807c6deeaaf1ba1ded8004df630ca2e1f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154370, "uuid": "3deb566a-2f12-4f14-8d06-6d8a2ca00aa6", "comment": "Malware payload", "value": "eab5670cdee5fc400e4fad064ab352519d8f952d9a9ae74cda48e8b9376e8f8672b5c2b7ea895fc6922ea8130c64ba18", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154370, "uuid": "764b6719-6b48-4d3e-ac12-f2417eea9e1a", "value": "T10421F6D252B9E801C3E3A1769F48970A30B3C202325D60E3309436EF6D3BEE81F8B061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154370, "uuid": "aab8ee45-8654-40e2-a012-f1341f9d0f58", "value": "24:9E7ftWLt83rtbBefHDhAGnbU+6av9dCjNL6mSSsjv/RWylOIj7iKL1dpV1q:9Mf0QZbBaFrbU+6avIGPSnwHdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154370, "uuid": "2e0beb67-74c9-409d-85a6-04eb0a288351", "value": 1179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154370, "uuid": "726570b0-9a15-4758-8cca-7f29e35c34ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154370, "uuid": "3e9b0656-cd8e-4855-87b9-953d9058f084", "value": "photov_064088356046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d23e5a8-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785132735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132735, "uuid": "3a34e1c0-8a17-432c-befe-d3f9168fcf8a", "comment": "Malware payload (PhantomStealer)", "value": "2adaf4b59d84eb1c49955b7f7429f183", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132735, "uuid": "ab7b4baa-be11-41e0-8c21-fdc2217043c2", "comment": "Malware payload (PhantomStealer)", "value": "7fe7d4029a8c120dadb61c2e79a528d4ebe768582fdd5c11870d0d5fd25ed6e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132735, "uuid": "2843c43d-7529-41cc-a22d-525906ac702c", "comment": "Malware payload (PhantomStealer)", "value": "283146253769b40060b186af98ecb60acc87b141", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132735, "uuid": "74ed126a-9cc2-4552-8fc8-828df15fffc8", "comment": "Malware payload (PhantomStealer)", "value": "a16a67eeef1588b88ee8bb0c146a85bc1c3faf51133e2ad43b506decbbb7f9f2d1746553352b7a8a5ac9808566e3cd1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132735, "uuid": "ca7995ab-71b3-44a3-897a-2edf6004be18", "value": "T14955235D2A566E7732A88318BF3B0B3DD768CBA1402DB586838B9C5112FDFF6C485D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132735, "uuid": "048d1c11-143b-4c3f-b710-5678d13a54c8", "value": "24576:rogOe/UZd7Q96e+U8a2JEZs5IUTNVJ+z/KLOrSo:0l7v+6ezZs5v4Cmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132735, "uuid": "09f9569a-2736-48c5-b4cc-423252af69e6", "value": 1284873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132735, "uuid": "d5cdc239-2c73-4ddb-a54e-57190fadda2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132735, "uuid": "11772c0f-dea2-4217-9f44-29d558f6e5a9", "value": "New Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f442afdd-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167885, "uuid": "fbd44c63-4327-416d-9c01-77008b397093", "comment": "Malware payload (Prometei)", "value": "81c226154c7663bb3f1b0df208dcf664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167885, "uuid": "fb9df87d-80fc-40be-b51d-d8462694204f", "comment": "Malware payload (Prometei)", "value": "7fecb00580517395eab594588d4b4efd2154d6160f20ee8da298d613d9223e64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167885, "uuid": "6d1b1781-a2bc-4ce3-a156-00e1e627432f", "comment": "Malware payload (Prometei)", "value": "84252044f7af6478ec0d2db1f5f6330ae8341b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167885, "uuid": "81071a01-7ac5-4c62-91f5-a904d399ce24", "comment": "Malware payload (Prometei)", "value": "10dd31c5fe2d3124961bd2bbbc682017872c7e9852a1acc6d3e597213a012d4125b35234e094f790511f7fa104606211", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167885, "uuid": "a3b6b53f-3930-4f05-a0b9-8d62ce27980c", "value": "T13574DF63F6B8F14EE88297324B57CB0287A53FA58842E09E79B4230F28756544F74F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167885, "uuid": "620ebfe8-caab-489f-ab3d-c4f288a3fa27", "value": "d9210cd966b2e5956644b71b6805e8d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167885, "uuid": "c899f0eb-bfb6-48e1-bff6-1fde4e8e59ec", "value": "6144:k+LQwhNI65MY5wH2l3D5YolYvRjf6yl/5JTFw1iKzHk2oGbksEb5iFeN:kMQwA65YHWDeXvRjf6YnyixGbk1oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167885, "uuid": "a25f83c5-42fc-4015-ac54-baf2f2f7f054", "value": 347481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167885, "uuid": "503e5c64-3835-42be-b762-8db3035437f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167885, "uuid": "8bfa535f-ee9e-410f-96e4-5b06bf5093e7", "value": "c17da88435a502ed14c705832371807419a7494a26be1c32329d4dc017477f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54559ed-89b1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785153150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153150, "uuid": "3c1931ca-a7cd-4a28-83f2-7f428b764aef", "comment": "Malware payload (Efimer)", "value": "bcd7e1a3a1341a04aa7ec824d94ea351", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153150, "uuid": "1b7f1020-af26-4e90-84e1-20632d7353c4", "comment": "Malware payload (Efimer)", "value": "80eb9807bd260554eb6a122055b5292a32be9194df58bcdc5b2ce047a27b46e7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153150, "uuid": "8d202afd-df50-4965-8a9c-c5ae1572b0ec", "comment": "Malware payload (Efimer)", "value": "0d59eac16604a2593079f229763b4a69e902e046", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153150, "uuid": "5553d650-495f-4372-977a-cd3a3bb9c73b", "comment": "Malware payload (Efimer)", "value": "fba2c3b3c1228c8b338676c253129fca85a27b9164582e9d21738998e655983d732d0704ad863d11900d029de2dc9d9f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153150, "uuid": "bcbf36e6-6709-453b-8965-720ea6d40c96", "value": "T172E63318BDE011EFE672613CAED195E5E8BC78F407B0C59F136883675E8B1E08A39653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153150, "uuid": "d423abd0-7103-49fd-8bcd-96c29e2a6e1c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153150, "uuid": "e88f3b70-9fe8-4594-a09f-94513f79c668", "value": "393216:DpzEmAPJZuPrLXMCHWUjX6cuI3/PGTAI:Dq/MXMb8X3H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785153150, "uuid": "3cb345b8-5d52-41b5-92e5-708fac3194d0", "value": 14304135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785153150, "uuid": "92bce41e-c622-4f77-abe0-c8a89d1ece77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153150, "uuid": "a0d1c787-2ee7-4840-93a7-f39ac067ed22", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dc69d0-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167649, "uuid": "5bced833-53f5-416b-aee3-62e49a5f2674", "comment": "Malware payload", "value": "3bc0585335394b1ae27b0da358823047", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167649, "uuid": "e0814262-0c14-4d3d-b8f6-84799b550f08", "comment": "Malware payload", "value": "8112cf5b4b19ae755580066f654dc91266ee0a150c3480b052bc0a6f17696f54", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167649, "uuid": "8f0f3f7d-7595-44ec-bfc7-9c2cfb1a3023", "comment": "Malware payload", "value": "a170f5338ea4dce983b80538ec5da333eafaabb8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167649, "uuid": "f25160cd-835a-4844-95b6-8a466dd4a9a7", "comment": "Malware payload", "value": "feac43c153c1c89fff9454692bf67f831afdd8f4856f6849dd6b2d0e3adbfecaa861a6bc64eef3925efb5408cd93b9bf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167649, "uuid": "5d26e6aa-898b-4eea-b287-c01eecd48053", "value": "T19E5126A5B430C4332A6D8C3C61BB1D556847466BC4A82D00B04B9DEB9FFC665FE61373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167649, "uuid": "f754494d-6ef1-4889-93f5-6ebe7a48d63e", "value": "48:Ry4l0x9EvWMf/WGckcpo4F8O27IY63vQ0obE2kCcRKSoLDd/03Sqbuh661:X0jEOMfeZkcmtOmIY632j6YS2J83Sqbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167649, "uuid": "356065ee-e790-4045-82bd-5d18765809a4", "value": 3068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167649, "uuid": "fe185c34-8895-4199-a186-86c510a58d49", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167649, "uuid": "984bdde6-081f-483b-b9c4-832d453f1f12", "value": "8112cf5b4b19ae755580066f654dc91266ee0a150c3480b052bc0a6f17696f54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff4730d-897c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785130270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130270, "uuid": "612a694f-58c8-42e0-b58d-d6c030332cf2", "comment": "Malware payload (Prometei)", "value": "1e23f9592d4495049c288f57c2f28781", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130270, "uuid": "bf193c82-1f0c-48ea-a6d4-42445a427777", "comment": "Malware payload (Prometei)", "value": "81760addaf68ddd3c15a24e180a2991f6fb4ab330a1650e0a363760cd0c36560", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130270, "uuid": "c4d51d81-cbe4-493c-8660-05db3033be25", "comment": "Malware payload (Prometei)", "value": "faa789c72351e372eec74ee024d61414124361b7", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130270, "uuid": "d0f3fa23-ba54-4add-8ba5-c6d20556d818", "comment": "Malware payload (Prometei)", "value": "723596ce146fc5fbf12e37e62bf50ec63e936e2f58193962c93f356b8b8dfe09ec55325877b49b196cf176b58e6f1b79", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130270, "uuid": "5c71a228-1b39-4c43-b597-cf161b15f65b", "value": "T157F0A2E4F4744C38B2985036A04674F82EE5646B5464385C68BF8C74D97D614748BEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130270, "uuid": "845c3dd9-9651-4a20-ae39-131000a74780", "value": "12:MkzKWIxXY2/NdMI8wn/R0faQdY4r8nakhJol6pGn:MUiXjlf88/RgaWYDa4oKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785130270, "uuid": "8a2d83b8-b363-4e21-bddb-b21a2957be3d", "value": 601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785130270, "uuid": "805a265d-a7f7-4e79-a173-636771932e68", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130270, "uuid": "b7f26d28-50ca-480a-a43f-509cac661845", "value": "81760addaf68ddd3c15a24e180a2991f6fb4ab330a1650e0a363760cd0c36560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7c919f-8984-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785133834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133834, "uuid": "593fb143-4449-43c0-a57b-31b58dc0d478", "comment": "Malware payload (VIPKeylogger)", "value": "e7917244f32857b84e276a7a57acf917", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133834, "uuid": "85f621ea-afb4-4e81-9064-159afc60917e", "comment": "Malware payload (VIPKeylogger)", "value": "81f9c180ec09b9a8f3d4da2738cf129353f513f9ac75f626e8a313edbb74f2bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133834, "uuid": "59237816-31c3-48d6-95e0-1007c6878868", "comment": "Malware payload (VIPKeylogger)", "value": "513057be5f14a8af62c400c5ce78fa8243795391", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133834, "uuid": "feecb1c1-9106-4859-99f7-b06294a6b5d9", "comment": "Malware payload (VIPKeylogger)", "value": "a42cf27de2126ffdf5b9ac3a769b1e6fe058fff2633294e19fd871b563d9e6c7a2e538407de886c1612153b0e820a6bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133834, "uuid": "4df7bdb8-e721-4736-9140-5836809fc66e", "value": "T1A6469F606E5859F5EF8C290E90AEAF1D87F042176A33706BFB41DF05BDDA241864B21F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133834, "uuid": "38cadc59-9ac3-424f-a0e3-9bd10d2fa0f2", "value": "24576:+t9a/eBZHXN2uItgcNPOFGn2IQEFC0cR5T9sqGl8wOlBxG/TwVjCKJne3+RHK65a:w+D935", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133834, "uuid": "0dcdc10a-792b-4f3e-99a8-60461fff1fd4", "value": 5506005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133834, "uuid": "1b7acbd9-3206-43cf-a1e9-29823d4b1bd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133834, "uuid": "bbd660fc-6ba0-4abf-9025-cac078ead8d4", "value": "REMMITTANCE RETR SCS2208023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eaec549-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785168171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168171, "uuid": "3f245869-ad5f-4ab1-8867-9aec8b0060b4", "comment": "Malware payload (Mirai)", "value": "fa278a941e0347f45fff767e4a3ef223", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168171, "uuid": "0c91ce44-8101-440b-9bed-e62ca8f5a533", "comment": "Malware payload (Mirai)", "value": "822392f60620eed96855fc51f293e41bd0332cdc0adb54cf4f0f9ab816ef460a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168171, "uuid": "130b1875-cd10-4028-9a14-2b436d686285", "comment": "Malware payload (Mirai)", "value": "305a3ee647995a083bd9a82ec657d3e83a60aa8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168171, "uuid": "2b35bb96-f9e3-4a17-94c2-e5f8e0ac97ed", "comment": "Malware payload (Mirai)", "value": "78ca527ef6465e235beba2a2b149cc2a15bf79cb44bc048175dde6365b350360137375d805f911047da3f5484518ce6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168171, "uuid": "2a5163e1-776d-4b6f-80f8-b5afb3e11aa8", "value": "T1C8B33959B9818B22C5C212BAFA1E128E331357B8E3DF73179D241F6477C696B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168171, "uuid": "6f738fff-9345-4bb1-b64d-e9a60589805c", "value": "3072:/gazwz102cpveoPaRl+UfacSAI8ywMJj:4azwz102cPPaRl+AS97Jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785168171, "uuid": "a47f7b27-f3cb-46bf-99c7-c2711a7aa021", "value": 108208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785168171, "uuid": "44f3b0c2-b1fe-416a-ab6b-8c07dfbc21aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168171, "uuid": "05e1191b-13ed-4099-9504-041452611ca3", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ce3837-896e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785124352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124352, "uuid": "92be7bce-984e-4972-955d-90ea1133e2a0", "comment": "Malware payload (Efimer)", "value": "b40c04705635d82de166087f3ff19874", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124352, "uuid": "3b9db11c-90b6-4d93-9dd6-3db0d5e21672", "comment": "Malware payload (Efimer)", "value": "8230ecb782d68b44a91d1dab3b65f98324e653efc0c8529c4e81cb762cc8e179", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124352, "uuid": "1cd7875b-cfd7-44f2-8cc6-300135ef52a7", "comment": "Malware payload (Efimer)", "value": "99bb423901e51d8e4a36a45d6a798a232eab7838", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124352, "uuid": "8f5fbd64-094d-47e8-be68-cd8eca89222b", "comment": "Malware payload (Efimer)", "value": "1562f51e08ee1ea5fb6e7a0aea718054611b34623b0c9e59176b52e98fa33b9b1aecce1941d2402ec9995715ddc80eee", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124352, "uuid": "2c8722f4-91be-4eeb-a875-7d6708f9c105", "value": "T14BE63364B9C012BDD5A3C13CEAE153D6D8A5B4B64B72C98B477883F16D2B1901C3EE27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124352, "uuid": "9eb9a94c-8647-4413-849c-df9b892b2d18", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124352, "uuid": "45836f53-0f37-4d65-b8ef-88bd9f3bbef7", "value": "393216:YEUlVtrifHCSUSG/azvJx+KrasoXMCHWUjX9cuI3/PGTAI:YPmUFyzvT+KroXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785124352, "uuid": "f8d2a742-d8b7-4354-a200-3d24024d9005", "value": 14297248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785124352, "uuid": "4e71e379-b0fd-47e7-b0a3-e5dbcea64e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124352, "uuid": "bef59986-dea0-4690-8fab-68da1347fa9a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1f787a-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132736, "uuid": "d5e30787-0937-44b3-8ad9-e4e362d3719a", "comment": "Malware payload (PureRAT)", "value": "3b1445e3e6c5c7592112a9cf3618cffe", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132736, "uuid": "43726d2c-8578-4d8c-ada4-f4337f515896", "comment": "Malware payload (PureRAT)", "value": "82c4aa38572a79d4607ae04ba134b248a77d16e77350110b4bd093af1c3a0d98", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132736, "uuid": "f9dd6e22-d0fe-461b-912b-ddd0eca70980", "comment": "Malware payload (PureRAT)", "value": "98f3eea33d8156a91510b359cad6e15d012fd128", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132736, "uuid": "1e51e78d-e60c-4fa8-873d-0593a592da3d", "comment": "Malware payload (PureRAT)", "value": "1d8801f62bfee3514bb676d31115accda8d1c69827848f67eb5096d96be137d4d2f3629059e78e0c67fc65b2abc2cc29", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132736, "uuid": "2e7e8328-839a-44cd-82b0-c7968063b0b1", "value": "T1E7210A6EF2299B29C4CAED32F50570033511510BFD0E2173578B2D503EC2B9E5938679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132736, "uuid": "5d9f37f4-1cd0-4091-994a-4ddd30a948a1", "value": "24:9AL1KdL3D+9a2yuAUFHxPVRrxWUOscfmSb+FV8w4ceE:9Aha+LyKJ1fruPb+FQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132736, "uuid": "d7f86e53-5ddf-4305-bc16-db4cb17a0b8e", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132736, "uuid": "c7e9b12c-dc80-4b3b-95f7-e0c2dcd8034a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132736, "uuid": "f5bb170d-be25-4666-a33c-20388088a446", "value": "photov_988210219585.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f812a3-8984-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133575, "uuid": "6d8fe036-92b4-49f7-aff4-6bd33e1a8816", "comment": "Malware payload (Mirai)", "value": "42dc563b1fa5404c8cb925f2c6fd1fb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133575, "uuid": "1fdcc427-2104-433c-963f-7860af1c4ad6", "comment": "Malware payload (Mirai)", "value": "8312ce1a81b6d45c46db78156d46286e1f55b8045eb751b113d768edf0de4f74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133575, "uuid": "db7399b4-296f-4f4c-bdb7-3b6a5e6d81a3", "comment": "Malware payload (Mirai)", "value": "879470dd7425ff151e00c12d971163b81efb115a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133575, "uuid": "2dda154f-350b-4f9e-ada9-08c2e1e984bf", "comment": "Malware payload (Mirai)", "value": "7ab0aba2d118bf5db79f44c0e741397950a38fc47319b325ff583c15618f6639b68e190b93b951a7324303490e8e039f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133575, "uuid": "797551cf-285d-4fd5-bc3a-2ad652e77a88", "value": "T148A30749FD416B10D8DA36FAFA4F024973934B6CE3FA7101EA245B3123CAA5B0F76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133575, "uuid": "69c5a0be-a3da-4dc9-8da8-74d07b6cefca", "value": "1536:U9nA5lh+otYJ/7fV1++tQoLMBzulVwOaS02gE+qOhqliKbUi7cHETTqKZ1Yap:TYJ/r+S7LwalVwOaSBgE+gp6ETTqKvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133575, "uuid": "a31821d9-f61b-4355-ac45-727dc0dafac7", "value": 99940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133575, "uuid": "63b9f70d-29e9-4548-bed1-3a14914babed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133575, "uuid": "8769ce71-3783-499f-b08b-b558162d63c6", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb4e828-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154316, "uuid": "6bbaf3aa-337b-4eaf-a57b-a4bfc6958a2f", "comment": "Malware payload", "value": "04950e07aa5063c8bfe7d3a2c6f4d865", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154316, "uuid": "85cb5f49-34be-43ca-956a-ee3654a0e470", "comment": "Malware payload", "value": "834632aa076c7692ae4373fe8323b6e34b6756089b6dede40795c67f527bcdcd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154316, "uuid": "bd033702-9f8e-4c01-a81a-d7a9176aeb92", "comment": "Malware payload", "value": "1e55a77be83bf791bd427d8af617123e3729eb9d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154316, "uuid": "0d065beb-50b2-4b3a-ac54-188842b72bf6", "comment": "Malware payload", "value": "8eb30d7c84a0a30a0d7f920d23cb631fa00cd9c684e1281a56a7683779d1c5caaf85261d3d18a62caeb3deea4db9b3be", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154316, "uuid": "b70a045c-8eab-4ea2-909a-51a042e04462", "value": "T1AC21B7BCCD2DF015D52A40F2785C1E99332D484364994AE266C03B1B7CDDA58AE0F365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154316, "uuid": "db04ca16-ca6a-41a4-8e17-71cb785589df", "value": "24:9w45mJRrkGH4iqaDZn97TO+Dkjn2/pn2FruTzmeqv/RWyL282npQh17r4Cyi:9n4Xr4iZ9n97TrDk72Rn22VRk2VpQh1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154316, "uuid": "8af67259-a7f2-4bfe-8eb6-9321b3a49efa", "value": 1236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154316, "uuid": "f1c1500b-7101-4892-a40d-eed7e57cf9e5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154316, "uuid": "0c9f5b4d-0b5a-4d2b-b3d3-f7147bf9ee27", "value": "photov_227810431843.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38073917-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158120, "uuid": "5e9e7609-2466-43ea-89f0-649c61c6873c", "comment": "Malware payload", "value": "63b84ede328c63a95c8ec5e8da747b0f", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158120, "uuid": "0bbf8561-573f-4879-8f39-41e3780c60b2", "comment": "Malware payload", "value": "8354d4378dc7b6522191c0aacbe794f062b3827bf20d0c09acc539f8b0106a8b", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158120, "uuid": "0ee650d4-30a5-424c-b272-0250539812d0", "comment": "Malware payload", "value": "2365f2e09a88486d2c0d748434b4436cbef78a5f", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158120, "uuid": "223222de-8600-46fe-99fc-e11ad9a1cadc", "comment": "Malware payload", "value": "f5f024ea22b558619d1a1a4cbd0d5777916e6ef109efd2f8127ebb4afb7e1067424835e5aa075c43a839a532fc73c516", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158120, "uuid": "171ef458-35ac-4509-8e4a-1e7a4af04867", "value": "T1F447BE14EED811A8D537D634CA729232D6BFF8420775A48F0689C2152FB3A909B7F3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158120, "uuid": "1db2cc47-ca3f-4e87-a52d-11d716dc095b", "value": "f35cfcc6a3cb25841aefe38eee53876c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158120, "uuid": "4f4dff16-749c-4f0c-9d35-f7cb532ff227", "value": "49152:nKwUO2hUongkNokMAMo/df9AF5xFtS7n0yLSddpA17FB1cq16UBE:Hsv+dQBaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158120, "uuid": "ee06ccb8-27b2-4d7a-bd73-c4b18e4e63af", "value": 26923520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158120, "uuid": "cd1012c5-d9dd-4ad5-ab1b-161aececcb8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158120, "uuid": "6ed22ee9-f71c-45ef-ae3d-eab886f56de6", "value": "8354d4378dc7b6522191c0aacbe794f062b3827bf20d0c09acc539f8b0106a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2465f346-8955-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785113420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113420, "uuid": "901c16df-0cd3-45b2-993f-b16841e19df9", "comment": "Malware payload", "value": "ca97388c5734eb30b7ebcb0804da0577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113420, "uuid": "ae497a2b-7be3-461d-a169-ff31b17fe9b4", "comment": "Malware payload", "value": "84742f0748a01c59931925dd2e1da61624c78fd115aad38a6acd1b48ee9d0fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113420, "uuid": "cdb1b57a-307d-4e80-8675-50135b73295a", "comment": "Malware payload", "value": "e9b0f1c855686f04ed6ce216a246d9e5af2d9642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113420, "uuid": "2add497d-02af-4c1f-a3e1-629c0c902e20", "comment": "Malware payload", "value": "20cc2e5af8a9685c49f3ef4105157c92875bffaa77a4e4916700817d5154aed0b91f795030922fb8b5ef24b5f2150664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113420, "uuid": "33166274-7513-480b-ac95-55a4b8f544da", "value": "T11B28CF02A3E88599C0BFD139D57B550BE7F2BC695331D7CB1180597A2E73BE04A3A362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113420, "uuid": "bfeea63a-8d9b-413c-97fa-99ba3df6406c", "value": "1572864:z2Jzwbt/z+l1zAxJorsgdnen9qPsniUd:KJzwbtal1z0ysge9qUiUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785113420, "uuid": "f3e5ac6a-7245-4143-962a-da5da2536539", "value": 95983616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785113420, "uuid": "27b370fe-712c-4a00-98b0-3c88e38f121d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113420, "uuid": "a67aa740-a918-465a-bbfc-02310501b1c4", "value": "HeartProblemsFanGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f6dda6-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154312, "uuid": "e74d8599-2869-4797-b575-2708c415bd5a", "comment": "Malware payload", "value": "1b2f7ef4f09afab6544dbab1634fb0ed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154312, "uuid": "dfb5c745-7dad-4275-bea2-a644ae56d0bc", "comment": "Malware payload", "value": "84ff4bec3f7a01b115616c44a56fdace8e431766c1f6767912d8fc1138ed1aa0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154312, "uuid": "d999916e-9dc3-4ff1-9b2d-1a92bec795b1", "comment": "Malware payload", "value": "a39362b3e620f6c8cfdb59193ce55ca7545c5183", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154312, "uuid": "36812f9a-369f-4c12-9e93-1a9a679a50c7", "comment": "Malware payload", "value": "cd7e3cab1786edf7ed062ba949347976946026c7b809fbd46666c02fb34f905c27826f67abfa9b6885f54d2facd02e0b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154312, "uuid": "26f1a499-6b78-491c-a985-79efcf123825", "value": "T10321C6D4815BCD67D00B63BB7CB345122F2187D95705B296088839AF2DE9C482B034C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154312, "uuid": "1ba4c656-8368-4f62-9468-663bac9384a6", "value": "24:9xTZuHaBsq9eqxWpih2Y2twmSrHhkJiiD+dGoTFl:9xTcH8sq9eqQps22PNSKXTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154312, "uuid": "eb43f7ed-2c67-47c4-bbf0-64077c594649", "value": 1186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154312, "uuid": "0a6c5931-6eb7-4faa-8075-bd92df6d0217", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154312, "uuid": "f19ca77b-73f4-4c16-a328-7b81fe01e1ff", "value": "photov_725979296720.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2833a36e-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785154228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154228, "uuid": "b33c1227-d2d1-4e91-98fa-d29d80ffe303", "comment": "Malware payload (Formbook)", "value": "012417881e8edcc6e96c22e10984bb83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154228, "uuid": "c79d22ce-1a81-4116-9e61-2190a3d8c7c6", "comment": "Malware payload (Formbook)", "value": "85708f2b9dfcda4f1ba9f5d9b6da471d646262c0f837b951360988a6bec114d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154228, "uuid": "6589ac1a-b3d7-42e1-9f1c-831f6478a46a", "comment": "Malware payload (Formbook)", "value": "b4d069c3ec09574e49bace3d5d65d8bedf77cbd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154228, "uuid": "0e6e7bfb-28f4-4113-9026-0367ae82e016", "comment": "Malware payload (Formbook)", "value": "f987a032434c511e0eaf8507f71ff759e2908421688e211f83eb435e0e8cca81cd03c2f2a80978f3bd6756963e31a66a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154228, "uuid": "3cdb9ff5-67d8-4a07-ad60-bfced5f2fc7f", "value": "T179E53DE537EF644349113B9EA44D4A318B6F86350D437DD0E8EB8BAC901B887B9D0E5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154228, "uuid": "66401d5e-fc20-4a8e-9a9a-87e547d6be14", "value": "49152:ciCA146oxndMtKvBAodlJdyL9MPVx1WKADJ11+GPd01QCaQffwPwbj:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154228, "uuid": "ee16a853-ef31-4feb-93d5-3c76dad00f97", "value": 3205230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154228, "uuid": "fe75450b-3c03-49b3-a068-fb5034036318", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154228, "uuid": "2e986778-2300-46c9-987e-12c8acee5a5f", "value": "PO_890.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82959b6-8969-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785122338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785122338, "uuid": "4863eb17-2f70-4d97-b339-484ef62c7e31", "comment": "Malware payload (AsyncRAT)", "value": "b9b9e94e807a98caa367cf2b4b995eeb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785122338, "uuid": "e5ad42c5-c2ac-4fda-984b-d88c35ada661", "comment": "Malware payload (AsyncRAT)", "value": "85a229fa75bcf5ef41066bb0618ade943cba3b72c377fee22bc2ff94dfaf4160", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785122338, "uuid": "3d4112c3-0e5a-4eb7-9bd4-748751079fdc", "comment": "Malware payload (AsyncRAT)", "value": "ac38d4936c5bdf74c2ecdd3d6da8adc35db12b6b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785122338, "uuid": "2ce0d064-c686-4968-b19f-82d906aae1b2", "comment": "Malware payload (AsyncRAT)", "value": "83fbc9febcf2f1bc1cb71d3d80644d9269572200ee09adbe8190968054006971b2e331f7f6b0785961390e31ff8d93a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785122338, "uuid": "8a87b2de-6945-4c62-971f-7ff15a75351d", "value": "T1D1C22A0833E4C671D2FD4ABA8C33D5009B75E95B9913D75A6FC890AD29237CD8A14FE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785122338, "uuid": "8ae7cadb-b5a4-4e60-a38e-4a7dc9ad712f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785122338, "uuid": "6851d374-7f4a-4050-bac4-d5b6f929ce02", "value": "384:5Tdv2D9YfxWcvHtZARPn9j/H9qbuUsMbQxnCJfJBndnjJXKyl:1dvhDt+LIbIBiBnGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785122338, "uuid": "d5638e5a-54d5-4502-97ec-d81a64f8a683", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785122338, "uuid": "046027cd-777f-4433-9860-eb218bffb591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785122338, "uuid": "dbcc0eaa-d54d-4edb-83ac-4cdb4feda89f", "value": "F8BETAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1d55da-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180973, "uuid": "2b4f43d0-42ce-4256-a24f-fd3070e5d824", "comment": "Malware payload (Mirai)", "value": "daf8a36252d90f286226d717bb5d9e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180973, "uuid": "125a0900-fb59-4a48-a8a6-1407090f79fb", "comment": "Malware payload (Mirai)", "value": "85f1f91bb75a6cc10d59e3896c3735854c0b28e7435bc7ea50d7833638e38b0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180973, "uuid": "7a4ed979-c12e-476e-a79a-6b46582d9821", "comment": "Malware payload (Mirai)", "value": "ed543e0cf97ff1bc500bebde653f50fcfaece1cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180973, "uuid": "7cf042d3-1370-4dac-92f4-7c9a76d370f7", "comment": "Malware payload (Mirai)", "value": "61c9fbe94e8d263955c304ef25a9c043fe0a56e54481557428db881c3a244aca65a85e337b39dc01b2ca144e8e9daf71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180973, "uuid": "033fe712-4846-430f-8837-fbb28bdfd92b", "value": "T1FE430154B70F66284D128532E171AFDAFBDB5FBED0F95083277A333467C980117A4A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180973, "uuid": "ec0e37a7-fdcb-4bbe-a958-83bdaced6dfd", "value": "1536:zbIZGdFRlG+lh5wKHwtMJQLLy6tlW46Cm:4ZGHRlG+lPwKQuQLW6tl2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180973, "uuid": "429c4f94-7995-4722-a34a-30240987691d", "value": 60104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180973, "uuid": "92c11791-1ebf-4b96-87c1-28fc8d7afb4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180973, "uuid": "d3210a72-d528-4591-9729-d6fc3ec79e9a", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44fc1283-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132802, "uuid": "1524be28-b9de-4f49-8e66-f80d57e45a1c", "comment": "Malware payload (PureRAT)", "value": "7e600acf8a5a41c19501448a24f1daf0", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132802, "uuid": "4d3175f1-374d-416c-a27b-73f87bf439fb", "comment": "Malware payload (PureRAT)", "value": "860890b795bedb7f1d2ec46cdea86ea51a2186639904af42cd4684fb350f9b61", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132802, "uuid": "17f3a465-1205-4dcc-bd80-408e581999b9", "comment": "Malware payload (PureRAT)", "value": "692a97884cda0432f12112317dab0362d6a4c38e", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132802, "uuid": "ad2894bb-7581-4808-a6d7-823283605933", "comment": "Malware payload (PureRAT)", "value": "082052e4cd49d78973f6872898e16c0f5b0699ec6ebb43115620ded4718657f89cc1e1a3485d7961740e00c9df58f834", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132802, "uuid": "d86d69fd-8a77-4be4-8bea-90c50f4e68e1", "value": "T11C11C81A83EF82B1EE1936B5B8B9992D18335C20C233A04727381F177717D8D433A310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132802, "uuid": "7e7609fb-a2fe-4567-93d0-673045af464c", "value": "24:9MmzfTVDmJ3Cr3sgsU4xY+gFmSlC4J3xiC:9MmT8J63sZUzpFPlcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132802, "uuid": "8105e694-00b9-49c7-98cf-0bc3c54d84eb", "value": 1036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132802, "uuid": "ea9d814e-a05b-4061-9c17-318efc0bc1aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132802, "uuid": "28abec29-c20a-401b-ba65-e946ce5c50ac", "value": "photov_301576887572.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbc8086-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143524, "uuid": "be9b7494-b7a7-41d7-931f-84b7c5e74e15", "comment": "Malware payload", "value": "4c2fc5a7dc99a978d176c08e9115149e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143524, "uuid": "63800fc4-0d92-433e-a827-3cdf4e3e465c", "comment": "Malware payload", "value": "867587b2a73b1a98fa0c0cfe49697665b54451a671f195a619ba9d6e9b47aefa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143524, "uuid": "3ecdbf7a-cb76-4a4f-b0fb-80578d3abf91", "comment": "Malware payload", "value": "e24a8763ff70408158cb112ba4fd467e6f329ad2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143524, "uuid": "28c087b7-e606-4d97-a19d-a2e065f3b1ca", "comment": "Malware payload", "value": "baa2f05c01a74ba9ce47958bc732e922dd6a48a3777a62bd879647149bdfd8d57ac57b7e644461987679596685089aa4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143524, "uuid": "6e54a8fc-1a02-4001-8989-60dabff5df5e", "value": "T13521EA2D5456DA21F81FD3381E9EAA8510A4C013680426AE630F6C0B7BFEE2C471D9D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143524, "uuid": "9ff39834-d029-43ca-8df0-5a2b704bd264", "value": "24:9GtxMmbCzM/ofRGOEMDwnpZJ+HmZUhnlb0bUlmSVopF4Q0FWyWFEiAfut8Z:9bzMgiMo3bZUhnlb0bUlPVUXn18Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143524, "uuid": "16236a1b-ccd0-4573-8486-7811390d477f", "value": 1252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143524, "uuid": "1a9521d7-81d5-477a-a6db-8749cd67cca6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143524, "uuid": "9ee7eb09-dfb0-474e-a339-2e49651a029b", "value": "photov_097408195668.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f87738-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143623, "uuid": "b184e285-e387-4000-bbc6-b73d2a4cfeed", "comment": "Malware payload", "value": "b89ba3510a356a5033b76f8e7f7583ba", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143623, "uuid": "448ec4f8-85d8-48cd-bf51-1276e1f51e94", "comment": "Malware payload", "value": "8692eefb725dd8c3dfdf8ebcfea25e979bb23a7848447abd63c033dff44ca0a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143623, "uuid": "f5755b64-da6a-4988-a64c-7baa951643f9", "comment": "Malware payload", "value": "c62fad210e98e8543a98b2d5f6186719084ce404", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143623, "uuid": "44015faa-5461-4259-8f19-ecbc5cdefd04", "comment": "Malware payload", "value": "324aa10a7d8cfb9b62f81f4c7dedb1411080e39fc8c424bcc7446dff1ffa78deb7a5f9f2d7ca6e10fc73df035a55d08c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143623, "uuid": "e390a199-c502-473d-bd5d-7dff5af03d10", "value": "T16C2168B6C8C8DD02C3879274BAB086281928A5C4A405528A675ED6723FB9FDC17900D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143623, "uuid": "e8258a81-e5c4-45ad-9f28-45e2e727ffe3", "value": "24:9nCMP8eX+a0yWnT+TgcFOPZO1CXPbBuCBTEprmSpHD+tbSR+PBSD:9CFeuQWT+TgcFOLXPVuCBgrPMGGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143623, "uuid": "eecc1220-6830-49b7-81f4-1cec13c2184d", "value": 1284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143623, "uuid": "2f8447de-e826-4622-a08a-42e452407e1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143623, "uuid": "cd9f9531-d119-4cb2-b8c8-10a3571e73c4", "value": "photov_451247531813.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03402aa8-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154166, "uuid": "1de3af91-cbf0-4b54-bf81-34d9f16786e5", "comment": "Malware payload", "value": "851a6d17b49ce43b8909a65bc6903733", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154166, "uuid": "18f803d3-6195-43e7-aeff-190dbd4b5419", "comment": "Malware payload", "value": "86e229b9e4b226f7a0d6a12479f0fbbbd1a19a366b6eabeaa33052eb43ec3dd9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154166, "uuid": "83b4719f-e391-4155-b21d-94eab8dd7920", "comment": "Malware payload", "value": "fc45897476a9db15478fccee7647172ded5fa11c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154166, "uuid": "ee341a46-cb65-4da5-a96d-7d26e4de02b9", "comment": "Malware payload", "value": "cd0e9edd46031d8a10bc011feadfc311f2a3e51b13d07b2102ef6b5d688e4f76184a2fe2d52f0b9321efa02a07172603", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154166, "uuid": "6dada62b-fe53-462d-aae1-e2028d595bac", "value": "T1A3218489DB82B9C0C0398A3726A8B80B3635AE6D2E155DE7236132831E9200C43563A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154166, "uuid": "c5acf05f-b679-4802-962a-d69fe8888a9e", "value": "24:9F3XCNyCnotm76FbLwYfSLiO21GmSLJJxOyPQBIr1g1usX:9F3FCKm76FQYXOBPnYqQKrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154166, "uuid": "9f88f46a-9567-4fa6-882e-caf7fa24b08f", "value": 1235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154166, "uuid": "58f44e46-121d-4db0-9633-bcccc3e6eab1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154166, "uuid": "b28a221d-0d1a-4248-81d9-b0b0511fb714", "value": "photov_824826714417.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f431f5-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133449, "uuid": "d6d9ec87-4ebb-44a7-824f-968cf1e7290d", "comment": "Malware payload (Mirai)", "value": "0d89d9c5269a7971561075ad669eb49b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133449, "uuid": "b6223edd-7fbf-4ffd-9ac4-4d0ed9bbe669", "comment": "Malware payload (Mirai)", "value": "870ad2759a87315099a439f37188c11106ed3cf1f233c2bb17bb9c75850f1dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133449, "uuid": "eeb15dd3-8298-4507-8de4-4c738aaae672", "comment": "Malware payload (Mirai)", "value": "64e92d00a9d397b1dd0203e6b6d16c6fc321e26b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133449, "uuid": "8d779b93-25c1-4ff4-86b7-cc60fbfc93e3", "comment": "Malware payload (Mirai)", "value": "6532306084fc23c2b6116309b9ed66d56183a603dada3cdacb134649f39e21fa78bd61bb790a5fb505a43e956332548c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133449, "uuid": "758c4a8f-1368-453f-ad2b-1f6cb15fcc67", "value": "T1E2C32A45FC505B17C6C662BBFF4E428D7B2A0768D2EE72039D256F31378B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133449, "uuid": "240e87d2-12f7-42ee-b92b-903833113d2d", "value": "1536:lMKH34hb0Dsbbpane8Vehe4VR5d+TtpUNyFOouDBYAG8oHlyWwyw1vqZl8al5MJO:lPH3oonec4j+hpav1NnOJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133449, "uuid": "58ed5fa4-c136-4202-9bcc-249a723e4d35", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133449, "uuid": "74c6c05b-4581-4791-8b0e-1cf242fbb0d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133449, "uuid": "f4e543ba-e70c-4655-bdbd-9317cb9c941c", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc7fdaa-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167659, "uuid": "c4e3d59a-6fa3-40ca-8343-37b9bfd51b74", "comment": "Malware payload (Prometei)", "value": "178141e784eb763d056a84a804fcabbd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167659, "uuid": "72052eed-2c91-4ae4-89c0-bab5fd1dbb7f", "comment": "Malware payload (Prometei)", "value": "87ca4c2b82172b7ea67acb751a1538e9ba725b97ef7c2d1067c6390b4261cf37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167659, "uuid": "e93228a9-5fca-457f-a7c9-f34fd281d1b6", "comment": "Malware payload (Prometei)", "value": "ffe557f820f063c7633636c623edf847304b6a09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167659, "uuid": "fa502012-d7b6-40e2-9342-446d816c9242", "comment": "Malware payload (Prometei)", "value": "97f02a76b3c71537a04aa3ac76c8db36a9831aac6f5cf170959238da9f2d8675cafb4135ad944eaedfee4e6155541e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167659, "uuid": "40995063-6f7f-4b83-b1e2-a1f0a53d071e", "value": "T10DA423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167659, "uuid": "89020358-aaf7-4650-a7ca-a7d2de6b15eb", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdf:Fs6pyCC/Ya2hpi6T6N4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167659, "uuid": "4dd1e449-fecd-4cc5-ba91-04cd81fc3e64", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167659, "uuid": "ff2b4e86-152c-49f6-9cdd-5168328b1ed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167659, "uuid": "162f0b0d-c01c-4a79-9d7a-3233c6957121", "value": "87ca4c2b82172b7ea67acb751a1538e9ba725b97ef7c2d1067c6390b4261cf37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce4035b-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154156, "uuid": "af9dfe22-99f5-402b-b2d9-6c64287a0e3a", "comment": "Malware payload", "value": "ffed0926e9becfc5e62acfbe591df5a9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154156, "uuid": "534c4de9-6190-41e2-8fe8-8de43aa06c36", "comment": "Malware payload", "value": "885bc1d1ac3ee09f54ab5550d641da1b500eadb2bc1142392b8a7f041720196b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154156, "uuid": "e583105a-e452-486c-98f3-5e467f5b4b8a", "comment": "Malware payload", "value": "706406ad2a4cfb30ea07153d9f44fb24ebfab7fc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154156, "uuid": "0aa3f9b3-bd64-4f2a-9b88-ddb8fa20308f", "comment": "Malware payload", "value": "a97b651ec37db5e7d6a35805426b34c3959965afb9e182283f22f1c4b5367931820ab2fb8ea2324c62487c67f6b719e0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154156, "uuid": "fc419fda-3f0c-4080-9deb-e831de3451f7", "value": "T1C121A7A4A018DD82F58AC237F844914E31CC9CA521306E97328312EDE503B9ECFA6BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154156, "uuid": "df3bff31-d072-425e-9804-9a1aad4588b6", "value": "24:9C9YwXFN1yNn21YQ93DL3ylq70AY3H3WQmSthGY78OzT91WTg:9GanByXylcU3H3DPbGY78OV13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154156, "uuid": "f7ce6b37-4830-471b-86f3-03718189bf29", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154156, "uuid": "612586dc-d94b-4ca1-83f0-e5d05522ed54", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154156, "uuid": "8f77ebf3-4601-4205-ab17-ef7856f49906", "value": "photov_721727721173.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701c82f2-89a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785148336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148336, "uuid": "664f09cc-ffad-452f-8e8f-066ecbd2f2ef", "comment": "Malware payload (ValleyRAT)", "value": "9d609843241b0cfaa6f79ef17f862862", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148336, "uuid": "923578c4-13ce-4f04-8179-fe2c87905aaf", "comment": "Malware payload (ValleyRAT)", "value": "893d4293a34a9e1344248282064b4c6e2e322843b4bb5b59330e571618f0acdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148336, "uuid": "c6e734cf-d16c-4397-9312-73264de877fe", "comment": "Malware payload (ValleyRAT)", "value": "1d0e8377773671bf43e53ceb18651c9588beccc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785148336, "uuid": "4e48fdd2-648b-45c9-9e24-c54d40dc9718", "comment": "Malware payload (ValleyRAT)", "value": "081a11a7654f459938af0d251c5b2e78e8c3b0980f805d373759d6c74dc691f0b6b8fdc860ac687aad3741529d4248c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148336, "uuid": "812386fb-9b45-481d-9a45-8cfcb87f0314", "value": "T169E733BF6295D52BE21DC23A84D6AE90683B70711733CADBDA911299CE075D09F3F360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148336, "uuid": "5bfa708c-771d-4b56-a4a0-2eaca6d45007", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148336, "uuid": "ee480962-5074-490d-8151-41c99d07a587", "value": "1572864:WXqgR72V+466fZKXV0ADPhm0tp9Qnbtl9UvBCluePn:H472VXD50fOJzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785148336, "uuid": "cfdf1917-2675-4499-a38e-aee04ee34247", "value": 69924627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785148336, "uuid": "9e30de2c-487a-4ab6-a9ff-7cddb0c14e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785148336, "uuid": "1eb42aef-5e44-4fe1-becf-25df5289063e", "value": "Hrdiag_setuprs_5.0.69.8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23baef0d-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133175, "uuid": "89eeb851-5fca-4b80-b3a8-b8faf2e9b434", "comment": "Malware payload (PureRAT)", "value": "9c17812044592182b4a327ae2adab12a", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133175, "uuid": "957c4547-fdcb-44f0-9f49-10b7d0fb4654", "comment": "Malware payload (PureRAT)", "value": "89a635775476cb1b86dc46a91ec337892b0dcd8bfff0734ca6fcefec5e52ad09", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133175, "uuid": "785f2f38-92c3-4191-97cc-b13cfcff0796", "comment": "Malware payload (PureRAT)", "value": "326652f91ec0928d674d7e78461328f82711ff09", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133175, "uuid": "5c58ba3e-f465-4a2f-ac0f-0a89fc4864ab", "comment": "Malware payload (PureRAT)", "value": "78d0f26820270e7cdb3b090d05f896897d348b31d08d0e87e5f524f1928eeb1939f078b0ccc963c5f16d1f2219cc5d6d", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133175, "uuid": "44e1cd05-6f06-4ee3-ae96-a5d52c198274", "value": "T17821BA8CC45D8CA2E40FB57B59E0B5A816132674B75053BB271D39906FCD85B2A05053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133175, "uuid": "e518f036-160b-4a17-af59-5922a6a62ac8", "value": "24:9LrLr6a2fDKIBNs4B+MmxAlHF8pRMDiRW+jvAPmSM+FV8uFXAeJu8:9HLr6a2fGIBNsnCHcvSPM+FbFXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133175, "uuid": "f3cf2297-622b-4e1a-b230-043a8a98d701", "value": 1234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133175, "uuid": "265722e7-441a-4015-a401-a28e0f5a66fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133175, "uuid": "119275f9-a3a7-4ebf-8878-228ae0c970f4", "value": "photov_511248196512.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6823e340-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180964, "uuid": "89403df3-bb5a-40c2-a0c8-72b3eb762832", "comment": "Malware payload (Mirai)", "value": "eb9220c710a42cb825d347377ae2a3ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180964, "uuid": "d2e0deeb-c7fb-4719-9e5b-3a4f88c997f0", "comment": "Malware payload (Mirai)", "value": "89c6b5a4f46bd7a650bafd35ba97b3bc6c6f062205fdd3768bdec95316465024", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180964, "uuid": "d123b742-4922-4076-9332-19c8e1f9e87a", "comment": "Malware payload (Mirai)", "value": "d0259e5cf9d1b13e6d9d498f655eb082cc2dc07f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180964, "uuid": "7901ee88-2892-4efa-b1bc-50ba8022b1db", "comment": "Malware payload (Mirai)", "value": "f084ddac1335d044400acee9c25009dcde4bb507206228d17dd8eab353481675eed7fc325dc83de6f3e694ef130dff53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180964, "uuid": "f86f2ace-f600-4477-9060-676706283d77", "value": "T1BBF2E0614EC9CC3862F5A5B3F17EC7A2335216F4F4E536720430829ED4B65873AA93A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180964, "uuid": "6d97a4e3-79f0-4293-adb5-410ec1b6799c", "value": "768:bW3+gALZMQUirNcnifwZGeOPd9zogWbDzprs3Uoz8:ITkEianIwuPnzogc0z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180964, "uuid": "43dda1e0-6436-4dd0-95d2-f5dd09f99409", "value": 35564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180964, "uuid": "fd65b7cc-ada7-4f80-8395-b4dc0680d2bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180964, "uuid": "4ed7050f-47c2-4ecb-b743-6a4a989f06b4", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3df2103-89ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785178971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178971, "uuid": "a178d059-4f29-4e67-9322-c3bceb344237", "comment": "Malware payload (SalatStealer)", "value": "b9974299de794e9b5e30ec95f7849e97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178971, "uuid": "63c1839f-85c6-47a4-9e29-ecca56e4f504", "comment": "Malware payload (SalatStealer)", "value": "89d0178c292a0230d69c1de53f5e55994d195329cbbbacbaa7fb2e6101917b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178971, "uuid": "691df2f2-41ec-4090-9ef3-bd95f892ee30", "comment": "Malware payload (SalatStealer)", "value": "9ada72bf5ea6e4464cd63605a1ec4fdb69b28dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178971, "uuid": "dca55218-5741-4f3f-b60c-075696d4d30b", "comment": "Malware payload (SalatStealer)", "value": "6534010eadfc63c58e883ebcb1c00579d23dfd80c8cbc50fd9dc0cd1e03773d208458c4de9c4a9582bf4588fa1339426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178971, "uuid": "777a7517-3eeb-40bf-a95f-a788a67abb18", "value": "T10BC66B11FADB95F1E903183141ABB37F23315D048B28DB9BEB547B2AF87B6A11C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178971, "uuid": "fc5c22ea-034c-42d5-9e74-dd69e7f8a53c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178971, "uuid": "bb8517ff-e35d-4c44-9894-372061d6d4e5", "value": "98304:Xh2290FF1WCREMbEdyWmYAzQ4tG20CEE9:r9sxEYJWmJsHA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785178971, "uuid": "ff96a74f-879d-4250-8c5d-61e1f4e94a18", "value": 12572672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785178971, "uuid": "5172929f-f18f-4e82-9d26-555682f16cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178971, "uuid": "45b846e8-107c-4e6b-866d-0774868e4ace", "value": "DiscordMirror.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73242277-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143187, "uuid": "d4586e75-90f1-449b-9971-8d14d09c282a", "comment": "Malware payload", "value": "6fbcec840bbc84dfb294c1d2f239beba", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143187, "uuid": "986343e4-bf8e-4004-a600-74c37f17f966", "comment": "Malware payload", "value": "89d141a62a24ae590a88e8c61448b555b6f95147d8a583ada6b743df376070ce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143187, "uuid": "d6d17e4f-8d3e-4a59-9857-072f98377dc8", "comment": "Malware payload", "value": "92e7e1f5cb708c2e286b2ff6477374726898ac8e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143187, "uuid": "7ce8704e-6f12-4eb4-8c17-7c6ad61607cf", "comment": "Malware payload", "value": "25e6a0907e1493fed7e19083c13941c6a5357f68277519a8600288185f9f64159c547a38deb9411c8a3a9732ed4c7672", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143187, "uuid": "04878881-f03a-4a79-831b-8587da50332e", "value": "T140218791D42ED8C1D34B4BB80D54DB5C3B5E4AB1114A0F057671D5A77CAE90437CD390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143187, "uuid": "604ffee1-8c6b-487f-83c5-f7f9dd303829", "value": "24:9iQsUSipgWNJ/CDQr6E6S0vFIIjEOWs7vul8ZmSk+v/RWyw57DNX8VQF+8P:9FsZ0NJBc/IIjEvYul8ZPk1t7DF9s8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143187, "uuid": "cd89836a-a6a2-488d-aa6d-3914fc459ec4", "value": 1278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143187, "uuid": "a7b76285-297c-49ab-a112-7e6771c1c078", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143187, "uuid": "d0501512-c33d-48a6-b013-f9b7065fbf35", "value": "photov_212543868170.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2375b5f3-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154220, "uuid": "d1662e40-501b-48cd-a46d-95cd2d4beb4a", "comment": "Malware payload", "value": "25a13d94eb2071525cd77fcba754c87e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154220, "uuid": "be9a905e-7456-486a-98b7-33ef6e150f55", "comment": "Malware payload", "value": "89ec0c87f61266606537c2511d5590ecbcd2a582fb14908c176af56853faf56a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154220, "uuid": "393116e2-73b5-4d8f-a474-3140e5655670", "comment": "Malware payload", "value": "72b7fcddce0d98f01feb114d44b23588de282877", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154220, "uuid": "d6afb40a-9131-44d2-a52b-f18c25213a40", "comment": "Malware payload", "value": "85905889b3e1a02bf9c94fd0ec0a6349a6d4468fa3e49eaa142ac5388ebfd06fea6cde03a396118382292045bdef5231", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154220, "uuid": "7f48dd97-cc68-4637-9041-6fede7db1e9d", "value": "T1AB21C658B231F64BC3CB8A35B010CF0B9156B438E860B82B61E136B67C95FC803051A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154220, "uuid": "5c244d30-3ea1-4b0a-942d-7dccaac2138e", "value": "24:9WIIl4KgjtMdjkhaoyaougAxTAPJbc8kmSKrLhzhheY7cVtGx7QUI1V:93Ile2bn8TWJgFPAhdheY7cKHID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154220, "uuid": "3f071954-c761-438b-94d7-b54a21a40d36", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154220, "uuid": "8168be77-cc52-4103-93e7-b2f60a74fe56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154220, "uuid": "8ae236f3-f756-4dd2-850a-25bbffe34fc5", "value": "photov_797234725627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8b72cd-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143602, "uuid": "57a4ac6c-0d7d-4c66-b724-da9c9ac18368", "comment": "Malware payload", "value": "5cf75f9bd40078ec6735432a45465f41", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143602, "uuid": "4cd87f46-059c-47ba-8afe-f9d73f4476fa", "comment": "Malware payload", "value": "8a35e0d54705468f906b13a8885926c5b9db021f48678f1cec123931e10c8607", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143602, "uuid": "fede5f2a-2d71-495c-adc0-f7510e816dd8", "comment": "Malware payload", "value": "27b39e589a94d6b1db24d865bf87d49108372686", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143602, "uuid": "eefeb9c7-9ac6-469a-94e8-686bb0ecaf21", "comment": "Malware payload", "value": "5b63bacdb946dbc54c30a3868f039ba8b355bbb6a3cd4b9c0505c47eeebdaae2e68fd376ca8b31530d64671ba84d7545", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143602, "uuid": "8808c338-7a1d-420d-95a0-2fe707b5dbf5", "value": "T18721E762C402F000C043FD3D3651F5952B4ACB0FFC12B76777AA206E74C49D0864208D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143602, "uuid": "5a1e6673-1ef5-4bb2-bf5c-a454430355dc", "value": "24:90ETmYjMakUPkaj2dE0k0euk//BwmSXFWyqhFBqu5Aq:90ETmsMxUPlGEaeD/BwPoDN2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143602, "uuid": "8029d9e1-a0a7-41bf-aeca-dd0dc8376ece", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143602, "uuid": "d90adf02-ba17-4cf7-9643-f75f061c2232", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143602, "uuid": "79df3fab-5bb1-4671-94db-981fdb7173a6", "value": "photov_305211494034.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702cf234-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167663, "uuid": "b851c3eb-2c9d-4482-8fe7-483875dcae3b", "comment": "Malware payload (CoinMiner)", "value": "872bc0abd4cf599d26401540ea130bfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167663, "uuid": "c24ac1c7-236b-45f5-9737-06993defc36b", "comment": "Malware payload (CoinMiner)", "value": "8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167663, "uuid": "6cca3b72-8a56-4877-9cb9-23ef64af5c5f", "comment": "Malware payload (CoinMiner)", "value": "4991cce0cbee3ffaa71fdb94d7fc564fe9169f3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167663, "uuid": "d39bd8ff-53e4-4262-baa2-1de716fea641", "comment": "Malware payload (CoinMiner)", "value": "e92a57011421bae3627fee68e2eaab702dd4aa81d40d196b4e04402ee234bfad78999a7c258fbc93a55e2a63ee538d45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167663, "uuid": "5d821d16-abee-43d9-b4b0-baeeb9ac117d", "value": "T1976533DA38C8C2AA939E6D31CD83150DAD25F8B5A37B670C49355AA3EE0BDE701517C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167663, "uuid": "93c5dd85-8028-4c2e-8a18-0df194bbfa1f", "value": "24576:gdAZiTnVtYiXg4vqM4L7cl3EwskCXbu4ZofxO0LvN3m3y4VMpw0x:gjMJU3EEevZkxO0h2C4VMp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167663, "uuid": "a220ea66-d353-44a6-97fa-d6365b84d3d0", "value": 1437592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167663, "uuid": "54470c55-168e-4bef-be4b-65e17fe83a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167663, "uuid": "d6ba2168-f785-400e-8535-fe53524fcade", "value": "8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3892e2-89ea-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785177403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177403, "uuid": "019a5416-d566-4f5b-8130-60eb237fb007", "comment": "Malware payload", "value": "071116d8ea1f5a5b4037a87d406af98a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177403, "uuid": "9f108009-215d-4418-a7f9-c6d4295e9b09", "comment": "Malware payload", "value": "8ca38b5e845b77ddf26b2596698c4dd7f4033e86b998e27cda460cfd9377de81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177403, "uuid": "cf240616-a18e-498f-b6ad-ba20149f8fda", "comment": "Malware payload", "value": "1846e071bc32e374172ebe5835b9c679d30f92fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177403, "uuid": "38e06ac5-32d9-4c16-b178-6d9e427529d6", "comment": "Malware payload", "value": "600079a263a7327b569fad27ffd537dfcba25b13e55a3be542ca15d5b478d84bc2817e9330be39e43f7c736e0aa2c1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177403, "uuid": "c2980965-c89f-4f90-89d3-a22ebde1f112", "value": "T13328C002A3E88599C0BFD239D57B561BEBF2BC295331C7CB0181556D2E73BE04A3A395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177403, "uuid": "1b3df0ef-6fed-425b-a64d-55ca800dccd1", "value": "1572864:J2JDwbt/z+l1zAxHorsgdnen9qPsniUd:oJDwbtal1zCysge9qUiUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785177403, "uuid": "b4673feb-a59a-4e86-93ac-156ded244a0e", "value": 99997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785177403, "uuid": "309b5772-0c92-491a-9710-3493d648be8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177403, "uuid": "631a2021-7e6c-419c-8275-e3ec7a5af19f", "value": "EROAPPLI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497eb2e2-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785167598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167598, "uuid": "6ce257ff-d958-43eb-9333-7a949be527cf", "comment": "Malware payload (LummaStealer)", "value": "c037ac52a26a18e7b2e911415e85a080", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167598, "uuid": "3b15d5be-bd7f-49c4-b303-5b53975b43e1", "comment": "Malware payload (LummaStealer)", "value": "8cf7bbe8eb52f88bf5c7129b4923acff510275d5c47a38bf82667c102e6e8c9a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167598, "uuid": "bcc5a5ba-8680-487d-a8e8-e928e4b9bb85", "comment": "Malware payload (LummaStealer)", "value": "7fe8414fe3bc35854a30b5ad87e3f8b5c1fa199f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167598, "uuid": "8f074181-57ef-494a-a990-955b2fc0556a", "comment": "Malware payload (LummaStealer)", "value": "65138ebde5f326aaf9b0e6d0137823c2bb890d1a5cc88ef871c1bec904a9bad275466d250dd1d861f349b5e379470107", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167598, "uuid": "a44c00ff-fad5-4acf-a49b-854c4567a01d", "value": "T1AFC54B10EEC745F6E503163265A762BF6339AD065F359B97EF443AB9FA332D10832209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167598, "uuid": "ce7bfc66-cd2a-4058-af15-6d88062a8703", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167598, "uuid": "65889a8f-ef04-409c-81c0-01c6d891257b", "value": "24576:oU6o6RHsYg/LEx4jm9LrKTmz24/+BbclS4sEGs2QTdaO436zbunRLdGnikiqeEiX:oPoBa9L+FuCEitHlqryVbQhFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167598, "uuid": "5da6379a-c141-4b61-a27a-7e9b58f58dbc", "value": 2605928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167598, "uuid": "722fb3db-8c11-4983-a964-d27a9d97f365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167598, "uuid": "e1b9d13f-6650-4a18-aa09-6157230ee08e", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b194212-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154260, "uuid": "1a852b8c-14a5-40fe-a995-4a8a4e067a94", "comment": "Malware payload", "value": "5dedf41f1a35c6efe94b0baafced09c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154260, "uuid": "658641b6-557b-4853-ab97-5ab7a21577de", "comment": "Malware payload", "value": "8d90e90104e40c211a7ff3dddfc4196f3141200e80048f4c09c1fa86c7b2fd62", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154260, "uuid": "2e830997-d7f5-4f76-911f-9f52c1440002", "comment": "Malware payload", "value": "ad9b5d0b12dc1e03f0ceaad1960ddf451065fa60", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154260, "uuid": "c3f53cc5-16b0-4c24-9ef7-97522a0376c8", "comment": "Malware payload", "value": "a836d43465c8043c8242c7db636cc3f34a459dd5dbf7c64d3528e25871856e0a9f6e41fcee1e32e35ca43bb2726b81b0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154260, "uuid": "a0279c99-026d-4303-8c8c-e63c48f3906c", "value": "T17B2198C4661AC4D9FC8786B57C721184CA7D1F94142017B255862AE1BC96B4DEBCE7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154260, "uuid": "b0792b56-510a-47c2-a991-1eac207ee38d", "value": "24:9o7CBzT9nSxrzKQ6iLo+TdEtYviGcumSmH2kmXt8JzfxGgXQH0w:9omBzTkrUfwEtPLuPDpEJZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154260, "uuid": "9fbc9bda-a3d8-4567-a02d-12a34b45cbb6", "value": 1304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154260, "uuid": "9e193bd1-21a6-4232-aa29-2e75cd72c947", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154260, "uuid": "a1fe7fb5-7407-4769-88cf-b1b6adb6912a", "value": "photov_424701176963.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ec64f1-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143467, "uuid": "0b77528f-ed0a-4119-a6da-88aeaeff5d9b", "comment": "Malware payload", "value": "7640823bae75c8872e59b70d886649c2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143467, "uuid": "ef05b7ee-6c66-40f1-acb2-1f8686751731", "comment": "Malware payload", "value": "8dd14bdf8bc7d456edb061f6721847169d5d1d985976c044ca757e70a6474c23", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143467, "uuid": "ea686bb1-36e1-4f2c-b43f-3dbc8982fd8b", "comment": "Malware payload", "value": "e82899e4764ed4e14edc4ba0f134f8dd8d5ca290", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143467, "uuid": "6edbeb60-1b9a-4c93-9ebd-7439168170b4", "comment": "Malware payload", "value": "986325aec94805ddcd820f44a7d03cb7f9ef3bfbd64ff7373d89b959e9628731180fc89fd379e0208bd2ce513ed8d557", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143467, "uuid": "34df6aae-cc6c-4769-b70d-8f7da91d80f0", "value": "T1052196DAD0C496E3C4065BB76D352121C7209E9D5C44CD5A237E73633E26DCC7B44381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143467, "uuid": "ce6ce318-e603-40b6-ada6-11698302ca6d", "value": "24:90ZHYQ3Jxtmfq6jH+35zbEOXv5hFIvb/ehFemStGbMH72ta9iihFZX:90ZHYY/mi6jHuFbEGBrIvb/rPtB2ta9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143467, "uuid": "7eec91dd-24ff-49b4-abea-2b9207ecb964", "value": 1170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143467, "uuid": "6aba6b47-9e60-4bb1-a7bf-b409206b5b26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143467, "uuid": "0567c976-8d29-4bb2-a0b8-7f1e695f44b7", "value": "photov_373094538566.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5a302b-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180971, "uuid": "c1f6da93-2da7-4e94-8917-26b7c758b443", "comment": "Malware payload (Mirai)", "value": "321559c9d66c92dc95dac75ce9843cae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180971, "uuid": "38a2677a-3597-4131-88f5-38923f87cdf2", "comment": "Malware payload (Mirai)", "value": "8f23e53b49b98d2f96a940271ff252f57e5b991e49f2a6d8b44c4e2f9f6f0486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180971, "uuid": "afefacfd-3776-470d-b620-b58f417c24d3", "comment": "Malware payload (Mirai)", "value": "8084f27e5333831646cf9b28c7784cd2be7e1721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180971, "uuid": "b4a27d81-c4f9-415b-91bb-1dbc572eb8e0", "comment": "Malware payload (Mirai)", "value": "7d7e8c9934101efb6af68339d28bed88d53db4c208c365e75d5d506c76752f414861dd129e328d1a9f8d8fab3fbf1cbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180971, "uuid": "de6e519c-5fc6-4bd0-b6b9-08cd41cbc415", "value": "T1FD538B73C9296E14C19582B4B871CB781F63A48482471FFA5BD9C2BA9447EFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180971, "uuid": "73a5cde7-dbd7-4efb-ba27-8be93af3be9d", "value": "1536:da/wtqWcoWl0FZWXaZMYfbIYv+/1K2GP94iCaPC00bzyIls/Gz:dsmcoWl0TWXaZMYDIYG/c2GtCaPY/DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180971, "uuid": "c325531b-1922-482e-aba7-fb7c651ba1e4", "value": 64468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180971, "uuid": "b8171d7f-e304-43ae-909b-484f0570f59d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180971, "uuid": "707e1b69-3035-4e12-ae6d-6c73b8ea5a2d", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2831e2-894e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785110616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110616, "uuid": "86df2f92-5db8-4299-a91d-958471aebe0f", "comment": "Malware payload (RemusStealer)", "value": "eafb10f6fb3732229b64d5cddfc7540f", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110616, "uuid": "869eabd3-f506-49da-bb9f-37454d8640ef", "comment": "Malware payload (RemusStealer)", "value": "8fb184c2d0b42adc0695d6dab31d7905490028c77d9a472d18c06975e19bf24a", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110616, "uuid": "f9b01028-e44f-4b5b-897d-0831736cee9b", "comment": "Malware payload (RemusStealer)", "value": "cb8e1f5df3bc9f7a3211698ccfd69b38956f0eb2", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110616, "uuid": "affe5676-6940-4c71-9331-5425db47f623", "comment": "Malware payload (RemusStealer)", "value": "f06f4531c5e30d7af2c998ecd3a179f164a14e0b8212f59b63ca3a2ff8785051ad7cc6da76baf56776d68e3c3924a412", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110616, "uuid": "a685a093-7ff8-418b-8776-9d9a9b653bfa", "value": "T19424096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110616, "uuid": "cc004364-a341-4708-b2fd-26ec1540640d", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110616, "uuid": "bfaf1aa4-e28d-4601-82f3-8759718d568e", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFh1NCGiics:Qj5WUEBx+Q7PEfFnQU+th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110616, "uuid": "c4b5e7e1-dbc4-4a92-9e45-b5ea85bc9162", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110616, "uuid": "1ac8c68c-b109-4c9a-8295-3611c452a11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110616, "uuid": "bcdbe62d-26a1-44c9-8371-15a30d3ee41a", "value": "kJHGFDs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e676b9-89ea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785177358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177358, "uuid": "7c01dc79-e3a6-436a-9d79-75292dac8acf", "comment": "Malware payload (Mirai)", "value": "3f253bf10227c573519f478d232db1a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177358, "uuid": "c7cbd57a-da0a-478c-8a53-4d3d616dfc13", "comment": "Malware payload (Mirai)", "value": "8feaac0336a3b0eb37cf9ca2981edf2842691ba492a0e169f9bf1a57a8af4c65", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177358, "uuid": "7f9793ed-c3c2-463d-be89-f714aa828420", "comment": "Malware payload (Mirai)", "value": "b2e389672d026f31f3b70eefd710944a5a64367e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177358, "uuid": "d816b22d-2a49-48ea-84fa-041ecab27e6e", "comment": "Malware payload (Mirai)", "value": "6b4627acb9fd399022a566094d2d94365e25ba6c49c107b2b7674c218cb9071579ccc5a10bc1a2fd16b6cc325bd187f0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177358, "uuid": "0c3189be-af3a-40d3-971f-cc3e89795cd6", "value": "T176016FC6D2605910405D996D7296A5A0F472C3C6068B8F687FDC543DBB4CE14B027F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177358, "uuid": "87a0a2bc-0b28-475f-8679-6bcec60b8383", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaSC5FbhV8CQEhJSCLfX7lesQCrRhTECHsR:kXCKysE2hi0ziQvZohaSM+rmJCJGO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785177358, "uuid": "41046715-0958-4962-bd01-f08797784e7c", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785177358, "uuid": "b8f1251c-2894-4c23-9e21-7b415aa4058e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177358, "uuid": "bd663b14-1feb-4914-b3ae-e7c5c539cc27", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be32a30b-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785154050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154050, "uuid": "6ae8312c-8d39-420f-893f-a20c4d67c2c3", "comment": "Malware payload (njrat)", "value": "69d0de9e78ec99497182dcb635a1c610", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154050, "uuid": "83307c9b-0578-4661-90cf-f1409cbf9858", "comment": "Malware payload (njrat)", "value": "91009d9f4544faf57503ca3d5b83038d9e861f086c3c00fd703b3190ab7e1787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154050, "uuid": "3e72606b-85c0-4abe-b9e0-67f024d92f20", "comment": "Malware payload (njrat)", "value": "da567ab609c3fb5f2cbf9e85e09d7668c7d0384c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154050, "uuid": "2fbf1c6b-fd6a-490e-b146-11fa974c568d", "comment": "Malware payload (njrat)", "value": "428598eca244fdc96adbea05dae129a344727882869b50961d530525fdcc1238f662d0534993e06e950ffde2aec6751e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154050, "uuid": "134350c4-89ed-4578-8871-66d4d2067d1e", "value": "T13C15F1291A278602E4B26FF01D71F1B157BA6D9AA232D2195FD60CEBB53B7103D18327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154050, "uuid": "624fea0b-9f61-4a9d-8195-d241e00d8649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154050, "uuid": "160dce9b-6583-4917-92cf-c888a8251aab", "value": "12288:zTuRToqC+9N15+KVuE1ZpIoVgFp2MXK9vsxKG+B9dzSo8UZmfzfFVECoaFKIL6Tf:zTu/5N1VIW8RoG+BXuSZjC9FjCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154050, "uuid": "6e9824c0-e483-4f1b-9bb2-412173ca26e2", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154050, "uuid": "f170bfd7-d744-4353-8387-fb3f34e6e35c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154050, "uuid": "93eb589d-bba9-4552-b827-26d4cab117da", "value": "QUOTATION ZBS260723 - PO-Q260723- THPT-ASN E2S A105N.pdf(782KB).com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0753666-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132633, "uuid": "e1aba4db-c2db-4fb6-8201-cd124a17a5a9", "comment": "Malware payload (PureRAT)", "value": "f5ae96ba96e0bc390d6d3608b38b735f", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132633, "uuid": "63e6177b-59be-43fa-b8e5-24cc86dd715b", "comment": "Malware payload (PureRAT)", "value": "914567fc0a23de8a69b1238fea93cef1c9975313d9356e3ac1d34afd11498a04", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132633, "uuid": "c18da7da-2210-4f63-818c-2dca4cbe760d", "comment": "Malware payload (PureRAT)", "value": "492277f0866102c7e2e57e5565f818b26b5de70e", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132633, "uuid": "20690cbc-11c0-4f17-9a82-b6e2db457929", "comment": "Malware payload (PureRAT)", "value": "eab2a30040c8e1f198db52978c5c496841495f28398bbf32e16fe8ba65b5e249250d8f064761332ad3e407489e4703b9", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132633, "uuid": "cfeb9014-990e-4931-b415-55406f7d30fd", "value": "T19521961FBC2E6144D52B9931342187D902D205B8D143E5A783FC7EF535626EBA7BD1E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132633, "uuid": "5620140a-3b93-4b42-85ae-eb952337b5e7", "value": "24:9pxXoYb0xBY37T3A6I6ymSNDp4SZ7oHRcO6LlA9:9ploYbiUr1yPNn9oHRsLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132633, "uuid": "4e46b59c-5485-4041-9209-1a7e87dc8185", "value": 1194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132633, "uuid": "3ca0673f-0fb2-4ea5-9429-7a70e8fefc9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132633, "uuid": "78c9b2e0-c270-4edc-a624-eea65b4e25f3", "value": "photov_433231450944.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba30095-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785135068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135068, "uuid": "a5c2cf33-82ad-4c01-b809-274620b15424", "comment": "Malware payload", "value": "0eadd9f44053db9c674980832f40c3d7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135068, "uuid": "dcbcf90f-9929-4714-94f8-dc4425f55455", "comment": "Malware payload", "value": "917715b8f50daa8476cada2192683ed06d7ab334d8d4e2a9f9b84bbae94155ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135068, "uuid": "8ef7fd94-efff-4b28-91f9-2b8d6c26a4cb", "comment": "Malware payload", "value": "9ae638cbddd99e36db6b17a430d44708be96605b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135068, "uuid": "a396fba6-a3a9-474c-a300-4b01c2be4377", "comment": "Malware payload", "value": "7b9c58dc73f94c35686aa2efeb0694999f1b9753b952f51f9c510fde50b64f8472ea7070514e78054e17ac7ca842ec9d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135068, "uuid": "7adfc179-6612-40c9-b1fa-70b59fd7e2cd", "value": "T1C8235C5516857C24AA98C8361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135068, "uuid": "604b3b6c-2d1c-45c7-b53f-7903ca7c6459", "value": "768:dl+i9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:L+ncr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135068, "uuid": "6835005d-9a45-46ea-a51a-ebcc34794556", "value": 50059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135068, "uuid": "758b144c-149d-4d0f-918c-4195ed4d364d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135068, "uuid": "7c090a55-db07-42d5-adf6-96faa617cf99", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2c0f7e-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143576, "uuid": "5d64be29-9a77-4fdd-a789-2425513c49f0", "comment": "Malware payload", "value": "1a590d295e0a5ca5cf13a84952180009", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143576, "uuid": "f292fab8-2e90-482e-b305-52102cc59461", "comment": "Malware payload", "value": "91bcb7f348e9024f9eb372143afdc7adabf4b53cc4b516e0dfde5137441ae35f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143576, "uuid": "7ad0265d-a03b-4aed-beab-3d50802eb7d8", "comment": "Malware payload", "value": "7388e787be421c9d55cf4788c63a756122b2693a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143576, "uuid": "ebbcf3a4-3497-415e-8727-3c3fd5ae8a89", "comment": "Malware payload", "value": "ddffc742e5955d043de6aaf407271807fa56a01e5541c8b96eac1a4e75a94b4aade4699c5c8684ef49815ea6d156db5a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143576, "uuid": "fab79315-fa9a-4a59-8b85-39c1a491273b", "value": "T128219680C51FEB46C61D893E1C9C4F4F1146088A93EA7A77A33571B63D17D996F03A88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143576, "uuid": "3515209d-712b-4c39-9180-a93acd75b5bb", "value": "24:9idrUqkLFZaxJ3Qm5gXr1EmBGIxncwZGGSVmSXS4mJfJkirpLPvxBtidIbt:9itUZ3av3QCDH3VPXlixPvf8Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143576, "uuid": "8b176fa0-f4cc-4429-8b05-b45b74ebd975", "value": 1141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143576, "uuid": "c62ec9af-81a9-4ca9-9b2b-b6f4c89d1c33", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143576, "uuid": "eaf80144-1dc1-467d-b5ca-1b966eb7f556", "value": "photov_635446815627.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c4e94e-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132989, "uuid": "a36b620e-a244-444a-8c98-14f7fc757f8a", "comment": "Malware payload (PureRAT)", "value": "db637609ab55833bcaba1aec9b74d4c6", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132989, "uuid": "a5221092-9913-4115-8ad2-4b74126ef666", "comment": "Malware payload (PureRAT)", "value": "92640a9dd00e81194630e78805a981056529a07625ce20f8f666714692e06661", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132989, "uuid": "e5378b0f-8fbc-4b37-9f14-513773de192f", "comment": "Malware payload (PureRAT)", "value": "fd87c7f9ccc7fa74518716a7c7c6bdb6e0fa69a1", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132989, "uuid": "a02be896-8a0f-4336-9d8f-75ea033d15f8", "comment": "Malware payload (PureRAT)", "value": "a5d13c7b525ef99d13a7fa458e55017ffeac3c5cadccf94368aeffd85a87fa9b5df9d24e8e23dc47cfc1924a72a9c918", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132989, "uuid": "9a4fd035-347b-4065-83e8-dd4cd1dbab52", "value": "T15B2165ADC6287581C44FCBB66529520B51595E48F423524609BA62337DD1B8D7B1B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132989, "uuid": "8f330548-8f1d-4747-ba73-8367e97d4fb0", "value": "24:9V79S9ry8fsXHWdkU6G6JxvKB5VsKqmSap+FV8KMC8Xzr7kGVlm:9Ro9OnXgmxCpsKqPap+FaC8jkGVlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132989, "uuid": "a37436e2-b85b-4d1a-b836-6d0c4c41ae4e", "value": 1300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132989, "uuid": "955d1336-2355-47ac-a48e-ed99fb9a2cb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132989, "uuid": "785ef4f7-fadd-4664-94e5-63cb771c8567", "value": "photov_386885136246.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a96b2c-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154256, "uuid": "2fe98d9c-881b-4188-8ace-6e6b2f14e8f5", "comment": "Malware payload", "value": "52c478600969696470ec55513f2439c0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154256, "uuid": "a738acb5-2d7e-4f4d-8846-2289031d2ec7", "comment": "Malware payload", "value": "927e57380a5e93e42b9895d5cb8ca9de0a389e2b9f1a52277e895065d3ba7ab7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154256, "uuid": "8afe1622-e6ab-425d-8238-f12ada95d50b", "comment": "Malware payload", "value": "beecc44c72abc5767eb25cfa23f05b993414e647", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154256, "uuid": "7b90aeb9-47fc-4c1b-9ce2-2f3a1857851b", "comment": "Malware payload", "value": "4c7d8e00c61f5a70e4f85c47f8fb82e398b85e92a7f7afa427bb72cff1a0e05672b64828167c25fa8215e85d6682784b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154256, "uuid": "efc09509-3b07-4830-be1d-d5d2bcffd09c", "value": "T12E21DA78C1A991C1C94F23316C3DC5C0333E4B5C622C20B7D28714A21D93B69050BEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154256, "uuid": "290409d1-0fe1-4365-b27c-3f303f90ebcf", "value": "24:97+oLhDkZd9Y7O14mCjRnNX9eRmZRBdTZvtF3mSd3JJxF95p2k:9SoLRk/2OimOnfeRcBd9vtZPdj39d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154256, "uuid": "f461f9a5-0628-4dfa-af04-d707a7f0ae5b", "value": 1224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154256, "uuid": "201e7532-b0c7-40a6-a6b5-3d5172dfd78c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154256, "uuid": "3d544b5e-50e7-4d42-bf1f-1fee20318826", "value": "photov_156725122740.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775277f2-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167675, "uuid": "408402e8-217f-40c1-b525-5fcf64d45a71", "comment": "Malware payload (Prometei)", "value": "187e1ce9e2036ac1067664244d74aebc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167675, "uuid": "47768a1b-0a3d-430d-ae73-16d84743d3fb", "comment": "Malware payload (Prometei)", "value": "9286fd85002dbc2abc431b816ca8237a2563015f73926f1cf3b379726bb46b78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167675, "uuid": "af3b6a8e-46fd-4b2a-9ad8-ed19926ea213", "comment": "Malware payload (Prometei)", "value": "704d82df32e0c2d5c7ab11b00ce9fcc54e1c6ade", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167675, "uuid": "86acfa0d-baaf-4e7d-a28a-6f5ec0061211", "comment": "Malware payload (Prometei)", "value": "6ce467ba2290f707885498e0f9df868cba3cffddb939edeadfa53a33fef89d5af353efa55881397e7eef671a76873641", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167675, "uuid": "d7136f12-9d86-4209-8e81-d16d16b32d78", "value": "T1DEA423B4F9219E9F6DD76DB91B24C31DE082C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167675, "uuid": "76a1cf49-d03f-489b-9e14-0fa09d77f645", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdD:Fs6pyCC/Ya2hpi6T6N41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167675, "uuid": "2aabd715-edfb-45d5-b322-10adea6a9ca5", "value": 449089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167675, "uuid": "79aaca12-82ba-4bd0-8853-6745d539425c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167675, "uuid": "c075c4d9-846b-4a50-b933-fea3d2b471db", "value": "9286fd85002dbc2abc431b816ca8237a2563015f73926f1cf3b379726bb46b78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfb7993-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143391, "uuid": "9c5368d6-f4db-4fcb-b3dc-9b3c3faa72de", "comment": "Malware payload", "value": "551b444b37539cb91c3114c34159e9f8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143391, "uuid": "e2242e51-29b9-4a2d-ad28-4e59115aa6b2", "comment": "Malware payload", "value": "92d30dd6be78798fb9479a2e52e7ba0f1a2ee00fbd4f0b8c22b2138e4d57f720", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143391, "uuid": "cd92c01c-3d86-43d0-a02d-1f9a811b006e", "comment": "Malware payload", "value": "7efa386d8e3bbfc92cd3cf20246d7e54b34e995a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143391, "uuid": "7e2bc708-2488-4205-a7f2-96f6563c6dad", "comment": "Malware payload", "value": "6e3b7682a510b87097598be9156c74083929544bdcbe9894162959e61920ca18189bcc56f598750e914a792f2e4a7bb1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143391, "uuid": "2319e22a-d0d9-45dd-af0e-2fc7ffe45ae9", "value": "T1F0E068C547B925CC0167AE4B14986E1011227CA89BEA82687DC4D44C57813A7180C319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143391, "uuid": "3e933f94-46f5-42a7-aa95-6425d5966bb4", "value": "6:s2S7ocgPlddCSMsTK1W8ThShRjuddCSs++yccl68yL5bBHvcvX+aEmpccgPlpJSa:sTVqddC0KrSmddCO1ot5vRadqpb93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143391, "uuid": "da214f24-e57f-4b08-a08d-6750c40512c8", "value": 375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143391, "uuid": "053faa39-d9d9-4639-9928-f327e0c2d5ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143391, "uuid": "fea7f31a-f405-4361-a16c-c0b5641a2cde", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e96d6cf-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158104, "uuid": "11990ab4-271a-4df1-ac5e-8f8c3c88c16f", "comment": "Malware payload", "value": "27bb421cc977a9d297ef00c029a58434", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158104, "uuid": "91d46039-4b10-4cf8-a103-d8113eebac32", "comment": "Malware payload", "value": "930988a31053c0a812789c2f2b54f32e6c27da1d9aed182202c949c710b33dc4", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158104, "uuid": "b0d4d8e3-df61-47aa-871d-e2dd37324d67", "comment": "Malware payload", "value": "12bb4dfde04dc44b337fb28752896469287ff8c2", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158104, "uuid": "b1b30547-e09a-4417-b7e5-a55fdcefa18e", "comment": "Malware payload", "value": "3b0ca83693261f5785d175646c6f80a4924739adfdc97cd4e971d6d3c9790afd56bcaa931f92cffbe6b403cf79b535e0", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158104, "uuid": "7ee6bd1c-dd5d-4ba6-8380-2415a393c0e6", "value": "T13D06336CA8B9F09F741763B096BE1471885C3D0937B5B3CD96AD37C860FBE64A825483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158104, "uuid": "08454959-fbd2-460d-acbc-df9d704ac8c2", "value": "98304:FGy1A+QQGjg/jS71Z5zq22+YVMjCg2J4tCIaUn+9a:FPG+QQGjgC422LYCgsYFaUn+9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158104, "uuid": "30723921-116d-425a-896e-8e085929ad49", "value": 3848648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158104, "uuid": "5f494b96-d850-4f1f-b8b3-823015902f3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158104, "uuid": "7a8ee8cd-0ee4-4681-a935-1a111c90d915", "value": "930988a31053c0a812789c2f2b54f32e6c27da1d9aed182202c949c710b33dc4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4846dec-89d9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785170435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170435, "uuid": "a9df96cc-50ae-4c2f-b765-9d28df620cb2", "comment": "Malware payload", "value": "e88232a0e206abb226ea26d8212eb13e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170435, "uuid": "d42e5d1c-5487-4469-9cb9-4354ab48d7b5", "comment": "Malware payload", "value": "93957b5a9a08759bba54d3019b494896b02a5e444d7560a8b4dd10cf48e12fc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170435, "uuid": "abe7d144-b007-439b-99a9-a88d7e495ab7", "comment": "Malware payload", "value": "6cc8cc7370f4f112c3c35d3df9626cb20cc636a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785170435, "uuid": "f0f7cd35-f50b-4702-95b6-da2fda74097b", "comment": "Malware payload", "value": "fa2adf031f2649a9835acbc488815c6063a0e88459483c8e73a7072e7d6ec76139c4c6173c40a2cdb1776be788e9056f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170435, "uuid": "536b0b87-a9e3-4e15-8104-76c5febb2abb", "value": "T1E0452285B2912AF9E1B3C53984A64952FB3778270720AF7F4790C3716F13A51BD2EB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170435, "uuid": "fc3a0923-7a2b-4c11-b45f-2c5d0893722e", "value": "7da77cce71b6ac76f77b8520f376f8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170435, "uuid": "7847c079-3ffc-454c-9c03-cf86e0ad9d6e", "value": "24576:6Be/MYbuYrVbPkFl5+XoSiJYiL8b6MqB9899o/yj:kfY1c+qJ8m980/yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785170435, "uuid": "381494c2-cd7a-4fcb-9699-429f9cf53894", "value": 1240928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785170435, "uuid": "e9e8524e-f037-4a29-a032-51086151dff2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785170435, "uuid": "1a3a2c35-b1a4-4a77-89f6-a2f06e52d2b2", "value": "93957b5a9a08759bba54d3019b494896b02a5e444d7560a8b4dd10cf48e12fc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54e413b-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132963, "uuid": "5007df1f-d606-4b20-8cde-a79fa254d4db", "comment": "Malware payload (PureRAT)", "value": "19fcec491828df34a063acfff40af540", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132963, "uuid": "03ccc247-dddd-48e5-9ec9-290c52d2b066", "comment": "Malware payload (PureRAT)", "value": "942c6af657c83f8cc00e656d80129daad85013e6017223b1b7b133828ac236a3", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132963, "uuid": "a19ed8df-e8f0-489a-8487-ba8b4ccc0aed", "comment": "Malware payload (PureRAT)", "value": "089e9c67f50450b6e7e3d020e974e474990011d4", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132963, "uuid": "f1b7d0ac-a8ef-4978-9857-caaff495c1bf", "comment": "Malware payload (PureRAT)", "value": "2a6ed8b0338af9d269aefe0c91bb4ee503bb8952a781e998459d9aaae553809a4bcb83133be92b4b05851ac345556b40", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132963, "uuid": "c15358fe-3fe1-4f96-9e5d-bb55a8c5b597", "value": "T19121C810480FC591CF8EE43B7F5AA2DCA5398E11B11716253210E9B33AE464C6B09A8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132963, "uuid": "509a834f-c9f3-4989-b63b-00bcf1c4706c", "value": "24:98gV8VRJIhbUEMtlST593Mr4+ANs1i557jnVmScO/wv/3JJxghm0OTZg72w2DOM:98DRJIhNAlA5pMr4+Y9jVPnIKh+ZCEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132963, "uuid": "5ff0a414-d205-483f-8345-a488a93e6ddd", "value": 1328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132963, "uuid": "229fd421-ca56-496e-8f6f-0d15806706d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132963, "uuid": "b4b83cd3-7444-437a-b7a6-6f0fc2e6e152", "value": "photov_408459201171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99b8ee8-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132568, "uuid": "bb2b788f-9cc9-4e9f-9aeb-17506a825516", "comment": "Malware payload (PureRAT)", "value": "bf2455bd53f652b37122760bd4ed01af", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132568, "uuid": "ec746c1d-2834-4de2-a693-dd84c735f038", "comment": "Malware payload (PureRAT)", "value": "954f528dcb907ea1637accc6dbc5fc5f26313bf7c05bf107883e79635c5dac4b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132568, "uuid": "474bb095-7af4-41d1-9c4f-cd70a67335ca", "comment": "Malware payload (PureRAT)", "value": "ec31da4024d100898aecf3308d40696c055dd237", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132568, "uuid": "98faf3e4-f6b8-4829-b87e-d873e5920381", "comment": "Malware payload (PureRAT)", "value": "b90ff72b541c74f9cb67fac677c46539a469f9ec5642916fa30131919c0582dfa8add0b422bdae62b1e67cf83a0d9b51", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132568, "uuid": "77ecea19-921c-46b3-ac09-036c059764f7", "value": "T1E821A32080D8ED00CCCDD6325B47628AB71316B1F3A943232B912F9F3618B8D5B553B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132568, "uuid": "373ba0f1-3d9a-4873-9b17-991785667d89", "value": "24:9g3r/y059zCPmpi9uFWVeo/2i1Da9TBtLJiqDXJqmSeqv/UJJxaM5pWAtF:9gbf9zOmpUCWVeo/4T/L8PekUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132568, "uuid": "9b480ffd-03f9-4b83-b7bd-3cf8e1f41ce2", "value": 1200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132568, "uuid": "efe6fa16-af6f-4738-8f79-f72ca89d3d8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132568, "uuid": "fb38dc52-dda5-4d47-bd60-f67909c14271", "value": "photov_471141756376.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3372719-89a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785149334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149334, "uuid": "8d446324-30e8-4938-a075-76393441d263", "comment": "Malware payload (RemusStealer)", "value": "9d2434089e612f0f39432c61a23af837", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149334, "uuid": "308ed563-27db-4f18-a125-f0246e508eda", "comment": "Malware payload (RemusStealer)", "value": "95d726a38b576746afdd06fa579d682e6028976db6b14a9c90f4ae60dc4bdc86", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149334, "uuid": "58f4676b-b39b-4161-9e3f-9a5a93e65100", "comment": "Malware payload (RemusStealer)", "value": "bb91ced3b18c61b560d62b92a6619fed99717d33", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785149334, "uuid": "6ede9141-5e73-4790-80f7-dfb6fab939dd", "comment": "Malware payload (RemusStealer)", "value": "004841f2a798481e57d6bf374614e8a2573423d7982c5888dd7ae62a2abc8ccef2ea012039a9404fb692d2b504cd1bca", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149334, "uuid": "2d1b1650-9e07-4da6-be7f-d9df3555f4d7", "value": "T147C55903BDA109E6C0AEA33189B252527B71BC085B3633D72E90B7782F727D16D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149334, "uuid": "7c2bad53-ad16-4006-9a9d-9a334353cb89", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149334, "uuid": "3d2864b6-76d7-40c4-ad1e-ae3b832202b4", "value": "24576:RLYbkpE1eZ/lqyjGNZkI2FdJYeU5Zt4Q3EtqcdGBkmazCEPZoBele5I9DUAKnKGq:RLYoW1WqzNZAZEEt/CoCyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785149334, "uuid": "25c4068e-6938-4ae9-8923-b3dda5abedc4", "value": 2606592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785149334, "uuid": "ca557954-441b-4187-9874-92ad91aabdee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785149334, "uuid": "b083b6d6-1160-4a06-aca0-034359cb6738", "value": "Bootsexec64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beb6ac3-8950-11f1-bd95-42010a9c0009", "comment": "Malware payload (AminOgluStealer)", "timestamp": 1785111258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111258, "uuid": "2b3197a8-f20e-49e5-b776-08db31f06209", "comment": "Malware payload (AminOgluStealer)", "value": "3d8d8f65a8a862d245622d202c311d86", "object_relation": "md5", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111258, "uuid": "b74b1de8-8da5-4bdc-8090-e7e8636c4f11", "comment": "Malware payload (AminOgluStealer)", "value": "9626a88c8395f0bd5c34b1c09ba8571d56004945c8569d954841fceafc498ef6", "object_relation": "sha256", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111258, "uuid": "2dc8eb8d-ee28-421d-9b53-81a39dd73863", "comment": "Malware payload (AminOgluStealer)", "value": "b5b57d4c1e5960687f2dd5f5dcd5c8039c90bbe6", "object_relation": "sha1", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111258, "uuid": "0357b89f-192a-41cb-8b30-d24d11125b4b", "comment": "Malware payload (AminOgluStealer)", "value": "71a21fa3fb8dc87fa38218a0536cc46324216c947a6599d25ac81f048ab3f51916a4b2f010b5a1790d42b6bb4cac79a2", "object_relation": "sha3-384", "Tag": [ { "name": "AminOgluStealer", "colour": "#059126", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111258, "uuid": "9516554b-0634-43ac-95a6-5850d579f529", "value": "T1ACA302B3FE169ED6057CF689D564AA68EF01670B1612998F3461A7CE0F372134AD0C8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111258, "uuid": "71cf2946-5fc9-4fbe-bca6-b54469992fc5", "value": "3072:XpnLayM6o4HPDJlaKED+AQlyHbbeypSgzB+OLLXu:5Lf97JoKEK0PZnzBVLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111258, "uuid": "e83fd93c-f8a9-470f-b900-09f77237386e", "value": 105290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111258, "uuid": "97fe2ce6-a446-4f6c-ba06-f6a3346802a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111258, "uuid": "a2ad78d6-aa9c-47a0-a582-69eb17290438", "value": "browser.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995d7649-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181047, "uuid": "cc9316c4-042e-49df-8340-a484d0501551", "comment": "Malware payload (Mirai)", "value": "7aa4eb9921cf68868726f2da36c9b4ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181047, "uuid": "1758238e-985b-46ef-901f-88bbfeaf0476", "comment": "Malware payload (Mirai)", "value": "969893508d09084e3f66faaa21e98a4bf533b2eb6f92403f06ba0d8243f3d6d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181047, "uuid": "90d7f294-731a-4e60-888d-b4974b9b06b9", "comment": "Malware payload (Mirai)", "value": "985692a91aaf08a47e978a0aaef0d8e7e7595cc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181047, "uuid": "6f573847-b058-46b7-befc-9b43b1f75ba4", "comment": "Malware payload (Mirai)", "value": "85e642d6d690a4b0774712441d0211cd8857fd8aadb0a95b9da745c2e759a4f25bbeda8d3334be9fc261db6b0da6fefc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181047, "uuid": "9b5a6168-7803-4c0c-8472-da686700d125", "value": "T172A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181047, "uuid": "3ed47dff-d3ae-489e-ae75-6445a7188eb9", "value": "1536:yk8NZJjWAanPscve4meOeuCyTPHvwIp/read7Q1Qs/Qd/uP:WZJjBanEzhHvlp/o1c/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181047, "uuid": "b4e8784f-8af0-47d6-901c-873e98945b05", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181047, "uuid": "80881e9c-fecd-4b71-b5b6-49630a808319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181047, "uuid": "6e65f213-458a-4bbf-99cb-d8e37733c8bf", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbb5d17-89de-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785172518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172518, "uuid": "9d835e84-d1ee-4cd0-bb87-17a7d02ef3fd", "comment": "Malware payload (CoinMiner)", "value": "73c4a1248e4fb6bb8430872a61ea76ea", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172518, "uuid": "41c07212-2d19-4aa6-a4be-0d5cdadc994c", "comment": "Malware payload (CoinMiner)", "value": "9787788d19b47b0b3a18a71ae37b23a372635d652028601c1d2f99f005070da5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172518, "uuid": "7093caaa-088e-4d42-a998-5aa5ce857a59", "comment": "Malware payload (CoinMiner)", "value": "517c8575d14540ecd15df6714cbb226b2f6c0e21", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172518, "uuid": "e6790349-23fa-485f-90ec-ba6a566df109", "comment": "Malware payload (CoinMiner)", "value": "1834c107beac6c29428e4af100ce206dae31f04ab6c27af084595f1bacbb1ec93863d6acc3942a84044c9fe8f50f758b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172518, "uuid": "0e200ff0-b7cf-4c88-86b7-5f45650fedbf", "value": "T1D022391F7E850231E39448B4157A864F553D1633A383B3EBF773E19D0B953498840AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172518, "uuid": "8c82f65f-3654-4efb-b9db-c07ced583bda", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172518, "uuid": "66844797-71d5-4284-a13d-09e3ae0b310d", "value": "96:EvwdfnoeYz/J4hrt6KBWdCZaDbFx+ZQKl6ETZjH/CPFJxGE9mZ2FFhxC7tCEe/z8:GwoNScKB6x+eKlKPFJxTEZmFhSer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785172518, "uuid": "ddc7b677-e982-4a87-9769-6349c9ba04a1", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785172518, "uuid": "cc21fc08-f753-4cb3-837d-5f89dc4d2a61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172518, "uuid": "cd3f2c1f-a8c9-4a10-a928-8e5df57485fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402d1260-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154268, "uuid": "7498b54f-1905-40cd-9823-6fcc76ea100f", "comment": "Malware payload", "value": "b4dbccec54ded86b48fbb3cb22f3d08e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154268, "uuid": "e4097765-922e-4d8c-ad08-d05f94b13163", "comment": "Malware payload", "value": "97d1d74af17834a471b259d0b36b8ef2fbf25afbc9ed6f1d5a012b09175ac217", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154268, "uuid": "156527b1-1506-446a-ab02-4e2a74e6dfc6", "comment": "Malware payload", "value": "5a00ca99c9efadc109f6837dca9bc3b5c021087d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154268, "uuid": "0c0e6585-3c9f-440b-b875-7f876a73cc57", "comment": "Malware payload", "value": "e2a6ac766a9b4f86b88b4eaa7018f80e5d8722b1ce7968dd4b93f4eca9e17758155f5492def651251c5eadac59d2ad2a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154268, "uuid": "a8642ae3-3cf5-427c-b49f-5296904f82e7", "value": "T1C821A777FBC74D04EC17D4F75C2A6638A81928516C0040E766580A80F6DA6A83F8C1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154268, "uuid": "5aeba981-098e-4c5f-9464-e7628025b598", "value": "24:9+qEb90gCrfOSDypMbbCnMeXbP5ygmSUbdWqft39DOTczPEg:9+GgKyebRez5JPQWq39dzMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154268, "uuid": "a51cc27f-c633-4f93-9864-976b2e77d09b", "value": 1199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154268, "uuid": "73fe6020-a987-4d71-87b1-ffc030c2fa77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154268, "uuid": "a8a9d0c1-0463-401a-83ee-b77d7f753491", "value": "photov_478553103546.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb214b07-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154045, "uuid": "41f87b2e-18ef-4828-9208-fff64965b9b5", "comment": "Malware payload", "value": "a1301eaa152ded4d59e4ebe339f7210d", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154045, "uuid": "248f6892-768a-4c8a-a789-b6046c0adacd", "comment": "Malware payload", "value": "986e06cb3babe6cb2e7eec75ab18b9f6407fbadb6d1acfb73aad06f5f32b9fe7", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154045, "uuid": "16aedd14-865e-48cd-b779-251d8197377a", "comment": "Malware payload", "value": "42cc51097632521cbfe1bdd81da731d6e37eb399", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154045, "uuid": "856723a6-51ba-43d3-97c0-e126686035ec", "comment": "Malware payload", "value": "a995ec8b4f7695a8ca8ba956340df7a638ef4286a4a39653eb1b3484f458d3408546a0ce57873b58dbb64fe65d25e318", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154045, "uuid": "c4d65458-0b82-4aad-9e68-2217a17c513c", "value": "T12F317D74AA694235F4FB4932CCBE3247B82C57287516E80800D9231CC4B3F0B68D265F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154045, "uuid": "e4895509-726f-4ace-aa08-079a80739fee", "value": "48:8oU6NNHbkumUlN8STnRcNV1NqCUU8OzBdjPn:8odbDmcdTN1U8iPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154045, "uuid": "c1bbee2e-3a5e-4642-8baa-ebf109d92dd8", "value": 1783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154045, "uuid": "c02ae014-f8c3-433e-8e66-4178b0bcbda0", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154045, "uuid": "9a6734d3-49db-4754-b958-2afadf7cc568", "value": "photov_860775411147 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0569e2-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167685, "uuid": "b1466f12-7bf3-4d03-8640-2b97a5492d97", "comment": "Malware payload (Prometei)", "value": "1e613dec8beebebd6baaea91998a628e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167685, "uuid": "97e871d3-c643-49a6-b5d1-257d261bf480", "comment": "Malware payload (Prometei)", "value": "998ea71c9c2d89374f17d5dc2d0d83abd5845849af7d87cff96542614e3364a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167685, "uuid": "1bf4db8c-2e6b-4280-9d6f-8f68d07052b6", "comment": "Malware payload (Prometei)", "value": "a5412dccd1a204bcd76e09b99a16140da3b9bf09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167685, "uuid": "a2b033e2-d280-4a22-a69d-f6aeadb478dd", "comment": "Malware payload (Prometei)", "value": "81200f80ef3bfafa2c2409be5d1ab61b4f865727533a59bd8dde10a37d2dc82b82c89fdf8f76f839d5d828f43a4838c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167685, "uuid": "3ea6faf4-1360-4fa8-ba22-ea026a743403", "value": "T14A34BF63A4BCAAAFDDD82F379C4E880713B66FE4D890603E1C44710EFE1A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167685, "uuid": "79394995-c408-4d11-a719-2473a7acfde2", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167685, "uuid": "a36d81e6-9956-4969-aa2f-07269cecc0da", "value": "6144:4GxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOD:4G60BpL8jk1FGjDc8GVdOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167685, "uuid": "02599ad3-524b-4774-aef2-fbd5edbbd39d", "value": 246264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167685, "uuid": "b095a484-1037-4b07-860b-692a29dc0da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167685, "uuid": "56435be6-bcfe-4029-b67b-869ba1a50beb", "value": "998ea71c9c2d89374f17d5dc2d0d83abd5845849af7d87cff96542614e3364a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33ce73f-89ba-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785157119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157119, "uuid": "3a36a804-6af2-4dd5-9199-4d2f407e2a94", "comment": "Malware payload (Mirai)", "value": "c7345c1dc14b8f8703f1992513a5bb66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157119, "uuid": "aa367767-325e-4c07-9594-25c16dd680f8", "comment": "Malware payload (Mirai)", "value": "9a13d58b6aee76ede19290cf358fb6fcafcb26190b260289c97d74d1e18895b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157119, "uuid": "d4a5a121-0948-4d52-a065-b99bdf5c21c3", "comment": "Malware payload (Mirai)", "value": "0168c8fa3f147c398c8d1c6197a56ccc86088e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157119, "uuid": "6624d6cc-2124-4521-9b70-7604b24b6833", "comment": "Malware payload (Mirai)", "value": "e6bcdf9a7ff7928b4b8094ba538cf13c4b0073d2b388060f6da916b67cf6f41bcd5c5c323a76b4de17b2697d8fcfd6ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157119, "uuid": "21d18c67-9438-4bc5-ba02-a7b58986843e", "value": "T19C34F90AAB510FFBDC6BDD3702E91B0624CC641722A52F367678DA18F94A54F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157119, "uuid": "fcbbee73-a6de-443a-8207-02378b57a20e", "value": "3072:uO95LHWecxKaGH5QASKYOn2jMhOY5+7lGNJuJils/lVb:p912hLGdSpwhr5sbIlSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785157119, "uuid": "75ea867b-3512-4da0-876d-232ee4c653c9", "value": 248516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785157119, "uuid": "f51507d9-6deb-472e-8be9-fde20e982d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157119, "uuid": "3207fd50-9a3b-4ac9-89a6-72f1b8cde203", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccc9c04-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132949, "uuid": "61f64e4f-86ac-4a55-8414-a757e9767a75", "comment": "Malware payload (PureRAT)", "value": "ff104d88505a09733ec77364f0903df5", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132949, "uuid": "81f8bd25-1e94-43eb-b21d-e8188b91bdf6", "comment": "Malware payload (PureRAT)", "value": "9a3cc30a23bfb4a68acf89892f3d8c8902bec94255ed6caed5192c56c05a6c88", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132949, "uuid": "5f7d186b-925c-47d5-8362-cd6c96d07ce1", "comment": "Malware payload (PureRAT)", "value": "177a77d31fd4680928a237454a416b95907c980e", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132949, "uuid": "f736593b-57ca-4a98-a6ad-53768e0abc95", "comment": "Malware payload (PureRAT)", "value": "196502bab279ba8b701eb4f29117b6dd7c2ad672372dfac6d5c90397b7df5c5199b5761fc011eee3cc88252d06ea013f", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132949, "uuid": "d2540c76-2b38-47a1-b5a0-b2ae526cf330", "value": "T13E11A50EF1DC8971DD99D135382DD6440E349381E054698BAB9235F73A08FDA630018A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132949, "uuid": "c0f6f6a1-583a-4488-8e55-3dddc1fd15a1", "value": "24:92ZUB1UAsy5LJUJS4UHj+D6mSj+3hGY7unwV+DnX:92ZE1tnUJSzHj+D6Pj+RGY7unK+DnX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132949, "uuid": "2bedfbfb-63c9-491d-93dc-8dac2f36ece6", "value": 1050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132949, "uuid": "984e2762-d7cd-47fe-82fc-1b701f54a0d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132949, "uuid": "52dee7a0-4d4b-42bd-9c3f-cd7adfe4b7b4", "value": "photov_043552068649.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2217c7-89b0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785152730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152730, "uuid": "1845aebb-496e-4268-beea-a6156a71ac7a", "comment": "Malware payload", "value": "73ec267a33b1ea9e809c5e856b04cc39", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152730, "uuid": "84095b08-a5ec-4cb5-8f4f-06f21f747d3a", "comment": "Malware payload", "value": "9a409f0e1a6ef9b3b98e34c758c7b450950613053d4a7ee8de43e57e7036b875", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152730, "uuid": "1770b8a1-d2be-49e7-9ea7-6abfe546613c", "comment": "Malware payload", "value": "b9d52456314f5e08d36cae33885f33ebc020de5b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152730, "uuid": "3a8dcb57-1aa8-4198-952d-4a1e82938439", "comment": "Malware payload", "value": "f4bfcf48a6144467f5b8a07a01d7a86e471572d87822291722e19b619cf21b00efe5e9e02932e7932bd1a9b84f1cacc0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152730, "uuid": "93a535c2-756f-4f38-89cc-8d2cb2e0e313", "value": "T17334228CD78F05A2CF44A7BB02670E8844F8773EF64645B274AC836533ADD2E426657E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152730, "uuid": "185de1ab-f341-4f35-b5fb-0d4752de269b", "value": "384:NawDQzNezJUrDUJJjd77apsqLAY959J5M9JnbvpZg4427z/rm5sZ0TyqmgE81:NaldUJJRF4Vev84v7bZ0uqhz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785152730, "uuid": "2915ecb8-5ba5-44f7-9ede-edc78aa3e2e8", "value": 231969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785152730, "uuid": "7b6ac8ed-cd96-4dfc-88c2-0059b2659acd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152730, "uuid": "926ec811-081d-4b07-bdb5-5ead8809d3a9", "value": "RequirementsXSheet.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80b9a20-89d1-11f1-bd95-42010a9c0009", "comment": "Malware payload (CobaltStrike)", "timestamp": 1785167005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167005, "uuid": "ac38ee10-4ec8-4a8d-b691-4c0807e67f7e", "comment": "Malware payload (CobaltStrike)", "value": "a3db22547419f693905d3dd045ee9f84", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167005, "uuid": "a724deb7-a35e-43c0-9c59-e506aaa4dae1", "comment": "Malware payload (CobaltStrike)", "value": "9a7fdfd933725c6cc3345da81b6ee2d6903e225f961aa18efa5b5a9447f4b015", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167005, "uuid": "36bbe561-726b-4430-85a3-07441478339f", "comment": "Malware payload (CobaltStrike)", "value": "30bc73c6672e6c46d21086a04762ce4170fd4e99", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167005, "uuid": "19645704-2f87-415d-8d8e-d69a481d175b", "comment": "Malware payload (CobaltStrike)", "value": "0b62c0cdff5d3a884f1ce4e67c0364b11f21733377aacf5903c252ffeb85505c8ee45a1634fd254780c160088d4e8dcc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167005, "uuid": "4d1817ce-f7fa-479b-b40f-872eb8ec5a13", "value": "T1D674230BAF946018E72D0D3F61BA429C05F4DE5F416BF5C77ACC627A1A3628D0253AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167005, "uuid": "720177dd-0e97-4bb4-8bf0-c03f83394a0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167005, "uuid": "2fc22444-2084-48e2-85a8-4929d1730166", "value": "6144:Q7D28gMOVSheJGlkR7/E03JClJXI9QzeLWsw1BhaaV7PaCSfA9W6JD2J:Q7D2okagZ603oJiQzcWb1rvV7b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167005, "uuid": "0e1ae248-7ce4-4b2a-9b7b-728eb8bcaedb", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167005, "uuid": "e13971f0-f4f8-4009-9cab-f6737d462f31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167005, "uuid": "584fcfea-0359-46b7-aee3-ddb22d670e26", "value": "dumped_assembly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f82c8b-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143541, "uuid": "3e39cbe8-c465-4b33-8179-bc6042561116", "comment": "Malware payload", "value": "bb349926d552e1800d8ab61d1e70968f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143541, "uuid": "fd8a6618-c05e-4374-b5bd-6d768dfd0e0a", "comment": "Malware payload", "value": "9ac48d8bc52702ec7d94141082abad65867fb1f9a8e4d3c100b634d8ba95574a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143541, "uuid": "8ab38219-7056-434c-bb3e-bafe7552c5a9", "comment": "Malware payload", "value": "1165ca23e4471663e5a7c10a630e0fe89f94f39e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143541, "uuid": "a1730990-3932-4695-bc8d-79d3f5c5c458", "comment": "Malware payload", "value": "e4f60fbca0fe5da1f147ab02d0e794fcde8638ce47cdcc98001175d49e0fc52b49a1b996b3fc1972f79e91f573eed6ab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143541, "uuid": "b198fb32-114d-4480-98db-ad52eed69d18", "value": "T11F21C67A01CB8C84CF67F0370286607A56244110C3573B2BF62C665DCD2AB5C673956B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143541, "uuid": "ffacb891-9309-4514-90c1-a99b3551f164", "value": "24:9UTx5Dh9K9Vi3upMURKRaljJZmSLlVeh6EpR4Zul:9UFE+3wXVZPLlU9UZul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143541, "uuid": "a5c6bc79-5462-46fd-aea2-7defacfe260e", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143541, "uuid": "882c4267-71c4-460b-8180-ef29254f004f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143541, "uuid": "5b47dba4-d004-4066-9aef-3ed7e974bde8", "value": "photov_985484071957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f28482-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154365, "uuid": "3da8165c-00fb-43eb-b335-e0a41091960c", "comment": "Malware payload", "value": "50868472632cb4734dc1f868e9c6dc51", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154365, "uuid": "41233b6f-8f63-419b-86bb-c8c4fa4deff9", "comment": "Malware payload", "value": "9b4e72b428d3bb601abeb7e73023e6ca82a2d436994b6ffd3dc209fde7539c4b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154365, "uuid": "162980ed-ed71-4f58-8afc-39aac31120b4", "comment": "Malware payload", "value": "90af96e78be4c7c43c3e1772c89b7857b2ce39d7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154365, "uuid": "0b6a72f1-ff12-4932-a861-5d28273cb319", "comment": "Malware payload", "value": "6a9ff240a7acd2c88418a2e4b8f2aa88a93902b286c15b3ebbba0f5cc050bf373c24752bd72e95a1d3dfbc0b01fa0507", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154365, "uuid": "78d860cc-c00f-43ae-9464-63c09003c16f", "value": "T123210A562C3BAE05C125C6747F6D7B8237F7EF2C58A020870E7674723782541B64C034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154365, "uuid": "5ee7779e-6c06-4403-875e-158b78db6085", "value": "24:9u+AFgs8NVJTNkidGeRuNYlkA8YqgmSPk4FWyyWXndodmWl0jscl:9IFgrXhNkMGe+UkYqgPPeZWdodmYi5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154365, "uuid": "aa2b8653-058e-49d4-97a3-e03f74eb8c3a", "value": 1255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154365, "uuid": "45e74a10-6022-4d26-8f76-a475fbed8a9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154365, "uuid": "a04ed42d-a31a-41db-b975-7de45bfd1d2a", "value": "photov_962526705216.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327f2c35-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158111, "uuid": "01a0e31e-2f1b-4c01-8a96-1cf1f055e7d2", "comment": "Malware payload", "value": "7bc1dddc0682ddc8da63b0532c4238a3", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158111, "uuid": "0a673749-5914-46a3-99f9-dd64cba7b38f", "comment": "Malware payload", "value": "9bce6637d1bc5cab93a76d62810168b69a7e8de5aec61668f22861f93b07cc1c", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158111, "uuid": "edf829f2-a3e3-4ebf-88f4-ed35d398454f", "comment": "Malware payload", "value": "687b8104ae862c3ad91a08483b0fe266881a4d50", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158111, "uuid": "589866f6-b698-464c-a8b4-df5a8f60ae64", "comment": "Malware payload", "value": "177de25ad651f8488af63c0eb8079ad2ad7d0cd81d97c948b5a0a71ca7e18724fae24d22d7f8ced2257049157e32d5db", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158111, "uuid": "ef4d1712-e22c-444d-98f7-5ada8857847f", "value": "T124F55B74D351B065D1A7C430CACA4FF4A4A1303B52366D1F1BC5D81A25FBEA1ABAD3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158111, "uuid": "78db6b9c-8d7e-4993-a491-cc9f2e5443d1", "value": "52fc4cd1f0148f6789c566674a94e859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158111, "uuid": "e5ae5348-d1bc-4704-8a40-066aaa51f657", "value": "49152:jA/sZTFGb5lQBlMVRA0KpQ4FpUC+/vh1TWbM1NJEV99MZBKpxeopN1r3jjnjhwct:poFuIJepHNDLHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158111, "uuid": "0169589d-1b0a-48ed-b424-faf8fbe3cd04", "value": 3454464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158111, "uuid": "a081fb40-af05-42ce-9fc1-918f505da295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158111, "uuid": "0dfe2c52-fa0b-4f6e-b815-36bf18b30f83", "value": "9bce6637d1bc5cab93a76d62810168b69a7e8de5aec61668f22861f93b07cc1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de2f249-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785168170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168170, "uuid": "573a2701-a2ce-467a-ab27-b4106c5a49d4", "comment": "Malware payload (Mirai)", "value": "743d7e79073c22c679920fbd6d16cba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168170, "uuid": "331afeba-f2ef-4fb8-9e8f-94d739770089", "comment": "Malware payload (Mirai)", "value": "9c7f656be3fce28333546b645e8c399c39767eb86e3757d19252f92fc02403f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168170, "uuid": "924219bc-c944-41aa-ac35-acdf19f1386c", "comment": "Malware payload (Mirai)", "value": "6d2c4bbc302d8b51e7843816c3d9c72421bc4419", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168170, "uuid": "cdc2c59d-0507-49af-abd3-703ceab4538a", "comment": "Malware payload (Mirai)", "value": "e20851620cc02af5dc91bbac4bae6223ced8725f3763069d8fc30f145083e3eaddac05f3eb4c19104a73fe88b63607ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168170, "uuid": "15f50cc9-c04e-40d6-9435-c33d77aa2b77", "value": "T15383AD32EA292D44C0455470B0B98F395B73A5C083476FB666FAC6785047DACF90AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168170, "uuid": "3e4fad9a-03f5-4e90-bb8d-634b2805b3c4", "value": "1536:UenMpsd6H316K/1hoNJXa+GlbDKu4JlvqjwKqad+WC7F:UeAsdukuhoNJVwbmuUqjLjwWiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785168170, "uuid": "7a1ee09f-47ac-4fd9-8205-7b57b396ac0b", "value": 83532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785168170, "uuid": "e3b48a0b-bf3d-4ae5-9f3a-5032f45a56c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168170, "uuid": "8a4db0c4-8960-4090-93e8-3e4b0981f540", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6bc973a-89ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785179405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179405, "uuid": "5a8a559f-72e1-4267-a2f3-f84689ac4b68", "comment": "Malware payload (CoinMiner)", "value": "6159d556244d9b3bdf4db6c7ea971cd5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179405, "uuid": "db87eeb1-10ac-4f5f-bbda-24f889575030", "comment": "Malware payload (CoinMiner)", "value": "9cae45ef7526eb2c7db2a7ed5f5b2af93cb55d5cbecf907f9a07afef887b54b0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179405, "uuid": "ce0d171b-271c-4381-86db-884679df1749", "comment": "Malware payload (CoinMiner)", "value": "ee1972dd5b96bd33dee22c6bee867e95f0e75c5c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179405, "uuid": "863e4706-ac00-452e-8a8e-b24e590cd4a3", "comment": "Malware payload (CoinMiner)", "value": "b4ea54c46e824ce293b3131311b234150e9afa0b88a84757aa4561b6000b8939bbdcf593482d76a784150be3a42b1fcb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179405, "uuid": "c830eaa8-9240-4cdd-81ed-8f4ec8edccc1", "value": "T15522391F7E850231E39408B4557A864F553D1633A383B3EBF773E1AD0BA53498840AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179405, "uuid": "8cb40311-2832-4bb6-a864-9d927999fbb3", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179405, "uuid": "06f0d9f8-2169-4e64-9768-f3d62a57808e", "value": "96:i2wdfnoeYz/J4hrt6KBWdCZaDbFx+ZQKl6ETZjH/CPFJxGE9mZ2FFhxC7tCEe/z8:RwoNScKB6x+eKlKPFJxTEZmFhSer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179405, "uuid": "c4b1d325-6297-4a28-9554-9b5743b42731", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179405, "uuid": "839cc5db-396a-4643-ae18-2d65c5f4d597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179405, "uuid": "6e1486dc-ac75-4988-997f-fd939363144d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13ec4fb-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133010, "uuid": "a9320699-3a98-4fb0-b2c2-1891c07a141b", "comment": "Malware payload (PureRAT)", "value": "eac1f62e5ad9b910706fd0d7e0f2d7b9", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133010, "uuid": "064cbe96-7aa4-4506-84b3-c90d87ec0628", "comment": "Malware payload (PureRAT)", "value": "9ce4979bbe1233c7f208c1b0ac1466fbd19e50aadd894d42f62f1b5b262544b2", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133010, "uuid": "9425fe23-f61f-4067-9e25-00c22d723e5c", "comment": "Malware payload (PureRAT)", "value": "ab6d05615902b56893b7efe3b53b39e739faf9cf", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133010, "uuid": "dc595b52-ffc3-4812-ba70-a4882cfa6df8", "comment": "Malware payload (PureRAT)", "value": "32ff6cdc9fcebdc36094b22acdd8d73125c0436d1bdcf0a4c8196dbdd2e92638878b96d478cc8bc33262f0603c6fc84e", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133010, "uuid": "e7cc6b3b-8352-4977-9c32-724936920637", "value": "T1E72196DAD09AEE00E90BD7BB1C9775C552244470BA904FB3419C2AA22EC55423F06BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133010, "uuid": "bb663c22-8d03-4131-9c56-bf3fc16f3b4e", "value": "24:9CZp3m09GCWqyMPKmqQ1/hJt4Qv+Db5zxwPmSQ6EplLuS/+pyh0MATG:9XaiMPRJJJdibvwPPYH/+p/TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133010, "uuid": "3da46f08-108b-428b-a47c-6f007eb54920", "value": 1150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133010, "uuid": "ac48c3bf-e23f-4722-a72f-fe203560c479", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133010, "uuid": "27c147b7-a8f1-4794-a43f-f2320b85120e", "value": "photov_549284952469.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2326cded-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132745, "uuid": "3584e44e-618f-49e0-ac38-a4fa0b77aec9", "comment": "Malware payload (PureRAT)", "value": "f9e66cbac6d92fdde8ec049d5d071c13", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132745, "uuid": "387341b1-3ab1-41b7-abd0-efd32bce072f", "comment": "Malware payload (PureRAT)", "value": "9d1896f0bc33084b3e00eefd38e46b36981daf8ea291f8ad193adbc034ae23ec", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132745, "uuid": "b4689592-75a0-43eb-bbae-29ad76ed7669", "comment": "Malware payload (PureRAT)", "value": "a1f394e89b6afa1368d8eaefb2ccf4dfb650ceed", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132745, "uuid": "70cf3ba1-d1ad-4bdd-abb8-0c99c1a45a51", "comment": "Malware payload (PureRAT)", "value": "2bc621b78b1669b239fd2e15768437e122e93739f6127a66897434ce46ef8c61d3a0e31b109d86ad56172d2f59950ecc", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132745, "uuid": "1093dce3-140b-4d6c-9495-5b7e47828bbe", "value": "T1DE21B4ED805C8A14C523D6BF3C164F6D64284281EFC554D00764D92B8CF3DAC2BE46E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132745, "uuid": "48950a51-5ec5-4856-b695-5ecb0afd6124", "value": "24:9fKvSwQpjewPZmOCnKBDHLduCpLy3GZMhaCshlmSGm6ibdWq8RKzfQBlm7gKkX9R:9fsSh5BmuDhNpLWGaYbP/7WOfgigB9dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132745, "uuid": "75b6f543-49c0-4e59-b118-03d6dfc8ba55", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132745, "uuid": "85693a29-545f-4b69-94c7-f45fa45329fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132745, "uuid": "eb4b8128-104b-4437-978a-34b563ebe28d", "value": "photov_225332944300.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bbcb80-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132749, "uuid": "041945cf-bae7-4838-8b8f-3a841fd4747d", "comment": "Malware payload (PureRAT)", "value": "8319a0d20f40c87e321af78721aa2b23", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132749, "uuid": "b0e5a75c-22d1-43c2-b01d-56d4a1716458", "comment": "Malware payload (PureRAT)", "value": "9d5014af310fed41ad51e46d8ef0948515a7742c84b50fde24d23493c291cea5", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132749, "uuid": "f765ceac-66e8-4579-8cb6-53b65a086823", "comment": "Malware payload (PureRAT)", "value": "ea88df51f101bc869042f22b66a466577430850a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132749, "uuid": "ca8617e6-fcfb-4fbd-bfa2-11ba318b17ca", "comment": "Malware payload (PureRAT)", "value": "f40edf7fd710886483966531b44cbfaf4e67391f530ea76d558f294261d182cd02290f938e86c65297c6c389b50dfe67", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132749, "uuid": "1e7aaeaa-d146-481c-a2c1-2ad5f820d40b", "value": "T1CD218662C6ADCDC0CD0B86723EAE19CA7018E9A44768D0321A6139666A3D9803F72522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132749, "uuid": "7290442e-9c92-418a-a761-10dbdebce588", "value": "24:9f16wT8lWMwg/3X9rj1n0fx9eO59tmSCbJJxTOCrZ29CmdCX:99L+11mLeOztPyb90zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132749, "uuid": "f7678aba-6bd0-4e0c-b28d-0c09741f27b5", "value": 1120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132749, "uuid": "50191398-27ea-40e7-96fc-d9bdb27f7e58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132749, "uuid": "afe7d380-59bd-49ca-a435-adf024510c19", "value": "photov_410469450160.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adcfbbe-894f-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785110800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110800, "uuid": "0d8da8d7-02c4-4c6f-af52-06096628c9f5", "comment": "Malware payload (RemusStealer)", "value": "d7ae17502be4db7ddac2dedaf98404d5", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110800, "uuid": "83a2e272-abd3-445e-a149-14d99c2bf683", "comment": "Malware payload (RemusStealer)", "value": "9e7fc86ad3c5efb2e6746ab61dc43187eeb685c1fd9719bcb9553c173530f899", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110800, "uuid": "eff9ce52-8aa4-4ce1-ab56-ab289c3551c1", "comment": "Malware payload (RemusStealer)", "value": "3b773ede23c77347e7ea0c24dce8adb966082a89", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110800, "uuid": "80860948-1fa1-4e89-a806-9afa42d1f822", "comment": "Malware payload (RemusStealer)", "value": "13c70e0c828f5ab80a71408273a0d84ff22cc13efa79fa73e7ef11ec2435f06bbeb3fbf91e24414e371ea0d73a25bcee", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110800, "uuid": "1385652a-8be4-4bd1-96e9-b056c05c4bd6", "value": "T1F024096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110800, "uuid": "fd2b26c3-eaea-415a-9b9a-48c17f43ffb6", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110800, "uuid": "6ac44036-21d1-4a29-a869-f4e1502aa858", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFF11CGiics:Qj5WUEBx+Q7PEfFnQU+tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110800, "uuid": "13f0ac25-055b-4947-bce0-11d8e3f72d3c", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110800, "uuid": "875dca84-c6df-413a-bff7-87ea6e3e8cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110800, "uuid": "d7fd1498-0de6-4625-9c91-0544b0862d2d", "value": "R2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07713b46-89c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785160616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160616, "uuid": "a87a8252-ae8d-4789-9e43-235ef93a4bc5", "comment": "Malware payload (Mirai)", "value": "2b318acc9699292b0c1afb6d761d0e8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160616, "uuid": "c778f9ab-be9f-4369-8096-001e768fa780", "comment": "Malware payload (Mirai)", "value": "9eb63f4927856a2b9567cd13bd31f7bc11cad2778569f165652bc28b1617d5ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160616, "uuid": "dd2601bf-9d37-4a23-a51d-91bcf917d599", "comment": "Malware payload (Mirai)", "value": "537e8cdc0c57dd9a9f95604d8957939c2ee4836c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785160616, "uuid": "369192ee-86d3-469a-b4e5-0adafaab2d17", "comment": "Malware payload (Mirai)", "value": "39214021ca9d98adcf616cf2ce27d67b41dbad9ea7c77aa8674935466dd9059d9a615f58ba5832cf0b5b540ddaf066c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160616, "uuid": "de005663-adff-4ff3-acc1-17a18d730b1c", "value": "T10C5302A9B1331B3BFAE0F07554C307413579AAC7F229AC01B89994C29DAB7053D5AEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160616, "uuid": "2c5ecd15-d90d-4ee5-9206-4dd3f0c9dfb0", "value": "1536:EHYANLKrDn+jiCTfNY4o96HQjZVWSiwLtv+x505bIQIVEWC:0LKrzSiCTFY4o6kgSimYZQIVE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785160616, "uuid": "057eb6e6-303c-4327-8d7a-1fc7bb9c7bdf", "value": 61364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785160616, "uuid": "780bbdb7-a037-424f-9dc0-e11d359c34c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785160616, "uuid": "be0d830f-d586-4dd4-ae4b-1c583fe9c851", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e8b1fb-894e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785110439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110439, "uuid": "84728b17-fa14-4679-b551-1beb06ccb50b", "comment": "Malware payload", "value": "0ffce0f74261da11c21206b81203b061", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110439, "uuid": "0c3518e2-befd-41ef-9aa4-b35676935a2a", "comment": "Malware payload", "value": "9ed7214d1a093fe7d3819b3143a17ce2a572662d55deebc6938a098cf8b0509d", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110439, "uuid": "63d8cde5-3ead-49cf-a3bd-f65f8837cb65", "comment": "Malware payload", "value": "88290cc37b0d09fe406dc6c55e3d6397066e2b99", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110439, "uuid": "c73888d7-4338-4e94-a3ee-b9bf63db0967", "comment": "Malware payload", "value": "3ff43c65758d820a45e5e0f5b73746e204f42e36e7b5f386cd02c21bffed896d3c64c582023dc39590864eabd9b585ce", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110439, "uuid": "47adfa11-8a60-4874-b1e8-f8bad4e5eb18", "value": "T15C3154EF45309A391213CDDEB3727248B41C81F7294BDBE49D584EE982495CCB266FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110439, "uuid": "3d999eb2-7561-4ae9-abfa-6af0889d7152", "value": "12:Ui6ODTxDxx6xHA/0PxJ3a63l2hf5Dox6oAwJY+xDk62A4tRI6lVEllvD6hZ+M6+U:lDd6p32sZA0YW4lVUK0WJ4C1Pxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110439, "uuid": "54923bc9-b9e0-4e77-82e7-c5a064c2e4d4", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110439, "uuid": "661495cf-158b-478e-945f-6942a78bac94", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110439, "uuid": "b1e5969f-58d5-4b5f-9922-6f760103981d", "value": "9ed7214d1a093fe7d3819b3143a17ce2a572662d55deebc6938a098cf8b0509d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfaded95-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154053, "uuid": "5c582795-9162-4995-bd24-26d4e8af1206", "comment": "Malware payload", "value": "f2c2003e2b1ce9f760375003ecbb2e4a", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154053, "uuid": "63dcb066-d311-4bbe-b69d-5a035321b113", "comment": "Malware payload", "value": "9f34a23c8bf580e17225b8fad3f99d2a7e9f076611bf00401c016767a85a6fb0", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154053, "uuid": "06f7eaaa-ca71-4dff-b810-f9f38abb0690", "comment": "Malware payload", "value": "bfc1ea0826f7c23f23f442a6f4809ecc8a0857bd", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154053, "uuid": "238033d9-0b78-4e41-aa00-e72e2265a7ff", "comment": "Malware payload", "value": "c52341db933356b5cf70b56c69779283e30763dcc62a7c460843ee6dd0f7ad80d8a07f181b3064e8a98088a3aaa99240", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154053, "uuid": "3c7c17c7-02c8-4401-a6bd-a05f2b10781d", "value": "T196A21A373256187503C336A888CF9208F7A5559B41492FE9F8CDD286FFB1965A3FDA80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154053, "uuid": "00fdb609-411b-4e93-a73b-e5bfe33dffe6", "value": "384:MocxJdEsvuvC0yGxZoLgSHX3iShp56hSuInE:CxJesm1jZoLgSHCShD6hYnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154053, "uuid": "dca56812-8a13-4568-87a2-10c7eca4d6e7", "value": 21974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154053, "uuid": "2e08b20e-6ed9-4387-970d-2bb9a8ae25b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154053, "uuid": "18ff7af4-8af7-4a21-b545-48e8e1b1e25f", "value": "ycjlvalve.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcd4fa5-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133162, "uuid": "98e2752e-1e8a-42a4-994d-24cbb27199e6", "comment": "Malware payload (PureRAT)", "value": "d9a7d3d13bfa4edcce33bce3f8fb3e0e", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133162, "uuid": "8914cd51-92c9-481b-9ed2-977b9fd590f2", "comment": "Malware payload (PureRAT)", "value": "9f3fe27ff64b5b9ea041ce76c013cf9defe365768f9ebfe6b2461c2a3764e41d", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133162, "uuid": "7896653e-6281-408e-85a1-dd31ca1684a1", "comment": "Malware payload (PureRAT)", "value": "11b1bcfaa8a3c4111642041e56cabac9a37fa237", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133162, "uuid": "21adb7a4-fe10-456a-8128-26b3e80395dc", "comment": "Malware payload (PureRAT)", "value": "46d69fac6fde2d21cfce99550b0c06e0d23c920676ef1e2de1a2e3c1ecbb0fab410d71cadebfb146101a11d660443f83", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133162, "uuid": "e2cf9754-e5cd-4e26-a38c-8ce7aaac2abf", "value": "T1A121B694DE94DA62E0CBC23A0E82BBE520173601D70CFD6B1D5379EB0E1C1D06B18AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133162, "uuid": "26e83cc6-7b6f-4170-aa80-d5a0d6d8b8c4", "value": "24:9kVSXQft0wzLmO2K7tsIUN2zKLuSvXcmSzns6fMqWyEFxhms5YD:91At0wvmhK7yw/SvXcPjs6U3jmso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133162, "uuid": "f20e037d-3a30-4a97-98b8-45833a303587", "value": 1144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133162, "uuid": "dc4ab291-4260-4354-bc54-a58c7bcfa39f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133162, "uuid": "ba35aee4-6f0b-4de1-9f51-cfc3635bd3c2", "value": "photov_845462799159.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4bb460-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167689, "uuid": "846436cb-6d87-468e-b70a-7a941c7f2226", "comment": "Malware payload (Prometei)", "value": "0ae09936a42ca437485310827d2cd568", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167689, "uuid": "0ef54d19-a546-4ddb-944f-a9a16fb1116c", "comment": "Malware payload (Prometei)", "value": "9f50e2753e2b2a2f97b7e41122eb0e732910dd567ccaccdd68f9aff804cf8708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167689, "uuid": "d7c5a6a5-ca4f-4d96-b2be-4229b00d54ff", "comment": "Malware payload (Prometei)", "value": "569e2167811f380f7218f4bdac725ef3952876ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167689, "uuid": "e9e780c6-bd11-40aa-9b6b-ea15efadb1d7", "comment": "Malware payload (Prometei)", "value": "a032efc69e99b951efc2fce012cdb174931e7140db2ecc4707355b7fdddcec259a585e71065df277e16745a7d8d7b9ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167689, "uuid": "ca231f7a-795d-4387-9424-2817ee595767", "value": "T1DAA423B4F9219E8F6DD769B91B24831DE182C172589D4C2313AE95A34F3D632AF2CC16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167689, "uuid": "82fff073-1847-4297-86ec-ef1a39cfc099", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdi:Fs6pyCC/Ya2hpi6T6N4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167689, "uuid": "5449f640-24f5-4270-aa45-ac5c76f4416f", "value": 449059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167689, "uuid": "e52b20aa-2187-4c79-89ca-26a48a974b81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167689, "uuid": "bf1a590e-584e-4f01-9438-37467edf8cc5", "value": "9f50e2753e2b2a2f97b7e41122eb0e732910dd567ccaccdd68f9aff804cf8708", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4abfbf76-8996-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785141401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785141401, "uuid": "45ed47d8-c1ce-46e2-abf0-af103e4f0b80", "comment": "Malware payload (RemcosRAT)", "value": "728a2d544040f236eb69b6b8f762a8a8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785141401, "uuid": "aae78493-d9e5-4a05-8654-df073c24af5c", "comment": "Malware payload (RemcosRAT)", "value": "9fb0048f506ad447890d3161857ff17419dbd3d9df0ecf7278c448b1b960e146", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785141401, "uuid": "c682f3b9-66b8-43f1-aa19-a39060997d8b", "comment": "Malware payload (RemcosRAT)", "value": "6f9587e61ae0bdf4c973108c772afc953e3431be", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785141401, "uuid": "b4c1fe37-acbd-45b6-92bc-35d4b9415a62", "comment": "Malware payload (RemcosRAT)", "value": "d6c044af8762d584a5901f7f2e569f312499564c44a32bda530543cf5ab6d94087dd7a83b8f35170e450113f0bf6ede3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785141401, "uuid": "e8093eb2-bc40-4c93-a53b-5eaf97a2f913", "value": "T130943E34ADFA502A7173EE598AD075A7EA5FB673371E581D10C203864723982EDD233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785141401, "uuid": "4dd659b2-ef23-4a0a-89b3-d8bff4dcf761", "value": "12288:pYXdZfgOYGkt+rBhFSGIa5LurPHCHXgkIHqD8:/BIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785141401, "uuid": "3cd12fb1-2092-4672-a18c-7717434fb4da", "value": 445704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785141401, "uuid": "ddb0aa2c-102f-44b1-b424-0d319fc6641e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785141401, "uuid": "6359e70a-6e2b-4666-870a-e22b5fbd2992", "value": "SON SEVK\u0130YAT BELGES\u0130FATURA NO KDK-26-161Rezervasyon No VNBK005473.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a4b986-89db-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785171162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171162, "uuid": "1d5f6904-89c4-4f29-9503-ee889210e294", "comment": "Malware payload (Efimer)", "value": "d71b2f14528e27c87ecf8b786c252d57", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171162, "uuid": "2848f026-4884-4924-82a8-f05351b4cb15", "comment": "Malware payload (Efimer)", "value": "a006492687681003d32393ccdd5b050340342672a29698d3cc399e4e2471bcf5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171162, "uuid": "55217415-9912-43f1-8dfa-1ec4a50c42ab", "comment": "Malware payload (Efimer)", "value": "725267275ae18ea5f45798957c100eb3136edda6", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785171162, "uuid": "ab99de89-d77c-4d34-92a4-4d98db1f3ac9", "comment": "Malware payload (Efimer)", "value": "ebb805bbf218f177192b37803af1a4d2354bd5838875d798e801116bddd5206b781029ac599f8c7a17c9ae898d61fdb0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171162, "uuid": "78aa41cf-dd4d-4d5a-ba1f-7050f5e3e4c0", "value": "T16FE63318E7D1239EF963833C9AA15654F1A674F107B1C9DF43A0C2D2AEA70E1C938767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171162, "uuid": "ccf23b78-daca-4442-b424-df33cc638e74", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171162, "uuid": "36ed2f41-bfe7-4718-a28e-acde5ad0d058", "value": "393216:IEaHxJEvfywqPdZWEMXMCHWUjXTcuI3/PGTAI:IDbEvKweXWEMXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785171162, "uuid": "790adbc2-88df-42be-ab37-791454beff6f", "value": 14278089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785171162, "uuid": "bd28d844-b75c-46cc-9c72-df8ba28ca7b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785171162, "uuid": "1b467753-4fb8-4d99-a87c-8e11f37e89ac", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88f0ca3-89ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785165637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165637, "uuid": "7b0a4673-051a-4ae7-9509-132b5871f30d", "comment": "Malware payload", "value": "f638e6fba851722a9bd26daebced4aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165637, "uuid": "e07863cf-a8a9-4812-8eda-0a05ef065d58", "comment": "Malware payload", "value": "a0679070b144bb0ee29c96b977c787a83bdd2dc8ffd676440ef887a3f1e4958e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165637, "uuid": "7a98048d-f556-445f-bb9f-d81d6d7c5bc6", "comment": "Malware payload", "value": "f13e08e01feb786c58b7f485ccd6462b32f0d14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165637, "uuid": "3ff08fe0-d4ed-4dab-9fc1-411fd53bff77", "comment": "Malware payload", "value": "dc3af454c2cb8dcf94a1f8c892b0ad1f80b0706c044654888492b8dd8b0510f3cbdbda16a65e28981c0fcf27011f50d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165637, "uuid": "2e8860a6-b1a3-47a8-913e-791c898bc3fe", "value": "T119F58C07BD9148E6C4ADA33189B222517B31BC0C6B3263DB2E90B7782F727D19E75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165637, "uuid": "6c2d4c8f-a101-406b-9c0d-034c6ab25f1e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165637, "uuid": "f3af8263-55a1-42d2-9ef3-21aae6958d34", "value": "49152:tlxiZTaX9PIzX8PeG7/MgDM6lgpHhldhnyxHxCgdk:tlMcbFD4Azi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785165637, "uuid": "f9a6a08d-260c-495c-ae39-648509e6dde0", "value": 3442008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785165637, "uuid": "38854104-393a-47c3-bcf0-d8437da79b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165637, "uuid": "15b645a8-1a44-4e1a-a476-124c2694f173", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57c8cb4-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154438, "uuid": "a857e1c6-0ddb-4df3-9d47-b205d88eb40a", "comment": "Malware payload", "value": "78fb84d280807080828f9cb7e945357b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154438, "uuid": "eb25fe72-7585-4d6c-b121-2516689305e3", "comment": "Malware payload", "value": "a08e8a8b4bb2209ef056079c5344f680fcfb0ef40716b39a949b89428576a18c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154438, "uuid": "a99cbff8-2320-4053-8cc3-e414745b7ee6", "comment": "Malware payload", "value": "34642ade307c6818a31030c5bfbd7585be838403", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154438, "uuid": "da7fb1cc-022b-4d35-b82c-267d9059523b", "comment": "Malware payload", "value": "b1e02d8002c2d396470d068a6dd77406d83f56e9042760286a048b2c4516742c500426e45dcec14c0403591bcd294ee2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154438, "uuid": "a0bb8a36-2b9a-4187-9c1e-ed2bd23e3fce", "value": "T10121C644C25BC6C5C08791B83CD6BB017523C748912138950F92E1803E4DF8C3B17370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154438, "uuid": "a544fbc8-7c13-49b1-a6f9-8938fed8a5de", "value": "24:9eyu75w8uEBnmi6Z2KCaxhDgjmSHLGHMnJX+DPTy6o7:9DCvuECDCaOPrRnZ+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154438, "uuid": "9d55ba7c-7601-4e94-9827-769bed0f7b58", "value": 1149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154438, "uuid": "afe371b2-8cfd-4190-90f0-d90d5541dcbb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154438, "uuid": "7a16bf9d-5b3a-4c50-af0b-72cbbb452783", "value": "photov_097644227821.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb8ba74-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133034, "uuid": "e9b5365c-bd08-45a9-a0c0-982102adbdae", "comment": "Malware payload (PureRAT)", "value": "63babb6da9cc64912f245418f213ca64", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133034, "uuid": "5bee6d0b-025d-438a-8c8c-413613a9cfa3", "comment": "Malware payload (PureRAT)", "value": "a0e701cd1eb953ab66075aabc5b7c8640d802a3d1280c78fa8e4fc553426f9bb", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133034, "uuid": "70e5bbd1-fd44-4b0b-8246-7f38e69fe9cb", "comment": "Malware payload (PureRAT)", "value": "fbcd6ca7ad3a3e80439ec9fe58d07ce60398190a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133034, "uuid": "c1784794-110a-4e56-884c-71dcf062f1c3", "comment": "Malware payload (PureRAT)", "value": "9806a31cd0674a145d4e8f2ed730a40cf73efffb8459aef6176962010a31ab2a13f2bb2c58c7835a0c4e38c26820cfc5", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133034, "uuid": "aaa7a6aa-33c3-4c69-9e3d-357052a32593", "value": "T16221E5C086230800DC02433B8A19BAF2B63971D10984A13FBF373F58AE3B8C631005E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133034, "uuid": "b2455248-ba49-4fbc-a206-cf9e18487ddc", "value": "24:97N/cy4SKZ0pHK7JtuMvkuL0mSm0bdWqhck3vjCLf:97fvKK6JGPPWCcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133034, "uuid": "3ad96fbb-902a-441f-8737-b87ccab3044d", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133034, "uuid": "c2b17bf6-0123-4166-b967-e08813d50052", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133034, "uuid": "634b0b1e-fc95-4f0b-a712-a91421b2af7a", "value": "photov_095071625598.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c078013-89b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785155201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155201, "uuid": "fe572fa2-b661-4d44-b736-2eec472da522", "comment": "Malware payload (AgentTesla)", "value": "3192b193fdf477d1cbd62ef26157990b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155201, "uuid": "d8b97bc0-0372-4837-9d9a-e9ea1bc14ac0", "comment": "Malware payload (AgentTesla)", "value": "a11eaa903c3ae7abe888ab9800c514d7cd2c445198f018dcc0a0ceafe3c7403a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155201, "uuid": "37b7b6ad-e8ce-4c4a-a51d-5749e70609d9", "comment": "Malware payload (AgentTesla)", "value": "1f5bc6e890d8e98586bb9ea4b68c5cc6d3e1626d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155201, "uuid": "9b70575b-1d01-43e1-906d-9c13e40a4833", "comment": "Malware payload (AgentTesla)", "value": "53a2e3feddd0eed3710ca15e729d17cf831e7afe29fd523223d517e755d3bf028d6f7a2d0923827a0931064de430d2e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155201, "uuid": "b7b9f348-fe69-47d6-bdc2-83be3c89ea94", "value": "T13006E4C1139C88BD7AAC971DDE7BEA50036D21139CC9FF9E30AA89047A45D8753189EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155201, "uuid": "40018596-8bf7-400d-b04b-60ce9239ef5c", "value": "98304:wQ0JgwTXUSOa12gWnrkgNo40DUhsx2aRvopfDqYZSxEnhRe2+BI4lV8lrGqvj:b0Jgw4a12pnju7x2ceDq/SnhRb+OTlr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785155201, "uuid": "be93192b-73e6-4ba8-9788-7e553c56e094", "value": 3958695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785155201, "uuid": "d8e68fcd-ed9f-4445-8999-24b481000b71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155201, "uuid": "64ab455c-bb6d-46b7-b030-147d9b159192", "value": "Architectural_Floor_Plans.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde25aa9-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132629, "uuid": "416b573d-65a9-46bb-8316-1a7f690052ad", "comment": "Malware payload (PureRAT)", "value": "96611980f22107cb8ee74144c945dbf6", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132629, "uuid": "8dfd39b6-1c30-41c2-9005-a0bbb908ebed", "comment": "Malware payload (PureRAT)", "value": "a2e0826bf52900d8908ee471b9eadd84304b2319bb66a31bf1713fae4f4affea", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132629, "uuid": "399513d2-93b5-418a-93e0-c1162ccd64f1", "comment": "Malware payload (PureRAT)", "value": "baebe3862696e4847ad892a3a57ff44b81e7e2aa", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132629, "uuid": "ceb8d2d7-7222-43e1-9367-b351a85ffcb6", "comment": "Malware payload (PureRAT)", "value": "36c480b5de0f27d4a45d493475d8fd878078e51bf7be2f846204e0775e1432076b106e2e3200f60f05afc505be75ec31", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132629, "uuid": "16158153-9188-4f5a-a194-9c4040f15f3d", "value": "T1AA21B4A9C8078507C6DB697B3C767408522D2A37DD90209F6BE6989F22031D30F4AB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132629, "uuid": "410dc26d-5298-4f23-ad42-69406635c215", "value": "24:9tfWpWv5t5lsgZIDVTJbVRgEA8K2OumSBlLuSBmSSDiotY0QfnhpaOP:9tfWpWBPlLmJxjDhPfHBmSSWotYFfhpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132629, "uuid": "45276ca7-2f6b-4e7d-82ad-1e21c88eb5e8", "value": 1289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132629, "uuid": "9b56e3b5-5db8-4ac6-9fee-2e1bffedae3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132629, "uuid": "5ea743e7-34d1-441c-88f4-8e422427a9b3", "value": "photov_501602830992.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b77267-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154135, "uuid": "a9873268-8b18-42bd-a40f-c549e4abee13", "comment": "Malware payload", "value": "bd798b1efc47e11c8f9affb002ccef17", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154135, "uuid": "4bfc1e3d-11c9-4085-8a69-1e2638f8dccf", "comment": "Malware payload", "value": "a2fd66787d58cf79bb0b9f9e82927f1269c992ec01d89bf959df3b9ca5788c17", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154135, "uuid": "aa375d6f-09cc-4d1a-af93-7dd8eacd577b", "comment": "Malware payload", "value": "912c75b316b19fa55d42a112b150eb07277b0313", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154135, "uuid": "bc9a3942-6a60-4264-8e1f-81ad2511bb32", "comment": "Malware payload", "value": "f23a27bd12c621ff941eaf7b14725ed6f5539efcd020db97e0c80ce8ef7d3530fefa3f59043b1a15371d8d790baa9057", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154135, "uuid": "028bf8e2-a259-4f93-a167-8adcaae4002b", "value": "T1EE216352905DA900CD8B86B37AB77519382246986022B0BB26AD2F4A7A53F0B16481AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154135, "uuid": "5abc80d6-7783-4cd2-953f-cb1e00ca7626", "value": "24:9B3ozrGKVXh21fGUMIZ0l0OK87yaw1mmivN+Jl8GM9/1kol2/:9B6GIh21yF7yaZ+E/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154135, "uuid": "b744874e-5e35-4b51-b466-723c212f9497", "value": 1137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154135, "uuid": "d676b5a0-4ee4-49c5-90da-78c4327111b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154135, "uuid": "5af3df2e-66dc-4285-83bb-f06eafeeb0fe", "value": "photov_630534957382.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0d4b2e-89ec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785178256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178256, "uuid": "f6059c7b-43bd-4192-b224-2389084a9118", "comment": "Malware payload (Phorpiex)", "value": "4f7a468bdcf482f08bd014ae52db5299", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178256, "uuid": "f6661876-8796-4687-b520-523419e93403", "comment": "Malware payload (Phorpiex)", "value": "a3b454082dcbf17d64ec6539870404fb7dd99ba49a69f7f4d98b1b31c436c199", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178256, "uuid": "6a9f4a41-dfc5-4d26-918f-69a5a639a327", "comment": "Malware payload (Phorpiex)", "value": "980f07f67302d588946e920dfdabdca3d3a8a05d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178256, "uuid": "78cefa44-428f-44bd-ac7e-f014b5bcbf03", "comment": "Malware payload (Phorpiex)", "value": "4a391a8b43c65111cc43954c0bf5ecf512e771a1954761b09378afa9ee7eb22bcbc1a7345927618c791a8ee0b10063ae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178256, "uuid": "957f4425-53c7-465a-aad4-f2caa66e43cc", "value": "T1A3823B0FB8424316E1E110B4966696BBD9B9AC7633C414EBF7D44AEE0A686C1FC3610F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178256, "uuid": "160271f0-09dc-427f-be60-d6fa56234987", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178256, "uuid": "53927f4b-6dbd-44cb-a057-8621aaac8698", "value": "384:AgZbmcmhzwEUaUu94gXTP+av8U9c+H4P:c5UaF9Ka0U1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785178256, "uuid": "4bf04f0c-5edf-4e6f-99dd-483cae6a03e2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785178256, "uuid": "97267d3b-cd31-4a8e-8f70-c820ea29809e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178256, "uuid": "08b18ee9-f2a0-4ba3-80e3-e634b1c24fc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b330f0d-8a16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785196351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785196351, "uuid": "23b3a666-a454-46a1-8313-3530abed1e94", "comment": "Malware payload", "value": "baa453124334a345c4a906dd4bced099", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785196351, "uuid": "6e0f15cb-1362-43c8-8cc5-5e6963fae64d", "comment": "Malware payload", "value": "a3c889a83799583a0dcbfaa90ad905cafbb0cd3221b54b49cb5fe3ceecec3d34", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785196351, "uuid": "6819ae68-738b-472e-aa7b-8643363b0899", "comment": "Malware payload", "value": "1d367e33e8cf273a56b8ddc493925c64ad7d648f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785196351, "uuid": "2f6fba31-761c-4bc2-8aa7-b0d4ad77b05c", "comment": "Malware payload", "value": "0d3e190edc2bf9d82e3b1a8e88de9cdc8f30fb94280f12c4e85f634c5962974f16b3dbd9d715e485a6d2bffd091fb8a1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785196351, "uuid": "648a5b86-0032-41c8-be49-5eeec18be909", "value": "T116E63309A5C402FBF5B3913C9ED12052D4B7B0630F32CE9B4B9487A59E671A14E3E96B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785196351, "uuid": "3c7f49d4-b950-4d4d-be82-440ac38d2d38", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785196351, "uuid": "89edf624-9231-4be7-8141-02ef4bc2416f", "value": "393216:nVranInkMFwut7BaYObzr0JCN7kHKXMCHWUjXHcuI3/PGTAI:nV+nqkMFwud5Kr08NlXMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785196351, "uuid": "de5c112a-55c7-423e-a00e-85d7a5a1b80a", "value": 14333016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785196351, "uuid": "9d047934-8d36-4ae7-9f4d-24f73dace209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785196351, "uuid": "9be53388-d90d-4e21-9309-01efb1da339f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9f9a0b-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154395, "uuid": "937b5813-5bd3-4b77-85c3-13f5016ed7c9", "comment": "Malware payload", "value": "5ac8f48d4cc7ff3266d276cf787be86f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154395, "uuid": "4288c1f3-c1e0-49f8-9cfc-5c38abaa5a9c", "comment": "Malware payload", "value": "a4fb08502584cef608e7ae33861ae1e28aa8c28929f431c0cc35c5b53f786af5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154395, "uuid": "e82e983c-f923-4c82-aa5e-d241f8eb1f0b", "comment": "Malware payload", "value": "ae1522f0e641d077af5cd816341b6f64ebab4a4f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154395, "uuid": "e0b23d53-9fd9-4719-8348-7c83fd79fd50", "comment": "Malware payload", "value": "cb07a7c06b46f7cd5c8207eacd576fb4ce7cc699e02e4d566854219ef0b46a3a15dd51c1791dc576197464c3bbf7bade", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154395, "uuid": "98fe32ae-02dd-4155-948f-018a550cf436", "value": "T1FC21A3AA60BE8841E50ECAB8345E9B492A4E854C44E4F38762647D0F3C14ECC970FBA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154395, "uuid": "14d951b6-8c5b-4dc7-87cc-4078ade0b99e", "value": "24:9tMUtiX8cji+eZpiZEY0jb3AfNe6pLa7BtqZFIBGVEtfZmSJX4S9SF4jbkUUzt9x:9B9meXi6ZP3AfPa7BtqZygE9ZPJZgFwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154395, "uuid": "aed710cf-fd9e-42bb-8dc7-4e9dca67d714", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154395, "uuid": "3ddf2db9-f4c5-482d-8e60-e3d33fd7dde4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154395, "uuid": "6c57cd3e-8109-49e8-afd7-ffa0a11d21c6", "value": "photov_763028390865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29b3ab7-899f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785145414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145414, "uuid": "4b0e0fbf-7c7b-49db-a3f0-e7e145552e4b", "comment": "Malware payload (Formbook)", "value": "c086246a14362e356f3413615b778079", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145414, "uuid": "7aaa1098-c2d3-4eda-b730-f5135278b441", "comment": "Malware payload (Formbook)", "value": "a511d02211003769575ee9e8a44888c5e11263400a8188033f9892da1b6b6a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145414, "uuid": "dc7da126-30eb-48c0-b6cd-2a84df6ae9ec", "comment": "Malware payload (Formbook)", "value": "7d77f2a106b3229587143cc962eaa2f36b288f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785145414, "uuid": "24dfde8e-cdfb-4367-8162-9ec7ec11ef62", "comment": "Malware payload (Formbook)", "value": "1bd0d117f50a0de291733b960a00ab201cf56ae944aadaad8968411ac0b0dbf9dee8f8c7050f7859aae248967c3ba904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145414, "uuid": "ca9119d0-d911-4482-9497-e715f0f7d2c5", "value": "T1EE65D02B2D13A536D7716EBF0C60E0B517686C56A5E4E1063EDEFDAB7C3AE013904352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145414, "uuid": "2d7361f4-26bc-4569-aa7f-2ae0423c968d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145414, "uuid": "98e53d4d-1a45-4d4b-a756-a8e50a682461", "value": "24576:3oULR4THPSnhaN7LUNaQWfDlFFcMi7SxjTPgZzVj5CMqLF7PjE14Xkv:3oULRiH6gyopfDNcMi7cPyj5CPRjE14U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785145414, "uuid": "ec8907bd-dbcc-4358-911e-a7241d7dc91d", "value": 1444864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785145414, "uuid": "e0a3ed7a-16c6-4991-a5c5-bcec464ca963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785145414, "uuid": "fdb45c3c-f499-448d-ac21-a785d91f9071", "value": "SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21703d4d-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167961, "uuid": "45ea70e7-9e92-4f0a-b9ef-dc46faedd64b", "comment": "Malware payload (CoinMiner)", "value": "2fbcd4381ac48c47b9ab98d0b380ed77", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167961, "uuid": "47d1d269-7d03-4c67-944c-bdc3973b04f0", "comment": "Malware payload (CoinMiner)", "value": "a516213a66bbab81d9d90526a7cd9f9179499b1f625c44a4b94cb96058120360", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167961, "uuid": "f81b57f3-e451-4723-947a-f78bb669ee4a", "comment": "Malware payload (CoinMiner)", "value": "8256d9b9fb81960e523990c1cf7d7daeda116963", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167961, "uuid": "53a706be-eef0-463a-bee8-0a75bc688f34", "comment": "Malware payload (CoinMiner)", "value": "82047685e293ef8b32404ddc7fe8561af2e1f835a0538282bae09500bbe6d90b5d34b1bd8822ab5e650287a665e653b1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167961, "uuid": "7cd0280f-5798-4aaf-866c-5f270d4a62d6", "value": "T1EA368D88E793E0F0E65308F0559BDAF7A1301A355053F6F2EB8A6B65B4337416F0936A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167961, "uuid": "11bb9b74-be83-49cd-ae52-9edf20027de0", "value": "98304:d3DPs8XPcr8tke04Xi2YT5ZYq4eTfP05Taj0QOtmADjSnaFfQF4:VDPsroy4/qJw5Rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167961, "uuid": "1bab5d78-4a5e-43b4-83b6-61cb80dcd6f2", "value": 5107292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167961, "uuid": "b2f1e07f-e17a-4c1f-95f2-5fc06c2f96a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167961, "uuid": "c8b64191-0fae-409e-8ec1-a2c22c5ec164", "value": "cbd57b480505947bde04f95df8639eddfdfde609b23ba4669b7cdee6ffa77d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed76e89-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133006, "uuid": "acc916e2-8657-4068-9c7d-a1845db49a02", "comment": "Malware payload (PureRAT)", "value": "d66564536ed8b75303cae8e6734155a6", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133006, "uuid": "b18d813f-89ec-4411-a90e-bccc6b1b03d9", "comment": "Malware payload (PureRAT)", "value": "a593671a6b004910acba9a307285b5c13281be56990a2d75b65ce563f971ec30", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133006, "uuid": "5abd834a-c43d-4882-bcb6-719ee13a6ca1", "comment": "Malware payload (PureRAT)", "value": "7b571da5df4ca8ebf4597a836613d58064914353", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133006, "uuid": "efd4fbf9-d7ee-4d59-a40d-576c69b44346", "comment": "Malware payload (PureRAT)", "value": "6cc158401db1d22fe9852438420bca86585506d2b713ab464f219e2e4a5465361e802894e1d00f954946c24d9e96baa3", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133006, "uuid": "0fc35917-23ef-442e-9940-d60904748932", "value": "T1D521C68882448674CA6AF73D3CD73B1581A34D61E5AF830B0E0125FE4A5A348AF8CFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133006, "uuid": "0b21eac8-1a3f-45f4-ae0b-6615e49c57f1", "value": "24:9AkRzpoTEFYcyVuICOtmq4sAuymGRCZmSjbFWyHwTxS5pj:9AkRzpoCYcyVFC3sAuy5CZPAEsSXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133006, "uuid": "d7c7f85a-b4ab-4a1a-bcd0-7b29f57ac5d2", "value": 1143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133006, "uuid": "f769bfa9-2d7a-43d6-b2d4-4161d4424b9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133006, "uuid": "6832219d-5b2d-44b3-b439-46f65ab5252f", "value": "photov_821558564324.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8667669b-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154386, "uuid": "65b052b5-206f-4f26-9254-fe8d0bd8fae1", "comment": "Malware payload", "value": "5a991dc41cc781abdf4e43e7ed7ddd38", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154386, "uuid": "4b38043f-ad84-4499-ae83-f48445115110", "comment": "Malware payload", "value": "a676d96a6cd9ba873d84bbcbf8b8defea62987ec83b4258ee6305d9f5ca1e442", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154386, "uuid": "cdb04c3d-f9a9-4ff1-bbbe-7cd36930dee5", "comment": "Malware payload", "value": "3e025e6f7483e10cb193ecf81cb08dfa7a6d8f17", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154386, "uuid": "a283c16d-e1d1-4ec7-ae2e-5a86e78b72f6", "comment": "Malware payload", "value": "82d6af513ba8a80580c0621bacb5542c76fabc628f644a14f513193806a8f3f3f3587f91d26293a3eceee22cabece9d0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154386, "uuid": "09019839-6258-46f5-88e2-bc6a52fa9f9a", "value": "T12E210A8CC6FADF24D702097B628C9D60ED73C06012053A811F38FA9EA27CE6EC271497", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154386, "uuid": "e4d566e5-13e4-40cc-8932-72bdca8de5ce", "value": "24:9g0/GVrIGaLzGDcahJyM9nJUFKPLxl7Jex4Wo5uZmSfl4J0HZ/xNW9UZ8rj2xA0N:9M1uzdyJUFKZJ4PlHV+yL1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154386, "uuid": "8091902a-89ee-472c-a37a-a6e5a35e6d8a", "value": 1265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154386, "uuid": "d6a735da-5823-47da-84b3-fbfc0b7557b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154386, "uuid": "7d2c959b-c289-4422-a2fd-47d62fc4aa58", "value": "photov_199100271286.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa5429d-8998-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785142421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142421, "uuid": "de6dcb76-aca0-4982-b32e-e072f80c9df8", "comment": "Malware payload (RemcosRAT)", "value": "20dedc559da86ea5aad5fa2d2b70bebb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142421, "uuid": "696fde27-fbac-4c52-bd1c-baa2589b0982", "comment": "Malware payload (RemcosRAT)", "value": "a6e9e0350c8c4b7103fe3cae27ee9214cf06681b52ada319c10fddc9efefba6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142421, "uuid": "ba28d0bf-b4d8-448b-9298-a1f6b852ab13", "comment": "Malware payload (RemcosRAT)", "value": "c77ab2bf118c91387d98d1dea7a8a552539bf72a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142421, "uuid": "308037bc-c71a-472a-b33f-7f94b9d78b19", "comment": "Malware payload (RemcosRAT)", "value": "cc2bd362d0ce3b2d8dedbf797fb1508445d6850810e62fff807630f1f1b41cdffdada410cac15af4cbc819bf7e32ce94", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142421, "uuid": "5ffb2d59-e27f-4aee-aa7c-347a1f30dbdf", "value": "T18455AF229B3D0F2FBFD62D624A6543851CF3942500FDE4CEA738BE821FF0D5699A1865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142421, "uuid": "a2b88607-9aa1-45e9-9500-9bcf858b2092", "value": "24576:tIctSrblbzNegXFHhs1WESc5L3B6zzo/fdTXFAJdnt0YTBHDPW8O9M+UxEYByK+M:tEugPsZSuB6odYFBHDNOYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785142421, "uuid": "b943b5e4-3709-4823-8bba-68143d518255", "value": 1306135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785142421, "uuid": "1f1612cb-1e53-4c6c-83c7-10fe7141fd51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142421, "uuid": "ef0315a7-4b39-46ba-a2bb-624468d52474", "value": "DRAWING.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8770412c-89df-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785172856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172856, "uuid": "48c16941-0ba2-4539-b727-51cc82b28dc0", "comment": "Malware payload", "value": "cf627b35bb65f894db5ad5b3709f9c02", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172856, "uuid": "508dbd7a-6e52-43db-8fb9-d02c5b3d1c8c", "comment": "Malware payload", "value": "a76023455d33b03b07f2e583ac99fa188ddcbef5b697776b01c434e13889bd12", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172856, "uuid": "af1dd4d3-6894-4fd7-ade0-bbefb138d716", "comment": "Malware payload", "value": "a04692696e6c974bd06c29665f6875f94b82e1f1", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785172856, "uuid": "09bada80-d36d-45ef-aff1-4cfb23fc1673", "comment": "Malware payload", "value": "52292887938c57504634da454f8c87b90bb865c751003c74163ca919bc58d0a0b22075e67d235d147f06dbc7efd86612", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172856, "uuid": "2d056f1f-f824-47a4-8198-afe48cbd8d28", "value": "T1FF66E018F9625EE7C169523048BB4A916735CC98BE72570B2290F77FBEF33418E13A85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172856, "uuid": "a318d090-ac88-4a62-997e-c404aab52f54", "value": "fb2ac02f8323711d4055ffd4e5e30d36", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172856, "uuid": "394bbf16-d121-40fb-8c2f-eed835a7081d", "value": "98304:oGrvQKmmfYeUBIdNuL8eWV+j5zLW1GYE0iBy+CYemEJmenCOrlF:ymf5UK7BeW+jkey+CPmEJmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785172856, "uuid": "b45693fc-fb36-4970-a8fd-01e11823b12e", "value": 6976512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785172856, "uuid": "b00cdc54-f4e0-465f-9fd1-4d136ce6ef85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785172856, "uuid": "2a11e4af-e8ca-4be9-a7fe-f8cc4adb85c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffc0865-89ed-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785178857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178857, "uuid": "cd7c8ae6-b0c0-472c-8e4a-b540883780f3", "comment": "Malware payload (SalatStealer)", "value": "f27c7e9e44efa74a367eff0200584d01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178857, "uuid": "c6a295ff-61a7-45ef-a055-66ec05f6a229", "comment": "Malware payload (SalatStealer)", "value": "a7c07b87c4968d7ac8120e2c6fb40ccd615d1bd25d4445fbe129d7c66235740a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178857, "uuid": "e0621c5d-3833-442a-82b1-14ccbcd18253", "comment": "Malware payload (SalatStealer)", "value": "26539d95c0c1a9b872469dab1e0d09ca54df9207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178857, "uuid": "12939418-c922-4041-863b-efa1a6a85782", "comment": "Malware payload (SalatStealer)", "value": "e0bc547423ddc36bfb5f096392bc3034486e67313b12f5f235d5320205475423abdb00759f0c7b70cad4f3102aaa74d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178857, "uuid": "b741cf96-d099-4b68-9e22-00dac755087c", "value": "T141F5336246235077F63BF734C4779D2F2A958A38D8225CE14961BFABF2A011CDE5E0E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178857, "uuid": "89b72be0-cddc-4fa2-ab36-e4007fdbf44d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178857, "uuid": "dd5c5793-12c8-4902-a7e1-2c63cb0ff6f4", "value": "98304:uXtvcLii7Y7Ex+QEM3pZzuh6VWJmk/A10sq:uXlcv7Y7BQEM3Tuh6VWJla0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785178857, "uuid": "045b6949-088a-4965-818d-1c8584c4a907", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785178857, "uuid": "1284a0ab-f0a3-4d0f-a570-9503a3815f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178857, "uuid": "90873912-1200-45ff-b3c9-eed273c36e88", "value": "DiscordMirror.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f65ee3d-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143234, "uuid": "6dd92bdd-ee8a-425d-85ee-7849a87e3840", "comment": "Malware payload", "value": "b4b465ca215a1cbe44aecfd1859339d9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143234, "uuid": "f6eef1a8-f2c3-4810-b7b8-7c3db6baa856", "comment": "Malware payload", "value": "a850d0bc39f9aa426301d8cebc50be97b6d72aaaac9b2076f9e01f597544b31f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143234, "uuid": "46d26189-646e-44cc-b48f-ecbed8f298eb", "comment": "Malware payload", "value": "f8f68b962b59caf0f4bee250e95a918981b95f22", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143234, "uuid": "1e78b282-6ddf-4558-904d-f7eed2add8e1", "comment": "Malware payload", "value": "828a288edf2485a554f639a35b23f427e849c0d1e8ef58c0dda6d3f63744bd153213d816a9ab89f5d1d24e928c0fb02a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143234, "uuid": "64aab3f1-348a-4be4-8f48-ff41c01ca949", "value": "T1CD2184DDC9C8C1B3C85FA270BA3B41A39508BA93120C347195EE32EA3AD1FC933124A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143234, "uuid": "46502f92-c5c4-4fac-8e6f-e2c1bb15a791", "value": "24:9R4Mg6cG/sd1db6ZTw0VRL+h4qMqmjKSc0wzm+CHGQy7RlA+0wz:9R4ML//s7MZTwYF+h4qMq6clx13N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143234, "uuid": "c3579cd8-bea6-4f27-8058-8712aaab1b19", "value": 1272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143234, "uuid": "3277f28f-1da6-4985-a43d-08eee6cfd463", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143234, "uuid": "52668400-24fe-4ae2-b8e1-94b111cc428f", "value": "photov_010423699475.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2008b964-89ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785165381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165381, "uuid": "dad42a6d-f4bd-4b0d-8852-6ce30d55c716", "comment": "Malware payload", "value": "e47a56b531f1c5cacd2bf0292ebb4a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165381, "uuid": "52818ec1-e6be-435d-884a-84eb3876188f", "comment": "Malware payload", "value": "a8be5efa1d932d3b04cec3267a120aef0b1cd4697aa838c29c29ec7afecbc424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165381, "uuid": "67210467-a60a-4dba-8463-e2f534041281", "comment": "Malware payload", "value": "3a03ecc8db62cb83832abe5bfb24d7542f80df9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165381, "uuid": "76ed59db-6b99-462b-9a68-43a722255035", "comment": "Malware payload", "value": "0a0cced7a023d3e661199b8de8bfda831bb0d3417a2253cfe1f6c31860817560bb9e6ddaad4af1f289c5e93c471ff5a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165381, "uuid": "cf09c974-fff0-43dc-aa82-3c1327ec1a84", "value": "T103F58C43BDA159F2D09EA33188A256527A71BC085B3673D32E90B7382F73BD16D78B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165381, "uuid": "13604c06-ad1b-4d9c-b5e4-2e06659d0463", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165381, "uuid": "4897d9df-a6a0-4220-bd92-a37080452f81", "value": "49152:FGUamZmgjD3cVyf5c6wJkR76ToT1vAgthC/PF:FGneb76m5fE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785165381, "uuid": "51fe8fc7-2537-4698-b18a-781ecd19369c", "value": 3446112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785165381, "uuid": "79b602d0-8b65-4469-91fe-66b687066145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165381, "uuid": "58025718-e337-417e-bfe6-6cb53aff3de3", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b655999-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167709, "uuid": "dff63a5b-199b-468b-8273-e3a890ed15ea", "comment": "Malware payload", "value": "69a601211a45855e4c407aaba243d848", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167709, "uuid": "1f7c53c4-0363-4c98-be20-7c4c408b86ac", "comment": "Malware payload", "value": "a8bf9a1f5ec1502b8f391c49f533d336e05f39f3a20e5fa1dafd796bceadf48d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167709, "uuid": "f4128547-eb61-4d44-b4fe-3bcd295474f4", "comment": "Malware payload", "value": "f087679f7d0a5b3fd55f9a9fd5df4a44d1d20221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167709, "uuid": "435addcf-024d-4558-abdb-c9de9b625ff7", "comment": "Malware payload", "value": "7926d9175af2e937f803b1c3572b3b2747b73c6491caca2095355fd5fdd39f6eb9231dcfbef99d798dda57124e04b581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167709, "uuid": "df56faa4-df3c-46e8-9a72-543338e0eb40", "value": "T195E5F857F49550E4C0EEE174C726A223BEA13499073437E36FA19AF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167709, "uuid": "33a61f94-266d-4186-a3db-1e4c2cb24b22", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQg:cqYUQuVDt0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167709, "uuid": "7781ffe3-916d-437f-92fe-3d8b99a5c809", "value": 3047424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167709, "uuid": "c50c7659-d650-478d-9769-4d6b8edb3c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167709, "uuid": "720a7f5c-b5b0-44e2-80be-4172ecfe667b", "value": "a8bf9a1f5ec1502b8f391c49f533d336e05f39f3a20e5fa1dafd796bceadf48d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa69ad15-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154151, "uuid": "aaa412dd-bc75-449a-ad88-3fa13e451a88", "comment": "Malware payload", "value": "559c9ca93850a195377f1d6c99f9e15d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154151, "uuid": "a5f3a6af-d0e1-4001-960b-25829fa75d09", "comment": "Malware payload", "value": "a8d493f5ea1bf425df6223bbf8ad21816c6576ba57052c7b5e80c6a178249bd2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154151, "uuid": "d207115c-3dfe-47c4-a1a5-a5b620fef808", "comment": "Malware payload", "value": "54f4dcdd091614f0da77d2150cc01daaef87d267", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154151, "uuid": "4fb648ad-5db6-40be-89a6-1c16577469ac", "comment": "Malware payload", "value": "b9638248baebd1de5fb86e5e17b6ba2869cd514cbf7401f2eaecdf18e8045b3b45727f4f32a899a9f8b61df91dce6061", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154151, "uuid": "570f2d96-442e-443f-a4c5-56cd944fe72f", "value": "T13C21C8B3999CCC41D29743BE2960DE4E77DA8094312210E757A59AAD392FFDC8F84944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154151, "uuid": "78e99424-58af-47b9-af3e-ed71f4430c3f", "value": "24:9cDuJ/vmHJmNufw/YtIbuXKyZ1fujgvZV4P+DkvSmmSzRs++hGY7mSaZ/9cfcjcR:9yI/vmLwoISKyZZKPJvvPzRaGY7yZ1cz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154151, "uuid": "982d4ec9-a629-4af6-af23-4a3eb7d56888", "value": 1335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154151, "uuid": "e59179be-fc5e-45e1-8336-1b550abac849", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154151, "uuid": "a5702f67-082e-463d-8162-26982d5eb9e1", "value": "photov_188029018908.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fddb0ee-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132766, "uuid": "1616bed6-5241-4710-94f1-b239ca851d4a", "comment": "Malware payload (PureRAT)", "value": "85d395e573ceb2df60dee84013117acc", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132766, "uuid": "b314c9d6-b757-4a74-96d3-9dcaa026fd24", "comment": "Malware payload (PureRAT)", "value": "a8f662d495b96424bbfdf210de257faf3eae7ff57a843af544c471f65180e57d", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132766, "uuid": "f35ac7b6-fcaf-4212-ac8d-b9717c835faa", "comment": "Malware payload (PureRAT)", "value": "75bcbd1d3b7becd462b552e27f5fb1277302d665", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132766, "uuid": "288c1c9c-45fe-4547-a8ee-c70469682a09", "comment": "Malware payload (PureRAT)", "value": "acb2b32788c793f240421a3da298ea733b151326fd738292f4e898b807278efc3da2017b0d9d90ee752930a5524ff44c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132766, "uuid": "bad33188-8e26-44b5-ad93-31a66ff9b52d", "value": "T18721B7450245FD53DA0A5EB9BFBAC99CDC644891DD1FEEC3230CBEE118E97445B08510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132766, "uuid": "79bcd2e7-7c8d-4ab8-adf3-bd38afb614ce", "value": "24:9z6kO0g5W0ttx3wnq6aPZgBgImSPfYOH9ookySz7:9z6kjg5Wo7wwSPPnY1oVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132766, "uuid": "3d8fcf5a-f553-4d58-a682-c0bfae8018cd", "value": 1233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132766, "uuid": "8d874b03-be48-4b60-93bc-92e6a6372dba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132766, "uuid": "5b9e472a-5050-45f7-b5da-c137a793de80", "value": "photov_944438987082.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8887a5f-89f0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785180348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180348, "uuid": "26bf040a-e8b6-4624-895a-5b3cb835841f", "comment": "Malware payload", "value": "a19f7ba96dd2609e73e0f5fd0791e4b6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180348, "uuid": "2d762039-f1ce-4624-90fa-c125ee59f801", "comment": "Malware payload", "value": "a94e2c99cd8aaed4124fb4301b71dc97d480bf47135d4d7f45057f2c05487b0e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180348, "uuid": "430c970e-52ab-44aa-a050-1dd5c6235dc7", "comment": "Malware payload", "value": "c23d60a72c13d435bbfbc428531f89a223024053", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180348, "uuid": "8caded88-404c-40c6-a4e8-b616b41d1dba", "comment": "Malware payload", "value": "b33eacd6aa7a4bc87e3e15c0cb5496abf3b25a15770b08024032a770cebf0bb0068af9c2094bfa743707cb1deb085012", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180348, "uuid": "e490b05b-2903-43dc-b69a-9a6d00858163", "value": "T1DC068D17E2A350ECC12BC17D4657A772A530B868C534FE7F5A90DB312E31E50AB6EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180348, "uuid": "841656bb-0a42-47e9-a095-270a98073798", "value": "5c3286c62c72665c03eacc8a3e846110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180348, "uuid": "6c6b7fc6-db57-4a47-82cc-91eb31fa4a50", "value": "98304:RBJzPZwQwRYTkDTysBKwbCHm8bILHGWCv5IjjPmg9:RvvpYTysBeegv5IjjPmg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180348, "uuid": "8a0faece-1f67-4bd6-a949-82724149f28e", "value": 3881984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180348, "uuid": "c42d70d7-e17e-4ebb-82f1-90fe93aab58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180348, "uuid": "59092ff0-10ba-4e50-8142-a1d9af16fd86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa27d05-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158098, "uuid": "00536cbd-1d94-4de9-a612-9518f9d93d39", "comment": "Malware payload", "value": "b3ae68fb93fca636b7b7b94b259bbb5a", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158098, "uuid": "10d26458-22ed-46b4-bcbf-4ed916333ea3", "comment": "Malware payload", "value": "a9bc8ccffb59006e917092ef0a8d72e6b2c6e29c7d2839dfea219f9a510405b6", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158098, "uuid": "622e20d9-e818-45ac-9c1f-0902ed5b8ca0", "comment": "Malware payload", "value": "4add82acccdca59dbb9470fd62e668e98f1a15ae", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158098, "uuid": "adb17a69-e472-4a78-9822-83d51b92845d", "comment": "Malware payload", "value": "33f9f4e26feaaeaf47ee23b30da9fc9f1276ffbd912b8b6c0b249c0cc5b13e5baa1a759fff06a8458813b7f19ecbca36", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158098, "uuid": "8c91b5ae-5c91-4756-8d28-cb28ec06a4ba", "value": "T125571870925C6067D1A78430FAC5CEF764AD303F5236191E1BC5D81A25FAE60ABED3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158098, "uuid": "1a0560b0-6070-48b0-8c88-9f84120bf24b", "value": "2b0b6823fb027698237d978e7f84f945", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158098, "uuid": "0bfae743-b562-4bd6-bd51-01e72465c79e", "value": "49152:kfBTUsC0xPxhTeD6uI/nFJj1wAGHR/J4+0c2LlloTKAgqjwOk1MzimYlVS:I1CCA0RgjgcaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158098, "uuid": "8c2169d6-afdf-4f42-99c4-e347b2689c39", "value": 28619776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158098, "uuid": "1b546c34-b175-4a72-b6f8-b4eae29dfc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158098, "uuid": "cc3aab0d-9fd8-4e76-83b3-e635643f50a2", "value": "a9bc8ccffb59006e917092ef0a8d72e6b2c6e29c7d2839dfea219f9a510405b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db871b9-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167713, "uuid": "446f6bef-126a-4216-a9b7-d4257e474be9", "comment": "Malware payload (Prometei)", "value": "67761ad2baae45e1929d91fe9835b477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167713, "uuid": "11599d3e-5d28-4b88-8c06-13b93eb64175", "comment": "Malware payload (Prometei)", "value": "aa1af69f17799d694f2f8b233644d9bfcd904149978d2040c5871b22ec179d9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167713, "uuid": "d5c53572-db44-46af-9617-344c4d1a092a", "comment": "Malware payload (Prometei)", "value": "f45940f1d84bb2dc7577e46adeab8b0c5e5b7910", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167713, "uuid": "fea8f6d1-5dcb-4082-8be2-a2355dee4f73", "comment": "Malware payload (Prometei)", "value": "b91324323370e4806e6ab21b6362a57f26aa501ea6705d2858019781256a37728ab2235e2f603df7f3649e2f72601fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167713, "uuid": "e90368e0-730d-4c50-af6f-616d6dba0a86", "value": "T1BBA423B4F9219E9F6DD76DB91B24831DE182C172689D4C1313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167713, "uuid": "74745df0-9550-4784-9e7a-c68862f14484", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdp:Fs6pyCC/Ya2hpi6T6N4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167713, "uuid": "4721b1d5-ae07-41c1-ad05-67cd082b390e", "value": 449082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167713, "uuid": "8ea96ab3-092c-4599-afe3-6d86f1df8f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167713, "uuid": "07c5eebe-138e-4ee7-9400-cc96b2b1ae64", "value": "aa1af69f17799d694f2f8b233644d9bfcd904149978d2040c5871b22ec179d9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578030a0-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154308, "uuid": "2e29fd93-41fd-42ba-9a20-2cdc35e2e7a2", "comment": "Malware payload", "value": "b56cdb4de864ca04c1e62e311cdf0921", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154308, "uuid": "218b74d8-44ce-4790-836d-9552a5cd3711", "comment": "Malware payload", "value": "aa554791dce9a6ccda13dbd3af97e167e03a4e1b34c3a83baaac5627e35de26b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154308, "uuid": "3d8ef009-cec5-443d-99e7-70d1fe489010", "comment": "Malware payload", "value": "e523e61395679fc4d8990d639852903627df1feb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154308, "uuid": "7f50904b-c676-438a-9b03-c582799b3ab5", "comment": "Malware payload", "value": "73eb77723d73000aea4a52ed8954f6ead01ec80f2bd1358b859408f9a80d5d6dae23045d762b5443b4208321132cf13d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154308, "uuid": "28e6ce77-054b-4025-8a57-0b718a283043", "value": "T11E21A763C6EDC902E64FEDF5B82E950223B56D6C18115E63CCD5B2913F358EC1741990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154308, "uuid": "2fc8171f-3c76-40e6-94b0-e3fdcc43b0f0", "value": "24:9DBjPVUw0bjqhfLDZ0X/qRKn2SOJjmSrJym5ybMHZINBU/V58iaaeF:9Dfv0bjq1L10io1OjPr7IXU/VTeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154308, "uuid": "649d31f8-3d6a-43d2-b6b5-0231806c0913", "value": 1214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154308, "uuid": "d90e123b-acf3-4b24-855e-f06b4985f1cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154308, "uuid": "833379e3-47da-42a4-b7d3-b418e8e793f0", "value": "photov_556068467832.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cb4f4e-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154273, "uuid": "3b0167ef-a8e6-4134-8c26-6774ddc948b3", "comment": "Malware payload", "value": "3fe9658e6fb6f877c5783fd608eb4b6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154273, "uuid": "2acf16f7-84c6-40ee-9fc5-c6030d4432b8", "comment": "Malware payload", "value": "aac9fc9f690515a6aafe794f408fae74591575c50ff42fa472c497a584e45c72", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154273, "uuid": "68dbd872-3efb-4700-8600-327f7ee58d6d", "comment": "Malware payload", "value": "fabb6122c7a21c8f14962eba2452bf18091f3347", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154273, "uuid": "09f4a242-6690-4396-b234-561a518796d1", "comment": "Malware payload", "value": "4bf0ce33ee195cdcd358ee20d963b063f0d927177f4ef55045c5f814d84efdd18015ec357513d718f664f952e3ad4b2d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154273, "uuid": "6c5b1f43-7522-4bb1-b5b3-594a15e17f4e", "value": "T14F21CAD08CD95AC1FA077D318400BF84E61BA7050657E3921201649CF5AFD941B19698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154273, "uuid": "1d46e2fa-cf16-421c-a102-e8fc13e69195", "value": "24:9mIisNzj0Jkfk3AkAyQe94KPHgmSM3B4JslGaGB9tKhHO:9t9NzoJyfX+APM3j7GZAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154273, "uuid": "8482221f-98d4-4648-b771-983f591454ad", "value": 1171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154273, "uuid": "5bb20f3c-49be-4008-b470-bc807059f4bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154273, "uuid": "68dbc5e5-83c5-41a7-94b6-9ce428995cdd", "value": "photov_036353162133.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab8da37-89e9-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785177210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177210, "uuid": "4a441580-a4f5-4140-ada8-9c43bf6c9f50", "comment": "Malware payload (SalatStealer)", "value": "cffac6c24519fd656a99ddfe63611a27", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177210, "uuid": "5d23128e-55d4-4933-a0c6-3f6517a5e850", "comment": "Malware payload (SalatStealer)", "value": "ab4394c429efc69b6927a5eb6ecfe7e2cc3df99dd2d279f96729d72a8283e85f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177210, "uuid": "ccfe607c-6f3f-4b1d-9f2a-95110bb6d91d", "comment": "Malware payload (SalatStealer)", "value": "21a14766846449b8f7b65b2b680b936e87320385", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785177210, "uuid": "61a31678-9460-4def-89fc-1c7d2972d1e4", "comment": "Malware payload (SalatStealer)", "value": "b8cf94a32e9789f2472520a7adc96ddba2fd2fb467f8e23579def248871856599fa75a04fc7cd0b4e56004698c03da8c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX2.file", "colour": "#C8C562", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177210, "uuid": "ad569ec7-afc2-4dd8-bdbe-be4eb1febf07", "value": "T1F5C6BE03EC6515E9C1ADD63189639262BB717C885B3123D72B90F2252F77BD0BEBA344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177210, "uuid": "f4562d12-4a05-490e-9cfb-38f97293004f", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177210, "uuid": "0ef098c9-b50a-4b5d-9e19-b42d6be8d2f3", "value": "196608:LJby2bfcDO0vqQjOCeQ/K6l6vaSCE5/i7/s:LlhfmO0ChY/FFzE5/i7/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785177210, "uuid": "f08bc0ca-4926-4032-8a38-50c8f8507494", "value": 11812352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785177210, "uuid": "c67cc3b8-03bc-4f57-b66d-00bd93dfca57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785177210, "uuid": "9155f75e-ef08-49f5-a324-757c558661b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c60c813-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785135069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135069, "uuid": "d37137d5-2f1d-4bd0-93f6-ea37d00f481f", "comment": "Malware payload", "value": "80192bdbe56fa8c2b4ee66613aa30149", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135069, "uuid": "25eab19e-fa0a-4bb8-85d4-aa1e96ac1f81", "comment": "Malware payload", "value": "ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135069, "uuid": "b256db34-1430-4389-91ac-3c50723f2b2c", "comment": "Malware payload", "value": "49b8f904994b452f3f1bf9936cc12696539dad1a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135069, "uuid": "17d73abe-ffd0-4b07-aba6-bf66151df2f8", "comment": "Malware payload", "value": "c4a3719c74e830323ef0467d9c134ffafcb42c5e7e48667193b560d1dc836365b278d2effd974a56c230f0119034d00e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135069, "uuid": "a8396066-e037-40dc-97f6-74035960d1f4", "value": "T148C27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135069, "uuid": "7b6f7163-f91c-418d-82c2-cfd1912c7651", "value": "768:6k8vCB+25j6es8R2l9FYpMSUpi+20qUpi+20YQX:z8l25JMd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135069, "uuid": "fd421c4b-2fb1-45e6-90ff-a965e58fa802", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135069, "uuid": "f4e7cb01-bfbe-46a7-8230-d536e88759c4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135069, "uuid": "b8d3a590-1a6c-4e95-b7bf-204d01ae6c31", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c90b274-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143471, "uuid": "09d9a4d7-c0ef-4bf6-851c-c181bdfe1a2d", "comment": "Malware payload", "value": "99ab1b572ec8fdc79d7b432c8d15b5e3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143471, "uuid": "fa548d26-b02a-4c54-ac08-8d32aaa45835", "comment": "Malware payload", "value": "abe58173e4e6f99297f8f031252eeabc2af18d795dcaa4e8c826265a691306a9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143471, "uuid": "42233f98-d797-4e36-9d14-717000581df6", "comment": "Malware payload", "value": "08a5b7c5a91e1f416edf86bb90719201c2b428be", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143471, "uuid": "96ac2523-8cf6-46ca-b932-5583880062c5", "comment": "Malware payload", "value": "665b95261641920eac8740b4175b1773a2370de6fb26b426e9a3ba37b5588b777f67c6714b4b89d5a5ea6e86f417d219", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143471, "uuid": "a83a09ca-979b-452b-8937-71e8548f3def", "value": "T1CF2166D968C61A67E9DB66373E826235BE86617E26B08171861531837515C800B4C9DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143471, "uuid": "77d00b53-a8ee-4252-a051-fb4ab6bc4512", "value": "24:9LoQ2e8urxGb9OCUZJCnBWtbwU2dEVE6kmSegi+gWq/R3QM:9LopylGxtUJOjtGV3kPe5+gW+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143471, "uuid": "eb9e8851-1f81-4eb4-9b2a-a91f00d20c28", "value": 1149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143471, "uuid": "2e52b02a-4622-4e07-bde7-b5e526b8ca3a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143471, "uuid": "08090842-4a66-4ff1-aa69-176ac860fbdf", "value": "photov_925905291378.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671399cf-89a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785147462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147462, "uuid": "8fd663b7-db66-47a8-b13a-95a6e9d8159e", "comment": "Malware payload", "value": "1b1a2aff188fdeb4d802ee4e19eb1482", "object_relation": "md5", "Tag": [ { "name": "pw-cs2hack", "colour": "#1A6E55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147462, "uuid": "63fc4224-b247-4a16-9669-0d4dd1a5319f", "comment": "Malware payload", "value": "ac61fb58ab1dab86a3ea965d3333a1f190df9e53d63ae4620eedec753d346d0d", "object_relation": "sha256", "Tag": [ { "name": "pw-cs2hack", "colour": "#1A6E55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147462, "uuid": "95cdcace-c957-4bbe-81b6-592d7e4dd1ce", "comment": "Malware payload", "value": "cf119a73326614fc12c278f05bb327fa7643a20f", "object_relation": "sha1", "Tag": [ { "name": "pw-cs2hack", "colour": "#1A6E55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147462, "uuid": "032c47b6-1079-4887-ac78-408a04db7f21", "comment": "Malware payload", "value": "04269e5a69c89c773238b5c3c01511753ecba2799e965ead4548d053e1c4f4dacc311a757cced352de92c5b5f89915c5", "object_relation": "sha3-384", "Tag": [ { "name": "pw-cs2hack", "colour": "#1A6E55", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147462, "uuid": "1f1b30f1-6553-4d11-85d9-80c9e21fc7b6", "value": "T189F7337ADDACB62DE808FF7C648C40A69DB091E6C4B69BF9DBF83B06047C54505D224B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147462, "uuid": "e8ce2ea5-422d-4483-844f-f9f4e4929deb", "value": "1572864:sKldniWk3qcLIG0q/6UhW/9fzyTdRICqxzBv9J1SN+I84oi4q:s2iPqcLIGz/6UhWfzOizJn1Sloi4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147462, "uuid": "342ae1d8-5011-423b-9439-5456dd6da143", "value": 75504893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147462, "uuid": "9f9ce0cc-88be-4310-883b-b4e885dc112e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147462, "uuid": "c03c8088-ff11-4952-b0a4-92edd453f6bc", "value": "Cs2Hack.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4921b4-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132757, "uuid": "140f1c9a-a365-46a2-89d3-47c94507655a", "comment": "Malware payload (PureRAT)", "value": "5c353ae73fd9526a9810116f37dad97c", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132757, "uuid": "9d8651ca-ac7c-4daa-93e7-aefc341a4841", "comment": "Malware payload (PureRAT)", "value": "ac8c6da8b99c9b57568ced3a3f0ab31ff5519680a374ba928451e05ccf4e92fa", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132757, "uuid": "5ab05850-a013-46d4-9fe3-89d8978cdcfb", "comment": "Malware payload (PureRAT)", "value": "c7346a5b5c9368c88c2bef3c0e5daf50cc166a7a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132757, "uuid": "59f8d364-98d4-4f18-bcdd-07cbeeb3ed85", "comment": "Malware payload (PureRAT)", "value": "e350348479593f8fcbd040989c4c6e96b79f9cb3532ada44e7c9c6194bace630ccfabe7d40a036e0f6d5c447bbec15a7", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132757, "uuid": "d6ae9b0d-ba93-4337-8f41-39581ca603b4", "value": "T18521958C006D1C90DF4F967B6FFF5E0698812B9CB819102A2CB33DB02D5E2953F4A06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132757, "uuid": "514e1cb0-f64a-47eb-ac65-c930ef7ab6c8", "value": "24:9TvgL/0GJ5CmYBiGPhi4xCbiqu3a0MmSNEHIbbjaHjRqyb+MkngaQYU:9TIL/j5Cji60aciqulMPJv4Rvb+MxaQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132757, "uuid": "0b2e608f-515f-4c9d-ae32-869d7f104305", "value": 1304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132757, "uuid": "e5c423e9-aff7-4e32-a986-bf4f859ec52d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132757, "uuid": "a352bceb-6620-4901-904d-ff961b029cf4", "value": "photov_431787658628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05cc79d-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154430, "uuid": "9fbb33f6-d9fc-4cd5-bc80-0f4554057724", "comment": "Malware payload", "value": "d3fbb58402a5a046e841c5af24ebbac0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154430, "uuid": "5fffdd54-6edc-4133-9242-e3f0b57a9a0b", "comment": "Malware payload", "value": "ad3b4d82935b02a5ebbff7112e3edc7ec48ce94bd7300de1128dbece71715df9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154430, "uuid": "f13d389b-5ac5-4103-a785-11286b1fd399", "comment": "Malware payload", "value": "9bbf240fe7c4d2eadec961c88dc80adb07833852", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154430, "uuid": "e3cfbdd2-7cb0-4678-a0f0-7e481038141f", "comment": "Malware payload", "value": "b18bf528405ae18e73cba12ff000a7e12b86e1d6ad277ec9e25c3af6ca198c6089b20060a3ee00559307911b136f4d59", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154430, "uuid": "a853d76c-4447-4bac-a615-79ff918192f3", "value": "T1A62133E081D24141C84F9ABBBF3BF609B10709E4A61226664BD19A4C5ECB84A96B81D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154430, "uuid": "1103f902-d05a-4c12-809b-e721f2047955", "value": "24:9z/nMFcJWpV0D0OlMfDd6ymSJZ+oWqVqDi18:9zGcf0OqVPj+oWPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154430, "uuid": "53f4ba3b-c161-41a0-950f-13fd5699ca57", "value": 1152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154430, "uuid": "c9295240-4709-4573-92ec-1b76f6bc1941", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154430, "uuid": "94ec68bb-5ad4-4c99-8195-48775db6d28c", "value": "photov_241762981719.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de01af2-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180974, "uuid": "8f7983d3-cf48-49c0-8d45-596c0ca2c990", "comment": "Malware payload (Mirai)", "value": "02279a2c42f051240de3be9f3cb009dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180974, "uuid": "2b8d4aa0-f851-414d-92f3-53ed797f6a0b", "comment": "Malware payload (Mirai)", "value": "ad4185bf0e84f884457992cae139eee59120c3429839c8b8306f00c5401e869e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180974, "uuid": "feacd533-7604-4c29-8101-e0be02084b61", "comment": "Malware payload (Mirai)", "value": "cb5b38f688b8e19c32ebfbfccaf49171ceda1f28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180974, "uuid": "2cdea6c1-67c8-4d37-9f89-6fd3a8f22c89", "comment": "Malware payload (Mirai)", "value": "4a803517dfd8f14f7f0bef2aa698b18122ed50719e13584ae7fa136e69dce9360f4f4f7662a57da1bcf4136ae616225a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180974, "uuid": "17d109d8-d875-4ee8-8978-3ea87584c27d", "value": "T13CE2F25E50DCE42CE55E803BC32BA98E21E3AD107F1BC96425C979DBCE541B520BAC37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180974, "uuid": "c7a57cdb-62fd-4f1d-b3c4-42b78ff23dee", "value": "768:+32bRAqg2pQz8PMjFY8AFOEPB6ZSq7xni5Ga0F:NbRAp2p4uCF+FvB6ZSoniRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180974, "uuid": "a18fef93-d138-406d-8933-b6326fa6c42e", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180974, "uuid": "1d5e962d-9e3b-4575-a63a-5e02c4e96655", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180974, "uuid": "12d6c96b-70b2-4a73-afec-ff9776f96ed7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608b4def-89ef-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785179663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179663, "uuid": "444fbcb9-9efd-4973-99c7-9d2fd6a31cc4", "comment": "Malware payload", "value": "0d7645d32e3d0e3f112306b6a57d267f", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179663, "uuid": "12460afd-8acb-45c1-a636-8814b1ee8b75", "comment": "Malware payload", "value": "ae361b0c289ee93120a5c8f230e296769ad679065371341ab62a7ecc8b02674c", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179663, "uuid": "2da2716c-bdba-49a5-b8ba-397f4b5758ba", "comment": "Malware payload", "value": "708be32ffe21f37efd99d42befdcae82ba85540b", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179663, "uuid": "63aa345a-c2ff-4e5f-8341-d2fc033a0ad6", "comment": "Malware payload", "value": "10a626f31e600b1e6d2bd65e0320b7cf365c2cc0fefe45ca766123e57812beed7893ce2887ec9ef3d8653f7771396fc5", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179663, "uuid": "8c161e45-641b-48cf-a96b-36cf5fc8e467", "value": "T1DB311B0639A4D8FC3C252B36345B3014F609065176BE49987D856E4EF3A9C42F7F0B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179663, "uuid": "55a0e30f-3806-45b3-afaa-f13ae7193396", "value": "24:JkSFwWwBDHrjHBEcr0NVya/wNZ8y2T7unOulBr5RZdPXR6/OlBhq2h7koJyTG+qI:JkU8BDLjHBEekp/wX8y5rlBn13qWhAGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179663, "uuid": "6ffb0f86-e666-46f6-bd6a-60c24eafaae4", "value": 1470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179663, "uuid": "322eaee0-848f-4222-8ce9-97b5cab30805", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179663, "uuid": "a469467f-8249-4ef0-8c70-190694ade725", "value": "l.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d7461e-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143197, "uuid": "a7168a3f-75b4-4665-bb40-bb2caabcc4eb", "comment": "Malware payload", "value": "0fb7536e1e8a3bfc6c3750354ca33323", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143197, "uuid": "92018f31-81f5-4c7d-bd47-95c7c7b8e337", "comment": "Malware payload", "value": "af203c207676b176443ceabaf8257999fe1915911efb268e4e5198d5ac79945c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143197, "uuid": "d3be4bf0-68bb-4682-9f01-ee2c40ef0ddd", "comment": "Malware payload", "value": "bbbe05b1ffff9595cf46978538648707d59a0e33", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143197, "uuid": "6757448d-5931-46b0-8281-4eb6417218e2", "comment": "Malware payload", "value": "23f814d6c79d545be0beadce26d852073a83e57813a902567055a35289a9c64f645164f45388fe1e62c62fed777f77b2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143197, "uuid": "5c2847bf-040c-4e18-9439-88f9627edd5f", "value": "T1B321C614C82A4F85E187DBF2B692FFA5235258B15091C665130C7B043FCEE2C2B32080", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143197, "uuid": "cbb99d6a-81b4-4818-a777-c9ca0e9e9bb4", "value": "24:98NKd6JOoSbR6kNwumwzyyXW7G7vmSrS+Jl8poMvyJN9AR:98tJORmwmyz7vPm+Ci4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143197, "uuid": "c1f6929c-700b-4248-a39f-4e89d305a3dd", "value": 1163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143197, "uuid": "a62f0bf9-91dd-42ef-bce6-f98982443042", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143197, "uuid": "bb64986d-633c-40dc-abd1-57875d3630f9", "value": "photov_032806492924.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d32206-8987-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785135130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135130, "uuid": "55cd1a3d-16ad-4c39-8ae0-6ef203fa3ca8", "comment": "Malware payload (PhantomStealer)", "value": "2519e7b005a0bd8e444eafa32d41141c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135130, "uuid": "89eb4359-3c6d-4458-96ca-11b565979eda", "comment": "Malware payload (PhantomStealer)", "value": "af8e39184404f87ea53f29454ca0211d51991129cda12387ee5ccb1a2dd83d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135130, "uuid": "69c65d2a-5ed9-4ef9-8bec-5fdba1599b44", "comment": "Malware payload (PhantomStealer)", "value": "8aab7cf8930de6e7796cab2447bcd0211e9f9ef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135130, "uuid": "e44c6595-85bc-47aa-9020-62d38d5d9e51", "comment": "Malware payload (PhantomStealer)", "value": "0bbd96332effb5a32c215a59bb2b5c5421f5cfe86ccad38398d8464b24fc72fcfcb123d53f7b1d2e7fe44981fde6a9ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135130, "uuid": "0499d15b-e38f-418a-b0a0-096425d9d545", "value": "T16D45011523069E41E0E687F6B870D37472680DDF79E2C3D69FEAAFF738293805854692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135130, "uuid": "70feff61-974b-4795-a9d2-f0c4848be27c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135130, "uuid": "56246e63-5a2a-4571-830f-0cc67afa9eb7", "value": "24576:GvSRp50166sYqKksJhmUMkj3RAKqK38GpkIdwFYZkpx93LyR:GUpe66X9ksvnMkOhKMMkIdwr9uR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135130, "uuid": "e0945802-cc21-4659-a34f-108e3f793281", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135130, "uuid": "48a71948-584e-46a8-8517-e398d4e444da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135130, "uuid": "0712dfeb-809b-4ea1-a864-56ca512dbdfe", "value": "Purchase order.pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ab2fed-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133014, "uuid": "b2b55a34-ad6e-4091-9f81-dd3a326615d9", "comment": "Malware payload (PureRAT)", "value": "8a7d2c78250ab8b270d162f501c5c8a5", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133014, "uuid": "f6c80b95-f02b-4f84-8fe3-0f26831eac52", "comment": "Malware payload (PureRAT)", "value": "afac2443222adebf4f38bec302542a62784285219354b57d58eb38e8eef2dc44", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133014, "uuid": "5b08ba5b-3e5f-4bd3-bf19-0be5ed1491b2", "comment": "Malware payload (PureRAT)", "value": "9e50bf176606a0f53240ddcb0cfa0cef80750575", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133014, "uuid": "561bab75-dcbf-4444-baf0-740f03247cad", "comment": "Malware payload (PureRAT)", "value": "91e4ab633a3e9455d3c8a94de3caa7cc0129f2457169fe264b3725cb026f86426f9b81d65e5a9d257e4c8385e73ea0ce", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133014, "uuid": "8a3ce198-80d6-4b5a-8ded-354406870da4", "value": "T162117508CC53A942DC1B46717ED9E62E903D05E0E74D665B89B039782F11679630B9E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133014, "uuid": "ea68ca7c-1fd0-4cd2-af5e-40ce78f6401f", "value": "24:9s7MeTe0f0sGWiDS6Px0CGGCylNipkegLIERqmSPlLuS7E7MmA4gLfRERFl:9s77epsGrJ6jGtlqt1EIPdH7E7rqRE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133014, "uuid": "93ae8c9f-3d4d-4df0-8971-8b368dc20676", "value": 1094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133014, "uuid": "4f496fb7-46ad-47f4-985f-9ef960264491", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133014, "uuid": "1b171c8b-21e2-456b-aa3a-7465fb75e5a0", "value": "photov_593034534530.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1881c00-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156713, "uuid": "4e514461-a7ff-4ca8-94ed-8c53bb613a60", "comment": "Malware payload (Mirai)", "value": "15cd18c5da4b247fb17c61b4a1026908", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156713, "uuid": "7890fb08-b4b3-4570-97da-daf73ed88c43", "comment": "Malware payload (Mirai)", "value": "afbdf2cf4dc4196369ce04816b793e07f93135ed633d4d252647a8695e154d42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156713, "uuid": "b3ec3d47-977a-402b-854f-1fc7e1229448", "comment": "Malware payload (Mirai)", "value": "bb8a75ca830db8bc69be7997606d38d3ac81f112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156713, "uuid": "6cb5331a-d165-4a56-92c8-d90ab4d23413", "comment": "Malware payload (Mirai)", "value": "d031e3e9967d3527630cc6290839c5adbee8393cd3dbe09ce5f1bd41637e6efe9e2e19a9285716c03eafcd8e23ad5a7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156713, "uuid": "2c2e8d0c-a4ef-495c-a3ea-37b88bbd8c1c", "value": "T171731A91BD81566EC2D063BFFA5E528D333563E8D2DE3223D9118B1133CA51F0977AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156713, "uuid": "4b88f4fb-f079-4be9-a596-186195c10aa9", "value": "1536:YK0DMG/nyU8qNxc5OT2MXYQMt41eA5uPkV2mWf4QIyduN8:YRMGfEqNxc5OTlSt8bKUeNq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156713, "uuid": "04d4a326-3d39-442d-b604-e86fc6b0d36f", "value": 80540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156713, "uuid": "d81eb43f-68f5-4ad0-b701-d16c4bb51209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156713, "uuid": "df7990dd-651f-4076-a207-d9e9a5e6c262", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c77592-894e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785110736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110736, "uuid": "649ab993-1718-4488-9177-4d72d951d79c", "comment": "Malware payload (RemusStealer)", "value": "0d618238e35254bcad69d184ef94a8e9", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110736, "uuid": "5e8e0b58-52c2-4864-9bff-d2d239d89d77", "comment": "Malware payload (RemusStealer)", "value": "b0fb0119b9cce5b7aeef7f3499f5a71c5642c89f130daabc60822413cc2f5cd5", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110736, "uuid": "e20c26b4-a99a-4cad-b3a1-399a446d0192", "comment": "Malware payload (RemusStealer)", "value": "ee749699843b1de9b2e711540cf16ebb9104ba26", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110736, "uuid": "75ff7b0f-4ea4-4d0f-a3cd-00a2ee24d5b8", "comment": "Malware payload (RemusStealer)", "value": "2835c5a80b75eea44dba59984da37ba34a745208a78aa2544ffc120aa74bb5f4b5ee872b1be8fe5d00e7188209c02b9a", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110736, "uuid": "94adcd1a-4810-4daf-a121-cfd33f3312b2", "value": "T1F824096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC46E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110736, "uuid": "24fbc6e8-b556-4732-99d5-e4cdde05cc45", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110736, "uuid": "d3d5fb4e-ca96-44d8-953c-3498b41b1c4f", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLF61gCGiics:Qj5WUEBx+Q7PEfFnQU+t8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110736, "uuid": "98398afe-3e09-4323-bb7d-50ce9272a48d", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110736, "uuid": "b347eaf1-c194-48b5-a87b-f365b5bf4742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110736, "uuid": "9727b6b2-9467-44c7-bc0d-d12d0c2091f9", "value": "KLLNMF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721deb05-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154352, "uuid": "43d0f568-44cc-4f1e-8d36-2194f7f07d1b", "comment": "Malware payload", "value": "c425f02cc95d3aa78f767b16a90cf20e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154352, "uuid": "33a3d6ec-fde5-41bf-bcfc-79d4ae6697c9", "comment": "Malware payload", "value": "b16b96e72a906e2c0c6ad0647918e5e8c8e39e74652c90ac0560c739d44028db", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154352, "uuid": "b762a0b3-5946-430a-b6ab-9c040638281e", "comment": "Malware payload", "value": "72b4a8581870ddcfe2a22584027c65ed9cbebb1a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154352, "uuid": "d3e07a3f-9331-46f3-8530-6d8601e81076", "comment": "Malware payload", "value": "fc50627850d09cdc24228d14ef733d287f4526dceeea7678e76ed148771253f03a1ea9a3ed2dd6a3b43840a19862e4b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154352, "uuid": "18a2086f-68a4-43ce-ae01-0076707d5811", "value": "T1F121C8A5E820DF11D4C3D373FE28A64A335EB01E061920AE4DA91130F737CE807C6921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154352, "uuid": "9102e8bf-b0fd-4cb2-8681-71e07ef07b51", "value": "24:9iQma/LAG4kvam3XT4YoCZT+FmSDlhbpWqKEGesAjQmwwlX:9dWGSm8lKTKPpfW4Unwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154352, "uuid": "1d0f281d-349f-4506-8a59-35d1e0a0f616", "value": 1322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154352, "uuid": "e43604c3-0af0-4a39-838e-d4bf89690ddf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154352, "uuid": "3e96e850-329c-413f-968c-6a71d8d83c61", "value": "photov_039755632856.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d3902a-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133439, "uuid": "1d744edc-2147-42a0-adac-bd71012c3473", "comment": "Malware payload (Mirai)", "value": "862182e9dc5f0a548f74c927d28036b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133439, "uuid": "594ae6c6-3cc7-4263-a277-dca4476ae290", "comment": "Malware payload (Mirai)", "value": "b32aece652aaf3eb47ea3f52879176db779dc65012761e0cf17bd2bcfb34aed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133439, "uuid": "9b7e3853-b212-4ad0-84bf-801dc55aa3c2", "comment": "Malware payload (Mirai)", "value": "5418b14b10ac1e3bb5cae345bd9f30a60907880c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133439, "uuid": "81f43132-2405-49f4-a28a-4c16af038292", "comment": "Malware payload (Mirai)", "value": "f892a6a94e7e59988ccb7dfb34d41ac8203b1503d8fa0c9780a31b7479ae457870e26cc41d431db629cc96fd5e58b425", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133439, "uuid": "3dad8243-271f-454d-9c88-6038f3273a8d", "value": "T1A0823B0B67BA2E17C0E0AF7A11D30361B2AE8B856158C32F6D050DEDBF497511D3A7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133439, "uuid": "499ef7cc-a827-4432-9461-588f51914aa1", "value": "384:nRCKQ9HF87GgfQhxGD5qJQmdVCYA4TyZYVf9S+V0S:nUKUgfQhEDMJQ4frTyOrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133439, "uuid": "c74adada-711c-4cd5-8618-fee64c9c192d", "value": 18292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133439, "uuid": "13b457b6-6437-42f4-9e81-b0287be24d25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133439, "uuid": "fdaf5889-b0ae-4a97-899b-0e3c15068e14", "value": "zero.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f74857-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133132, "uuid": "62330c4e-2d82-42e6-90a6-9dca2b8c93fe", "comment": "Malware payload (PureRAT)", "value": "5f20649b8a05161a62cd9090668650e7", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133132, "uuid": "99226dc0-4fe0-4538-91b2-6fad74106e7f", "comment": "Malware payload (PureRAT)", "value": "b338600681f26aedfe556be8d1c2903cdf326c2748ab1b7ae47df9574ba78ace", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133132, "uuid": "38a8db4a-8e64-45e9-8158-c5b60958b48a", "comment": "Malware payload (PureRAT)", "value": "2e39e8015a282027b63033ff1713afaaed7a4bfd", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133132, "uuid": "cac20e2e-2e78-4576-800f-5b75770a3e4a", "comment": "Malware payload (PureRAT)", "value": "0496ce351390f46db1828676760fa9e47f38aa86ebfc55f0013047d13a77d82d057cde3c5cec2834beca9f30b119fd65", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133132, "uuid": "4ef6094f-9783-4a71-95e3-2786cfdde8be", "value": "T1F721A7BE80FBBE01EC668130790676941A998A51E091B30B222C91EFEA657F973804D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133132, "uuid": "9c4fb814-1dee-44ba-8fb3-e9a03eb5163b", "value": "24:96Qao/PsP5XeZc1zgYw5gQLMX4CmSe2h6tMhqUYx4P:9DaosRXIxYShYfPHdM4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133132, "uuid": "a4c5f69d-a7d0-4b45-a6ed-34f8701fe8e9", "value": 1175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133132, "uuid": "fd17d440-282d-40cc-b1dd-bf754c036a29", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133132, "uuid": "2713629f-f624-4923-ab8a-0ee919e3a99a", "value": "photov_616576703618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b0bfa1-8984-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133576, "uuid": "6e6380c5-4283-495a-9b0d-93251f444e90", "comment": "Malware payload (Mirai)", "value": "d17b2039d23ef04c1eeae5e9f1e4ac90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133576, "uuid": "1625ad8a-585d-4cc2-9205-697648051951", "comment": "Malware payload (Mirai)", "value": "b33afecf560f75829b5d96c2cac9e9209f5674207d46ebefcfd3a7ef39c09f1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133576, "uuid": "7cca7f9d-3af7-42a6-a906-4ea1c84029c4", "comment": "Malware payload (Mirai)", "value": "78b6f30ec586a8c4a6d374bc21a00cd6a18b4725", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133576, "uuid": "35fed56b-2552-484c-bced-7543845f8dbe", "comment": "Malware payload (Mirai)", "value": "3c7a2f5b11a00426e24b1756604a40f9352bd9d04ae260f3db52983213b30ff8cdeba5fc397c757a8e595e7a9d5cb057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133576, "uuid": "d19523e2-4844-417d-b5ad-77208e0ef685", "value": "T1FEF3D81A9FA10FFBDC6FDD3702A9060235CC550722A93B753674D928F55AA0F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133576, "uuid": "8c3a82d5-7e20-46a6-870e-8e114e15af6a", "value": "1536:iU2SYw0JuupNUY9xRgJD5HoLIWb/aMvIDo5Zim+mi0bURcR4T2uz5AnpZcC/2+5s:Cw0JuaXxP0U3z0Z2uz5Gp+C/r0SOoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133576, "uuid": "cf8b6c61-be8d-41fd-ba9e-81ba0a67bbc4", "value": 164884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133576, "uuid": "322911ba-2493-410f-9708-fd5968b44f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133576, "uuid": "aba5045f-dd94-4cf6-b2af-656aa365d9da", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9a16e8-89f9-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785183925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785183925, "uuid": "28684e95-08c6-4729-bca7-dce5a9c70e5e", "comment": "Malware payload", "value": "b6aefb197539613b95d2f7de957307aa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785183925, "uuid": "4d11e1de-7351-4859-9965-0a0ca332a8ac", "comment": "Malware payload", "value": "b37a2cf2e2f75f6cf0afd27aa05c627fa9d814e6babb603e8fec4b09b32b4079", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785183925, "uuid": "f802bb1d-5b4d-4edd-9108-92947a7cc9ee", "comment": "Malware payload", "value": "97bfb5e496346dfcc03cd84c0b81f9b2349b6ebd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785183925, "uuid": "77f95788-8c8f-43d9-b529-ee35df39a642", "comment": "Malware payload", "value": "5b70522f055451f8c0260ffa561d6191bef9716eb11803f191e6b834c7f1717bbdca723b7b9578e8a30f737753262496", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785183925, "uuid": "ce386ec4-c02d-4143-8c5b-4f79d994ddfc", "value": "T19A822A0FB8424216E1D110B4967596BFD9B99C7633C418EBFBD44AEE0A686C1FC3250F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785183925, "uuid": "cf15c47c-2a92-4d1e-9035-62b450cd2c7e", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785183925, "uuid": "232f5e31-f586-4e93-aa73-cdd8d285c225", "value": "192:AWk6SkQzngjoWLsmBDTlIUqRQsPcleSMv9fKUSiu9zwfge+VOgbOOqmEd6FQv9P0:ADZbmsmBTsU0Vu94gXTPuav8U9c+W4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785183925, "uuid": "930ec5fa-6db0-4641-9feb-9804f85007d2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785183925, "uuid": "2793facc-080a-4ad8-a233-a7ff6d166f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785183925, "uuid": "a0c721c0-fb09-4674-94ff-fb4466c6d582", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d451e7-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143532, "uuid": "c688050a-e8a3-4e57-8093-5d51d8d74abe", "comment": "Malware payload", "value": "3108f64c1b7fa72eb94f93555a75c0bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143532, "uuid": "e8801f5d-69ef-47ef-837e-dea42ac09eb7", "comment": "Malware payload", "value": "b49c56f3e4d37b9904593bd8e45a10ddc07b8122c2f789bed2b980b39128162d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143532, "uuid": "68f75bf3-9e1a-4585-a239-fad222805df7", "comment": "Malware payload", "value": "f07707d07bab2e0061f0fc2186b2fa8adec07ed7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143532, "uuid": "54388de3-00e2-459f-8874-182d4e6eec1a", "comment": "Malware payload", "value": "6b037437b06ee4f6fb728ca79103a5d6f3b3c5de866d11b393356afd75132f415351cdd0783ac7219a453db092a57776", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143532, "uuid": "6712ab75-9a19-44e7-b6f0-16dfdeddc44e", "value": "T1E311757485EFE830DF06D936BB00B131D2657641522AD122276EE8863D9D8C39B039C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143532, "uuid": "acbed81e-865c-48ff-aa80-ff5003b10112", "value": "24:9w9o9EKjQ2KE98nJ53DL74MlcgmSP064mhHcN2A9o9eeXCIlcH:9INK8EenJVcgPsvgcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143532, "uuid": "f7d8e64a-47eb-4e0c-9240-e58f15d0891e", "value": 1072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143532, "uuid": "ca74104c-0ba6-4f27-bb07-e2e2886ee4dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143532, "uuid": "18eebe3d-9505-4eb6-b3c0-9adc2eeab3b4", "value": "photov_939862795057.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4cfba8-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143528, "uuid": "89dd55c8-700f-46da-bdaa-204d1292270e", "comment": "Malware payload", "value": "e87270ddae67409b82834d4edc0ec27d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143528, "uuid": "9d7aa16c-8852-4a2a-8078-c0d1cdda3e2d", "comment": "Malware payload", "value": "b4adba71210ec03be4d8ed05dda998e034ff97509ac0c257dd02a8230e68760e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143528, "uuid": "b06dd726-18c0-4660-84bb-683cc68dd1fc", "comment": "Malware payload", "value": "ba1d1139c4c6b970e4e058d11c8bd83dc65de27e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143528, "uuid": "ca22112d-0f72-4ba5-9b87-c309b85517e4", "comment": "Malware payload", "value": "c81200962c010ca535c082739d6b908ba80950c0e989c1bd3257e323e4f1e47e82f6391c57137916d1f5b7f48835e413", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143528, "uuid": "5628230d-f780-462b-bd73-091674438b11", "value": "T1842160F8859C1631C8C179B3B201EFBB343E41924B59453886899EC1BECA4C82B86AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143528, "uuid": "31b732e1-9b0a-4840-9891-b7c11b37622e", "value": "24:9yXnOXmSJmOoA93GQ8roZu4xTMGMmSR+Jl8y8yZVNW15NO9ghX3k:9yXOXXkA93GQ88Zu4sPR+J8yJWA9Ak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143528, "uuid": "df67cf45-7aae-4d66-a7a3-9e5e2a62133e", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143528, "uuid": "f8fc2314-4755-485c-9b1b-23d313188159", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143528, "uuid": "5b34aeba-f877-4807-adb9-e2a6afd089e2", "value": "photov_257295561603.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da567ad-897c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785130320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130320, "uuid": "20032cb2-a783-46a4-91f3-afda81d3c5e3", "comment": "Malware payload (Prometei)", "value": "e72c9c548288d86122704475560cd4c7", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130320, "uuid": "8c5c8af2-efb2-4694-845b-e14c03d01666", "comment": "Malware payload (Prometei)", "value": "b5147693ed4a8744cd3c32e2a2b8c6ec77acc6c8f0494b994398161a0ba009c5", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130320, "uuid": "93724db0-a819-4606-8b9d-5f4bf9fbdf62", "comment": "Malware payload (Prometei)", "value": "c9e7fb28a237dc890ddf125a80c5f61fc92d2783", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785130320, "uuid": "5f50c6e8-dfa4-4531-b914-87a187d82206", "comment": "Malware payload (Prometei)", "value": "57005232e5e7682d34a151dad2caa2da1b2b5f595eeb7581807da75eec42113441f707fbb61eb38ccf8baf55cd1be5f2", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130320, "uuid": "c43379b2-6196-4426-bf60-12b0cdedc1e7", "value": "T177E068F5EC31A671340C4138BF4B1BE96487B82F6819746465334566850D06E308F368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130320, "uuid": "e968e654-b49a-49e5-ada7-041b958acab9", "value": "6:h/WI6LSH3NsQBjGVKVD+B53BvMBDyJfip5JtBGPZXvc5IH+5egNObTZ5CVN0srIe:5WIp9NBjC11ZYaSJaPZ4ivgIbTHCj0KT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785130320, "uuid": "3298561b-a7ea-4e6c-8a79-f7198bf78969", "value": 367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785130320, "uuid": "f15e410e-aec9-4ac2-98f8-e18351880e01", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785130320, "uuid": "ecabc440-d070-4a05-a581-37b928cbc92c", "value": "b5147693ed4a8744cd3c32e2a2b8c6ec77acc6c8f0494b994398161a0ba009c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6927d7-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154185, "uuid": "e89562c9-a43e-45d8-84a3-8a913285f5d5", "comment": "Malware payload", "value": "bfaf629467c7497fd3c54a79401e99f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154185, "uuid": "65a31f5b-744e-4ef0-8c01-db401c05a0a3", "comment": "Malware payload", "value": "b55b082ecdac275bde08a972ba0f3585d12bbdd5d6d12824987ff2205e04b3a6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154185, "uuid": "4df63be9-ea1b-484f-a718-eb38b14e7770", "comment": "Malware payload", "value": "137a78827c07c77352d7c09a47a3adfe0373625a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154185, "uuid": "1c7d3221-ba80-4971-b56b-c180e2ba29cb", "comment": "Malware payload", "value": "ff473b23bfc63cd830fecaf1e08de86c59aaef084030ff564b87ce0ede1a3d5c705e357dbd6526d1409eab95a50c7a28", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154185, "uuid": "d5a312a1-132f-4aba-8cb2-e7f88160e1ad", "value": "T1AE21A70C005EEF42E40A417577A2850427664B4651FF72F367067AC59FCEFE90B61343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154185, "uuid": "f4499e65-6fce-49ce-8268-9fcd2f08d2dc", "value": "24:9g5HSoKUu+VohBgL+/4t3zDK7ouUJ/lZg69YGeBmE775dW4mSrgxsAHSG2o5HT9/:90SoKIs14t3+Ut0P7DPksnlMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154185, "uuid": "0b7afe3c-5357-4afd-b79f-1fb26ad5bb48", "value": 1208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154185, "uuid": "25ae75b2-49b4-4d1c-a77c-ca50b6932543", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154185, "uuid": "e120b866-8f8a-4076-aa82-052a71f333a2", "value": "photov_469278221381.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d273bd13-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133039, "uuid": "c5ddb3ab-145a-46c1-9e0e-1c49d1a4aeed", "comment": "Malware payload (PureRAT)", "value": "e8c52cc99374babb0c5fbd5a95d1ff44", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133039, "uuid": "2124c939-32ee-4871-92e3-c69e0b77680a", "comment": "Malware payload (PureRAT)", "value": "b563dc1c123768b03d026db3ae03be9d8068974b21eb73b983d5a9b5c8cc438e", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133039, "uuid": "0c0b2446-2bb4-4884-b612-d04343292815", "comment": "Malware payload (PureRAT)", "value": "f37281c91b31c60fef09fc640f617cb9f07fdea5", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133039, "uuid": "5d8b074e-867a-4f36-84d6-e9fa46e60e47", "comment": "Malware payload (PureRAT)", "value": "207700a7ed39124c93ac8ed7e8c98f494bcc20a5deab5673fd258999d0b3be2d0f31fc0d0a5ad6a2884ac6498e16837f", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133039, "uuid": "511f07ed-67d0-4aa4-89e7-f6d938548312", "value": "T19D218647C4C4CCD6E847CF36A6300E815D5443B1AD2D55E7A94578E33F29ED83214235", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133039, "uuid": "12089b77-4015-43a0-bf5f-af062df2c843", "value": "24:9nofxmEcriXWxN7+Vl81EI7fpnDTAzWJmSPUHIcpw5wy6o9ydWiq:9OVcRxN6Vl81EIDZnPUpw5wyEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133039, "uuid": "6ace0962-8a42-4138-a378-e314ea4e13d8", "value": 1111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133039, "uuid": "6436af37-4526-46fc-bd9b-be5ad76f3850", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133039, "uuid": "8c2b473c-fef2-407d-8046-e1cbf882a908", "value": "photov_605077881890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cc96fd-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143191, "uuid": "18843fc4-77d0-4489-b55b-5caf3527f487", "comment": "Malware payload", "value": "6b2013493b57c3b557e4a9aac506a066", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143191, "uuid": "85855675-3b32-4989-8b58-b164f0678bb1", "comment": "Malware payload", "value": "b5e58fa9b62f2c43ad3529e7a09cd5d9624700131d865e87087d7c9deeeb9b6e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143191, "uuid": "a2ad051a-3e7f-4e5d-990c-1be608896b8f", "comment": "Malware payload", "value": "2f3dc8a582ebfc69b4d70188170deb47d644edeb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143191, "uuid": "7dfdee9a-9228-479d-b622-e01442f0a880", "comment": "Malware payload", "value": "e3c359a585c0e29a599bc2aed0c6b5c200ca343cb805a233fe5e5d96ea7802b155ff119f83f066056ff7491d2d4d66d4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143191, "uuid": "b3274947-0d96-49b2-8a75-07a67f5170f0", "value": "T1E721A720E92D824EFE8BA73E7C676952E2C09367C81377D32647864DBD02E9D27240F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143191, "uuid": "adbc1293-58f2-42b8-8792-6f9fff63bca8", "value": "24:9wMuu+03Okr1jzdPiN3clch54KwRmSFZhGY7SNYY0kUSS:9Ps8ztcsl0wRP5GY7NY0SS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143191, "uuid": "419ae94f-01e8-4410-a08b-e06ad51abbcf", "value": 1213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143191, "uuid": "586167ef-de34-4677-9600-cf603f712303", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143191, "uuid": "92f32f51-502c-49a0-a2fe-4f118201ba15", "value": "photov_770379465640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0459f744-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158034, "uuid": "212e7665-ee31-4386-9176-d963b4ab4ada", "comment": "Malware payload", "value": "ba9a2e4a93627fa814f9bd6a6411b4c4", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158034, "uuid": "f78d16d8-cca0-4837-b8dd-9c042b06b22b", "comment": "Malware payload", "value": "b6bc6863350aaaec905b938754e39f08fdba7efef40e049e1f57a9f667395b7c", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158034, "uuid": "bf00ed0e-3716-477f-a8ef-de4eaab3a014", "comment": "Malware payload", "value": "58095a183564588d46f90de0df699d45ca78aaf1", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158034, "uuid": "cfe1efca-84da-4ed4-b81c-ea380ab0ebc5", "comment": "Malware payload", "value": "0f75657c1bbff1a1e284c3d5d0684188cbf870fc66f630929684a4328bf3785cea492250cb2d77cab7825beb8b7ee160", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158034, "uuid": "7b74758d-f447-4c65-8051-897c64c5ec84", "value": "T18F26333C7A7971ACE216C2BA83BEB4288F8C4F41676293CDE69D77AC71FF550A110449", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158034, "uuid": "688fe056-45c2-4452-a9e9-f33c3a6f226b", "value": "98304:O7k8FmFQMv9Gy1A+QoGtg/jSnsGoCKgaKQW32J4tCIaUn+Zg:uDsFQM1PG+QoGtg6dXKg3sYFaUn+Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158034, "uuid": "e5d56e23-fef5-4fce-a4fa-1cee01f53aaf", "value": 4508273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158034, "uuid": "2c04b91f-ba69-487f-8528-3b4891ba49b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158034, "uuid": "1438ed68-55ab-4aa6-9d67-800cafb7d0ea", "value": "b6bc6863350aaaec905b938754e39f08fdba7efef40e049e1f57a9f667395b7c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad275dc7-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132976, "uuid": "5f903e63-528a-4ff0-881c-1afb13ce452c", "comment": "Malware payload (PureRAT)", "value": "8a6f31b3a37675e58d732be4a31a03fa", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132976, "uuid": "23e0cf2b-32e9-4b25-861a-998d47e21341", "comment": "Malware payload (PureRAT)", "value": "b72bfde836149b60c411abc1ce4dc45896060d5c9476187001b8aaa009b259e5", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132976, "uuid": "76228079-32b0-4272-967e-44a262f79dd0", "comment": "Malware payload (PureRAT)", "value": "76f329521a77c5f2e2f67ba332c80f3836c563b4", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132976, "uuid": "2f7c6331-59ae-45b5-952c-1c3d7e43432f", "comment": "Malware payload (PureRAT)", "value": "4690eb9cf6fabff9c165d5504c5f1fe94adbbcd19494d86dc7aa13d249ddb95af3fd4feba7e1ed2f8e0d2c4d08af97bf", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132976, "uuid": "c0b13cd9-0c95-44db-90bb-cddf3a0a46e1", "value": "T1D62195A9D2AE868AC081C43BC582F169636AC470E0CB1552326E603EBB38F5C1B440E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132976, "uuid": "ca48f494-a86e-475e-8a2c-528ccdf93ac9", "value": "24:9axIuMZ4utTpEhlkQQvPWlxqmmSsyhGY7VFZFNQ/t6n:9a8tTpQkmlxFPsKGY7VFzNQgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132976, "uuid": "57af63c1-adcf-4682-b270-f3c414f1a5fb", "value": 1301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132976, "uuid": "9771421e-85cd-4d9f-ab63-67788cc6cfb8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132976, "uuid": "ce38d117-33c8-43ac-9628-ee5705ec613f", "value": "photov_284357572444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7229160f-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143615, "uuid": "e890a878-7d2c-40b0-8714-f6a69ca296ba", "comment": "Malware payload", "value": "a890dfc3358cace362996f984d139479", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143615, "uuid": "ffd006d6-a604-4c17-a5f9-3ed5b6083c2b", "comment": "Malware payload", "value": "b76e996dd0e2b5c8145a47b4bd5acda7d811ef8f28124e2751901b746933e5fb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143615, "uuid": "60d7d0c5-7c36-4c7a-ace0-bc9805e6fd76", "comment": "Malware payload", "value": "6ce0f36a16e7c46d6e0df9cc3696054c3a1c8004", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143615, "uuid": "832a6c7a-aaa7-4b70-a68b-56c1bd9e4b10", "comment": "Malware payload", "value": "16154177f4b9d2783037571717aa4ad62b53493708916fb75d64505b940bbcaf00ed2710021d7e2b349077b04b7f4dee", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143615, "uuid": "63ad8315-0c88-4ffc-9ba4-12efdb57bfe1", "value": "T13511B50490A68B91CA7BE07BFC63457D45201A724004A0A1292C61FB795FFEC9BD34BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143615, "uuid": "24fd5777-10ce-40e6-95d4-41d6772af86f", "value": "24:9kPX+Mr79k4xWCRS5H5MxQgSK9IDplmSbh6Q6egj6jKwpUW:9kPPdk4xbRS5HiuIqfPFRbWwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143615, "uuid": "e10dfe5b-58e5-4bf3-8897-4b73f6d2eb50", "value": 1087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143615, "uuid": "ec8151cc-9483-4d07-85f4-9a5599df8e44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143615, "uuid": "44f34ea5-ebb2-4994-bafc-e4f86e3b4bfb", "value": "photov_062776929150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89c3c5eb-8998-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785142366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142366, "uuid": "703e15c2-81c6-47ba-8370-ea678101d1bd", "comment": "Malware payload", "value": "e9e6e925876eb3bb02f09cfc1965aacc", "object_relation": "md5", "Tag": [ { "name": "efi-corruption", "colour": "#3FDE89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false }, { "name": "xhopeless", "colour": "#0A8D4C", "exportable": true, "hide_tag": false }, { "name": "zdn2pwn", "colour": "#E31789", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142366, "uuid": "4a53354b-e663-4afd-b92f-700076b65dc5", "comment": "Malware payload", "value": "b77f680bf36519600963372d5a6bc7883c26ba3ba17669083b2123c534a6489b", "object_relation": "sha256", "Tag": [ { "name": "efi-corruption", "colour": "#3FDE89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false }, { "name": "xhopeless", "colour": "#0A8D4C", "exportable": true, "hide_tag": false }, { "name": "zdn2pwn", "colour": "#E31789", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142366, "uuid": "fb2828f5-5ac6-4dec-96c5-1b37d4565b05", "comment": "Malware payload", "value": "c8905cffc8022087a47343197fe8153089cbd6d7", "object_relation": "sha1", "Tag": [ { "name": "efi-corruption", "colour": "#3FDE89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false }, { "name": "xhopeless", "colour": "#0A8D4C", "exportable": true, "hide_tag": false }, { "name": "zdn2pwn", "colour": "#E31789", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142366, "uuid": "51834756-18fb-4c0a-a6de-c3de6b1e211d", "comment": "Malware payload", "value": "6c6b8449f4525f60825816f5e7bbb6c9bda42e87e697ea1a6f524a53ed161a9c0804e0143d96cbdc476ad4c1ada8ffef", "object_relation": "sha3-384", "Tag": [ { "name": "efi-corruption", "colour": "#3FDE89", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false }, { "name": "xhopeless", "colour": "#0A8D4C", "exportable": true, "hide_tag": false }, { "name": "zdn2pwn", "colour": "#E31789", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142366, "uuid": "61c2cbc2-47fd-412c-9327-8213c2f609ab", "value": "T1ED947D82B7C66DD9D2158A3589EF83293738F5E11A439F1B093472350D23AD0FE97A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142366, "uuid": "8a73f22b-68cb-4663-af57-101c1c0f15bf", "value": "dd2d85b2e048c4a260266fb4365fe25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142366, "uuid": "8833f509-c78d-4daa-87a1-2a9697af4f51", "value": "6144:KiXU4/N1hEcaiQ+GTWH/obazxU95VGYT9T:KikYbWcaivGTjV959T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785142366, "uuid": "0149bc3b-49d4-4316-8dc3-58ed4f46c1ab", "value": 416241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785142366, "uuid": "840753a7-7bac-4751-8a7d-2c8795e04c93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142366, "uuid": "b297fdd8-6acc-4ebb-b1eb-1517ca11e535", "value": "xhopeless.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89dfc0f-89b5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154954, "uuid": "b97f02dc-0b3a-45dd-99dc-03a982e8f765", "comment": "Malware payload", "value": "8ed44d8cc84a1807fd26ea7b0666030a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154954, "uuid": "3d040849-4c15-4dfa-b31d-64774d500027", "comment": "Malware payload", "value": "b79b2fb0b2efb45c522c724c85e2122041a4cc896bd86a91a6955204e655d994", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154954, "uuid": "285d30cc-a5a1-4927-ba1a-4355be92d78d", "comment": "Malware payload", "value": "4494cc8265172ea2312f405af1fe4191e8ff92dc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154954, "uuid": "a17afcef-5ed1-4d11-ad55-db969a895a64", "comment": "Malware payload", "value": "98d09e108a60d8e24ad448c3df995f853dab1d08d298c943161fde9814548ae5af09d7b954f67678f8df0c66bca4cf19", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154954, "uuid": "3173a68e-5283-472a-8aaf-da646c59c1ee", "value": "T114236D651A857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154954, "uuid": "79abe9f8-b759-44b9-b147-d7144780000c", "value": "768:QXRWNGxVx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ElxMcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154954, "uuid": "12551699-cce8-4fae-a21a-544230f7c407", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154954, "uuid": "565a3eea-00de-4a07-a3de-d52b1c9fa921", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154954, "uuid": "491a0aae-cf35-4ea4-a80c-8f515fbdbbf6", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2484a796-89a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785146921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146921, "uuid": "a82aadda-712b-4a2c-afeb-fb91f5f8feea", "comment": "Malware payload (Formbook)", "value": "e3e6db5a6bebd1f45ab972562872e4f6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146921, "uuid": "ea489bdc-e530-4cf3-ba1d-1ca187e6467e", "comment": "Malware payload (Formbook)", "value": "b843f789741fd63734b29a534459f18cc5c650e9abe64feee2742fa79a4104ff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146921, "uuid": "fdc83636-a963-463f-b67a-455917e8c1f2", "comment": "Malware payload (Formbook)", "value": "51b9d06c4b8d8defc8ca8b063d9f656692bced42", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146921, "uuid": "a993a684-594d-49cf-bf42-6decc8b1f64e", "comment": "Malware payload (Formbook)", "value": "f9b7a79267958ed4078c4203fc6e5ae36ad4ace49b15ecf02a9b751d5062f18c8eda917451e479b0280b2f16691f36e9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146921, "uuid": "83e7116a-4962-456c-8129-3f02ba471177", "value": "T145A3ED990A877884533677BFA72B98D6E776072B01401827B83D7440EFF1A09DEE4DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146921, "uuid": "7014841d-19a6-4463-8013-0516aa91d6a4", "value": "768:9h2BTN70sFK4P/hxQixJb5I9pTAy64VA9eVFrwSLY+6nv1GBVdasyfmzO5vh0g3V:ueEfP9v6QS9K5lac1hwBg6Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785146921, "uuid": "4f8eba22-3baa-4765-a949-82d336f4e134", "value": 103306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785146921, "uuid": "36f6f660-ac22-4f05-8c6a-28fc95f78cf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146921, "uuid": "262f96a5-3889-4a2f-9198-da09e548e362", "value": "Ad_NEW_INQUIRY_SPAREPART_02877843 DOCUMENT_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b69e75-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143319, "uuid": "f86b1263-0380-45b8-b388-d67e09cf11d7", "comment": "Malware payload", "value": "22a5941e77756e87eae588a17c856056", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143319, "uuid": "acf44ac0-5fd6-4614-83c7-3adac79cdcb3", "comment": "Malware payload", "value": "b86f676dcb8a3e45743dc196a7db42404341cb9e6b6e8d46d1e8856c49a75425", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143319, "uuid": "416c3b79-16ec-4f4e-8fd2-feefcef3e6e4", "comment": "Malware payload", "value": "6ef1e9e7b8cc71e4e9144a659fed7bf81cdad4ea", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143319, "uuid": "5ef35298-765c-4c50-a555-935b2cf5de77", "comment": "Malware payload", "value": "95a90de69cd4df7caff392c353492639588f4c707dc02b880746c18ad64fab70e7921aaf80c904200da71b4b2a55263d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143319, "uuid": "4ce3f1b6-916b-40bc-bfcd-4ecfb07d7440", "value": "T1B6219611A05B8B80C0118A7FBF35C6E4A174C196E462C2A74ECB6CAA2E798C54707EBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143319, "uuid": "6a007fd2-330a-436b-9bba-d0e65ca5c55d", "value": "24:9sBCR1kBkgnGcHFlumhx5gd8nnsqX9LOSmSibMHqk6jJynCEi:9BReBkmGcHFlumKCnsO9LpPYvjlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143319, "uuid": "1936e531-f69b-4889-8579-51d2048e1557", "value": 1169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143319, "uuid": "9224742b-ffff-4f2b-ad97-8731c2916d7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143319, "uuid": "f97e782a-ac8c-4425-b25e-98cba849ad1b", "value": "photov_565225557024.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc193966-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132572, "uuid": "898cdd10-eee1-4a20-af49-08c50056325f", "comment": "Malware payload (PureRAT)", "value": "a82e8cf854d32f47ff3dc05d99ab409b", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132572, "uuid": "98607c91-cfcc-4bca-9e2b-bd73effc190e", "comment": "Malware payload (PureRAT)", "value": "b957a65c1c3a6b189d07edb6cd3c78f999b3e3aef34b06e50c155dd049c80c0f", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132572, "uuid": "40c74c1e-0d64-49cd-a482-f01b10fe4259", "comment": "Malware payload (PureRAT)", "value": "3836e871584be949c7f8bd07b5eca8bffe97bdd2", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132572, "uuid": "57ea9e6d-d99d-4eec-a4a3-d6cf328c3c50", "comment": "Malware payload (PureRAT)", "value": "20436b1c03350fcee5899975a874307e0fa6d926f768f4a40213298cc3b8f4c520f5f0679b36355765f7172b4b79522f", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132572, "uuid": "90cef374-a6ec-40db-ae6d-39c0a8aa6a0f", "value": "T13C21B694F1785C8DE4C68078EC0CEB9AD982A6409811D25633EE38293953CDCB707089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132572, "uuid": "204ea70a-d873-4a3f-a10c-7637973c0a49", "value": "24:9rNcxcAS4hyRCiID1RILQPHtmSn2ghheY72k9t+wGGGtRTp:9rSxc3VRRLMHtPnFheY72kyw2Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132572, "uuid": "cff4c2ae-6556-46b5-99b8-ac2146460430", "value": 1133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132572, "uuid": "5f5f2eef-19be-4175-a583-509b4260ff78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132572, "uuid": "4733ed91-7189-4209-90f0-671300f6fad5", "value": "photov_551877306281.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0e4493-896e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785124195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124195, "uuid": "6735ce1e-4e9f-4ff1-9bfb-6bdfa6f1e100", "comment": "Malware payload", "value": "48a25b304eb3713989cb9dc976618cad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124195, "uuid": "875c47f1-fb83-496a-8c3e-2724759d7775", "comment": "Malware payload", "value": "b9605d53a902f60867aca67f42ac7a53222edd2463c3936c5c3c9e75a457a7dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124195, "uuid": "c447a0f5-1a68-4f31-94cc-a6e41e691ffc", "comment": "Malware payload", "value": "9d86e201c18c09c36a208c4f1a35ed98a66760c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785124195, "uuid": "8437738c-8f28-44bb-8a01-01cca42a28f8", "comment": "Malware payload", "value": "9b58dfe76de15c95c6b40b6aef9e856f1401efb0fc11332e11e3f4365cf499b6602c1addaf1e7b6ba3543513418be9d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124195, "uuid": "8520d304-e3b0-49d0-a181-a274f1b8d7a6", "value": "T1D6C28D966A967C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124195, "uuid": "d3cf82e2-fa08-4d7d-b73b-b96d2ab1e453", "value": "768:d8vCB+25j6es8RY9FYpMSUpi+20qUpi+20YQX:d8l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785124195, "uuid": "571dd995-ef27-4912-909b-48fb148879bb", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785124195, "uuid": "d839e104-dfbf-44a3-8e1b-f90efa41e1a0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785124195, "uuid": "2db489d0-8a6a-495e-9576-65367976c8c6", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b11079-89b2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785153664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153664, "uuid": "5f83ddbf-7bb1-463e-bae6-2f7a7e3cfe16", "comment": "Malware payload", "value": "f9004f27af6dad07b76401a1239eba15", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153664, "uuid": "24b14205-80c7-43c3-aaf5-48fa576aded9", "comment": "Malware payload", "value": "b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153664, "uuid": "a1c5cf77-57bd-4a19-946b-002498e96df8", "comment": "Malware payload", "value": "0faf952a07bbb7de84aa6ff0c78e9884e83eb403", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785153664, "uuid": "8169c8db-7a5f-43dd-8e6c-7fe5d8e41298", "comment": "Malware payload", "value": "2dcfcc7c03d701a4e06997de5888c7841d30cf9ca2e82fb051f911e4f691e6a7e47126bb57ec8dafcb17fde0aeb78a75", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153664, "uuid": "5e04224a-347b-40ca-af02-b703beea0b3a", "value": "T1243161DE042019395716CBDE7363764CA21CC1FB2DDBCBA488594EAA83881CCB662F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153664, "uuid": "8d2f262f-9b46-4469-a29d-94a78a3ba5b3", "value": "12:Ut6Yc0X76IZXDfSwW69BAJaIvQr6v2Ex1wcr6qvULwxq6xQMUAkDnT6nLtTwI5YX:mXZXDSqBEOHEx11LvYWLFwcY8NKYKNLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785153664, "uuid": "19a184bf-d413-45fe-856f-b7ca3bfb9c7c", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785153664, "uuid": "8d7b321d-79b3-43cf-98a6-c770c17b4736", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785153664, "uuid": "7375f5be-67a4-417a-91b2-83caf9a52f1d", "value": "b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea6d0062-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154125, "uuid": "48acb0fb-bd2f-48c1-93b1-9023478189dc", "comment": "Malware payload", "value": "330b5748700d5df996e791564b58fe83", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154125, "uuid": "cd08dd63-223a-41e3-a223-151673e63324", "comment": "Malware payload", "value": "b9d5637edb3b651988d53407ccf4c5b916cfda59fab4d01a69e93213b5243cb4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154125, "uuid": "dc67fd2a-f868-459b-99bd-c7fd238f8865", "comment": "Malware payload", "value": "19993074356adb6af7bd61ddd45130febcd33d45", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154125, "uuid": "3f693c7f-6434-40f2-b6bc-0f171688513f", "comment": "Malware payload", "value": "322c74a0ac4324bae17355fd70b1fa3f8572b781c91f81882d5ea8680c4035bf14c04fe330d37a515e0b6b8005b5e30d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154125, "uuid": "951bfb89-71ca-4e43-a387-fbc79177e47d", "value": "T1C211C88DB4DEC596CF0B4572F60AC629046DCA4BC4000DF7174C297A3666EA0024DEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154125, "uuid": "efb34cbe-bd6b-4520-9748-a3a765ac4801", "value": "24:9um8sCMHaq4xmap6GW+7k3ZKEFmSHhDY7mmV938z:9umoP149ZXFPBDY7m1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154125, "uuid": "2fdb3420-bea4-48f4-bcfc-103559f1df7c", "value": 1051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154125, "uuid": "ced33993-0e57-469d-833d-4a08f4f4579d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154125, "uuid": "44402dce-a2e7-427f-a277-3c4f334e0341", "value": "photov_606583489143.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a342a0e3-89a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785147133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147133, "uuid": "1718edcc-1a2f-4082-851a-9870c46cb559", "comment": "Malware payload", "value": "8601f915eb7e11eb6e0c14cc332952d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147133, "uuid": "826974ed-9299-4973-a166-0b5bda84b5b0", "comment": "Malware payload", "value": "b9ded5190f79ff49dea11caaeecbf6722ff03c5c5e5674ee9a4f031373c34be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147133, "uuid": "e1711cd9-25ff-4546-99d7-128327abe28e", "comment": "Malware payload", "value": "d8c73fb40810868b0456cbd757a060cb767a85f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147133, "uuid": "4cfa7f98-f91d-4cf5-bda4-c4bdf8a4e71f", "comment": "Malware payload", "value": "da7ced406f8cfb44c165114aa7a4f228bdb02aac555e97bd7fe89eb70498f82e9237b1b7d05f6b5ad5ccfef4d8e89a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147133, "uuid": "68739a1c-af51-48ba-937a-712aad0f0131", "value": "T111264B4AEC6100B7D29B227A7DB61CA47174780D6F2153D3B548E3B439723E86DF83A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147133, "uuid": "d90228b8-c4ad-4953-83c8-e3302079be75", "value": "75cdd659f17f4eea75d2b0927fc62a6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147133, "uuid": "3c8cae1a-2070-4c17-a5b6-850d5bf7ce42", "value": "49152:HnoeRzV0A6Nrb/TivO90d7HjmAFd4A64nsfJ3CGD11ix1dn5gu69nprojwvHSOMd:IzA6x351mwPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147133, "uuid": "721e39cf-1846-45c7-9a9a-da509628d824", "value": 4483024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147133, "uuid": "de145be6-83a3-42e7-b965-61a42f00773f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147133, "uuid": "e01dce66-38a8-48fb-a516-8628c568c6e6", "value": "upd_helper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e45a50-897f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785131568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785131568, "uuid": "09463d35-7ea6-4881-bcad-bea91124e581", "comment": "Malware payload (Efimer)", "value": "474856aa1c293807bf2d2362b82d7291", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785131568, "uuid": "0cb52889-85b9-4b82-90ec-c8ab8337acd8", "comment": "Malware payload (Efimer)", "value": "ba4fd1b65144475c6685633c5be135a14fa5df4977b1c3bc13ba70d082ca085b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785131568, "uuid": "31bb4cf1-d79f-4e67-b5ef-7e8c5ece8cbc", "comment": "Malware payload (Efimer)", "value": "b0bcaafa2144d3c16edb4bfdda00002f24c9e6b2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785131568, "uuid": "8d9262df-2c47-42cb-9f77-7068d15222bb", "comment": "Malware payload (Efimer)", "value": "bdfb23291274093a79eaa82ac6c624fc9ab6ef7e1f2e0598b9b874099db73eaab4bbf5685b652c731ae68f5fb1e40080", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785131568, "uuid": "cd899dd7-b6a3-4614-a9b8-26b0dc122af0", "value": "T11EE6331972E021FAF6B2403CEEE1496AE955BCB78771C19B8748C7A62F172E00D3D617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785131568, "uuid": "1ffd6686-4939-4ed1-8059-ef5945239f93", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785131568, "uuid": "26396d65-b00d-40cd-b7e4-ce1fbc40ddfc", "value": "393216:fdyrEp6xCsBm+uuZ0dXMCHWUjXmcuI3/PGTAI:fdyVoluZ8XMb8XbH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785131568, "uuid": "42946c6a-e255-46a9-a42b-14e046bb0e30", "value": 14324580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785131568, "uuid": "e4e86114-c3a5-450e-950c-eda3caa58570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785131568, "uuid": "30f44d33-eb2a-43de-b5fd-b1eb6b309ab6", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1438731-8953-11f1-bd95-42010a9c0009", "comment": "Malware payload (Tsunami)", "timestamp": 1785112797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112797, "uuid": "66fa3f7d-e2a6-4939-bb37-57f118f574c0", "comment": "Malware payload (Tsunami)", "value": "b2a1ba08d246a39483f9cde2c94c9efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112797, "uuid": "abfd45d7-4c8a-4d5e-ab9b-0503b073daf1", "comment": "Malware payload (Tsunami)", "value": "bcd7660ccc0b839dd001bce86a2ba33a6777e644be12fae5ddc3df87a767e76e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112797, "uuid": "9c86a22a-a4ff-48d1-a1ff-3e312fd06533", "comment": "Malware payload (Tsunami)", "value": "06449f2bda9c2cc2c24cad58c09ae2a4a7094ca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112797, "uuid": "f05363e8-5550-49c5-9a0c-441d68fb9818", "comment": "Malware payload (Tsunami)", "value": "18a72411087da4e3ebeb89f7443bfbdb35803adffa43a551b456d53d0a736b59b586f0d9cb5edbad996e29f1ef09e6e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112797, "uuid": "4ac2bb5f-6af1-43b4-9589-9e41790ba8b4", "value": "T1A10533995BFF79828EA61C9D41E7DA0B07D62F9504FBCD0058E7028953D9133CA22FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112797, "uuid": "b3098e7d-741e-4591-847d-edf348a0b86c", "value": "24576:VoG13EsScEPHXMWvDa1kt78govVlkTun78MzULIhn:Voe3EUEvNv7g/vVlwwJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785112797, "uuid": "28d6563c-a804-412c-95aa-1f151f98da29", "value": 801282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785112797, "uuid": "38631563-53ab-4705-a6ad-f0d2b6bfd27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112797, "uuid": "5223c80b-d1b9-4106-b24a-330053471ee3", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8ae6bc-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181057, "uuid": "855c05c9-1bf5-4424-a7c2-528a146559e4", "comment": "Malware payload (Mirai)", "value": "49d464ea3cda0476bd57a5f2adee763c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181057, "uuid": "15f48ef0-d765-48ca-800f-b15cb870c39f", "comment": "Malware payload (Mirai)", "value": "bcdfae513af1faf835e824dc17e5477980da3973a429f3d6976f3c315561293d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181057, "uuid": "5b5585c3-2169-48c6-b430-852e255d9405", "comment": "Malware payload (Mirai)", "value": "fadaf1e8eb41afefbb973830b288b51c68cb9540", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181057, "uuid": "a2b2801f-b55d-499a-b777-0d3cdf81f1cf", "comment": "Malware payload (Mirai)", "value": "b0b57ec506470c3c6cd5c52867dca1dc9e884cbff405a3d5c6b9c99bffae35249c5ee805090c6087704ccfad5f428136", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181057, "uuid": "e7f2ac5d-aa33-4566-b8eb-4cc26aa188c6", "value": "T1D8634B02B31C0D47D16359B02A3F27E183BFA99121F4FA89651EDB869276E371186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181057, "uuid": "34120eec-ea09-4094-852b-505ab91eb5bf", "value": "1536:1qJmBD+STCTNsLIw8TxLQj6an5WLeIEy54dKJclT4s/GnsD:EgeRsLwpnLeIX5ZRsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181057, "uuid": "d8431b7e-d66c-4142-984c-a30bf6385879", "value": 72708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181057, "uuid": "6889186f-1c8c-4e72-ada2-02ec3d909b08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181057, "uuid": "36b80000-9724-481c-a920-9aec378230e7", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3ecc58-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154233, "uuid": "4d01d859-8bec-40e1-8b39-96b37e439da7", "comment": "Malware payload", "value": "fa5a7340066783b91f2f111adef5ff18", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154233, "uuid": "be5b7b53-c5b1-4d68-afc2-ab57ce52f263", "comment": "Malware payload", "value": "bd100490e2ca65ffc88be0938873f3f8fef7b46d1858c4373411c879acf726c0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154233, "uuid": "98812611-3a81-4135-a73b-195f3ad3999e", "comment": "Malware payload", "value": "732dfbefbf39265406a9062fc32d3cfe761ec135", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154233, "uuid": "d32e6949-8d98-4817-bf99-85af9c9606fb", "comment": "Malware payload", "value": "7c8c1b8fdc24649649c67d45b0122920f5726454e289197011840751ace6c244dd403fe62eca5cf86fac6c42db335ecb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154233, "uuid": "52d8a54f-6efa-4251-8bb4-3c8ca7174d96", "value": "T1952184EDE20AD0CED543C374A606899E782806D53B063BA36B15A941BA58DCE210FBD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154233, "uuid": "83e1bc05-8575-4b17-832d-0f9594fe15f3", "value": "24:94H5NcUqYD68tL5vOp8ZSITsIvzmSU+oWqG0shAzGFwTm:94H3Iv855Wpp+BzPU+oW/SoWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154233, "uuid": "3d266584-67c2-4fb0-a60f-1a90aa524ff2", "value": 1208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154233, "uuid": "5d950cdf-10dd-48c2-97a6-1cbdc8668b8c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154233, "uuid": "23676c9f-a0e4-4713-ba59-6450d985a656", "value": "photov_228459378333.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1938dde1-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133158, "uuid": "cb1b9cd1-4fdc-4fe1-a604-fcfaee9a172c", "comment": "Malware payload (PureRAT)", "value": "eae6b93765f3cde8ff402d902872253c", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133158, "uuid": "754a0e32-2fe8-48c4-9804-19ae7b69ca05", "comment": "Malware payload (PureRAT)", "value": "bda937cde056a7c3080ae1f5ee9a30b6855b7dee33eb2695e28a79cbc25e309f", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133158, "uuid": "5af889cc-e2a7-417a-8ec4-63d30f773975", "comment": "Malware payload (PureRAT)", "value": "285003110f6868c0d184656be34707233e18f6b9", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133158, "uuid": "bbfd4c13-cfb1-4f99-b442-80d77cc7c0a6", "comment": "Malware payload (PureRAT)", "value": "2276c6f24e56779e2cd053b9bd9e099e076bbce34c4bb39b6f44619698006ba527332614071032b5bf7e307c87a9372b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133158, "uuid": "b1a86660-d96b-43db-a8ab-c20668306320", "value": "T1A4216378D884FA13D213D572EC6CF444F8A64AB055094CAC33273DBDFC139E96744460", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133158, "uuid": "671328c9-dcac-492f-afd0-fe86e8092ade", "value": "24:9ebNOsRmzG9eNW1EFSuq9dbthQmSDb+24R8etY+V+fBlVnxAvK:9eTRmzG9e81Edq99t2PDytYR/kvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133158, "uuid": "225f6f6e-1517-44be-9713-cce1fb9f01e0", "value": 1201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133158, "uuid": "645ed56d-4b13-4427-8f82-e0093b63d238", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133158, "uuid": "df47d883-8b96-4152-b7dc-ce8e8a731177", "value": "photov_777582167527.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efba746-8985-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785134107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134107, "uuid": "49747863-b69e-43cb-97e5-3c229856948c", "comment": "Malware payload", "value": "bb0a2bb7304992e73886b92269022727", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134107, "uuid": "8ccb9124-5512-4e82-a384-0c2f6aea1649", "comment": "Malware payload", "value": "bdde7805820e3ba5101df7f9a6de339dfd32c368d3128346ecdccdc5f9c09474", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134107, "uuid": "72cb866d-6b63-4944-b925-cbd22390dada", "comment": "Malware payload", "value": "234531cb7c65e51f9e1e26934e4581c996448212", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134107, "uuid": "5484a5ab-a775-4df5-a004-a15e2c9678c3", "comment": "Malware payload", "value": "6c6f44416196869504f4c099bfcb123d380fb8ddc20ceeed0265fd8a76ed4f8753a33c58a2c3b70d73d69d88f9a09cd0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134107, "uuid": "bec55dd3-5bbd-4281-86d9-b9f0e6a7e205", "value": "T174F090CD41523F6D45CDC90F7653894C904693CE568F97CA3C9D0826A5C5BB8F858E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134107, "uuid": "5f70f84f-8a78-4eee-bc8c-91cd556d5d32", "value": "12:KSs6wZ5ANyHe0f5A+sw5AequSYeJB/5AAWzpk:KSKZb/sweIpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134107, "uuid": "815b2c5e-782b-4bf2-aca7-b2ae4aec1e60", "value": 530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134107, "uuid": "6dddcea1-4e95-468b-a15e-73453e4f0267", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134107, "uuid": "e3fbe3fe-0ca0-4ec2-a5db-c5fb0a88fe9f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7429ea-8989-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785135928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135928, "uuid": "2fe97c90-b2c8-42e9-941a-0025ace54157", "comment": "Malware payload (Mirai)", "value": "b812ab3193f2da9746dafa70d5dd2c39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135928, "uuid": "beab1137-bd06-4fdf-b5e3-55c2a58baf02", "comment": "Malware payload (Mirai)", "value": "becf4b756070ed4dc6967f20e141cba37da181e3e0a6d198901196441c25dfbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135928, "uuid": "6fe06789-f98b-4cbc-a6f1-edd1aa6272ff", "comment": "Malware payload (Mirai)", "value": "485d4091473db2feb34e2583f5fac85b3b19fb27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135928, "uuid": "226e29c6-5480-47ea-bc73-c3b0dc58050b", "comment": "Malware payload (Mirai)", "value": "040fee538cb18c7a70fdcd496b22d3fa5d5a2f802022d07138edfab53346f26978878727763ceea564d31e527a86077f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135928, "uuid": "98c64015-9a66-49c7-bab5-0ee3d9b0c762", "value": "T149219E9AA7D36D2BCC540277DCAF5710E362AE54869EF513F32216250C6E21A1F2115A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135928, "uuid": "818e6e10-b1a4-45aa-b7d0-fdcaf869b56e", "value": "24:JColMlgP9qD0at6EoKGArUlFSy4WzLCkIddx2HuGIDv1Nfc7:JColMOFqDPtlrkFSy4WzLmGIr1Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135928, "uuid": "8a571c94-b1be-41e4-8b0b-73295c0ea097", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135928, "uuid": "3204b4dd-29d6-4021-a317-644802235f85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135928, "uuid": "e3575d94-d87d-439c-8d99-4c7af5e46a2d", "value": "dlr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34c67b4-89fd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785185788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185788, "uuid": "4062be5d-7b72-41df-a61f-37f80486cde2", "comment": "Malware payload", "value": "7dfab6d94576579e466f5bc7ace0019b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185788, "uuid": "ec6e31ae-8139-451c-b58e-76cc2281046b", "comment": "Malware payload", "value": "bf1dde0ee67946f8ec76c64b6eb4252040ad4ffb097cdc9528c844de923a1dad", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185788, "uuid": "e86ba650-a54c-4c26-b0bb-73e46b164ae1", "comment": "Malware payload", "value": "d978cb046c6ca900c621f6d4adc9f9d32c8a2307", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785185788, "uuid": "b7b09bb5-96f6-4253-aee2-2af0272eb1c9", "comment": "Malware payload", "value": "3eba4a7531310212be6ba8476cd30eadb67e22f5f3b43b26c05ff2ce5ec00ebe6ec79446ee4cc0b7063d526a32f977da", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185788, "uuid": "38524ce8-14f8-4923-a96a-3461b8051a0a", "value": "T1E4822A0FB9424316E1E110B4966596BBD9B9AC7633C414EBF7D44AEE1A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185788, "uuid": "d6805c6c-1582-45e9-b3ed-2de6d6538594", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185788, "uuid": "117bdb07-d1d6-44b4-a11e-f4719852da06", "value": "384:A3ZbmcmhzcEUaUu94gXTP+av8U9c+w4P:D9UaF9Ka0U1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785185788, "uuid": "4a032fe5-bf57-438f-90d7-462999a344c2", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785185788, "uuid": "b7af65b4-b651-45b9-9d28-c899f9386604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785185788, "uuid": "4ea418f9-af9d-4684-8ace-7edac38a64c2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5fd53c-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154294, "uuid": "4332986d-2be5-4d7d-ae62-33da176c0d2e", "comment": "Malware payload", "value": "f65a91e78ec23ced6d804dc4303d40d0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154294, "uuid": "974d8926-cc0e-4de5-8b7c-8046b8677811", "comment": "Malware payload", "value": "bf666210794eaf103195ddd645499895faf7773ed679b27a51381258fbdf8217", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154294, "uuid": "5016e522-329f-4b10-b3f2-763f1350cc6a", "comment": "Malware payload", "value": "75c1d29b6038b8295b551c5b4d8d9860f0410b80", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154294, "uuid": "f728072a-c20d-42a1-bee2-fadb1fdcffc1", "comment": "Malware payload", "value": "80c9c283c55cdc8c314ec2b4b401342662d4413e88099005e8b2d324fd792881e30d016e54dfe90541cdfc8af85b3dfa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154294, "uuid": "61c8e4ef-7f14-4062-a0cd-e70863313b02", "value": "T1582187854E94CE92F329C03539BA62652539AA57910202EB1BC5BCCB3EE24888F401ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154294, "uuid": "9f5080cf-4130-4fa9-b2e8-8a8b88dc9361", "value": "24:9X42gbHEzW1kxl667uXYF6giTf0FvRCxeEfeVZmScoDq0FWy2MUBCmNpapPAl1xt:9XLgbDmV7wNf0FvRSoVZPcoDqXuUBvrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154294, "uuid": "4c3c9b4f-95ed-4e66-806c-de0dbd684856", "value": 1275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154294, "uuid": "0ec8a357-4d29-4eeb-b1dd-637013622f77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154294, "uuid": "bc947a75-8e11-4aee-a660-2058a12a6858", "value": "photov_319175877519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9ab00b-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180970, "uuid": "4e388a68-5f3c-42f6-bdda-5ba0a0f5c6f8", "comment": "Malware payload (Mirai)", "value": "ea8b7c0d882457972abc0a36300567ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180970, "uuid": "685a2a65-8c01-4161-9280-a5705ddaf7ab", "comment": "Malware payload (Mirai)", "value": "bf7d5c7b3fdddb0e47cae68fd1c62eccdbc0f79cd3a721ad94f8bc3b814f7983", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180970, "uuid": "73c89fc6-4628-4275-8c5e-4b72a1a7f56d", "comment": "Malware payload (Mirai)", "value": "607274016bcb327548d78a19d896019bdb5e0b23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180970, "uuid": "960ba628-7b55-4bb0-ac54-c1a5c2b64302", "comment": "Malware payload (Mirai)", "value": "876b08ca9f13f4e85f7055f647b4d86595c21a33b7e0b4178a109f6655e1aa78e44ca8db11cb708f73ac970b0ff42278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180970, "uuid": "4a0f293b-b339-4802-ad21-379511cf1948", "value": "T10B735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180970, "uuid": "14a37b05-2ea1-4a6c-89bf-1dab688ee72d", "value": "1536:jP+SbCGR18pspTH1aDQ2tXXUN95s0xwlWptCMR8/cW:zf4yVkpENP1x6MJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180970, "uuid": "f0d6482f-9e22-4187-96c2-590175a3166e", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180970, "uuid": "3589c299-6b70-4426-8b02-bee0e47e738e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180970, "uuid": "1d3d604b-0355-4240-ae1a-fcec4d0a293b", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693e00f4-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180966, "uuid": "07a2f8c2-8711-4e2d-8519-a6db4cc0e2a2", "comment": "Malware payload (Mirai)", "value": "85ffbb4dc7fa792edf3d277692034811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180966, "uuid": "ba962755-917d-4e45-a9a0-c500972af66e", "comment": "Malware payload (Mirai)", "value": "c07dd050aea476f9d7671b9fa8ef23ffb8e811f2fbc1b7ded93a5156eab37cfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180966, "uuid": "ab9a9fd5-beb4-470b-9569-4d5f5d87658d", "comment": "Malware payload (Mirai)", "value": "1fa39fccc67c7fbcd6a381baf3f80ee9a79dae2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180966, "uuid": "d2bfc3b8-ce62-4421-8ae6-3d3de6b873ac", "comment": "Malware payload (Mirai)", "value": "1a111add85c6ccb3a1c98b97f05d0f0415fd18e45a94c341fd3a5947ab446edbe6608299f1b705378712112c97b95c12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180966, "uuid": "7c92beaa-8a84-4bda-8fc9-4959b8de052a", "value": "T1CDF2E1B6470545CCCC6CB27E6F94039673424B22AA339D1EB449B2F5BE7E56C72823E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180966, "uuid": "f36e4146-ef76-4f80-8dea-e9f81b44d3c6", "value": "768:NNYKyukZoTMKexVh2AggRJcZmNtlJSEFe44jyRe1gM/rJgGlzDpbuR1J3:HYdWlexVhH7RJom1+UygMJVJut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180966, "uuid": "dc8b6245-c563-4d61-b36f-2e7216fc1945", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180966, "uuid": "00e8644f-b5f6-4450-be61-64a2ea08aca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180966, "uuid": "dcbc839f-19d8-43c7-99a7-7ed474b00b01", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b43de5d-89ee-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785179278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179278, "uuid": "765ebd1b-365f-4632-a9c2-580fc3e209a9", "comment": "Malware payload (Mirai)", "value": "5a9ce5c275b5156203f29eacece2df88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179278, "uuid": "076cb349-6ee1-46ae-bd5c-8e155492d373", "comment": "Malware payload (Mirai)", "value": "c0e8d8f831e09a7475511eb6f1abdd112cece025c72f3de814f15da2b00fcf6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179278, "uuid": "f1993460-84b2-4ce6-897a-bced6af4c177", "comment": "Malware payload (Mirai)", "value": "55eec20005f77e94488d377446b4c9aca5b7e453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785179278, "uuid": "e9ff8b37-703c-4e1a-9931-1d990444b04a", "comment": "Malware payload (Mirai)", "value": "f3cfbcc869892c0e4d9e4e7c12158ff015682e4ef0a955ceceff2fc4f828885a587d34df4cd47672986180e0be1248ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179278, "uuid": "31606137-46ff-44d9-b516-7f312e888edc", "value": "T157632A5BB9918F15C5C1167AFE1E538D33032BBCE3DEB213DE146B642B8B56B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179278, "uuid": "fdb92069-fe31-443d-be2d-0b4d41476607", "value": "1536:owncTB9ic2jTA7kBWvepIcqADRxqUSAcYiaYWBJR4ECTyh:gT2j00IfAFxqRwYWBJRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785179278, "uuid": "3fff2580-89ee-428d-b40b-4eb6d737a273", "value": 67748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785179278, "uuid": "732a8da2-8a14-4d9a-b0c9-82d5a522196b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785179278, "uuid": "a03f2a3f-9ca6-4b68-9e23-006b0e9b5f4e", "value": "dmff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9f87e3-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167743, "uuid": "f432a4cf-51c2-44ab-9427-05bee7329bc5", "comment": "Malware payload (Prometei)", "value": "d2577b85f5a29ef579bfdfdb64cfa874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167743, "uuid": "5389f2a8-ce75-48db-8938-8967040961f6", "comment": "Malware payload (Prometei)", "value": "c17da88435a502ed14c705832371807419a7494a26be1c32329d4dc017477f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167743, "uuid": "0314e474-ce3d-4618-a4ee-aaedf9bd1956", "comment": "Malware payload (Prometei)", "value": "53fa5d6d3cf75f2444a38907d1170cd820cf2196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167743, "uuid": "05cf5e48-34f0-4d95-9ed0-5b0162f9004c", "comment": "Malware payload (Prometei)", "value": "49133b9b45a11e4d43bcfc45e4cd99c41c81b71d211b43bc5737d10e4f30ea93fc1ad7cd7f8473ab3ab27c21ea50e6fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167743, "uuid": "0da13455-de1b-4d36-be41-7ac343f9f5f7", "value": "T16434F13628B82F04D4637335B10B1F3196F59B1F3B7A119EEAFE47B5B1A4A0119630DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167743, "uuid": "31b7f179-d9f7-467f-bb7e-4a821f6e17e1", "value": "f418afe0379776397753ae40798cc2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167743, "uuid": "cdadd441-70e2-4fef-951e-610f5554cb7e", "value": "6144:mMooVQnnOBccnskYPmTpUxrr1XRA7WHxWoN+J0EafCUSYibN6WGd:pQnO/s1mTpG5bUo4bafVibvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167743, "uuid": "a9aacc1a-cb6c-4cdf-9e1c-cef2bdf23dce", "value": 251737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167743, "uuid": "4616b0c7-55fb-4c54-8f58-6eda72d62e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167743, "uuid": "f975f311-a1f5-4505-9386-ba40b5613511", "value": "c17da88435a502ed14c705832371807419a7494a26be1c32329d4dc017477f09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae65ff0c-89f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785182800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182800, "uuid": "beee83bc-4a2f-4351-a58b-dae2074a3f84", "comment": "Malware payload (Mirai)", "value": "d3ad513ac5096bf3d13271707cd7cf77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182800, "uuid": "aa3e96ea-b132-45b2-8a56-fb8343f6e03a", "comment": "Malware payload (Mirai)", "value": "c21a12edd5493e0e0c762a0c7ac7ce1ebbcbffed11fc27714e88b0843908e994", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182800, "uuid": "c3d6d1ef-321d-4538-8422-360a1cb4f2f7", "comment": "Malware payload (Mirai)", "value": "fc6dea26cfe7ed304840aba9fa5df4156700f55e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182800, "uuid": "da4d8111-47b1-4f6e-826d-8ee40ea4eb9c", "comment": "Malware payload (Mirai)", "value": "0fde89380155a59a8786eec6066dcec0855d36fb45c7c6621137f82dbe40e89263234fec269725ea3fae7f5feac70f36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785182800, "uuid": "bb65c247-ae6a-4911-90b4-c8b734d95018", "value": "T1EA534B8CE383E4F6EC1B0670101BF77EAA756D222028DD67EBD8B663AD32752911751C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785182800, "uuid": "43c65ee1-b9d5-441d-8ba4-41ed8bc98310", "value": "768:Zuig7OrllKLCz3M5UyNkL3REk06Dxu2bWX7lrL07uZSV8n5O87VRpdP8PqayRB0W:Z87OrPK2z3KCLhLlhqDZSE/R7uqaE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785182800, "uuid": "fc72cdec-f53e-4d0c-b35d-46da9588c40c", "value": 66404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785182800, "uuid": "f0fe7f88-a38b-4dd2-9ea8-01801c75fb1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785182800, "uuid": "fc0a739a-33d4-434e-be00-038c548392fe", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5148aa6c-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143560, "uuid": "cca94c05-ee22-4bb3-911f-1a2a8097421a", "comment": "Malware payload", "value": "2150cf7fe14b0ae685ffe9f876452e43", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143560, "uuid": "3d9a0810-070b-4780-b728-5a338176b264", "comment": "Malware payload", "value": "c28abda35a629a5684d5ce30e23ef63c2cf90ad85af21202305076569229d4c3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143560, "uuid": "d233d4e6-2e28-4c6c-8ea0-0545e6081475", "comment": "Malware payload", "value": "ddaf857f7df6ec8f01a525a9e6a6267ae786ab89", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143560, "uuid": "b7012437-8d67-4b2d-8d45-c53fb001de26", "comment": "Malware payload", "value": "adafc45b2753eade69427332f286c3faf9fb1c9206abe131c7c9cbf400f85921b1a67a1ee6c78603bd26683dcd5c77d4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143560, "uuid": "6ae07e7a-1ba5-498d-af8f-4389ea3e7c49", "value": "T1F7114200187E8720FE47923E2C1089CA86964C5AC051A1813ACD69B36D9BBD487030D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143560, "uuid": "4cd451c5-1bbc-4f0d-bae9-6ee535c84fed", "value": "24:98LBP+qDFuOgWuGJ7Uw+2A8Kg9YnPmSzhth6sK+0WP66skl:9YuOfuGJV+KKgWPPlbikl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143560, "uuid": "4620c7cd-7a99-4721-b9fd-246796a0fd7e", "value": 1088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143560, "uuid": "03e5da93-6e6c-4728-b41c-64e171d3812b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143560, "uuid": "b8a95639-2fd7-4369-bf74-0d49d997b258", "value": "photov_353982718372.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710f2a7b-8955-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785113548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113548, "uuid": "6ae2e230-79c8-4f52-9197-9ac20299beca", "comment": "Malware payload (Efimer)", "value": "7b229cd58d97751c907b89d5d5612b18", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113548, "uuid": "39fa8dcb-aff6-4e2a-9c57-27095385b6eb", "comment": "Malware payload (Efimer)", "value": "c29fb2bdcaefee9681b1b7ab1f85e610c9218918a11591bb63f553ccd6f5077a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113548, "uuid": "5d15dc37-47a0-4cd9-99d6-c40b20ba92f7", "comment": "Malware payload (Efimer)", "value": "914b3d26eda8d3de8c302f2479973ad87e7f6760", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785113548, "uuid": "bd91f239-c11a-48e8-9ca5-bc80278f8052", "comment": "Malware payload (Efimer)", "value": "cf9e36629e0c28cb74368ef1427a58027a0b7b5af58bd6ec564b423c851b9be74523b747cd5426cc66a4b1feab9506a1", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113548, "uuid": "e47e88c5-f0aa-4640-aa6f-621e2841d487", "value": "T1E4E6331834D012EEE493023DE9E1566AE4F974731733CE9F0BA457617E872918E3EA27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113548, "uuid": "d93443b4-ee9d-4b51-b7b0-d686d32ceeef", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113548, "uuid": "8d091ed6-54cc-4998-bc29-aa09db53ca05", "value": "393216:kf48iQvA8w5VopGfa80CBkZkRxXMCHWUjXzcuI3/PGTAI:kfzvgopGf3xXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785113548, "uuid": "94d26d61-eeaf-4ce3-98df-7fc126fc9743", "value": 14267443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785113548, "uuid": "c9012139-335d-41ed-89f5-bebb7e3c4a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785113548, "uuid": "9689aaa4-bb63-4cc7-8e88-d5754695937f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e281423-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154211, "uuid": "59eeba50-392e-4132-98ca-71829bffbcc7", "comment": "Malware payload", "value": "241ca4ebfed28de85532559119727b65", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154211, "uuid": "7be0d088-07ad-4539-8b80-a836d427a300", "comment": "Malware payload", "value": "c31931d2b90341257a98a31b57b2b4661661be34d456b9b3207e80959de35321", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154211, "uuid": "ce87c765-1b08-4149-814c-edfd49a2dcdc", "comment": "Malware payload", "value": "27f87c244d812e56ab29d22326dc44064647612b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154211, "uuid": "00eed587-8264-4466-83cc-9f49f5c6b954", "comment": "Malware payload", "value": "c957b55daf72a71fcab07cc60593adcc5f48ff5bd491000c7687267c77285aac6b1787b984ae1f45e9e73b5e4282ae73", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154211, "uuid": "769fba66-b2dd-4838-9d75-4f9149bc9970", "value": "T18D1186E581AEC841DC0FCB71B44F770A3A2219842850F2F68F9EA2833D75E5653959C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154211, "uuid": "86b8adf0-43be-4bab-9e05-480eeccdf504", "value": "24:9mS6Q+wF9/WBNexk3tUX5VkwLIHeemZmScq+Jl8HbJqSuS1jg:9mnQ+w7wUEtO5HIyZPcq+AVqlGjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154211, "uuid": "94b2660b-ae8c-4b50-9b82-4964bae2664b", "value": 1110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154211, "uuid": "5c1c5bf4-62dc-455f-828c-8dcb8a9b7f87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154211, "uuid": "59b35c6e-6cd7-4969-842e-638ba3ae25e4", "value": "photov_329494199046.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43a28c4-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132586, "uuid": "3e62a504-8302-45d2-b4ce-606f5d859416", "comment": "Malware payload (PureRAT)", "value": "db6ab3412111bc2a1f2a5af071f76bf7", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132586, "uuid": "1b9f0957-a953-49a8-8881-019b43dda04d", "comment": "Malware payload (PureRAT)", "value": "c3d8d8df88d5ac9a12da38279d673fc983323f1b61984e107782d1308cb18255", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132586, "uuid": "f1808540-f15d-4233-8762-fb647bfea258", "comment": "Malware payload (PureRAT)", "value": "ed1cdf5a863a7d3bdea8c7afc6876d430a66176a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132586, "uuid": "a69ffe5a-9e39-4379-9c5c-979671257bb7", "comment": "Malware payload (PureRAT)", "value": "3716d3ab23bab4fbf21f577ce816470ef6d166dff9b7bd05d7cc677e1b8c3e6cd0fa07c22c7a60a5ed32485658ea0b57", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132586, "uuid": "9862d45d-c32f-4c62-a183-83fe73869778", "value": "T1BF2196D4D0B5D911C216D33D589936354201DBC8851C508B7F45B2992CE6D9E6B09B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132586, "uuid": "36e067c5-d506-455b-9ca2-b5be07c4e5f9", "value": "24:9wfpwYVgAYdoLXDLhicfU0xAnPGF14FxazygLdmSOfC4JEDaG1g/PAQ0:9wfXVgAYaDkcfDmnPGFddPOfcD32QQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132586, "uuid": "eb9db37a-79a4-4fc4-a5ad-e578836e3f42", "value": 1134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132586, "uuid": "a2d5a878-3546-4ba8-ba75-558c3135aac4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132586, "uuid": "2c36cb93-1583-4464-8778-d6b8c2d82fa7", "value": "photov_977520666596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e920ed4-8953-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785112658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112658, "uuid": "90b588c3-7e99-47c0-8a6a-0e30fac2fcf0", "comment": "Malware payload (RemusStealer)", "value": "7cf591c9fd2aed0286ffb519f12da683", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112658, "uuid": "83fc90e6-ab5a-4d1f-99af-a6e167c3e05a", "comment": "Malware payload (RemusStealer)", "value": "c431caed57d9d7699aa519790582595c96224c0f00bee914f8c4ee2252495e23", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112658, "uuid": "75e14385-f792-4c12-bf96-df91f1856484", "comment": "Malware payload (RemusStealer)", "value": "0ce231dba3b1911ca64b31ca8bce79fd1dc4c1b1", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785112658, "uuid": "777b5285-4563-4f31-a0b8-7b61dc6ef459", "comment": "Malware payload (RemusStealer)", "value": "51095550a6f94d05104f1228f3e85b5f15297330ca5a61f85cb3bc6fc3cd7d8b5146383df4c34cb4ffa923b2abe9e915", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112658, "uuid": "df42a621-2a2a-4c56-b078-bbac610939b6", "value": "T155B55A07BCE109E9C4AA937289A655917B71BC084F3223D72E90B7783F76BD08D35B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112658, "uuid": "0c5e261a-fda0-4c69-a5c1-508e4a826324", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112658, "uuid": "3a4b7a7d-2dd4-438c-aaf8-9d77950e45b2", "value": "24576:acxN90g5jzFAijN9XqLa9KDFu1CEY6aWyPnSXfTLqJBele5r926CSckiM1:acv902jKijnqLaMD44EmPgIJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785112658, "uuid": "c24e1419-9063-40c2-913f-1f7af69d4667", "value": 2373488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785112658, "uuid": "98b7eaeb-f5ce-4d3b-ad94-8cc67aa6f281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785112658, "uuid": "ca6d3837-d232-4b5b-9faa-a8f305712ef3", "value": "beb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f34c4c-8986-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785134526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134526, "uuid": "b93310e9-9f3e-4bc4-b1e2-afacd33f837b", "comment": "Malware payload", "value": "d753ccef3661b9ab3342040793effa77", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134526, "uuid": "3c1d7c42-a6c6-4c95-bbdd-9367802c80b8", "comment": "Malware payload", "value": "c47ca35673ddfead3ae1cc4a0dde94693aac7a20d570290df608fe0ea784719b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134526, "uuid": "1092f945-95c6-47d1-a13c-fef8ecae99c7", "comment": "Malware payload", "value": "bcf11e9a1313217a6b4da9bb41e1380265343c23", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134526, "uuid": "8bc9bd4a-94c9-4788-aaed-956f28c3feee", "comment": "Malware payload", "value": "07bbd830cc1ec377c5397ec492d1d5156a67c895bd2d11da943048f9dfc4b77d0883d1472afc460fc41de2a6d2eba9e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134526, "uuid": "e233efb5-a6d3-45dd-98a9-987461c68ae5", "value": "T154C27D966A967C44BDC94A3E4CBD2B1D6DF5C3E1324942AC3D8B3C719C11FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134526, "uuid": "8c35ce5b-a40d-431b-b2c6-5fd7100d9f77", "value": "768:/8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:/8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134526, "uuid": "9e1c3b67-88a2-4f74-81b0-70fca494794f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134526, "uuid": "6b14c5d9-e4db-4b8f-8587-a53f989acd1c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134526, "uuid": "058df5b1-c401-4df4-8eb7-888bd2975318", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10cfa24-8950-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785111508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111508, "uuid": "84bfab5f-48be-4057-81f9-c57a1c12f367", "comment": "Malware payload", "value": "85a36e73daf264f1a5542ac916a4c76e", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111508, "uuid": "345c8b06-0580-4a8b-9adb-53e18f91dfc1", "comment": "Malware payload", "value": "c4ea01549f1fe365652d0c9d839f54d8d8f42bf4182ad5389839908e8f2a5653", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111508, "uuid": "160d6e35-434e-4e44-944b-76c3c8999858", "comment": "Malware payload", "value": "98b80727f0babd8acfef0b3ba8c882d29dd6d4df", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111508, "uuid": "5dd55454-02df-4f77-a4d8-9e7af22f37b9", "comment": "Malware payload", "value": "8ce9ae4797d0d68d71196c78c6b395547af37bec1bfebdb0c99873a9c9c99c5665578570aa276fdc86665aa736079dea", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111508, "uuid": "4b3df87b-e75c-4fa1-846d-b9418e55374f", "value": "T1E771EDA012CF6FA85691E05B25A2730A1430FDB355EBD9C4E4FBCB15E821C11D8BA777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111508, "uuid": "48250486-6d63-4f79-9179-bbeafbb6ea8c", "value": "96:9sn5Iv404T494P4C46tXsPaq2uQ4dCLLIzoD9j2A:Cn4404T494P4C4o6vxdCQ+jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111508, "uuid": "3809f8ee-4796-4088-8cbb-780a0ee1b2bb", "value": 3729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111508, "uuid": "187933b2-94b3-411e-b984-4d5191f87628", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111508, "uuid": "01aae691-33e3-4074-ac23-9c1c6528bb49", "value": "wp-static-cache-c1adaafb.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b913577b-89bb-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785157478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157478, "uuid": "77ea6963-3ad5-401b-8421-f84eaf5b3664", "comment": "Malware payload (Mirai)", "value": "ad31465bbfe1540e343311acec378bdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157478, "uuid": "215e3499-bf4b-486e-bef3-b018256c10da", "comment": "Malware payload (Mirai)", "value": "c517df44f682e4d44b7226012dc8be313728c8ae47009ac35a09cd4c7c4d1d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157478, "uuid": "0e489035-2759-4a30-b9fe-b00ff9a4a3c1", "comment": "Malware payload (Mirai)", "value": "f55673320740e3a13e25527bdb5c8f7b297b29ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157478, "uuid": "347b8f22-2e23-431b-a3a3-34be0c3a4143", "comment": "Malware payload (Mirai)", "value": "012cb34e84f56ebd29d84bfb34b3a045eec4ec98c0da7aaba0323feb63a611e18857ba96a730caa13b3bf2b0fc05ebad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157478, "uuid": "d7f0f681-4c20-4625-b52d-0e3f1820f802", "value": "T16F634BCAF983D5F6F8930930106ABF639DB3D6BE21A9DA43C3A455369D12502F412E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157478, "uuid": "0c340d01-971d-420e-94fe-44e0605c25e8", "value": "1536:TtWvgYGwQQszb6DF7lOvZOWsIyq3XoZSQY:TtDYGesH6hJOvwfIyqAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785157478, "uuid": "4434b257-1139-4b02-ae63-d61dc5b6ae68", "value": 70740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785157478, "uuid": "54be7152-cece-4c09-801e-be47f688efec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157478, "uuid": "e7d5035d-56ed-4663-9978-5936a8f87ff1", "value": "Space.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3f0dac-89c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1785161483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161483, "uuid": "71116dc1-70ca-4ace-8571-3404c76f0e3b", "comment": "Malware payload (KongTuke)", "value": "bfbbf30418735fa202dd952435235c23", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161483, "uuid": "ac90c338-ae77-47f9-a74c-995daa3cc1cd", "comment": "Malware payload (KongTuke)", "value": "c5a3d94cb6b4be539b68401e2fbd8008740d230109ee13a5b3b863f8e2d935c1", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161483, "uuid": "c61e7b29-bf5b-49a6-bc5a-7a5602710222", "comment": "Malware payload (KongTuke)", "value": "df2b580f61876f7b2b7f1fea312eafb81ae3b406", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161483, "uuid": "2a877471-6978-471a-a936-31dfba73cb7c", "comment": "Malware payload (KongTuke)", "value": "0cc74207ca9537a68f2e68bc35713ac1357791b8d112556b57e929884a8f04f368eea3d3e88288a6bc9ced5cad58c767", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161483, "uuid": "48c0f41f-901d-43af-9485-c160ae2b57f8", "value": "T13B07339FD4110484BA3CEC6920C6C7D5CC136F1485BB6934AD0B9839676BBE6FE943AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161483, "uuid": "9f60d5e6-aeb5-43cc-ade9-57fdd2b94629", "value": "393216:uIPdqdV/tYiXENQ14sXt10ANqkRZd6BVp81mJw1fsFi13:XqbSiSQ1JXLN/r6fDJ+kc13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785161483, "uuid": "d7192455-99f3-453a-a986-24549e11d298", "value": 16871997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785161483, "uuid": "fa768572-f561-4088-a580-2079b9fe2863", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161483, "uuid": "5fb4f700-54ec-4f9d-9093-236829e9d77a", "value": "package", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b685ea-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154357, "uuid": "d3fb533d-aa74-4d88-85c9-20013f7cee16", "comment": "Malware payload", "value": "26bb913b26f88abcfb1c185ecbb7acc1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154357, "uuid": "e8e673ff-07aa-4c9c-a984-abe16fd4edfc", "comment": "Malware payload", "value": "c657bdae9a4aacc6aa0b29171d28780bbdf2d12d0662cba492788fddb096b911", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154357, "uuid": "bd8c7a7c-832d-48e3-b255-eaaeea5cffb7", "comment": "Malware payload", "value": "483ff301c59401bff7741dc2708e0208c1cf6294", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154357, "uuid": "210a7e35-10e2-4bef-b053-510a9390fe09", "comment": "Malware payload", "value": "e937d74a859b5346a4170806eaafeb956f406cfa4138c2c5a9721d1bde540b92c938273acb05c9e8e9a2ad008624f088", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154357, "uuid": "ea4f82a9-a1b1-400b-b295-ea2020085aeb", "value": "T12B21F972240DC8DBCC04CA3AFC3BD3C290885CE9624384B71784FDD57FA349485007AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154357, "uuid": "ee204ec8-fdfb-4e2b-9532-4b83375bca90", "value": "24:963+AFxmv9JwTGDh8hik7Sz2/Wv/KA3aX2BmSqbMH+aQUvr24:96bnmHwTvik7SzXHK4OcP35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154357, "uuid": "ab167c74-01d2-4647-9185-c6622a3a681d", "value": 1169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154357, "uuid": "42ae0cd0-2a6f-434d-a57f-f554d2e5bbf3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154357, "uuid": "4880d8c0-34ad-41cb-a28a-d6c17f57f4c9", "value": "photov_832842672736.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa79602-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132596, "uuid": "e2971f1d-9056-4728-8ecd-0d838aa9eeec", "comment": "Malware payload (PureRAT)", "value": "f492da7d9327c651986611f044ae71fd", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132596, "uuid": "157ebb55-a512-4de5-bc57-8e134de5bc4b", "comment": "Malware payload (PureRAT)", "value": "c665cc1b6d1da78c1a7e2da15d9f10f9c1e8ddceedcfb70f541f6893f908f4b7", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132596, "uuid": "849245b3-42f8-4816-9411-b558f187f1c1", "comment": "Malware payload (PureRAT)", "value": "f7bfd90e97a1274ff809fb6c3a1bb9f83b7aed12", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132596, "uuid": "e5bdd30b-1f50-4e5d-b163-1ee30230a6ac", "comment": "Malware payload (PureRAT)", "value": "1dd59c5af6fb733a13afc24fc3c286a231f724fb0ea9198cbd77b28847c71216dcce6f895e450d6a4a684ba6848d8b50", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132596, "uuid": "ec84d5c6-f717-446e-a983-3ba44f204910", "value": "T14521B789D4375095C088C27369817C38621E4894465A15E1A79F3A2DFEF0B8EB157441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132596, "uuid": "fd9d2b68-7d89-4da4-90ec-a514374a6cfb", "value": "24:9kq6H/7u2LtasTXNgm0iDBW6dklkn0IPmStAbY2blZsWqCu6wvvl46W9sYnTwI3:9U9NxDBW6Ov0PtIYjWbu1aPKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132596, "uuid": "59887a8e-0b74-4c97-83dd-cd8a3d3446eb", "value": 1288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132596, "uuid": "5da82d71-90c6-4198-9a17-5c68bf1e1830", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132596, "uuid": "bfedfeb0-47a9-4813-8bfe-5c7f39294476", "value": "photov_276272927056.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5029e596-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785167610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167610, "uuid": "a292c80a-adef-4c91-a224-e06c4f34a95a", "comment": "Malware payload (Formbook)", "value": "b42a311b875fdda0fe88ae5c8c095925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167610, "uuid": "22233ab0-82bf-469a-a151-8c7ab98b3870", "comment": "Malware payload (Formbook)", "value": "c6713b3c5ba4da5044d96463cae74227a6a898abb051a5f75ab7b508eb20f7e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167610, "uuid": "1d7fc922-abc3-4099-afea-8df95e89a9f8", "comment": "Malware payload (Formbook)", "value": "d9c867640ff0501be51cb36b7db485127aff3a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167610, "uuid": "2471e35e-94aa-4ec4-9058-8311261a0119", "comment": "Malware payload (Formbook)", "value": "9615b92aec092f252703b559591a269ac0013fa0735ee34f31e25e1616022b8379f7a872feccf8fe66466ec900ec5128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167610, "uuid": "e70eff4f-fe73-47b8-9660-f743a24ab8ed", "value": "T12616A18046B48DF866BC970CDE7EEE40035A7153928EEF1F706D2584B666D13E30A9DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167610, "uuid": "6e8d2d35-8474-4133-b2fc-1618e5744e63", "value": "98304:dUe4MK+50MAtTwDcInDkCDwPJRioygCXeg8yJRnPd+AGtfS6:d94BVT7IhDwPJUoyXZzP6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167610, "uuid": "f6c82f9e-bdf0-42f0-b9a6-0d4c26fea635", "value": 4037287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167610, "uuid": "95c71289-c259-4c93-a579-9e076f469284", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167610, "uuid": "deeb2967-4516-4ea4-984b-3ba526dc8a5c", "value": "PURCHASE ORDER_909826.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113f5c64-895c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785116394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116394, "uuid": "f3c467d1-38ca-487d-9059-c697ff015758", "comment": "Malware payload", "value": "56ff9604be4436c616b152b068f95983", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116394, "uuid": "39dc90db-dbcf-4b28-b7de-2333bb53e5ae", "comment": "Malware payload", "value": "c67e82aed910bc4706a7da1675284bfa90f5c9371d596f541a575fdcc02e36f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116394, "uuid": "a95de158-99f6-495c-be20-d9723a157ccd", "comment": "Malware payload", "value": "b93bbfdfea4f556420b999c242b09e2ec83b494a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785116394, "uuid": "e0f5fbd3-37fe-43b3-96c5-eda90c94eb15", "comment": "Malware payload", "value": "2da1ba9a6d05566f8114c0254f098c7c382b9871a0d0bc394343978c6cdb3d16ad5037be7dd62cdd750ae43c2133cef9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785116394, "uuid": "f1425657-4718-462a-9828-bb5ab87b9bb2", "value": "T138235C6516857C24AA98C4361C7E2F0CB9AD43E6324452EE7FCF3CF68C4A69D910971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785116394, "uuid": "2bf6b75f-6671-435b-b8c8-527691ff404d", "value": "768:+i+j9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:5+kcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785116394, "uuid": "83fec485-cbe4-425c-9350-d5eb7329aa62", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785116394, "uuid": "4aa75da7-be3d-4237-8cce-ba77ce5ad1b5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785116394, "uuid": "170827be-0c2d-4550-a373-dec6d3e2fa83", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1921ed-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167599, "uuid": "d8f899ec-2681-4322-bd84-335666426766", "comment": "Malware payload (CoinMiner)", "value": "cfa17142ac6d8d5925fbe4bde7815bac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167599, "uuid": "5c3aa66e-5bdf-441a-9ead-c995e8999f79", "comment": "Malware payload (CoinMiner)", "value": "c6a35e65da4be7cc3be1d23f1a8d3de42dc547e06d146c792a698c34aa4f4b39", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167599, "uuid": "86b397dc-2046-4b9a-a062-ddbbc23169fa", "comment": "Malware payload (CoinMiner)", "value": "ecd1be310d63e722180dac0afa550e8ceb30a577", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167599, "uuid": "1b5c3b54-0bd8-4c2b-aded-9c7fa5a64dcd", "comment": "Malware payload (CoinMiner)", "value": "e6c5294385cf038bcb8df2fec72600ddde4a81df726e9dd462a5ca0365014202f755ec29d559cae37fa61314d993a248", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167599, "uuid": "21e48bdb-e1a0-4c60-8db6-bde3681db70b", "value": "T100168C98ED0F3912F3C7E23CCF4A97E172173694E32390B279D2524DD59E9E4C6A2A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167599, "uuid": "65c4a213-f991-45ce-a169-0debce8fcf9a", "value": "98304:7H9YwWCaUpy7CpMnt3IMSrjohWudd+tFW4:j9YwWCzfpMtP5GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167599, "uuid": "d34d3382-aaae-4e00-9ccd-c5dd57241c07", "value": 4199888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167599, "uuid": "d2f1d12d-6268-439a-ad55-f6708902a589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167599, "uuid": "aa11b5cf-3035-4cdb-ab1b-de9202caa72d", "value": "526c040bb853b294f4fb55f8301fa8a03d2bea9dc1877570fc98cc04890af440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7754fe0b-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154361, "uuid": "528792ba-2f69-499f-9f2c-2f9489e6dbe3", "comment": "Malware payload", "value": "ac53ce3cf876109f7e936dd7e20eb062", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154361, "uuid": "77cf668f-308d-49cc-925a-bdec59faada1", "comment": "Malware payload", "value": "c6c6cf7deb26562ac5a4dbabfde7cdf13800423b2fa6bcc3239f289895af4abd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154361, "uuid": "1d4a354b-e6fd-444e-b797-9678cd4d1013", "comment": "Malware payload", "value": "fb699cafe5b081d06ef30776686bbdbb0f777600", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154361, "uuid": "1e04b2fa-9466-43d8-bb28-afbe1b2e0b1e", "comment": "Malware payload", "value": "75595e85795860187babe060e6636077969543e89586e1061ce9990e7310ac04652836fae8a439393276b5e96a0ca9b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154361, "uuid": "f298ddff-08d7-4f47-8741-4ca4adcd949d", "value": "T1B021677899D7FD43FC32613A1A55670A1084D43EE239BE23370E7265BA2ED801318638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154361, "uuid": "0a34500a-d903-4c8d-891b-bbb96a74a1e7", "value": "24:9Qno8scTJFDuX/AOWD3m58IevTzpshmSD44PsiPtmnmnnpAVtl:9QjRD1Oe3mJyPpshPDxP7nmVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154361, "uuid": "736fbb69-a2d7-46d8-99be-228a51e467a0", "value": 1178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154361, "uuid": "6b8f812c-4024-479d-9671-54bdffefc895", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154361, "uuid": "ba308947-e283-47a0-8281-93988f6c1da1", "value": "photov_118296204477.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63bbc0f-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785167754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167754, "uuid": "a0767917-4e49-4f8e-9e58-f3254f7c04fc", "comment": "Malware payload", "value": "ed9418868a6573e9e1e47b8fd9e0abdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167754, "uuid": "cb613436-82a3-4442-8d9a-ed59b3e8c5ea", "comment": "Malware payload", "value": "c6dd2cf27b42c1f06f098b489bc44e153e1eb855e923ebe4d0e9ff56a780b82d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167754, "uuid": "dae41dde-3dbb-48b8-9ca3-54e329a46801", "comment": "Malware payload", "value": "c1f8bf04be778c64029d02ada70fedc4878d74ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167754, "uuid": "d6ab5f38-192a-4cc8-8f16-2af27be1d574", "comment": "Malware payload", "value": "78387c3e4e39f963e2fbb343d3dc6b20928e625bbd98f847f21a8cc635963b1faf49bc4bbac7fc0511f7a0ab7c0792a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167754, "uuid": "32da8ed2-4407-43f3-b317-9c198547e4d7", "value": "T113A5F857E49590E4C0EEE174C726A213BEA13499473837E36FA187F11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167754, "uuid": "979e5723-6f62-4433-9057-964cf89efaf4", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0U:cqYUQuVDtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167754, "uuid": "32e1959e-77af-4206-af65-fe79bf0ead50", "value": 2162688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167754, "uuid": "a051167b-e194-4013-8e22-178c7611c92b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167754, "uuid": "8b670120-0037-45f4-9e4f-ee507f6691bf", "value": "c6dd2cf27b42c1f06f098b489bc44e153e1eb855e923ebe4d0e9ff56a780b82d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622886b5-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154325, "uuid": "ff6d0863-521d-4ed1-95cc-d965d3b70ecf", "comment": "Malware payload", "value": "c33b5713906b48b0bd6997525b01caa9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154325, "uuid": "6616f83c-7852-4734-89f8-7ab1674808bc", "comment": "Malware payload", "value": "c7ad3c3bcc7cb4cdc5c586d0415121a07c2694097a6526dee2b261e15fa4ac05", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154325, "uuid": "8eb77f8f-f184-4036-af9c-e86276dbd00b", "comment": "Malware payload", "value": "62d3baf69f255ad8550bd56c1fc62a6992d770f8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154325, "uuid": "391aa511-a4ec-4c24-807b-1d75462db7b1", "comment": "Malware payload", "value": "a427be98dc0f7bc192db9d5e87017da76927e867ad7f6528cdcfe0bd64417dcc07a7be28a68ce7d90131fa411986fdd8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154325, "uuid": "bc0ac558-d716-4b16-b817-9845ab12cef2", "value": "T18E21B9819299CC91EACEC3F34D5FCDE43A180511611374E7430B0FC86E0FF5D4652A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154325, "uuid": "83f435f8-30f4-4b7e-8ac3-07ee04d482f9", "value": "24:9kIVrP6FIEG/U04OBq8tb+8l2mSH6HEbLWqnXn7+8NAQk:9k3FnMq8tb+/PzW47+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154325, "uuid": "9cfc6e7e-6619-4f56-a45d-c4a04d6614c5", "value": 1147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154325, "uuid": "b19decb4-b19b-4fc0-8ba9-1ba476379394", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154325, "uuid": "bd3a3ee2-572b-4bc4-b6b4-be796b191367", "value": "photov_899246928324.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83b5684-8994-11f1-bd95-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1785140780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140780, "uuid": "ec4a7220-f7b0-448e-9911-aa26e53444db", "comment": "Malware payload (SiriusRAT)", "value": "192a97ab073d1c6f3e73ca0619eab8ae", "object_relation": "md5", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140780, "uuid": "a4eba819-b8c3-4bd6-993f-86d56821ecfb", "comment": "Malware payload (SiriusRAT)", "value": "c7e2244762bdcb8c81b3fa0fdc4d33dae0c059ae00064fa0db38b64631854a0a", "object_relation": "sha256", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140780, "uuid": "583082a7-7597-44b3-b5b7-0bbaa782d549", "comment": "Malware payload (SiriusRAT)", "value": "d39f9907face41af02593ad63754e2555eab3357", "object_relation": "sha1", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785140780, "uuid": "445f7016-324e-40d0-901a-8935fb64e1c1", "comment": "Malware payload (SiriusRAT)", "value": "26d11369d8e08fdd91b20f7edfa88f01333dcfc57ed1a4d761216d1bf7498401bbb06b64ea4dc15ad4a807ff0f6b9b5e", "object_relation": "sha3-384", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140780, "uuid": "2297b7f7-e30d-40ac-9a8c-a0ac5d45eeb8", "value": "T17DA4EC34ADFA502B7173AF698BE47597F91FB663370E58091093034A4A13A42EDF163E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140780, "uuid": "1fca77d0-6ad1-4fdb-887f-a85c7122bc53", "value": "12288:GzAYRsB0U9L0ATr/vcCqPWIvAKf35hskIjxWAGJ7d0szcMaXpVT:h4UKrxAW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785140780, "uuid": "2309db01-430f-4669-a5d3-9b50ebe83556", "value": 464736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785140780, "uuid": "bfef9376-fee9-4dc5-9e99-74d17268d797", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785140780, "uuid": "c370e443-6bb4-4ad3-ad56-69f267493da8", "value": "RFQ-2026-001_Supply_&_Delivery.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32d06f7-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133443, "uuid": "342548f0-5597-4bb0-8b2c-75f0eed09cff", "comment": "Malware payload (Mirai)", "value": "8f941e72a24b3bb80244f17b53d01385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133443, "uuid": "7c95ffdf-11f7-4178-8b91-04c60893309e", "comment": "Malware payload (Mirai)", "value": "c801d9444ffc077dd137dfe41a6a5b5b6818a377b4e6d725bff604dbf266fad5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133443, "uuid": "7a688838-795b-4027-a429-26351b11b5b0", "comment": "Malware payload (Mirai)", "value": "a74940fc9ea02c56e2d0904b4680829b27691e34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133443, "uuid": "8a94ae29-bfe5-4013-8058-6489de672e2c", "comment": "Malware payload (Mirai)", "value": "ec94cea060d27d903ae143c435460ae77e5fbad46187064e93b6250c5ef60559430d57dff2a50c3b12fa9c3b13d04406", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133443, "uuid": "e076e7b3-e6e3-4849-b422-5a6fd96a3d31", "value": "T142E307D7F900DDF6F81AE33748530906B230BBA649925A373257356BED3E1990473E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133443, "uuid": "ebead0ad-90fc-4084-955d-52e547e998e8", "value": "3072:Cza+WVypSpe2OyIriUWP8QQGLFV1jbiFL97XhKHA:7Vypue2OyMikXGLYLhSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133443, "uuid": "aae32f2b-ab75-4f39-9226-0bf69f700d2f", "value": 144992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133443, "uuid": "fd8737f7-db5c-4aad-b25b-d4b29d09b026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133443, "uuid": "547b2366-bbe1-45c7-b849-442d7129f7f3", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bfb41f9-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785168166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168166, "uuid": "67ed6e12-bbf4-4f18-8a33-556f8d29057a", "comment": "Malware payload (Mirai)", "value": "e7fd198f74e23cecbab9272144fa08e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168166, "uuid": "10d3c20d-76d7-4c08-a900-912a9d360cd2", "comment": "Malware payload (Mirai)", "value": "c859d49d60cd38d913408e6ee456c4c362bd769785abc220425dfbddf831e4c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168166, "uuid": "40fe4fc2-31c7-42db-9181-bb8f7474ab4e", "comment": "Malware payload (Mirai)", "value": "08f2c75c966384219c4bf65e7520e226c6a00252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168166, "uuid": "cffdc4f0-cb2f-488d-8d1b-479485b03f0c", "comment": "Malware payload (Mirai)", "value": "2e7889484f6fbf1eeb38bedc9e7e0e72a2e036d097051b5499f46fda6cea2e7605ac5288525ca4e351c1708754228daa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168166, "uuid": "cfb54fa4-e986-47bb-9329-8fd7cc161950", "value": "T174934B02B3080E47D1A71DB0353F2BD197BEE6D121E4F689750FAB9692B6D331486EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168166, "uuid": "e2944560-4421-4d91-84ef-8fbfb74e9bb8", "value": "1536:XefrO+xXyy3U+M8JekB7T9/xtLUWnJKUBKgslCe/SNRcYJfqqS2JINAS:XGptyz+VJzB7T9/bLUAx9e/SBJOAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785168166, "uuid": "9248fce0-fbc9-40b6-a804-14d5092aa708", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785168166, "uuid": "4cc52461-ab34-4502-85a2-d933a041e021", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168166, "uuid": "baea1642-4077-45aa-83ca-1a58a792fa77", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581b3907-89b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1785155168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155168, "uuid": "8fb03b13-07d2-4cc8-9239-7db333af9395", "comment": "Malware payload (PureLogsStealer)", "value": "67073352c54815574913a2f184b15abd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155168, "uuid": "371b3815-9f0c-44e0-8344-3ef6ad815736", "comment": "Malware payload (PureLogsStealer)", "value": "c89aa97ce9b0306e4dcc3f00227e337e68d3769502f082ed999b80513a2093cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155168, "uuid": "9ae0adde-5a65-4b64-9059-09b06f126e93", "comment": "Malware payload (PureLogsStealer)", "value": "1cfc117331d07ca2fc2dd1c758b2fa24a21966a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155168, "uuid": "7fe0cd8a-9f6f-4fa3-9e5d-13f883d6ec35", "comment": "Malware payload (PureLogsStealer)", "value": "6c341e09a2a11a5ce14188d21c46ef4742b1a31a034c73f8c1804b8a67d4f2afc15c37335e72c30038d34856eb55c985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155168, "uuid": "9878a2ef-ebba-466f-a4a7-f39d39f4824a", "value": "T17C55233A1856FB730B1C032D23AF1A33227C758DA46CD6945B9129CD252B723096E6FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155168, "uuid": "2db990bd-3ed9-431a-bec1-d511f04d7f0b", "value": "24576:o+SkaqbOZhhNNObfejuxOkAglAaTIBg7wub9qWqcKgflRuJSsgsu:602ucmTZqJT2lRjsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785155168, "uuid": "058fbbcd-a115-42fc-8a21-4e6d2ab1eff3", "value": 1377514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785155168, "uuid": "f65d41a1-155d-4603-b47a-176d53a8cc01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155168, "uuid": "12ada56b-d6f1-41cf-b34c-0efa9848c006", "value": "NEW P.O 2026-03783292.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7f2d28-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132603, "uuid": "90e54f47-df9c-4539-8aa7-734730a7512c", "comment": "Malware payload (PureRAT)", "value": "b8ea75d9e6c00dd1713c955ef8ef95e1", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132603, "uuid": "71fed2f9-30b0-4fe9-bc87-646704767f00", "comment": "Malware payload (PureRAT)", "value": "c8e58f7fa40cf7bf57fd637b02bfb8d4369f5168d3871e1a192b4c622f8a8fcf", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132603, "uuid": "922800dc-2ea4-4c29-a236-61cd7a18e140", "comment": "Malware payload (PureRAT)", "value": "7e37a194adc41402e58f3579224bc13c72ecd6db", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132603, "uuid": "77480403-e93d-468f-b4fa-0e9ffee677db", "comment": "Malware payload (PureRAT)", "value": "8b00b1ebb1c16a0d6dc3c0b6709bb2fadb9365195ea84351460c22bdba91e93afb03549986ee717a955d0f0a026aa0ca", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132603, "uuid": "9802eaa6-74d9-4bee-9cf6-ac8ef44c29d4", "value": "T195118638D01DCDC4C8D78476A97726AE256120828A27681E034369BC7DF399DAB004F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132603, "uuid": "6c618812-7e4d-4e05-9fc0-a6ec10552e04", "value": "24:9k2lyNr6Ks4ji/WE02gBOm55ZmSPhGY7+Ew/23+95Sxml:9Ep3jvHZPpGY7zlxml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132603, "uuid": "37fa049b-1baf-4ce4-a263-38c466c6bb4b", "value": 1100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132603, "uuid": "fc986f33-b149-4a86-bf3a-4f3dd85b747b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132603, "uuid": "97724ea9-d3ca-4c18-b649-f6eac6e37153", "value": "photov_416471674203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5bdc565-89a4-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785147594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147594, "uuid": "0d5de2ec-8748-4134-aede-4912c5b58be3", "comment": "Malware payload (VIPKeylogger)", "value": "6d35991c80b4b89ee4acf2294c63d14c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147594, "uuid": "0797e60a-bef2-45d4-86c6-80c00dd09b17", "comment": "Malware payload (VIPKeylogger)", "value": "c94d8d3467ed5eb1697103133cd47600c7095d6ac34b3424e1dc26c2f126145f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147594, "uuid": "c6ac6cc2-df51-4f3b-8a72-417cca31288d", "comment": "Malware payload (VIPKeylogger)", "value": "e18fb4adbbb1b02e21f8273042ee84158f8e4234", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147594, "uuid": "3f9c4722-3dc6-4ad2-a3bd-9d99ea52ec30", "comment": "Malware payload (VIPKeylogger)", "value": "9eede076d238794dc8155f1ce884eb7e6f8cc2cb2ac6cf14e2198aca644956e027a39ffb200c24760bdc6b5faed66c29", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147594, "uuid": "44bc493d-c7d3-4469-b688-7ee91ce67dde", "value": "T1CE65931D67CC2F0B48B92F39CEF657463A37CAA18E0BC15E752BB054E9DE78443949A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147594, "uuid": "87841adc-b912-43b9-8bf5-83030d2a4c70", "value": "384:y6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Q6Qt:XxyRtZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147594, "uuid": "e9d37ce3-3c06-4f3a-afb2-3d58f12c99a1", "value": 1468183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147594, "uuid": "9d25c8a4-01c9-49d0-96ac-5687e5a95f71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147594, "uuid": "4d128a7c-329e-4d06-bf33-5731c4e67acd", "value": "SATIN ALMA S\u0130PAR\u0130\u015e FORMU_xlsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5896672-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132641, "uuid": "6f5f4ede-fd3b-4fa0-967b-a24783f76f4a", "comment": "Malware payload (PureRAT)", "value": "0d5d7648efd4283fdd61bc0139dd344f", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132641, "uuid": "0d8dc2d6-7229-4d70-93bc-162cb7cc909d", "comment": "Malware payload (PureRAT)", "value": "c957d8c11ebeccf2ffaf01b2a80a809b90ccfe1e0b068a50b18d0e69c82a8d77", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132641, "uuid": "e7783fb5-60cc-4878-91d2-ff61b4db5826", "comment": "Malware payload (PureRAT)", "value": "bbf1e7212e4fd52de01f931ffdb2367970ac0afb", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132641, "uuid": "19bec176-6f01-4c5f-965e-af1c583d895f", "comment": "Malware payload (PureRAT)", "value": "8c07cb646736a5ccb0441df032f83fcde0060a223003bcbc0ada758839983bc39fe54ead13d02c77a8e8b247b73ef780", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132641, "uuid": "2f91d842-8b3a-4703-8dd6-c5747a8dd980", "value": "T1C121849CC9ACFB89C0CB9C35BD18D54D0044A1ADE01272E39698567AEF69F8E17831F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132641, "uuid": "58a677f2-d150-46f7-8376-8119cd2b05db", "value": "24:9EzSN6i5Gl+fRE8oQmdY1byoT0yLy6+MXjWd7mSorhGY7RFVXTMSbWnWe1+OTwF5:9Eu15GYfpNm+ZyO02jWd7PkGY7RDAjsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132641, "uuid": "daebe705-d556-4694-b7c0-a1ebc620393e", "value": 1282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132641, "uuid": "549a9453-a7db-4202-8da4-d8cdfdf370a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132641, "uuid": "afdf3730-a788-49dd-8cdb-7ec0d3de9c98", "value": "photov_173624634575.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a67e0af-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132811, "uuid": "ba1e7c24-ac39-4e8e-a99d-174d8fa9caf2", "comment": "Malware payload (PureRAT)", "value": "de4fe0e7df4cb83323d8f5a9dc3739ef", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132811, "uuid": "2cfa732f-7db8-464c-9668-2732580bff9b", "comment": "Malware payload (PureRAT)", "value": "cad8e4174c49afea6d757ce377f7614685f83e319a257ed22b998fb1d3e60c03", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132811, "uuid": "3fda200c-c64a-42f5-a53b-bc9a50e126df", "comment": "Malware payload (PureRAT)", "value": "02172dbc32dce6bbaa5a2193d430e34ebe19453f", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132811, "uuid": "9f94b336-3a3b-4035-8756-667b4d53afb6", "comment": "Malware payload (PureRAT)", "value": "9b87c1dc93af47545d307a75d9a7dfc7cc10afa86c72dda509a1d46ec2919b192f5652f711eea2056419f0e05fc747ab", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132811, "uuid": "731fea09-7930-4d5b-b239-6ab9d8b6039e", "value": "T16F21A7D8D1EB4325D89795713C96AD4A660626F91608B293071E96873DF61A87B10850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132811, "uuid": "43720c33-6f08-4a12-bc4c-c93543661a73", "value": "24:9kk8svuTphzT3rkn4YkNzIL4S9zex0mS2+xB8ZdqCCmigmEKTb+29zxxlX:9kkMh/7kn4YhL4S5ex0P2+AXijXB5xx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132811, "uuid": "686fa547-085a-424a-958f-cb56adb5740d", "value": 1219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132811, "uuid": "d80dd95d-c19f-457c-baf5-ddd0fe6aa11a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132811, "uuid": "ab2ba13d-00e6-47d4-bbbc-99bd3f400d4d", "value": "photov_701003436761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65784435-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143594, "uuid": "96c16bc6-6a2b-441c-abbf-58fa0feec99c", "comment": "Malware payload", "value": "4ef33dfd53330572defac178810f8e47", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143594, "uuid": "5001a6c4-87d2-418a-8778-f8450a0983a6", "comment": "Malware payload", "value": "cb825977362f38b7523f7b2a40dc14ea433d4c9f7fb2281f8b2a3675be7250b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143594, "uuid": "a4859ae0-cbbc-4498-9071-8455d1c900f8", "comment": "Malware payload", "value": "a4622bf16883e4df193bd2fb70fcf79b6bc75f56", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143594, "uuid": "1bbb0a32-cb93-465c-9ba7-f1789042ddaf", "comment": "Malware payload", "value": "e70268cf685b3a82b50af90ac463c622dca9cbbc8cdc91c0ac29c97b1dc34a83ba1a703d63ea63464d30edd0538ea815", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143594, "uuid": "61bdfb0f-30af-47c2-b518-c2edc022b2e9", "value": "T13E21988C816EC651D45392B36C35CB24271989583C19D85503DFB5FEBB09A5D0F14657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143594, "uuid": "cfaaea9e-e511-4f84-8dd7-2904486e0bf5", "value": "24:9dq7lg3/loMg7bDmBwZaT0BqnKAg9mC5xyEuHUmSCbMHTE4E3dRsGfRlKux/x2H0:98ElgP8wZaT0BqKe4xyEDPNQ3fxf7K+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143594, "uuid": "006bab1d-671f-459a-9a96-66571d8d96af", "value": 1311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143594, "uuid": "3cdc0c47-8459-4735-b80e-678a871c60fb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143594, "uuid": "e58ba254-df60-4b62-9c69-93b7f96d45d3", "value": "photov_855606278985.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b007ff-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167758, "uuid": "9948de2c-0b35-4c1c-a8be-3f5b68580259", "comment": "Malware payload (CoinMiner)", "value": "2cacbcdfeb26d1725d80422e253a2fc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167758, "uuid": "a587af8e-9902-43ef-a24e-4b4d71d8cf91", "comment": "Malware payload (CoinMiner)", "value": "cbd57b480505947bde04f95df8639eddfdfde609b23ba4669b7cdee6ffa77d19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167758, "uuid": "c109b29a-dbbd-4044-ae72-34d074d72263", "comment": "Malware payload (CoinMiner)", "value": "57e1d0b782c174059611aae4a6d195c1edce5536", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167758, "uuid": "a7bc35cf-9d75-4d9a-adf7-4e46b56cae14", "comment": "Malware payload (CoinMiner)", "value": "eb8ecf8473b7b913720d34f49020b83612203185838aec695d20e5ac7fc674eef44ca272f2ad5d91b448d682521814fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167758, "uuid": "3489d59b-56b9-4f3a-8628-b3af8352941b", "value": "T1BB853354E38C4944F9E349E117A1AEFF8DA6B14CC06E1B34EB3E91C446B5F250FB48A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167758, "uuid": "efe65a53-2aca-4261-af97-d10c464305de", "value": "49152:BTqdFctG2Czd5CSZSX+TEYVamMld+DQa6UGpNEQcjCbuvqLWu4a:sctG2aCSHAVmMldmQjpNEH+buaW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167758, "uuid": "dbbae900-ab21-42d8-8315-6c37400631f6", "value": 1796112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167758, "uuid": "b0d52abc-1f9b-451d-b1df-524dca61f250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167758, "uuid": "ddce4a48-3195-42b0-8ab7-2150b278ac92", "value": "cbd57b480505947bde04f95df8639eddfdfde609b23ba4669b7cdee6ffa77d19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac1ebb7-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "cda3e4c6-32e7-4b67-bc95-ef12cbded0c0", "comment": "Malware payload (Mirai)", "value": "440e581fdbe45b3d890aa06e346965f9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "48480e42-9527-4c67-be27-721b67ba2a46", "comment": "Malware payload (Mirai)", "value": "cc35442a31e308625864a25dbf0c59092529aed0e38cfebd59c5713fa347c04a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "3366e7c4-eedc-4590-a59a-f071471aeae7", "comment": "Malware payload (Mirai)", "value": "ce4f2627f2bc5791d7576402d7a269d797e38d40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "4d0dca6d-fc97-49ec-88b2-6499edb10007", "comment": "Malware payload (Mirai)", "value": "f4a6d690037ff02fadefa93be4f36700fdf22278fd9cbe564be42fcf7491abcb5794d1c9fc96ebbdd7de5762e1e50ed0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "5b589eef-9813-498e-ad9b-4c60c3e410cc", "value": "T1EEF22B56AD56CA02DAC42277BB1E42CC7F2603ADE2FE73035E196F616797C270D3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "bf1dadcf-3d9d-40e9-a120-aeeca6a7fd82", "value": "768:PJzqTCH6/6Jqpf+guCgs9pcQwiNkWlqxU4xoi:hHa/6Jqpvz33c0RRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156434, "uuid": "0b4900eb-d276-4c5e-870a-86b800a9d293", "value": 35824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156434, "uuid": "da1bf40c-2e85-4fd2-94d6-03e7b5820891", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "1e9ad899-6dce-4dfb-944a-afdb9fe24ed8", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5640b54-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133071, "uuid": "cdac0711-f1ba-45f9-94dc-df6e211e144e", "comment": "Malware payload (PureRAT)", "value": "6d0ffadcb6d85aa87964ad78fe601a35", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133071, "uuid": "cfed56f0-d894-42fc-ae1d-4da8c1272caa", "comment": "Malware payload (PureRAT)", "value": "cd29040303d728fd1f60ce999ece56dabe69f5315e57ebdd65fc9312c26e0a63", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133071, "uuid": "8ca475aa-859e-4c2c-ae2e-14ffb30ddca2", "comment": "Malware payload (PureRAT)", "value": "7b83fe0023983a31f93f9d42a6b143355e921cb3", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133071, "uuid": "b71c2b9d-b7d7-49a6-aa30-07158db602d2", "comment": "Malware payload (PureRAT)", "value": "bd051a95c470ab50feed9b8baf464b015afbbd341ec83901a077838c7abe299a0217c50555d2fa332cb41f864c12a146", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133071, "uuid": "d14697b3-255f-44e8-a52c-5cb505f323d1", "value": "T15221B6ADC0D9DA86EC03A7371427FE642AE1D517A12B9402A7B321FCDE026EC7FC1040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133071, "uuid": "65b933c1-6577-4d19-b63e-d4cb199997d0", "value": "24:9zHjtIs+MOGQOCkOcmAqlJeBmmSIhheY72mVSbBcjPTK1UL74:9zBjiLRcHAP0heY7HSbmjPGWf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133071, "uuid": "1cc82f30-7790-46f6-aca1-476055e82868", "value": 1127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133071, "uuid": "bfee4a91-b40f-44b7-aad9-e997ef654c79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133071, "uuid": "c0fed95d-00ca-4d3b-b4d9-3b843b383594", "value": "photov_673784645957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914042f3-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181033, "uuid": "2c4afb0b-401b-43a6-a25d-40425fb61119", "comment": "Malware payload (Mirai)", "value": "f38f263e2bbb77465eeefa7b93621e5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181033, "uuid": "4c17730b-1e55-440e-b706-94b072b909d8", "comment": "Malware payload (Mirai)", "value": "cd53aed245ab98676bb8647e627677a6d4c5b08e8645b384ca1d6abfdf0586eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181033, "uuid": "4a9bd1d8-d318-4c93-b3e3-50d1131a382c", "comment": "Malware payload (Mirai)", "value": "cf0b4bac42733f31aa90e0ec43fb496bf696102b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181033, "uuid": "21df2ed9-e6d1-4275-b437-4875a16a5cfb", "comment": "Malware payload (Mirai)", "value": "0a2ee94950525c1c438d8ac748dfef0dcc042f61f6369fab394ca1e996cad4f2280b62ae803408d5a439bc3159b1e237", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181033, "uuid": "c3147a5a-38e7-4207-bae3-ea719e996af1", "value": "T14AA3E506BB650FF7DC6FCD3706A9070225CCA51B22B93B367674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181033, "uuid": "8a31bd32-565d-4fce-ad4b-790c1d26cfd4", "value": "1536:LvGefaZSdtug4/xl4ExO29zyN0ZNhdZp54crFCZeLs/g5J:LOefaZSds59zm0Hr6etJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181033, "uuid": "cfec3440-34e4-4610-8f05-34ab02624fce", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181033, "uuid": "f7861a20-a25f-4136-a727-96274c144ca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181033, "uuid": "975350f7-8c3f-4122-9bee-ced2bfcc57ab", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aaf6709-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132704, "uuid": "5670e8ea-d7b3-4e07-9c29-269c94ad27e8", "comment": "Malware payload (PureRAT)", "value": "3e4963bd2ac2c0f8d02942a967e2abfc", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132704, "uuid": "6becb833-c293-4730-b8b6-b94d7a5c28ad", "comment": "Malware payload (PureRAT)", "value": "d0b7b7f37ab291120fa8291ae23c968db5b30afb8412a2ee0b2561a1aec29c10", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132704, "uuid": "18d690a7-c0a4-4b93-8e52-0b578736ac1a", "comment": "Malware payload (PureRAT)", "value": "ca07ca65cced721fb40381ccbe99911fa53e3004", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132704, "uuid": "f518d9fb-7f24-4111-8ea7-0500bf390e81", "comment": "Malware payload (PureRAT)", "value": "0184963e1dbf4b315412a5d9d3ce307d4696273bda36c31eaee8a63d6f6f812de68db4a5eb6fdc56709d8b4de323a569", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132704, "uuid": "73f79063-1ca5-4e88-985c-db4f5d766979", "value": "T1A921A735847DCF55CE97C332AE9C907A1C6353D809B0A19B4231F6D397835C8174E1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132704, "uuid": "cd0a961f-75c9-444b-861b-fe5c88da2aed", "value": "24:9DD4jhv1z0+VbKBOGXPm/jH0sQcDt1oNEYYImSphv/3JJx+P2D9sHqw9:9/shv1z0+VbKBpfzcD7XYxPPUgGHB9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132704, "uuid": "f9f4b951-3371-4247-806d-8c31bd7d4255", "value": 1208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132704, "uuid": "5a97e79d-6439-4750-a71b-9ca738a4fd80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132704, "uuid": "5fa4ebc5-8c03-40cf-b732-88e04983e0fc", "value": "photov_080785206615.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61033dd-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132616, "uuid": "98593eff-34fb-496a-ad22-145b99ee5f94", "comment": "Malware payload (PureRAT)", "value": "bb5ac110e215692fd96b41e93b13b1f7", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132616, "uuid": "a0afedf6-95b6-4129-902f-a47499cfd6b3", "comment": "Malware payload (PureRAT)", "value": "d17ff95ee08012b3722c32eae6388f980d920aa654258e52e3c884d1818d8152", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132616, "uuid": "07b617f0-16a8-4b50-817a-8442a91c44e6", "comment": "Malware payload (PureRAT)", "value": "7537da67628f85b2b7a2160830aea515b230fa6f", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132616, "uuid": "ead0c7fb-f2af-4e4a-b7f0-8973ffa25c7b", "comment": "Malware payload (PureRAT)", "value": "214e3bda6f30b7ee339c6a55bb4851b61bf9ce516ade991163d04b9042bd441dbef83fa85ce239e077a3d223d1944b00", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132616, "uuid": "c7d1c9e3-81ee-4d00-a1c0-6109ac2e0424", "value": "T1AB21A325802F4881C48BC43E6C4FA1B2036B57FE4214E70A36E768F73D48AD43B88DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132616, "uuid": "0d488538-3c2f-4f5d-bf18-ad54594234e2", "value": "24:9/zgO9nKk5kI9nt+BSpejY5gJMjmSeMrSwYV9jrnJWv:9/znnXxjPHO/ZWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132616, "uuid": "eda9d9c1-63a5-4109-a7c7-a77988a607da", "value": 1197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132616, "uuid": "83cec7cb-3e7b-4c49-8a2f-b538ec60110c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132616, "uuid": "14a0747a-052b-4b42-a239-4b440e642bbb", "value": "photov_860181865552.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25207eb-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132985, "uuid": "a81d471e-5f39-434a-9853-929906c22a31", "comment": "Malware payload (PureRAT)", "value": "2f1924a50d1999bfca3677c2a2d8c7d9", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132985, "uuid": "8095b52a-2fe7-4686-8499-0321488e736d", "comment": "Malware payload (PureRAT)", "value": "d1bc696ed4fd9e9c79ad5b9a6246e5a386f8b939e529ee9bd64511bfb5730575", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132985, "uuid": "2eae5936-944e-44eb-9eed-ff3ef242d4be", "comment": "Malware payload (PureRAT)", "value": "b49b992a667b33e6de727294afa4bcd3eb58966d", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132985, "uuid": "356ec6d5-c5c1-4604-bd5f-eb9f04aab235", "comment": "Malware payload (PureRAT)", "value": "502bb81cc1cc322ae2a45789e2e7bd236fbae54a4c0a7e5938202942c7a7f4280e4746633c117b31459284a7e9fbf57c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132985, "uuid": "4a98cd5e-2649-46b0-b873-cfe73ee80a21", "value": "T1E021C660C0C16C16F99F3433703A9D9A44280B0E400D849E7771A89ABB3FDCCBB049E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132985, "uuid": "dd7bd8a7-6587-4600-baea-cb5c0833579c", "value": "24:90SoC0D+E2lvZ5LvY4WdashVILnD385hmSYV4R8W6lU32A55:90SD0GvZ5laa2V2D8PJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132985, "uuid": "81997688-ce6f-429b-8737-a26210e20923", "value": 1169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132985, "uuid": "f98cb321-6769-4ab9-ba72-1d3f1864e639", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132985, "uuid": "2a18d049-ce0e-4379-9884-7cdcfc41f01b", "value": "photov_927004824038.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e390f51-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133166, "uuid": "ab818185-aeca-448a-9b5f-605499349a8c", "comment": "Malware payload (PureRAT)", "value": "b2a40e125ada9705997cb039fb230453", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133166, "uuid": "fc8cf3a5-7e77-4d16-a373-c1cbc51b58f6", "comment": "Malware payload (PureRAT)", "value": "d231dc8cc7be8d8254a11d1a0a790c2bf79b20f7f8f0529ad95cdc9a85266958", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133166, "uuid": "b1bb0aa7-2bb8-47f7-b4ff-9cb3f46cfe92", "comment": "Malware payload (PureRAT)", "value": "7fc9fee04531a7f1142809a5dc34d1b237c5c8b2", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133166, "uuid": "a9106b0d-8f62-434f-9609-d539069e1fb0", "comment": "Malware payload (PureRAT)", "value": "bd2849f0bb0012aef235134e0b0393fe2e32c3b39535a0fe3c866ae42908627026ed432cbc588f750100082a9d020e55", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133166, "uuid": "6c80163f-d84a-455e-85b5-29cd255ed48f", "value": "T14021C6F9E46DCF03C66EC6B62F22238050A150810011B293FF5A9867BC65D86F3C16D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133166, "uuid": "c2f4a297-9882-4e41-883f-7df9e572426c", "value": "24:9bAi5xNvd/gZp257DP7F950mfK6HmSepbnEblZsWqFg3Xd91jjX:9bh56q57DjLWmfK6HPCWD3XpXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133166, "uuid": "a7113827-6f19-47d7-9231-52f716406d1d", "value": 1162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133166, "uuid": "bc30707d-19b1-4377-bb15-47c7351cfde9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133166, "uuid": "16fa7c0c-a95e-4531-9d28-cfbc209453dd", "value": "photov_527849238883.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27538155-8990-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785138765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785138765, "uuid": "20f0033e-4b11-4aa7-9ce4-d799930af51f", "comment": "Malware payload (Efimer)", "value": "e704650185db924cde0393601a50146c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785138765, "uuid": "3915677c-0b4e-4157-8d36-b5477b568583", "comment": "Malware payload (Efimer)", "value": "d276a797d263894eafc88f2229c6227dd8ac88ae241180a2560b6c21c5da4cbc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785138765, "uuid": "fda58061-ab6b-4ec3-919e-77a730953598", "comment": "Malware payload (Efimer)", "value": "13aad4d139fa8641544060a0848ceca2f83c3b0e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785138765, "uuid": "bf2fc971-537d-4497-bd27-3ad1f714346d", "comment": "Malware payload (Efimer)", "value": "3dd3134891c5b904535deee6ca9bed3fdf2ad335a1cc5a9e86041056e664f8f1ca5635292fb8f1049994b7f9f68c1e14", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785138765, "uuid": "8c7aa963-444e-4ebb-8fc0-ed2a5995e97c", "value": "T100E6330469E025EFF977403CEDA164A6DA3638390772CE9F9EB887762E871D09934347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785138765, "uuid": "cb41e4e7-2607-40d2-a2c4-ee78b1d7a1e1", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785138765, "uuid": "140071fe-bdf0-4ec2-8fdd-78778e58a400", "value": "393216:+z0z2TYd3D+iJNiSpaNW79y1jZb8XMCHWUjXJcuI3/PGTAI:+zEd+iyKaEYxZAXMb8X+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785138765, "uuid": "f94b7cad-606d-4687-9f44-bd74852f13e1", "value": 14292852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785138765, "uuid": "6e7345b9-23b8-48db-b256-907c51b68652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785138765, "uuid": "fb262b37-86e3-4bd0-a149-9a6fd6659e1e", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9025bf-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158366, "uuid": "f908de2d-1a4c-4e8e-9f94-0f0701c7c5db", "comment": "Malware payload", "value": "2371ad79775aecbe4d70d849f141f8df", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158366, "uuid": "a37ec066-0be8-4608-8065-ab471974e3c0", "comment": "Malware payload", "value": "d28451d7d841988dcc93285c453bc9e93f7e339818ceef96dbc317ecc4a2bf5b", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158366, "uuid": "7bd51f03-81bf-4952-a5f4-eb9f9f9a5b02", "comment": "Malware payload", "value": "cd116ebcf55e8ea855d9e99431142176e0a08b01", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158366, "uuid": "1fde4849-89ca-4ee3-89d9-92ed749cc7ba", "comment": "Malware payload", "value": "1e72f10670bfc21d04820931fd827557fdb10870a4c935ce72a92e4a17fe5f42560126a71093746a23a315d3c622d9e5", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158366, "uuid": "44f44d89-6e6b-4e05-8bbd-db80231ba512", "value": "T197578D65F7880A98D065DA34CA27A717C2F1B8D60335A2CF139D5A891DB3BC15B3AD3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158366, "uuid": "65d6c9c7-d3bf-4c64-9e23-8e730b19a67c", "value": "f7e02f7bc11db9a86bc6e94b64ef6cd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158366, "uuid": "12b2ec20-0197-457c-bd52-615f693c3e67", "value": "49152:YIhVnn7vByv2gCJmgtGoPIhPQTU1xLLu5uaLdUvjd1RpA:Ycndyv7gPqPQTU1xLLu5uaLdUvjd1RpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158366, "uuid": "f58e3ccd-ed6d-421e-a90f-bd578bcdd028", "value": 27918336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158366, "uuid": "7ff2542f-ac8f-427e-8bb9-fbe9d56eae81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158366, "uuid": "0eca945a-a4a4-4c4b-84e4-330902d2ea2d", "value": "libwinpthread-1_2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3f3c04-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167766, "uuid": "045c90f0-aa43-428b-88a8-ff4e9ef05222", "comment": "Malware payload (Prometei)", "value": "bd11a6b7c86bfe4e0fd407b0be2554e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167766, "uuid": "93eb8413-9afd-432f-b39d-618cb23993de", "comment": "Malware payload (Prometei)", "value": "d2e9f95d58c56a2c000577b00a0d04bb96d8f9479e115c8dbd20e00195604971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167766, "uuid": "9664349a-b550-472b-89d9-8e1344d7c0a1", "comment": "Malware payload (Prometei)", "value": "ba088de3a2d3e05a7af056af4a47912f64f96201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167766, "uuid": "5fd47388-faca-400b-866d-91a6efcce5c9", "comment": "Malware payload (Prometei)", "value": "dd27de4cf0b9995b2d7c23f6870ecf8a85644db7df6388ece83701251fddf3b877dcffc4685773e299245fbd8fd50eb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167766, "uuid": "c1c34dac-cef4-4685-b107-88d0d759dc03", "value": "T12534BE63A4BCAAAFDDD82F379C4E880713B66FE5D890203E1C44710EFE1A5095F3A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167766, "uuid": "cf98ad9c-69b6-4202-a0a8-9dbf2f657786", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167766, "uuid": "849aa152-df09-49f7-a21f-881f337e1de2", "value": "6144:zGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOi:zG60BpL8jk1FGjDc8GVdOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167766, "uuid": "56109f9b-59b3-4bec-90d1-42e57ee5e97a", "value": 246235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167766, "uuid": "a838a253-a2ae-40be-8678-9102359678c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167766, "uuid": "c660a729-43cd-4e15-8272-3fda0029da6d", "value": "d2e9f95d58c56a2c000577b00a0d04bb96d8f9479e115c8dbd20e00195604971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c730b9d-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133136, "uuid": "2ad0a03c-478a-48ae-befa-558f623415b9", "comment": "Malware payload (PureRAT)", "value": "3f984ccc8169f1f2012a0a6f58ce935e", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133136, "uuid": "c369fba9-c08a-472e-b0ce-a1c1f805114b", "comment": "Malware payload (PureRAT)", "value": "d36e869ca08a70683a8c1e6269b6c47ec36b0b0cd69067664479b1cfebf69cf1", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133136, "uuid": "97e091bb-17e6-4e9b-8180-3dcf69b61069", "comment": "Malware payload (PureRAT)", "value": "5c3049b9cac71f18b035f286a75e8e39062a326f", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133136, "uuid": "4cd42b8b-3795-4f4d-ab63-c881d74ad074", "comment": "Malware payload (PureRAT)", "value": "0ec2365da19fd47e8c69133d6d25f0660f3c61b315dc1424381a49a26873f7c9edf08f83b5c1e5bf9c679cf2b618a055", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133136, "uuid": "9a41c78d-6858-42d3-a991-675004bb863e", "value": "T14411A5F1E065CF05D87AC77B3D07A5B431BA94C08358C13E23A75E981DB7A451628962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133136, "uuid": "fe21f661-db19-40ed-bd5d-15459add934c", "value": "12:5jzeTgxOco6412EJ7L/IC2TovqK3Y21zYorRG0ZG6qShGOoIWky1Sl0abobeuWqU:9CoOc4aHKzrRq6qA7mSMbdWqUTSrGkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133136, "uuid": "242e89f4-1679-47e8-b7cd-54e8ed0245cf", "value": 1019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133136, "uuid": "126e7ae9-fe82-47a4-84aa-998b47dbf76e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133136, "uuid": "45c428bc-9018-44a9-a8a5-4f31fbbf8039", "value": "photov_638055251943.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec404b0-894f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1785110887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110887, "uuid": "893bb06a-08ca-4ac8-897d-7caf5865b982", "comment": "Malware payload (ZigClipper)", "value": "81729e5e6c1936b27f016a20897d30f1", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110887, "uuid": "88d1793d-1037-4709-8078-1c0cfb8fb87e", "comment": "Malware payload (ZigClipper)", "value": "d3e984f5e189ae6cd49bafa6298418583acab68292390bb63f21deec50740310", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110887, "uuid": "c64a28a6-90ea-4e0e-a711-ec383c1bb121", "comment": "Malware payload (ZigClipper)", "value": "4c2da29463731ead232871e15e781ffd5f710a9c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110887, "uuid": "91d09478-ab92-452e-9c94-512fdae5ab89", "comment": "Malware payload (ZigClipper)", "value": "cbf13fb071a9324a638644347b72cc2ff25b6cebbf88c1fdc2cd0da03c0e3a7d6e3a8c601db689f54e868e5218ac3b2f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "id-exhumepacifier-cc", "colour": "#449271", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110887, "uuid": "e9613a3a-c8be-4f58-bccd-162a348e3280", "value": "T181C48D56E6D2C1F1DD4349F1331FB32BBB7A5E2A8925C5F6E3E229499872361190F082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110887, "uuid": "e980c9a3-975d-4fed-ae8f-fab727e4e48e", "value": "12288:q8hW8fk0oD1RJ3/zk8XpKBB2iqSCbUdcw0E6/h0EZ1wDdM6GeQSMuVQ/:q8hW8fk0g1RJ3/zNZriqLbyGE6/h0dDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110887, "uuid": "beed00e8-08f5-432c-a8a1-8e46e39851ba", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110887, "uuid": "64028a87-3499-45eb-b2aa-d272897915d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110887, "uuid": "6ac64ce0-8ee1-4e14-a7b6-f33fbead6167", "value": "xqAAE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4243eb41-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132797, "uuid": "c7fbcb1b-6cae-48f1-97ea-65e66a2085e4", "comment": "Malware payload (PureRAT)", "value": "c9eb4dd7daa0ce92977db1318ab0b0a0", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132797, "uuid": "afd2687f-c982-452a-8cb4-c4a69cffea29", "comment": "Malware payload (PureRAT)", "value": "d41cab0882dfbeebe51f4fd6e9c6d428102560514b0fcc7115b4898d3e2f4618", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132797, "uuid": "b79fe257-f657-4fb0-ac73-39455961051a", "comment": "Malware payload (PureRAT)", "value": "577c728bac9b778e3e0a88349c2a3ae63157ba88", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132797, "uuid": "62af9781-f703-4b61-9270-8d2407cf57e0", "comment": "Malware payload (PureRAT)", "value": "22081b22bc11fe11fce7747eb84b137fa5b5e3de6a15fca9134f842d649ab4a69a78e8662d73acc693a7be49f80fb78c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132797, "uuid": "54eff928-92d2-4d00-807e-c83c6b1168d4", "value": "T1692157F44F4EC283F61385F22CAFAD18321676C78397443536406EB7796389816895A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132797, "uuid": "5096cc0b-81d7-46b7-870c-19c4312cf794", "value": "24:9Pgz64mTdhTA5VHA0IPA42cVkWP0mSez/cyblZsWqu4vfhZShpFzSwhXg:9PgzKTXOKidWP0PezcW2Sh3zSQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132797, "uuid": "53b03f56-4c0c-44d4-ada2-fb7f07a1543f", "value": 1252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132797, "uuid": "29e60afa-02e9-48ab-af29-028c0fbf2a84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132797, "uuid": "cbac14fb-d25d-4bfc-9d9d-c236fb2f82c3", "value": "photov_285614473538.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4223eb-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133106, "uuid": "43fbba1d-6b7a-4335-bad5-a385fa2e7809", "comment": "Malware payload (PureRAT)", "value": "2fcb37929d3cb08f64cfa180527a3000", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133106, "uuid": "bb294fbc-e41f-49bd-86bb-0388afa62374", "comment": "Malware payload (PureRAT)", "value": "d48c496738fb005cff63a192efe007ec03f11c3c1da1401921e57757deba640c", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133106, "uuid": "f4d27c76-bafe-4923-84c7-afaac9e96ea9", "comment": "Malware payload (PureRAT)", "value": "ca93154e92cfb91c320f15f682f9de6b00317f4b", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133106, "uuid": "411672a1-9ded-49bf-b65f-9ffa7d77d95e", "comment": "Malware payload (PureRAT)", "value": "042f6d6e31ba33237400d7cad501c83a4c881d1f9c5683ea006405ebc90db238c22559097763639966cdf54d6dfa5769", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133106, "uuid": "4f0ff6bc-322b-4f29-be68-9d3e281e5057", "value": "T15C2174A81164E5C1DC4EC23E2DF2AA0DB9348600FC0E95A2B1CD2CE66FD1DA4565976A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133106, "uuid": "f5aa212f-a028-41df-a29a-bde5f0f15eea", "value": "24:9T3Adk1R7n0e6QpCqL2zRufi3sqIV5noZmSTHzhO3Xa0vc:9LA+R7nPVpCO20VToZPvhL0vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133106, "uuid": "78e4e457-1463-4912-9d6e-3766a47aa634", "value": 1199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133106, "uuid": "be6601f3-8815-48a3-a93c-7ee20021a9ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133106, "uuid": "98c64c0d-03e9-4465-ab5f-8bad786016bc", "value": "photov_556420230813.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1b35d4-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143205, "uuid": "3392c8a8-722b-43bc-ab02-282680ef0495", "comment": "Malware payload", "value": "37b8f3e9a786a5f350280159af26826c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143205, "uuid": "49dcbf03-4bcf-4f1b-b3f6-48a9acfa774c", "comment": "Malware payload", "value": "d4918e743624c7f681179a86b62e1d5c6e9561c3e548337c86f1043d7b698c52", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143205, "uuid": "237b23d1-0a48-49af-9ee1-86d39c5b3304", "comment": "Malware payload", "value": "7ba28c9b0cf6bbdf9291545742e65b7f2b3a46ff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143205, "uuid": "0d1faf4e-8691-4a43-821d-df93e4ee9e0d", "comment": "Malware payload", "value": "ab2c5e1191b0cbb876a38dc45ddef41bb143831e13f2a3bd0f3a478e6072d6b496cf346044ca82741363730e6ee3e27d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143205, "uuid": "392ba2c5-5c6d-4568-873d-c2d12001dc77", "value": "T1F82196F80039F821DC9BD6F1250E4A305A629FB293828915813AA5D3765BE9DF3850DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143205, "uuid": "38adac79-7957-48ed-ac7f-a85f30bc964a", "value": "24:9RIBviQEfpyvk67jNo02RyCWmSJ8c0FWyAGbIr0:9RIQnRyvk6fNo0lPTX12Ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143205, "uuid": "c59d2a3b-cd56-4d1d-bf87-1e4905652403", "value": 1163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143205, "uuid": "8beaad6a-bdc1-4449-8d9c-293359dc1dad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143205, "uuid": "da5d594f-afc6-488f-abb6-0750a362d1ff", "value": "photov_701215966379.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68526160-89bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785159060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159060, "uuid": "fcb1a758-04bc-460c-a90b-2b76d1904fdd", "comment": "Malware payload (Mirai)", "value": "dc360868115dc228e66b0569afe4a7af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159060, "uuid": "bf3c99e0-10b1-478e-b348-8c03df7aeeee", "comment": "Malware payload (Mirai)", "value": "d4c6fe587718b4cfa1ba8d053b7190ecd3f25df6d52c41713c4a09d38c2704b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159060, "uuid": "069fe3a2-364b-4a4b-8ce6-900fc6df3d9e", "comment": "Malware payload (Mirai)", "value": "aee48464c097ed4a86068f4de7ae0c221d30162f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159060, "uuid": "abc340da-7699-4226-94d0-0bb2424a3738", "comment": "Malware payload (Mirai)", "value": "2b0255f02a568eb455bf7aec1bca83f06d9f19a55db4cabaee7891b8aebccdd0e18cb5a4ec7006ab03bf2e1aa1d06505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159060, "uuid": "dc4b80d0-f975-4e07-9281-2a898fceac1c", "value": "T1EE043A02B31C0987D1672EF43A3B27E0D3EF9AA220B4F645750FAA8D91B2D365545DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159060, "uuid": "0f0a6b33-5c6a-4759-8f00-ee67af5f20bc", "value": "3072:gMkqsT71be12NQEGr+pxKs5LJMYYuQf2HC:kf1KcNVC+pxKslJMRuRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785159060, "uuid": "5785e842-1b8f-4d46-afdf-7cc8e3fe55b1", "value": 179088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785159060, "uuid": "6daab0e2-68b6-41ae-af93-94159710d95e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159060, "uuid": "ba5ff107-b7e9-4ee0-b819-2d86c8faa4fd", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c50762-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167773, "uuid": "5c13d0e8-3ca7-4358-bbf6-89119d676340", "comment": "Malware payload (CoinMiner)", "value": "59e290a7d2a396e11879c3235398b473", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167773, "uuid": "29baf725-ff2c-458f-a96f-58039960a09d", "comment": "Malware payload (CoinMiner)", "value": "d5a0377ee9f1732a6f10372750fd638e081edf44a9703eda5d5ef53a2ab82f43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167773, "uuid": "cb543416-8183-4981-b698-2c46b2259afb", "comment": "Malware payload (CoinMiner)", "value": "14e4719a1627a54d36cd1d2460028d2de46b942e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167773, "uuid": "437b1ee8-cbf0-4ac2-9173-c495d61d524d", "comment": "Malware payload (CoinMiner)", "value": "0e01627742b7e51d9166566e35a98036f8b34a05a956a2165458804ae02b50a92d49b6288a4306fd4f0bc820bff28925", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167773, "uuid": "c0aff890-5a48-4a9d-83aa-c870c6d01966", "value": "T1949533B8788DEF73EB9EE4F98BCB1FC55D307940CD1BD912290DAAD4A25E26529DC001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167773, "uuid": "4ab67040-a328-4422-aca8-fe6ec40b4e73", "value": "49152:zjoi028a1ENB11lcrCl7DVC1nZCSv+985nkqj1wu2Q:zFP8aj6wz3adQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167773, "uuid": "ddc642da-aebc-40a3-9f2c-b5562c272974", "value": 1954604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167773, "uuid": "b5738301-f2a1-41b9-bd68-30c7554170e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167773, "uuid": "ff1b8d40-5341-4b65-94e4-c32187caf872", "value": "d5a0377ee9f1732a6f10372750fd638e081edf44a9703eda5d5ef53a2ab82f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986f44fd-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143250, "uuid": "8cee176f-81f7-42b8-98c7-0ce450302538", "comment": "Malware payload", "value": "21168d7fbdaab6a4212fc9691890ebd9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143250, "uuid": "2f350078-f125-4d61-beb6-c34d5411704b", "comment": "Malware payload", "value": "d5e539d1a4126dfa1552a2f17552d64bc69963766987a60864c8473a5ca8b3f5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143250, "uuid": "6331dc25-ee1c-434a-b1f1-08b34ef6d1c3", "comment": "Malware payload", "value": "c60d21105f5aaa5ebd38a812b7e5f3941c929f7e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143250, "uuid": "a5e76e02-e1bc-4e3e-804c-38d17636f996", "comment": "Malware payload", "value": "abfdc6e34f0aa326575d7ef2f307c89a516604c0e5e38dd8a0842af3b06db9aca649d0e5eae3fd000536efd896bbe7d9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143250, "uuid": "e256da46-8b55-41af-93f1-ba3f245d97c8", "value": "T19A21B20380AB4E04D911DB3A1C354D7C823F82AC2146C56303E6714E3E478BEEB2CED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143250, "uuid": "2eb04467-d2c0-4591-bbbe-5ed7b901ff5d", "value": "24:9VZ8eXOoGZl7b+Qqb0cCZDo74p/yUX0mSNoT+MrSqK6Z1Op/rUXc:9VZJXOoGZl7b+Tb0Tom6UkPNQO0Z6TUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143250, "uuid": "3e6e2dd1-a6e4-4cfe-94cd-3e75f1245e3c", "value": 1149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143250, "uuid": "e74107c7-084e-418a-a986-97d110f9f440", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143250, "uuid": "012ffa6a-21f7-4235-ac9e-f80edc22c4a6", "value": "photov_777420842244.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703be2ee-89ce-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785165516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165516, "uuid": "b572d5cd-ed3c-4126-a0e4-57ec57095e67", "comment": "Malware payload", "value": "c1bb2fdcd4847e82915a53c2cdc3d0b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165516, "uuid": "30c1e2ff-1daf-4858-bd95-63796228c296", "comment": "Malware payload", "value": "d69b8c36d05fac82f308170c325fb133d5f3742687e6a63dcb620292fda20896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165516, "uuid": "d322b8e0-4475-458d-8dce-2b5882b82c7d", "comment": "Malware payload", "value": "78664b35e371b08bd87ff410288c4185622fb0b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785165516, "uuid": "0a359c7c-cb9f-4a80-b304-48d8004f0117", "comment": "Malware payload", "value": "ad01cf2249bb329e85f3f304110e0db97b02ebe9bf6f9fe799f9ae4e9025eb3fb4fb76684f4eb4ab5034e614a8eb1650", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165516, "uuid": "0e0b1c20-1149-4185-802e-810f95c07062", "value": "T1D0F58D03AC9149E6C0AA6332C8B32656BB71BC195F3637E72E60B6342E737D0AD35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165516, "uuid": "cd7f8d63-5883-4347-9f99-1835af6cdc29", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165516, "uuid": "8e0097e5-f019-43ba-8bde-2db3691d8723", "value": "49152:8+TuBBWzOU430t1ux4/+OiHCJBKQkPqCYtg:8Eu70fuU7iCKgbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785165516, "uuid": "55cae0f1-4b10-462b-82df-ca3ec2c81810", "value": 3480432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785165516, "uuid": "10a5b169-3d69-4ee4-aa3c-ac436eba8b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785165516, "uuid": "a0822650-9294-443d-abc0-c8988c3f5aaa", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac77bfd-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180969, "uuid": "070eb727-e7a0-4e3e-91d1-06aa1d252c03", "comment": "Malware payload (Mirai)", "value": "08aee2b179ead9e28e96f7845d1a2636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180969, "uuid": "d7a66a56-5183-4f16-8ef4-893088640c9f", "comment": "Malware payload (Mirai)", "value": "d6a82668a5b9f9aacfbd2fab7b7d586a959639c80c55a2fa6d7e6a1d62be43c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180969, "uuid": "d9420c03-d941-46e2-acee-21144ac0551f", "comment": "Malware payload (Mirai)", "value": "ec4137788b142a162065fa46493a7c02424f8e12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180969, "uuid": "ca5316f0-7e49-498f-b01f-7a5d332b2cf3", "comment": "Malware payload (Mirai)", "value": "19a2a5e3d9368ed9c69924311eb030a4600ca3f5a4308bc1b7701e88f2a4fc6f128ff41777a8881c47c8898c9b7f9813", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180969, "uuid": "f914b02b-ff02-4f8d-ab65-b94c7854365a", "value": "T1A2F2E0F1C02C59BADBF658B69996C3507B7A458A67B4AFF02087DF220854427F9C9FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180969, "uuid": "b2266aeb-3d5a-4664-9616-770bd84dbabf", "value": "768:pjVmE5tNa0FKdZX8XVvIpZTw6jiGK2q4uVcqgw09O:pKdB8XpmZTwka2q4u+qgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180969, "uuid": "359650c6-47c9-4b2d-9f21-0797c52c9ec9", "value": 34332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180969, "uuid": "b334eebe-e87f-4f3a-9321-47bc0ff9c800", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180969, "uuid": "4eb318fb-7ff5-4857-9435-66f7c060a785", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246f3651-89af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785152074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152074, "uuid": "7ebc6bce-170a-46d7-a519-79afb036393f", "comment": "Malware payload (Formbook)", "value": "c966e728f948667972f3e54eb839b50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152074, "uuid": "776e4a96-ef15-451e-a059-71688079fcf8", "comment": "Malware payload (Formbook)", "value": "d712b6f9fa3ea6fa9c9dd1b6e7b7c9d479720470efd3ac8e7c3f419ee4f592da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152074, "uuid": "dae9d737-caec-453b-b038-ea9eb58bcfad", "comment": "Malware payload (Formbook)", "value": "a98d2dba312d2a841aca142f86c12fd34eef698e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785152074, "uuid": "df35a2a3-30f4-4d9c-a994-0517430e347a", "comment": "Malware payload (Formbook)", "value": "35167c40d5fe427445c92e3297797376eb5415286d8631a6e2967abfad2ef0f753272efc84b8266696682c8f97dd0226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152074, "uuid": "383f52e2-69c0-43d3-a48f-858dfdfbb88d", "value": "T18835F12E0A135A02E4B26FF01E71F0B1677A6CEAB135D21A6ED20DEBB4677107D04767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152074, "uuid": "4698e2cb-1fbb-45af-adca-9b7323f4dfd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152074, "uuid": "c214b26c-5db6-4b40-af43-5bc382db4010", "value": "24576:txS7xDI8bMbg82u9MiHiEYz23LygZtVl3USDi7:txSCiMh2u1ileLLRl3BDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785152074, "uuid": "f3be3dd3-878b-401a-9be0-7cd085d29145", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785152074, "uuid": "a3d79486-5853-43f3-918d-a78947555787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785152074, "uuid": "7a8c98db-f802-4138-aea7-2413771337d9", "value": "Dekont-2026-07-24_0T122032.314.pdf (~21 KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6feafb-89b3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154049, "uuid": "9f772311-26be-4bae-8614-038e9a9daa2e", "comment": "Malware payload", "value": "40253da8e83ab369df1bbdee532d8707", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154049, "uuid": "c35dff5b-48a9-4884-a618-7cc40dd755ab", "comment": "Malware payload", "value": "d720c70eb7a545bc1681ec12edddfb94caa42768aa81faf594477b8bc1328e18", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154049, "uuid": "c2e0e9ae-b0ea-4b00-bfda-a3eb9030d315", "comment": "Malware payload", "value": "79ee9c555eebfd7b23606128c2fd050ca5134b47", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154049, "uuid": "4d77fa69-d30b-4787-989f-43702dccb5ef", "comment": "Malware payload", "value": "44878547a021009bb99cb040d771016e1b1f4423baf518623d1c3ba6094c6114abb974a770de9680c13a767cd24f2e18", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154049, "uuid": "e6962489-bd3c-4c9e-8ec4-390470082230", "value": "T16BB092102C60523FCF4FCE1A8299C2254C6A3111627582E17A618A19BE049AAD216549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154049, "uuid": "eb79bbcd-4304-4444-8fd1-8842c6ea84e5", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIFlECL0n:s8GFGMFI1R3Ks8zsO0cKTr0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154049, "uuid": "041d2f69-d007-4e6c-8c17-377680768393", "value": 118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154049, "uuid": "322646a1-eb48-47d2-b270-212b393ce3e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154049, "uuid": "6077c7d2-44f3-430a-957e-4bd64b1b5f30", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3bbaed-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133054, "uuid": "bb38322f-40ab-4824-84b8-24fc77ce941d", "comment": "Malware payload (PureRAT)", "value": "109378628af8330a3ae8ac6227a06e13", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133054, "uuid": "0728c345-fa66-44c3-96ca-935ad33f03a9", "comment": "Malware payload (PureRAT)", "value": "d7e3a1971ce392b9904da4f805e7cddd7a5c9c7e41f2bdeee1db4bd9d00f3a59", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133054, "uuid": "31b0a0e8-39c8-404f-9e23-09f3e27f3fbd", "comment": "Malware payload (PureRAT)", "value": "8ba26e8fb21b1e190ec1361551a5cad141f689c9", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133054, "uuid": "c55febdf-3f2d-4680-b970-072fe1bdf717", "comment": "Malware payload (PureRAT)", "value": "5c6848a720df1ca9c9b781bde83f6c15763093496c5d323d5139705efe61aba5250bc0413a060353a461e9761cc98626", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133054, "uuid": "7595b3a8-11f5-4cde-9f2c-84ddbd4ab058", "value": "T15821B638A4FC9D92CF4EE03BBD059102937809316D0E61C10BF4538AA80F3C872D4D50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133054, "uuid": "ac9d3f28-5d4e-4a67-8e93-3762b98cddbb", "value": "24:9IPmg1KgU4LYee9ek/Qdxp0sYqvSmSAcJJxLHf57v:9INKaLxe9ek/Qdz0BPAuJfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133054, "uuid": "92ed4be8-2997-492f-9402-7cab79446e2c", "value": 1143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133054, "uuid": "f0feda8c-cd71-428e-8e56-2f1de4581273", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133054, "uuid": "f3859345-f987-453e-b5b8-21da7dff6d26", "value": "photov_277451512669.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42067fd-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167777, "uuid": "1265ac14-9c34-42e9-a8de-56d709b57d83", "comment": "Malware payload (Prometei)", "value": "07a74e7e694ae07f0e881757c4f0041a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167777, "uuid": "c542051f-2a88-4560-b05a-889cb48a3e88", "comment": "Malware payload (Prometei)", "value": "d8a096c35f124bb243abc801ff3af7c29f783033ae9a6a0864dcc3fb7828d454", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167777, "uuid": "ada45930-e313-4af6-a50e-e9a78e9f12e1", "comment": "Malware payload (Prometei)", "value": "76aaee2df541d18f148d075ab036aab06b7f671d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167777, "uuid": "7fcbd9c1-8cee-4f52-9e35-3475988de8e9", "comment": "Malware payload (Prometei)", "value": "d2f27f6fac2c4e17cc8b20d0c5b2d7ae0616079ace721f761fa4bf8d923c7231359d709efcb9fafe05d50f8d2312686f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167777, "uuid": "5c227a12-72c1-4f2d-8160-57e6c70ca5e2", "value": "T1D5A423B4F9219E9F6DD769B91B24831DE182C172589D4C1313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167777, "uuid": "9adf918e-c986-496b-ba43-68dacb2285b4", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsd5:Fs6pyCC/Ya2hpi6T6N4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167777, "uuid": "a7a5b41f-f755-4d59-97a7-909fd6539044", "value": 449077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167777, "uuid": "0b7f9032-48ff-4f31-b4c1-4e466870552a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167777, "uuid": "cd45200d-f4da-440c-828c-75bd94303a29", "value": "d8a096c35f124bb243abc801ff3af7c29f783033ae9a6a0864dcc3fb7828d454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be27b8f-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154181, "uuid": "615635fd-2bae-46f4-a3c4-77de5c0f6a9d", "comment": "Malware payload", "value": "8dde98b1bf00e61cb92c0e8dc4ab2796", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154181, "uuid": "4ec6d8b5-82ad-4172-b580-e0143768d985", "comment": "Malware payload", "value": "d8d3350c0a33efd5d93355091fc9fdb83573f9ba640cbca79c38f235d0deedb1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154181, "uuid": "86e18c00-f66b-44ff-9980-5ed567bee459", "comment": "Malware payload", "value": "8e82a7ce6be011eedad96a8b8c2432cbd5c9f0fa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154181, "uuid": "6125b17f-d013-4cf9-9249-416fcc254d19", "comment": "Malware payload", "value": "bf367f40c8d9ec816820195499aea7ac640c39cb2eb266e7fb8099f9fb3bc8b6c324ff43c4f8d96ce046dee56021a324", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154181, "uuid": "2674568b-e59b-4157-bc91-2bd88410298d", "value": "T12921C801D42BFEA3C81EF1361A9C2F3645135098108D42B6F12854BBF7B6ED663A87A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154181, "uuid": "43d91afb-ec5b-420a-9e43-85d0617ed8d2", "value": "24:9iL534ezCpjWNhmkF2xzJ6PWP+6wLSuhTmSya4JMgW+Iqn9haflULlI0L:9Le4jI1eYN6wXTPHq7afj0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154181, "uuid": "f859bac1-0ee1-4764-97dc-4645abd00e70", "value": 1376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154181, "uuid": "b372f89e-5cc3-4552-a0a0-2e7f7b9a12ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154181, "uuid": "21e73ec4-af5a-4fb1-addc-c444343d7f90", "value": "photov_763696125571.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68141d49-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143598, "uuid": "671febef-f68f-4e2a-9239-d20cc2856927", "comment": "Malware payload", "value": "d88014128fb553fdd388b93668ad075a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143598, "uuid": "c9f2753b-eadd-4158-b936-20cf6082a5a7", "comment": "Malware payload", "value": "d949b642bc0185a1bf37557038f2c24e8879070b9563f1fd7862adb43a9df209", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143598, "uuid": "7f4d3acb-4fd3-4ac5-b310-cab8ce8b05d5", "comment": "Malware payload", "value": "ede6ae7cd6c205c50a30b7f785325b6e70f886fe", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143598, "uuid": "e97c2b16-afcf-4ca1-9c96-d0dc71a8f546", "comment": "Malware payload", "value": "21c03923254d3587318626b8216c828332d725ee41d6c86f6424266efb3889e6430d8c3eb1861533113005b10dd723a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143598, "uuid": "497df3dc-c0f6-4436-b65f-0652143c624d", "value": "T15C21A7E0C0368205EA53473F36A85ED61EB201810491A41C479C9AB3F69B6F84B5C4D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143598, "uuid": "4d7ab6e9-f760-4dde-b99b-28da0005e903", "value": "24:9IUN9/On4TiyxZ/SZ8SFA8B2M8vFmSog4NWyoyoL3bZy04N+fUG5+A:9I68JyxlSZ8kt8M89PNZL3w04NKZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143598, "uuid": "3a756bc2-8831-4a96-91b4-676c434ad4ce", "value": 1220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143598, "uuid": "d013045c-07e9-4fcf-81bf-caa9fefe2574", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143598, "uuid": "953e62a7-73ea-4ef8-8e96-2a9363bd0361", "value": "photov_038798911662.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1947eb3-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133440, "uuid": "4e7b62d0-58fb-4740-b4d7-9401efbea3e8", "comment": "Malware payload (Mirai)", "value": "67552a20fcd591be54d0656fa3a27474", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133440, "uuid": "d57496da-d01f-457e-8554-494c72a1e4bf", "comment": "Malware payload (Mirai)", "value": "d9eb1c3377cec6607d3b0b4ac034a1470551202699a8e8de47d3c1271ee7ba00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133440, "uuid": "6d069e7b-7e61-4c69-9287-14435159d31f", "comment": "Malware payload (Mirai)", "value": "8e284083423e8a6aae484a63084cbd38848b3df7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133440, "uuid": "5bd88ae4-07f2-4d31-8859-c414699a4101", "comment": "Malware payload (Mirai)", "value": "7757d2345421eee0a6eb0f998455c8cba54c6c3718315e7107a4b05124780cc0527b988eb5435d106d5ce714e3afc292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133440, "uuid": "b2e7a2cb-bf85-449d-b9d9-3039d34900a7", "value": "T186C33A06B30C0947E1673EF43B3B27E093DFDA8121E4E640755FAA8A9172D325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133440, "uuid": "94ef5be7-9ad7-421f-bb5b-1765e9732382", "value": "1536:Olcnnx4v2gUsz3KxFt9yFIQJzjapg1DVcvAhI6y2Bqy8+iyqtDgMc+VF:Olcnx4v2c3KxcPJzGpeBhacEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133440, "uuid": "264e7b16-9bd2-4a00-8cb4-6a027e514ec7", "value": 125604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133440, "uuid": "6d00a34a-d700-4da8-83e2-9eef3f5e421c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133440, "uuid": "bc2bd54c-2701-4edd-a97a-263f04af9fb3", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b96f80-89c7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785162571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162571, "uuid": "b1072226-67ea-46b2-8971-170b9b2c6232", "comment": "Malware payload (Mirai)", "value": "2ee60fa9ef32feec9dc06c7568c3e6c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162571, "uuid": "efe86b37-16c5-4ec8-a531-071b9cd1b907", "comment": "Malware payload (Mirai)", "value": "da545d84ddb6827fab190470cdbb1025601867ad9b89848e4711c17fdede8a84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162571, "uuid": "ddc7e141-f8e8-459d-887e-2f2c851ae3e7", "comment": "Malware payload (Mirai)", "value": "59d12fd3e366ac36f4711afb529621f2ba66ee51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162571, "uuid": "a03cf558-c850-47c8-a941-f7bd670a2c2e", "comment": "Malware payload (Mirai)", "value": "def51e9eb896731fc3da4fecb338d29e0c8ecd8a7a9292bf2f62a1dae5112127c0a767fcb77ec7b188b632a52020671e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785162571, "uuid": "679d97e8-a99e-4f29-8dc8-da6b59379627", "value": "T12C141956F8819B15C5D511BEFE0E528D33232BBCE2DE7212AD246F3077CA96B0A3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785162571, "uuid": "1287dbd9-6800-48b4-91c4-a9af21707112", "value": "3072:/rEDLznyoiOI06jh1UCT+XyX3iO5ha/t+BXoFV47JQ/vhCyQmdEI:EXnyX26d1B2yXSOval+BXo6JQRDQm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785162571, "uuid": "01783f9b-9e8d-4923-8830-5440dca786af", "value": 195420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785162571, "uuid": "dee02314-dd56-4ed9-b9b7-664595e67e6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785162571, "uuid": "1773d606-d431-4e18-a2c1-14b50dac1107", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90ce790-89ed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785178926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178926, "uuid": "969239d1-0257-491c-a1a5-468efc3d9be8", "comment": "Malware payload", "value": "f17f9ea89456088476a8057993ea802d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178926, "uuid": "f1a4185d-30ff-4181-a09d-03e281c1409f", "comment": "Malware payload", "value": "da5c52f4c5ea577b48c2735aade14fdc94c2244c970836189fe4f8bb6f31203b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178926, "uuid": "4c760521-2eb7-4374-b260-1777e22af96f", "comment": "Malware payload", "value": "807e30581fe479fc76223f0ef9e126834d8179f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785178926, "uuid": "1d311932-9e2f-412d-8a66-e3e885a71b59", "comment": "Malware payload", "value": "91faa47d69b996b981f1ca93d503a5cc72cce431a2a89b3b78a81564719d11bb5226b75a099be4ee6d7a2998460e68c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178926, "uuid": "10cc34e9-2fb3-411a-b103-5f1eef5555ed", "value": "T169C27D966A867C44BDC94A3E4CBE2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178926, "uuid": "35696d93-2732-43fb-99d4-29e150ec4270", "value": "768:W8vCB+25j6es8RLnp9FYpMSUpi+20qUpi+20YQX:W8l25JLPd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785178926, "uuid": "b74aa0af-1b59-481e-bd05-9d5afd4ddc26", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785178926, "uuid": "42ba34f6-467c-4b0c-9dc2-24df7f9e9d34", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785178926, "uuid": "9a4fb3cf-5acd-4680-8c48-2570e1acc4e9", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0830f9a-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133063, "uuid": "3c3234ec-d1b1-4ca7-a863-f8b4d5cd5b27", "comment": "Malware payload (PureRAT)", "value": "a9cc3cc79fefb6d092a554eb4190b497", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133063, "uuid": "188a0961-2482-49dd-b305-32f7aae78807", "comment": "Malware payload (PureRAT)", "value": "da81d29fb66af2a4b60b22945ab321d20068accf778c38971d0fbb5150c33b6b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133063, "uuid": "f6246416-2d34-43d0-bc83-d8980c8cea08", "comment": "Malware payload (PureRAT)", "value": "3029a7535e6818a28e205e8fee29173f6b2a31cf", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133063, "uuid": "e9109741-2b5c-48f6-8716-b0b6cf2da5f1", "comment": "Malware payload (PureRAT)", "value": "dc5233d444ab265ae64e27b304e0cb11109f120611f9f63174059c27fa5f1ebe42de074f9a290eb42ae34685d8752479", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133063, "uuid": "825d1602-9b98-4414-b5ab-0464b1b78298", "value": "T191219A48CB0D6503F41205767C2FB56D12DA611493235527171C7C647EB748C27438B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133063, "uuid": "3678ae39-75ff-43a5-9b0d-fbc7881580f2", "value": "24:9jDi5mVUvN59jspb5g4fKsmktUA9Kfgi5q2SPfmSQf/MbdWqQQeSPJIy3U55PV:9Ym2vrgb54X6U8wgPnPmIWJQmNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133063, "uuid": "39ed6a82-db6f-4f8b-9d38-3fe080e9edd4", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133063, "uuid": "2ab77369-fce7-4b3c-9226-c24f805ef82e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133063, "uuid": "67026ada-9e86-442b-b475-3e096f51aaeb", "value": "photov_202306220778.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3872a9f-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132611, "uuid": "6a6d43a8-6ed3-489e-8960-e9f0a1f9177f", "comment": "Malware payload (PureRAT)", "value": "1e07c7b727e48fdd65ceda97a538b63f", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132611, "uuid": "a68ab61e-b9f0-431b-8a65-34ec30ee0638", "comment": "Malware payload (PureRAT)", "value": "db9f58368bb5f48a06cc4d92ae3b71be61418491d5b6ccb6bddd9d85991d43b0", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132611, "uuid": "5ac7df04-5024-455d-8234-19b7fccdf468", "comment": "Malware payload (PureRAT)", "value": "c97087a22ba7b71bf574295b411a29fcd999a03a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132611, "uuid": "ae8d7189-30cc-447f-a09e-8d475b62ffc0", "comment": "Malware payload (PureRAT)", "value": "2935f292e02f15acc35054c023a19e1709629432ee3f8dd880762bb577faef2ca60a77b0dafc440ccbf1dd894d92de14", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132611, "uuid": "881888f6-4d99-4f48-bb1c-3773cd8ca7b7", "value": "T1C8210AE249B9EB04EC4FCD36207F695E73380DD4D548C60FA3673AA65EA1BC0BB55044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132611, "uuid": "a85f1a47-8022-4a02-9067-07538be7d802", "value": "24:9rScN0oHZ5A9dMi02HMVyoT7Y4IfzeM3PvmSlSMrS309yPHCEf:92zw5wdMf2HMVN79IBvP9O3kGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132611, "uuid": "ba8435fb-ca4e-438a-b681-c7dafdea0246", "value": 1185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132611, "uuid": "ba010078-8a20-43f4-80bb-f817242ae8e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132611, "uuid": "5950ba97-723d-4f36-b91a-c8117f42b585", "value": "photov_424679104002.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6a219e-89bc-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785157723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157723, "uuid": "b14511e6-a3d0-40f3-b7d6-6188bde59336", "comment": "Malware payload (Mirai)", "value": "ea16734ef3b7aed9f15e84b4628cb072", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157723, "uuid": "c549efe5-7616-421a-a4e7-a4c9ad0ac00e", "comment": "Malware payload (Mirai)", "value": "dbf46eac8bebada17c1fc112d3da97cb322752bf7999f735d9ed2a2677be24a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157723, "uuid": "6cb57b71-2ace-4f5b-b172-38da88062d13", "comment": "Malware payload (Mirai)", "value": "5e1b63a86a5c9cd68e4ff441514a5a5f232fd88f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157723, "uuid": "9f40c335-f792-4fec-9e06-f0c449ebcdbf", "comment": "Malware payload (Mirai)", "value": "0db24a276049448da3dc50fd80a69b0d691d20b741ca597e11ab80210a609499b1c989c48a2987ecc35cf7cf1517d8cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157723, "uuid": "d567dba4-d482-4cf1-99e9-9b3f6b2c8fe9", "value": "T13C443946FA404A13C4D6177AFA9F42453333E768D3EB73069928AFB43BC775A4E62601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157723, "uuid": "35d0b400-9a80-4911-9bfb-abdce8d40b97", "value": "6144:+XLSdtiFh6dkCZILaR8guAUc6YfdkxvJAHFH6sV/GTMmx2cLis:+XLSdtKhpCZILaR8guAUc6kdmho/MMmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785157723, "uuid": "bf511d21-7e27-4ab2-825e-5169298f6ed4", "value": 258413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785157723, "uuid": "ec960f6f-7ae5-4c3e-9cce-ec50cdc65820", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157723, "uuid": "77ed1c70-3173-46db-b471-b7be9811ffe3", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dc8149-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133075, "uuid": "2c54caf9-81a5-4770-95d2-1a0c7e656b50", "comment": "Malware payload (PureRAT)", "value": "fade308fbb50fd51b26462387eb36b39", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133075, "uuid": "947f075b-7dff-450b-a0bf-2344b0bc6c3b", "comment": "Malware payload (PureRAT)", "value": "dc48314e9b051ed39d848004bd73f3fe42fa00c121c868134af71b96e24c651b", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133075, "uuid": "918682b1-8c09-4ee3-a3ff-e458c55824ca", "comment": "Malware payload (PureRAT)", "value": "31322e19cb24cc87a9dc27b357812ad44ba63d1c", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133075, "uuid": "0eb13120-6cce-430a-839b-577a5982ee0e", "comment": "Malware payload (PureRAT)", "value": "35b5b83a3b5bf63a8d40dcaf89f4a8bd4de2755b06f40d08e129f1c534af4b3783478134e3092fd34ef3fc0259628ea4", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133075, "uuid": "33180c60-a490-4901-a1d8-5958110c225e", "value": "T1D611B5E1115C0C70CC3BC1F518DFCFFA35B3919130424211420D1AB93D21D4A3C08EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133075, "uuid": "c144359e-a5a2-4dc0-a2e4-8b822b6b844f", "value": "24:9RaEqD3HA4SG7yM37EH39HymSubdWqpUFNDcaE1ByHtn:9YrD3gXGeX9HyPOW4kumtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133075, "uuid": "8cb4a98e-1389-49a6-a429-c0bc4721bc0a", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133075, "uuid": "52d3860e-1e65-4437-bb53-e4c269b60c84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133075, "uuid": "1aaba6af-cae3-49d2-b55b-5c6f30c5fbe0", "value": "photov_532524973609.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b876422a-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167785, "uuid": "c1df5de9-9749-457c-9aaa-874de01e51e3", "comment": "Malware payload (Prometei)", "value": "1310f96fc2ffd3ccc3481e2190ffcffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167785, "uuid": "6bea5388-a40e-4f11-b555-6a4640511693", "comment": "Malware payload (Prometei)", "value": "dcbb54ffa785a62cad9e6f61cd46deb863d8449f1f1ac32b11fa50e6f29db80b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167785, "uuid": "79ca62f4-1be0-4d0c-88e6-b7a991d6861a", "comment": "Malware payload (Prometei)", "value": "06ab8cc90a6b5029928cfc556cf58d9153ce9985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167785, "uuid": "828c27e4-a592-46b4-88d2-815188939b3e", "comment": "Malware payload (Prometei)", "value": "efdd743f9df5b86fbdb0266a1c6ef921b8209c546ee99a5c59761c55425bf582abb308d442d1b696952c6194307463ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167785, "uuid": "f3642bc0-4408-45e0-91c7-1d397d990bd3", "value": "T1129423FA1B8DF3FB49127F7027A0980181A47470F99D775986CBFE9A0FA52679CC4108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167785, "uuid": "9f03b154-b78e-4ee5-8367-a5a80ba1826b", "value": "12288:4a6aYYIX2dWVxeJAaLYxAOfUhjXb44UfhlBeLH:V+2WejYxUxs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167785, "uuid": "fb93bf7a-26c2-48be-b07d-1bb1c1679f27", "value": 428380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167785, "uuid": "4198f061-8b5c-4be3-973e-ee82cb100ec7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167785, "uuid": "58fc1bca-ab77-4b95-8284-671b5a0c5ece", "value": "dcbb54ffa785a62cad9e6f61cd46deb863d8449f1f1ac32b11fa50e6f29db80b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8c2cd2-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154343, "uuid": "bfc6025d-7b18-417d-a04c-9930d3831fc3", "comment": "Malware payload", "value": "391440151fc54eca7453531716d50cd4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154343, "uuid": "11cd7598-4c2e-405b-89a7-073ee826a293", "comment": "Malware payload", "value": "dd47329fb4c7ea6eaed3c72a609cb88d93d5edca6dcd0f45b4c207e2eaa50f72", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154343, "uuid": "5ba41da6-cb4e-4829-beb5-c980fcfb17a9", "comment": "Malware payload", "value": "653e7244651d5d6c894281dfb81a03f57f5a7dd9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154343, "uuid": "73ca43fc-ff4e-4dbd-b11b-4846f6719686", "comment": "Malware payload", "value": "28554245e1ca26fb7cb20915ba1847b8fc8b894bb64e142c9cf492e0de73af0f4a1dc1a1cfce10c19d01235156b604c0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154343, "uuid": "dc0c6746-b318-40e1-86df-bde2389df064", "value": "T12721639E49D0DE41DC4643B766FD95C68B2506ECFA09B19A0BDC1693FD0D7849A8E1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154343, "uuid": "690afb0b-e7c4-4770-83cc-f63ba4b2f36a", "value": "24:9IrFUriUFn6ULarwLR9LlEHw9mF41dsKs3mSnzNHUVZ/mEr9HX:9IxUui6anM9F4X8PzWVZ/lZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154343, "uuid": "8d7675cc-ba83-4135-b39c-24db3df9200a", "value": 1146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154343, "uuid": "670a6f5f-ff6c-4f86-a5f8-356a940088e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154343, "uuid": "d58e5a6a-a5b7-476f-8603-40a620e31487", "value": "photov_079359259606.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d42489-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785132325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132325, "uuid": "9d0327b3-9a2a-4ca2-a825-9136460cc2e4", "comment": "Malware payload (VIPKeylogger)", "value": "0ef492da421b72a19541d1ae856efdff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132325, "uuid": "e49ac91b-3bae-4559-b79b-6cc95558581a", "comment": "Malware payload (VIPKeylogger)", "value": "ddb1fae4a772b5eb9db713b5974e5ffcbc5f712a0be8b1081323e91227d64e79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132325, "uuid": "83d89529-d1ca-4124-bc09-ccb1ef86a02c", "comment": "Malware payload (VIPKeylogger)", "value": "6b97bf764e3c924ac217209a49a41b8297ccb79d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132325, "uuid": "4c9911bd-4028-49f0-a340-2ad5b41a0aa8", "comment": "Malware payload (VIPKeylogger)", "value": "dab27175b1af275312abc3208475bbc1978f15125f510c9afe0030f9b051f84157bee5f276e8ff59e85cf57a3ecd4394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132325, "uuid": "a6306669-46c7-42c4-aa8c-5aea07f3a22f", "value": "T16FE30257DFD41935CFAACF3C615564429776EE81AC2B6BAB13C5A04B3AA934CE031B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132325, "uuid": "a6c3ef61-d528-45ec-8506-6bc41b8c391c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132325, "uuid": "2b428b86-eb1f-4005-b8b7-273161750edf", "value": "3072:fN6ER87+Qu9v6p2mF5YPl5Qtv8a+RoeXIWnrLCRrKRjoQA8:fTsu9v02mFADa+RDXIUrLC1KRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132325, "uuid": "a7a3790a-c70d-4c04-9f05-83ce80ff9ee9", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132325, "uuid": "42281729-d00b-46a2-918b-64733142eaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132325, "uuid": "1f64e3b7-a7f1-49fc-bb39-fb76c687f7cd", "value": "HGF98765434567800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f12c2e-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154224, "uuid": "ed77c570-9af5-4e6e-a120-d8276d5fcfbc", "comment": "Malware payload", "value": "e3f50e0ecbf7380da14c2e71d331408d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154224, "uuid": "33ce7e9e-b03e-4405-b667-28da7cc93c8f", "comment": "Malware payload", "value": "de8fdbae8cd50da39e5f0dbd9e191904fef8e88df146585a65e416a0e4936d54", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154224, "uuid": "ef1f674c-2ada-4745-b554-09de7bbd4bf3", "comment": "Malware payload", "value": "3ac85aa3e96ad1dab43fce84c5825661d4b5170a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154224, "uuid": "ca1a0850-2799-4df1-9673-fcc8d26d5ffc", "comment": "Malware payload", "value": "3a3979007234022a8c4ef808b58d0c89b09b2cd7a7430393ce514d4b3d7f0db8291f19dedc4de1646d0f91456777ead9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154224, "uuid": "595e27ce-33d0-4e6f-9382-259466bdc983", "value": "T1AE2174A88447D9FAD0CA52337932888650B5A3B9101D5CF23561F2F4BD5EB8B2B1E194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154224, "uuid": "6ddceace-2180-4089-9840-1a340a9281bc", "value": "24:95TBIqOJW4GAMd+tvbgIcYqNERQ+O4zBrT2EaaYmm9HMXZReV69Evd+OM//:9WW4VzgRYYMtzBxabmVXkkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154224, "uuid": "bec4488f-6aee-4255-be39-236e4e8874f2", "value": 1203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154224, "uuid": "4428f0f4-c6ed-49a9-b5db-c7bca48265cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154224, "uuid": "982e7b19-77f2-4f5a-af05-d7431fe30bca", "value": "photov_515092583271.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9364d3-8950-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785111470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111470, "uuid": "32e3246b-7391-4084-98b5-df79920abc92", "comment": "Malware payload", "value": "77619e60fa9c3a1e9d52b5e43003c523", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111470, "uuid": "34798ca6-634b-461d-a30f-64b3cc257980", "comment": "Malware payload", "value": "de9efd031aef9caed59021a2c79356d875648426a921151e18db33ce75aeacff", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111470, "uuid": "1e281a6e-9d91-40a3-aa5d-79c0680a6cca", "comment": "Malware payload", "value": "692993f8b0f241eed8cf2636bc7b1ed17c2de3d1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785111470, "uuid": "f0c7754d-1147-44f4-ad64-c3cf15395288", "comment": "Malware payload", "value": "4177723df1ed27f2d99f2e4a750a8b3eaf8d20dc659d227d92c0c0ad414680114cdb1769b7fb5b27ff30041f96347d1a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-60137", "colour": "#97538C", "exportable": true, "hide_tag": false }, { "name": "CVE-2026-63030", "colour": "#BEA7A6", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "wordpress", "colour": "#DCF336", "exportable": true, "hide_tag": false }, { "name": "wp2shell", "colour": "#04CD5E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111470, "uuid": "c6939b51-6ef5-4abe-8475-2c51f78f5ae5", "value": "T14D2167A183CF3E692752259A3CA9310B11307AB782FAC6D098FFC655D511C4089FBA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111470, "uuid": "2b6fecb0-0fd0-4ffc-8f04-b2ebae0727af", "value": "24:0wPsgZbEyDS7dKm+CI4hvoOs1+w7w/3seXr+vJqw/YqzA:0ksgZX2YzawW0eX8TdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785111470, "uuid": "18161f7c-978c-4768-99f8-ec6d9db0e281", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785111470, "uuid": "a0078e17-a898-4e47-b8be-61e68e497e1b", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785111470, "uuid": "5d0bb663-7fa6-4437-a322-8d0c78e84a4f", "value": "wp-static-cache-7c197308.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451acdeb-89a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785146975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146975, "uuid": "5b5ccd58-1721-496a-ab23-4c9ac9d8cc7f", "comment": "Malware payload", "value": "216b2a4a642e3f1a9167d236c391a71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146975, "uuid": "8febee47-5245-4bdd-ad9e-21b3d1a969c7", "comment": "Malware payload", "value": "dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146975, "uuid": "8360c397-9e7f-499f-932e-534231dfedcc", "comment": "Malware payload", "value": "433663bb3bc247d174e46b37ce68d1f0d136f261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785146975, "uuid": "b3f9857b-b3d0-4d4c-99e7-024921df4aad", "comment": "Malware payload", "value": "28aa8377aaf386a82434791ce86e37aaa2580a3f14dd7ad2e0d73a6f67527a237420baa0184567abbfd6e9aff8f7edc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146975, "uuid": "003ede8b-54ac-4072-92c5-662aa395fb42", "value": "T1462833BF2298D61BE29CC13BD5A39F90B533B0750B23CAD799A502A4EA435C55F7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146975, "uuid": "0f2481b0-f084-4746-8d32-83022402d704", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146975, "uuid": "dfb82370-99d6-47b0-9323-48912bc7c212", "value": "1572864:2XqgR72V+46pH7nockiRncKjtO6tTr9MwZYSrl2yu8U3nOw8oq4UOGmlhwY:n472Vy7citZt9ME32yup318MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785146975, "uuid": "7f991db8-9603-4394-bf65-cca4802d9910", "value": 97503964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785146975, "uuid": "a4c4d637-8d4c-468b-be3c-0d9af11c2d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785146975, "uuid": "0be24b93-fa02-4e96-9abf-6d4aa11ace91", "value": "3.6.0.Safewin_chfy_PIAX_v0.1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb3d86e-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132793, "uuid": "ba63a54a-eaaf-48a2-9045-4123edb79819", "comment": "Malware payload (PureRAT)", "value": "c08c4005ae7226d6be815538ec52c386", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132793, "uuid": "3abf754e-e7fd-480c-b211-09318fd43c57", "comment": "Malware payload (PureRAT)", "value": "dffa48b41a29def87ad6ba2e3f1f23d9e04749643254085df047e17351c185d3", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132793, "uuid": "36dd70c2-c01f-4a0e-8ae2-251295ef6d0a", "comment": "Malware payload (PureRAT)", "value": "adec50290dc2e57272bf3dc12b008a132ada4fcd", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132793, "uuid": "259267c7-308f-42c8-8bc1-82c68992d68e", "comment": "Malware payload (PureRAT)", "value": "0f4aa9b6c7ab76e216629f50e56c383e6b73ef3cf30ae5adf002906be05a64d77f4706a87e6156b0951b15560b2203c6", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132793, "uuid": "39f56602-07e4-4444-b25b-2fda47bbb19e", "value": "T1FF2195E3E5190581EC2F827FAC165C30F27DC3C7331594949A2E3A836F9797CA691A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132793, "uuid": "58baf46e-c96f-4997-bf32-101a59a97216", "value": "24:9gAR2ORb2L6QamG8mZ7cJPWdB2wqZ/3mSJyblZsWq91jWixpBLTX:9Nr8hJeoZ3PVWu1jW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132793, "uuid": "bea148df-bdbd-49ba-b66f-740f8649986e", "value": 1331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132793, "uuid": "0d05cf4b-25c6-4c60-af3e-5667c54cb9b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132793, "uuid": "482bd479-a628-4bfc-b56c-3e39912c39af", "value": "photov_778715603350.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbecef9e-89e3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785174770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174770, "uuid": "4da8989d-6f60-4440-a668-5fb3a58c6125", "comment": "Malware payload (Efimer)", "value": "b909d08eaab5ebd97e5ee9af79d9952a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174770, "uuid": "96a439ec-8f03-4c31-8bb9-f54e249a75a3", "comment": "Malware payload (Efimer)", "value": "e15b78ffb8b880b99ea1dbc2f51d1426fa0d72da39c10e5a0e364d62ccfaa1ce", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174770, "uuid": "6f22a8e4-379a-4d01-a968-3ed83b270c0f", "comment": "Malware payload (Efimer)", "value": "e03a3925deefb4888331a3c9573a5199248ac9f5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785174770, "uuid": "9ea21d0f-def5-4094-a6e9-8b991a75936d", "comment": "Malware payload (Efimer)", "value": "182e3b15a1c0b6c672f3502780fdc19e991a3ef6a70f0db3de8e874f14e4f06dd2fff24bd3fe4a67a8cae957d771f40b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174770, "uuid": "0c638713-8f8f-4263-ac9f-25a471d67bfe", "value": "T102E633686ED001E9E8B7903CEDF262A9D155B0661BF6C5CF07A847B62E531D0CC3C9A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174770, "uuid": "436b7b89-a4c7-4c9a-8537-3dc4b614ebfe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174770, "uuid": "3c7c2917-4127-4d77-9f20-46852c90e121", "value": "393216:KXCjeC/KZc/VITAKqL1K8FeXMCHWUjXjcuI3/PGTAI:KXCj/WTNA78XMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785174770, "uuid": "c4dbf493-2cac-4d7f-b7ba-139fbaa8dada", "value": 14273030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785174770, "uuid": "8ce33dd0-809b-4bd1-9bd7-78a871bf8f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785174770, "uuid": "72b34080-132c-4922-b4c3-8217ae07938d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5397ffeb-89c0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785159455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159455, "uuid": "66e1294b-5b89-407c-a49b-e9b696bb4cce", "comment": "Malware payload (Mirai)", "value": "e989a109af6e2cfc04dfcbc5140f01d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159455, "uuid": "ce025d22-1616-43f5-a26a-4cc7310670dd", "comment": "Malware payload (Mirai)", "value": "e1d4e04aab183f72923e45a1f9d06a04b78213455fa9a1bbc024d8186515c685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159455, "uuid": "f626bdb3-df7b-4add-a4e1-07d1f5d15251", "comment": "Malware payload (Mirai)", "value": "f52033f8d87cb4f545a59d5e12497bec5571549c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785159455, "uuid": "ab31699d-a7cb-4995-b348-e50eae4ee53e", "comment": "Malware payload (Mirai)", "value": "829afff446552d55ce0458fc06bbfafafaab04b59484c16239cf067ebd9ed42a55133ed8f8c9d2b18a2de159b5987e60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159455, "uuid": "091a490a-e40b-4fda-b2d3-c7fe25a81713", "value": "T18E34B51E6F228F6EF269CB7447F74E35975C23D626E1D681D2ACC2101E6038E541FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159455, "uuid": "8bab9b75-634a-4662-9bb3-d826a232bbba", "value": "3072:U8MB4rtkUoO86hW1gMkIZdzWcVzYPh3/dZmNyGT7vTY:U8M258OxUZBJk1dZm4ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785159455, "uuid": "909186f0-8637-473a-9e87-72116a028391", "value": 244420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785159455, "uuid": "dd2dced2-867f-4cb4-a57b-6e8909fe9bf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785159455, "uuid": "d00d4fbe-cdc4-4792-9565-a947906597be", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f24be83-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143583, "uuid": "6fcd4410-6d4c-4228-ae1a-c68edb0813b7", "comment": "Malware payload", "value": "7118893f06437e44a7f1ad74e3b733f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143583, "uuid": "d509afb2-b8dc-48f1-b3b3-1363f936b69c", "comment": "Malware payload", "value": "e24533456a5a40db59af85a1d9ae2687f6ddad13d9ebc36e32952a68aa1ac1b5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143583, "uuid": "ae99da2e-6c4b-47dd-a729-0c06cd45fe6f", "comment": "Malware payload", "value": "0d06d41b5cb0267d66db8ab0f2380d34a5225376", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143583, "uuid": "cb0948f2-2ad9-4d50-8aef-8081e8d10f97", "comment": "Malware payload", "value": "fe976dc4792eed6914f04556f4b00507800c416f9bf868a1aecb1b385d650e80a6db6ef2665fd62798507270799df989", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143583, "uuid": "01991211-940c-43cb-aef7-207fa1c0fe65", "value": "T10621B494860BEEC0C873C33908B9C19A563427A9731003EB2E1DA5B21E49F82EE1B211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143583, "uuid": "86c5761a-ff49-4708-8dad-2167d5db4d7a", "value": "24:9RWrxJ1SatAjMCnZ2xTo7rRHyAbyu8mSVHukrQYA8dxDzzUGQRNy9s:9m/tVboPcAbGP8YA0E/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143583, "uuid": "2b32c55c-29b0-4035-86f4-777021d47a44", "value": 1288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143583, "uuid": "74e2ea5a-fe05-4774-9f06-fc14eafaccd0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143583, "uuid": "88b4f2c9-5d42-4404-87e4-c4d29b0bd3e8", "value": "photov_506034851982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957a99b2-89c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785162572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162572, "uuid": "4fce3e58-a72f-4ef3-99b3-7b91c7b652d9", "comment": "Malware payload", "value": "300ad0abb619dd29794ede2e6737c7c2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162572, "uuid": "676ac102-ab2f-4100-8dd5-d28f13257b12", "comment": "Malware payload", "value": "e2715e05cf729245c8a132f8aa250327cff593b5f519de17796d5b5bbeb00017", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162572, "uuid": "148ac8c5-8ab7-4cc9-8a20-03f1b02ae9be", "comment": "Malware payload", "value": "fdd39084fdd4d7ab16356c7847fa86b92c359481", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785162572, "uuid": "9e0403b4-3120-4ab2-b5e2-f1a77a804197", "comment": "Malware payload", "value": "9965b51f307b4ae67d24d6cfccc205962a453c550cf5d63e40e76126d5ef9e10eb3161247381966339a72121a04456cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785162572, "uuid": "a0870d17-df6d-453e-a082-70c03096c042", "value": "T1D6C26D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785162572, "uuid": "b2cd5af1-a01e-49c6-9372-a2942eb8e74a", "value": "768:Z8vCB+25j6es8Rn9FYpMSUpi+20qUpi+20YQX:Z8l25JBd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785162572, "uuid": "9cfb23db-20bd-4a79-bfa3-3e36ec77840b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785162572, "uuid": "e125506c-e6f1-4bfc-972b-28c1a76e0fc9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785162572, "uuid": "47c1e17b-6435-44af-a807-40edbd1d28c5", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afdcdcc-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "c5035088-01e8-415a-b833-af4ad6394454", "comment": "Malware payload (Mirai)", "value": "2decf4e02cc67138ad12a09a08e1b263", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "eaef9cb5-613c-4754-a34b-15b7582a9f01", "comment": "Malware payload (Mirai)", "value": "e277bbfb9e14ab63dd0da045e8be64d73d99fe8be39309510f2cd4b40dad52e2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "c0c3c959-8326-4efe-b353-fa2b6fae039c", "comment": "Malware payload (Mirai)", "value": "1526b0a5b5b9e70c9373d145b555773f436c39c6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "2677f862-7383-4124-945b-a84b37c29095", "comment": "Malware payload (Mirai)", "value": "7da79b87e7cf9f7d5161c7e1d8dc48b1f8319ea9630363d0ac729b311cc4ee48b15582c3ba39d44a6a6f4ea836d5afea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "7d6218a0-89d2-43c8-94b7-64c6acb4237d", "value": "T1FD43F75AFD81AB01E5D422B9FE5E51493353476CE3FA71129E20AF2467CBD2B0F3A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "bb6f3caf-efc2-41c7-91e4-c6361049db34", "value": "1536:dvnyy+Dy8/4P2FH1doaRyGJdlhBiASg0wT/KHND:k/4P2FH1Aq/Sg0aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156434, "uuid": "a526302a-c688-405f-998c-0e15ece400d7", "value": 60516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156434, "uuid": "b7cff9a8-9f1e-464c-a0fd-b07694862276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "a97d89cd-15b0-459a-9f57-56a1296a21d5", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910ead18-8998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785142378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142378, "uuid": "7de0a13b-adc2-4e4d-8786-0385a6d34b21", "comment": "Malware payload (Efimer)", "value": "4583b63955175bba51746443acbf0e74", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142378, "uuid": "af3416ef-4212-4079-88fb-8a4221f324ae", "comment": "Malware payload (Efimer)", "value": "e2ad654bb4f079d2160f4d08753e80abba1a38feca3f54b8debe78c7ccd7f028", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142378, "uuid": "69ef3145-1b99-4472-aca4-851642344e71", "comment": "Malware payload (Efimer)", "value": "39ea75bcb491e0fdbab18a9a6f487a49babc72d3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785142378, "uuid": "8c1b5c1b-0111-4fd7-a330-043054349c41", "comment": "Malware payload (Efimer)", "value": "92d723ae2545216ed979550ff0da2d58610b8d7a5be258117a4c8d76de5365419714d284612679dc1a45b1935c884d4f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142378, "uuid": "620fc09a-3968-461d-8113-05bb17dfce5b", "value": "T117E6334C62C502EDD977803CADF16298F5AA78F50732C4DF1B6882A5BE171E04E3969F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142378, "uuid": "7d07f79b-af51-47a8-9d75-de018333ddf3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142378, "uuid": "93827f67-0650-4c29-8d5b-af51c7531519", "value": "393216:TrYfGFuaUFKuWr57L8VkMMlz1EucXMCHWUjXucuI3/PGTAI:TrYU5p538G6ucXMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785142378, "uuid": "f567d15a-1ad9-4058-b148-efa99882b35b", "value": 14291981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785142378, "uuid": "33a103e4-db54-4537-b9b7-f23bea09a42e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785142378, "uuid": "4afa314e-92a4-4fe6-ac6b-07e49d366d32", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea9723f0-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133079, "uuid": "35823e42-322a-46e5-9e95-678753307482", "comment": "Malware payload (PureRAT)", "value": "c64df55843cedd2021cb85b712f4e936", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133079, "uuid": "5d7b4fa8-c1fb-445e-8d4d-89a52dfcac7e", "comment": "Malware payload (PureRAT)", "value": "e315a4d4ad672553dd44b71f2bbcb3cf3e662fe63e0debcdaf87b8dae64d4868", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133079, "uuid": "67312af9-02f5-4dd2-b0e6-bf98d230f7ec", "comment": "Malware payload (PureRAT)", "value": "6d5e93b535461b910f3e2d48604ee4e632d43f64", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133079, "uuid": "42b67139-0f9a-450c-8f76-e11359e5cc9b", "comment": "Malware payload (PureRAT)", "value": "7a6b464bb5b813973d5ea1922a0ae5c8cb062b8c2f80ab8a24798f97717b8b992acc1cbd664f6169f916e5ac8b68bbe2", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133079, "uuid": "9fcff244-a851-4ed0-bad8-a63f793f0569", "value": "T17F21B75E64F8ACD5C6C8E63E787D4E8CF702F9A08013580B035419B67D07E97B711584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133079, "uuid": "443c4462-3e0a-467b-bc1e-19052dc724bd", "value": "24:9c89bu2dtWyjD10XZzrpAm//+25l+CYDAXmSX5hDY7JYu2vOdS1ChPOIVX:9c8QW8yjp0Jz6mn+K+CYEXPXXDY7JYuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133079, "uuid": "fe5488ae-7eae-4cc5-b0c1-3640a6d52057", "value": 1259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133079, "uuid": "04a903bb-5b4b-47c1-89e2-258f0076c51f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133079, "uuid": "9c491fe8-2a60-4c83-9934-936ddede05d3", "value": "photov_734341042366.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890b7879-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154391, "uuid": "9ecc79b7-91e4-4928-86df-dc8de35d7711", "comment": "Malware payload", "value": "5bbccbf44d17e8fe4dfdf158789fc306", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154391, "uuid": "960e3f4f-eb39-46d8-bd82-ab9cd9033f19", "comment": "Malware payload", "value": "e327ffdeefa77cfd6eb494123be76d4cb1111bc4f689f36de3b08357f587de4b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154391, "uuid": "11f812af-c621-4728-8ec4-a73989ce4bf5", "comment": "Malware payload", "value": "8250162c4d49735d2a96628cd28664e96a6673f4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154391, "uuid": "9372cd1c-1f31-46fa-b2db-e4e3eafcb49a", "comment": "Malware payload", "value": "5aa9ce70ead76513a02998cadf0293bccf0e3a9fb998f63b9e74a669c8864794908991bc6b640dae0f0314606e8d8388", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154391, "uuid": "9683d7cb-d580-4335-83bf-120463677ff0", "value": "T1C421A37C854C8B53CD174A7BB7278A0A63B6C845620220427A29B233B1B34C5EBA21A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154391, "uuid": "6cb00f56-4687-499a-a6c9-38a0ce26c12c", "value": "24:9SNbMhpolrmCV9xXvqTiFn/A4HRmSmUBv/DYJJxm/r0VBb0Emuq9X:9CKpmDATi7HRPmIKi0/bOuoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154391, "uuid": "5d87f78e-5161-41c5-8269-9c2f988f4e14", "value": 1195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154391, "uuid": "6d3e1e74-d1c3-4863-9484-1af8d8ce40bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154391, "uuid": "d3c40150-91e4-4f7d-b8c9-a7b5901e59fd", "value": "photov_860775411147.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a155352-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154339, "uuid": "f604374d-c23c-4eb6-b216-aa74ae18634c", "comment": "Malware payload", "value": "f46e0f22fe356bde4c7af2d32da1e493", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154339, "uuid": "ca79137c-b397-44be-9cef-cf5562a6b8a0", "comment": "Malware payload", "value": "e32bb62ce5a4cab7f3451e238e33d5cce8f260925cb835814f2e61bcf5a8483f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154339, "uuid": "034679f2-7574-4074-b664-e7653c44036d", "comment": "Malware payload", "value": "951b0d6655e2207c52a0675aaa82ec9f9fca7e7a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154339, "uuid": "047b3672-ebe8-4321-bb76-d25a2e25483e", "comment": "Malware payload", "value": "fae9b3f83d1a49725acf2277a695b0980050ee43913c5731cefa2035923c412694cc5b5459687f9680a21f7bb3a52b21", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154339, "uuid": "23a11d4f-1061-44ea-805d-f0ab87ae1462", "value": "T1C721A7B5E111CC07C1CB8DF33DBD0A7BB06574AA696CC4B29E2E64C90E6322C2762565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154339, "uuid": "e7e12eee-0297-4586-8adb-31babed68d7f", "value": "24:9s/n3HtLyAJz0ZNSYZ9Hl61eZmS+bdWqKHKM+L/nCLAzC:9sfAfZNSYZ9HlZZPeWTHKjfLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154339, "uuid": "3c9e47cb-4391-4f22-8bb8-690fdec36f54", "value": 1189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154339, "uuid": "6e33979a-65c8-4c85-8401-789f1ef8f6d2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154339, "uuid": "9833f019-e643-4c29-b9cd-8ac7a8696638", "value": "photov_857348197437.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d500f409-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133043, "uuid": "1d8a7a6e-ec57-4f5d-855c-157c81b9f88e", "comment": "Malware payload (PureRAT)", "value": "dde1f3131b29ec09dcc6c06534127376", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133043, "uuid": "3268bb96-4526-4f21-9e14-a650fadb7f0b", "comment": "Malware payload (PureRAT)", "value": "e35105f9503e82356d833b8d2a02a3b23e9f43b05f9687ac9c0a46b4c9b52d24", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133043, "uuid": "f3c6048d-dac1-49ec-8980-031422680898", "comment": "Malware payload (PureRAT)", "value": "362925d11d03a4332dfdc59d2b9913ce533bad9f", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133043, "uuid": "18444252-90c3-4052-823a-d3616e3d23ff", "comment": "Malware payload (PureRAT)", "value": "27899cb38fe5afad6254a4d3617820c4c3d6a1b9319a2dd0cc5998ab76d4d428a401485e3e47e8755db1c98ea325dc07", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133043, "uuid": "f73ad9cd-ede5-4ef1-b140-5d86538fd36b", "value": "T13021E71BB5B18BC0FD0F443B81753E47423687198403596D9A95FD0AD3E6F4A332E4E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133043, "uuid": "22fc288c-24a0-43a5-a71e-e3d4c8b9025e", "value": "24:9kqaAsc6umN40+HS8f8lN4IHEVKIUjMs7yyu2mSO4PM/jEV6VGfFah+JZQH9:94Cd0+ylYI5Ms7yyFPWEycahj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133043, "uuid": "8b1741b3-5764-4f9e-92ce-91a660f32e0a", "value": 1295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133043, "uuid": "db3cda38-fd27-4868-8966-c9af3f05eeba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133043, "uuid": "f17fb0c7-deec-45d8-bab5-460dd96153cc", "value": "photov_549591236364.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af855bc-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "bb8d5bf1-6c11-40b3-9847-af9be2f151cf", "comment": "Malware payload (Mirai)", "value": "cdbd897aafc4da6a2c10c812d0e7b5fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "c4df8b2d-4c00-42ce-aea6-1d1964e96f16", "comment": "Malware payload (Mirai)", "value": "e3a8bde020103b559eb3a1364b5b970d1e9253861171e191dcf65b625b63ac90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "ede51383-c0cc-41eb-a8af-437029a9ac5e", "comment": "Malware payload (Mirai)", "value": "131bb6e207ee5d5e62a5b3e5d765ed52e0ddac8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156434, "uuid": "ea4c3357-a747-4eb4-a366-fd15c955d61c", "comment": "Malware payload (Mirai)", "value": "ab4a2abfda7ca98d6956a7dbc3fc37fe105960b895125c0bac7c32deded2a5f50cf835d26361dbd85bfa35e5e2eac29d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "e89ff043-3f6b-41dd-afd3-ff26e1693c5e", "value": "T15D23F757BD81DB01E5D452B9BE5E618E3313077CE3EEB3265E246F2067879670E3A802", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "21f00b64-c6ce-4fb0-9a72-4e9f3d062a3a", "value": "768:NGn/nptkWUE6VZ40JdfKSgqRfVmp7OtNMNFpniOWGg00OFwNrmRI6xo:NGn/nptk1vVZNK0Q6MNiOWGgoFwh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156434, "uuid": "e10e307d-a93e-4b9f-be3b-584a91cb1dd1", "value": 47552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156434, "uuid": "5873f911-43a9-4042-8ebd-b11b78f67a2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156434, "uuid": "6f29d2d0-24fb-45fd-8dd6-4cfe367dba44", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace2d83d-89e0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785173349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173349, "uuid": "fbefaa55-d080-4dc0-8ac0-da404710658c", "comment": "Malware payload", "value": "d5bdd6261f62142a4bbbdec838a86f48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173349, "uuid": "a68d2701-099a-4109-8bc2-ca68c385ad01", "comment": "Malware payload", "value": "e4ba900efe648da92c9dfb373d8ed24375247ad816928a4863b501fba498fd8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173349, "uuid": "2d1ac281-82c2-45ee-bce7-acd357f9595e", "comment": "Malware payload", "value": "ccbf18454fd0d0c02c54f529bb0c25fd44ad2b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785173349, "uuid": "dc3f385b-ce60-4dc5-acc4-955404be3680", "comment": "Malware payload", "value": "73943f41bc3f9cafb6f2988f2ffd321ab056a2b0f008ad848ca7f3a4a05db8854e8539c649679b32fdce369ecc456dd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173349, "uuid": "3da0f050-d1cf-446e-ad58-5827a07e357f", "value": "T138D48C307695C036D5A204721A6C87B7167DBA320BA658DBB7D82F7E4EB02C29734F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173349, "uuid": "856b44fe-6ac1-48fc-ae19-ecce2d22d0a7", "value": "e87e69067e8ec0b60d35dba244831f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173349, "uuid": "b46b94fd-0e8b-4134-9da0-0a6f020cbd59", "value": "6144:FFNCXZU4wXl9yILo9bmvihRFl4++uOJ+PWSSzpAO/phTwB8uAspJVv:FXC9wXyIE9bmWDVazp5nwBispJVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785173349, "uuid": "06574416-9e55-46d5-a938-77595f00f2aa", "value": 641800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785173349, "uuid": "2bfc73b5-ca70-483e-87bb-ba67387a340c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785173349, "uuid": "ccfbf02a-fb5d-4416-930b-1ca91b1ee72f", "value": "TMUpgradeHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1bf8ba-89d4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785168168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168168, "uuid": "de6d6a51-f759-45c3-bc2c-2d463f00d876", "comment": "Malware payload (Mirai)", "value": "57eb0864c5044100a0924f5d9041b333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168168, "uuid": "90c9f5eb-48c0-4ed5-a8bd-b0fb490be61a", "comment": "Malware payload (Mirai)", "value": "e4fd9b03dbe36250de140a7dc71286759b83cc540a3ce79f561d7a95474e15dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168168, "uuid": "7834ff99-3d66-4cac-b881-30fa7d16c97d", "comment": "Malware payload (Mirai)", "value": "81119e2c3b411be159ff1389e20ae90b8e5a781c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785168168, "uuid": "fadf5b86-5efa-4a0e-97ce-3daf756b4f28", "comment": "Malware payload (Mirai)", "value": "d1ff4fd2aefaf54929a1318ac8df98bd36b3644d3817551ddce4c9bcb5edb4198d46e8b7e635ca106bbc75afacde4e03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168168, "uuid": "709fec6d-b1e8-422a-8cd5-4b3d1fa87e69", "value": "T11FC3E71E7E258F7DF2AD833447BB8E31A75923C626E1D585D2ACD6102F6024E141FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168168, "uuid": "1bb15570-71b5-494d-91ee-3630e389df75", "value": "1536:py5aBqP7MSCKrylSUIf1+luP0+tWOlg0yEkv1BvMEWCdWEealLbP+h390j:IaOulLUUogcQ9BvMEWSWC2h390j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785168168, "uuid": "6de81fd7-37a2-4c83-94bf-d38c9b420bf9", "value": 120404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785168168, "uuid": "7a4d4ba9-3255-43b1-a397-7c481d360e97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785168168, "uuid": "73ce2e50-f14e-4172-845c-88ad092ec9c7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63997f6-895d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785117154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785117154, "uuid": "995b35a5-45ce-4ae9-be63-02675419b5d9", "comment": "Malware payload (Efimer)", "value": "e63172525926f847841634253c9534ac", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785117154, "uuid": "b18168d9-3516-407c-bad7-79946836e811", "comment": "Malware payload (Efimer)", "value": "e594838ef765312d60475677ec54bf23a4fad659aad928f4564d49890ee9c23b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785117154, "uuid": "b3a12d04-29cb-4081-87db-ca766720d4c3", "comment": "Malware payload (Efimer)", "value": "e34584001e81b6d185beac42b2b48726d8790207", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785117154, "uuid": "a9452164-25dd-45c9-9957-2f339cde641b", "comment": "Malware payload (Efimer)", "value": "208dfbce37a18149b37bef1606f01f74e46e8d3d18d54b918982a18cebceadfa45e6a8401b3c6f45adbbfa9413a95976", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785117154, "uuid": "8fb84e2b-6063-4984-83a4-f1efa1732309", "value": "T12FE6330CA1C502EDEA73423DFAD115A1D1E9B4714736CADB47A8A7E12E332A1893DF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785117154, "uuid": "014003e9-8cd2-433c-91ee-cdbfc033e521", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785117154, "uuid": "a189462a-66cb-46a7-80ba-17db3103911f", "value": "393216:THWnvb0GsvF8qwjw+gXMCHWUjXccuI3/PGTAI:TU0LClpgXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785117154, "uuid": "8eb65b29-b817-41f7-848b-efc1be48d6ac", "value": 14319114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785117154, "uuid": "3ca200b8-386f-4281-98bf-70f0052171a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785117154, "uuid": "24b8832b-2076-491b-9ae0-e3cf2257148a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b1a4e4-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154194, "uuid": "e20c175a-505c-4076-9b90-73066ecd46e1", "comment": "Malware payload", "value": "6cbe7574d048dafac5ebaef14646ac3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154194, "uuid": "66407a11-fb1d-437f-a86f-15ae367a6ea8", "comment": "Malware payload", "value": "e5dd21abba2a089bd45e53658361327d9336166502d8ec73708865901c3a6082", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154194, "uuid": "d4364975-58c6-4e2e-9945-62e38688fd9d", "comment": "Malware payload", "value": "fd4eccec2700a463af634e08d893eef1c3686668", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154194, "uuid": "b2da2021-3ffc-4e8d-8748-ec7a9a657eee", "comment": "Malware payload", "value": "a59278b7179a97efefecb2ce366d24913807cfd4c4aba94bb8803ca0d7b5d7b9ce3fef8465653faaeb746d08b31cd1c3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154194, "uuid": "46a45fb1-bb6e-4d24-bff5-5e789e7411ae", "value": "T1B221E929C08A9531C98B0BB2BA57FF0F28D1D3444A03306B53B11ACE6C02ED88723238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154194, "uuid": "bc934843-6d87-438e-bcf4-d9e49cc0d094", "value": "24:9cK6lkq6uiqQ084inasZ1Y9g1RxRmSp9JtnnY7Xxg6u+kqNaCzqdtl:9FJuiqQ2OaSuO1hPp9bY7X+6MK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154194, "uuid": "31510d5c-b324-4268-88ce-892fcfa72d5b", "value": 1154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154194, "uuid": "0e00afe4-c4c3-4925-95de-7abaa4c3066e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154194, "uuid": "e3bc7758-c11c-4f84-ada8-55ed6d774685", "value": "photov_730128136941.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659560dc-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180960, "uuid": "f9b0f72d-dda5-4c46-8447-ef15bc408d4e", "comment": "Malware payload (Mirai)", "value": "16ffe2957feed772ef139779389eb8e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180960, "uuid": "85788cf1-f8a5-4a4e-bbe7-773366bf0680", "comment": "Malware payload (Mirai)", "value": "e61cf04f9405cbb67cf42963cdedfd0cfe4758f336c74822a1d47ab21c7c8770", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180960, "uuid": "4f55f57b-aeb1-47c4-bdad-903bae7d3abb", "comment": "Malware payload (Mirai)", "value": "8e8004ce786d9eaece399d89d114af3c3e6481d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180960, "uuid": "4b0da180-1c07-4fb0-af2c-fd996c4c8ebb", "comment": "Malware payload (Mirai)", "value": "148a5fe27c49aa5ac714e5806e9bd61be58e0637e1057f177033514f222200c3797807911db386e8b164f0b8d565d17a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180960, "uuid": "a5bd8baa-2c53-46ff-9747-2ac896582314", "value": "T15DE2E11175FA8536D7204A7E8F94D38F99AF6D38917C3277C4488724660CC0AAAB99CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180960, "uuid": "494d7b7a-108b-4043-8e62-e604604e2864", "value": "768:yr4LGJKgQQz3i6R38X9pD6QvXQiwlECO9/vpuM8s3UozR:yr4LGJKetR38rPpJFvpu4zR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180960, "uuid": "5a7f0b0e-2ebe-4696-9b00-663790c6450d", "value": 33872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180960, "uuid": "17c35679-21af-4618-ac7f-ed46ab772573", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180960, "uuid": "9ef5c06c-47ab-4036-8d38-787d92ee0b85", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd2168a-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143255, "uuid": "48e41b43-b02f-4bdb-8218-3a7e26eb0ce1", "comment": "Malware payload", "value": "d78075e09084fba9e077449c3bbdfec9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143255, "uuid": "2ae3d945-254a-4982-849b-50a016073983", "comment": "Malware payload", "value": "e740c60bbbf854aba549893fecc7b8269a12d2df7a647f28910cd42ef12b795b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143255, "uuid": "889c9498-e797-4352-b00e-351ad19afc28", "comment": "Malware payload", "value": "8b95ed1784e5536ef14427559e57969f4feb3191", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143255, "uuid": "716f4535-a42a-454d-8143-5025d0f2c5df", "comment": "Malware payload", "value": "887f99bd109102ba9db44296c4722bf5b7753b3184c86f7d5df5bbf515b960d6d47a2e905c9b115f153913d62998eccc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143255, "uuid": "503d253e-cff5-4b59-99f8-fde0eace65e7", "value": "T1B321AAE3C9219135E85B423165AB725CD37935D12B2317AD36B478573C4BA9A5706100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143255, "uuid": "06f0beeb-ccbc-421a-ab6e-675441a77a70", "value": "24:9rQ2Y5Qw4UR6Kk+Ux5b5msmS1plLuSvqY+ApCOUU56IqVTQ21o4:9iHMPBPJHvCAMOUUbqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143255, "uuid": "67100241-9444-4496-9909-9bfee789629c", "value": 1215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143255, "uuid": "975d9166-9ea8-455a-bf8d-df863f8e29f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143255, "uuid": "54dd0edd-9819-46d7-ba36-096168f10907", "value": "photov_785543720778.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a7362b-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143565, "uuid": "72a420c6-c321-498b-93dd-dbbac9c2d154", "comment": "Malware payload", "value": "ced3baf1352046e1f00d0a41a4f9d5f1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143565, "uuid": "83aaaa88-0d70-4fbc-b923-422c6ebbb605", "comment": "Malware payload", "value": "e7bc77c620dfe00356a4c8993bf5751fe494a3b6d1960a2e8d79de8161d508e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143565, "uuid": "56ae7500-6ec6-4828-abb1-f21eb1bc7356", "comment": "Malware payload", "value": "7754160e5077faeb6766850e572c5f9858e62c13", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143565, "uuid": "2446b26c-1d5b-4489-9780-53fc6dd1526e", "comment": "Malware payload", "value": "4b7c994172e8f93150210df5f55cbc0297bb15d500af5b1b478db267ad01998e51c89195a9c3265f7dc986c0f931a5d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143565, "uuid": "a7e6c00d-1b3e-4b38-9978-a2ce4b9bbf0c", "value": "T17421EA3CC555E364CDCB877AF423FECB33950158B7074972065D01543C82D1A17A9CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143565, "uuid": "a9674151-8b6b-4e0f-89d7-691da34e0af9", "value": "24:988t2W400NdcIfIXt5eamkfglNeubHmS8Dp+Jl8qHkhbvf49WzV8bGj:9bt2WW+Zt5HPz0POp+kzzeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143565, "uuid": "4c304d6b-b7d3-4138-a20f-d20f39f7528d", "value": 1260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143565, "uuid": "0421f772-8bad-4c7d-aacd-171e661c7559", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143565, "uuid": "11efea15-80b1-47c3-9081-8a7ce2f4dcb0", "value": "photov_975384469934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22494f93-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158084, "uuid": "828e0a1e-c365-418c-9d02-aed7559aa435", "comment": "Malware payload", "value": "850da43df1dfb3b2def61948d0dae05a", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158084, "uuid": "604a3741-6c47-4d35-94ee-5927b5321b55", "comment": "Malware payload", "value": "e7cf9b864f0764be1f73f8dcdbe490619998650235550fdf10621366ccac9b43", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158084, "uuid": "16ae28b6-a267-422f-961e-1d9ee2a0909b", "comment": "Malware payload", "value": "ca8320eb6848cd32109ee8603168155a3e43b5e8", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158084, "uuid": "87ad0539-e4ec-4eb4-b13b-4496c46fb70e", "comment": "Malware payload", "value": "738763619db46b7e80e16419a63be98d4eef8444aab02695f3d9e5695542071b427e32a85ad09c9b59d1de629e72c85a", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158084, "uuid": "034cb08c-f765-48b7-89bd-67692f6ef821", "value": "T137479D15A2B811A8D723D6348AA79E32C67278060777A48F07D9C3071F73B91AB7F716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158084, "uuid": "3d973e14-32fd-45a9-90e1-bbc99503618b", "value": "1d460d40d677072556393e27fe74ae8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158084, "uuid": "516971e5-d26b-40bd-a005-0e2553377246", "value": "49152:1QHVgDcWgpI+dyc3DU1jTMMAgdgYjoE1+BL8+N:eEcvJjMmLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158084, "uuid": "0166be15-d2ae-475e-826c-21fc909a859f", "value": 26923520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158084, "uuid": "b3114da0-bc7e-486d-b4d9-83bc828ccfaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158084, "uuid": "3e2d9417-e29e-460a-ac5d-98f30c96521f", "value": "e7cf9b864f0764be1f73f8dcdbe490619998650235550fdf10621366ccac9b43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91a7fd9-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785167866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167866, "uuid": "19eecf0f-7e42-4c45-9077-604225d4326c", "comment": "Malware payload (CoinMiner)", "value": "90593e25fa5bd96bde4b77d4ef9dbd63", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167866, "uuid": "0a0af6b6-f134-456b-809c-4c64fc190ab4", "comment": "Malware payload (CoinMiner)", "value": "e863bd21f4bac8aa4ca9bfa206c2fe24b5d81ada4f09c61d7afee087f67aaf92", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167866, "uuid": "e5bfbd43-fe47-4f22-af9d-8b93f2de133b", "comment": "Malware payload (CoinMiner)", "value": "9c9880542d3d91b000ba2d3499f32e20784038db", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167866, "uuid": "7cd4d721-4f9a-43f9-bbdc-e2e7839f9dcc", "comment": "Malware payload (CoinMiner)", "value": "452dfb9ed5c1f9f53527307e242a391e98cd10a11332198e595c4f9f748beb1e19c1058ba1595fea869231266070c591", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167866, "uuid": "24ac721f-5bd4-496b-911c-040bf7cd35ff", "value": "T116065B81FC41CF52C9D03A7BF66E828833530779D2EA70069D255B7467DF99A0F3AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167866, "uuid": "1babb779-956d-4cfd-a144-2a5eb6403fd2", "value": "49152:BVcvdi3d2+be6NowPn3e7knQrj+PQOwvupj:BAi3jbpOuncnOQOwmpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167866, "uuid": "4c9a8173-ba2b-4354-aed7-0c01991d88cd", "value": 3904272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167866, "uuid": "bb09d157-70d7-4e17-a4ba-a23ad211ed7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167866, "uuid": "65baf9ff-6fdd-4bd9-995e-e3e42224790a", "value": "8aff1e9e988033fcf509e995c64b2e7cd5432922a5502b43aa32bfaa6de08ed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52726fd5-89b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785155158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155158, "uuid": "69caa418-0657-4a00-9253-9e9308bc1571", "comment": "Malware payload (AsyncRAT)", "value": "44202a668f470eea6af3bec1bf9400c9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155158, "uuid": "950ba372-6fe5-4e45-9c90-0dfdeeae4f17", "comment": "Malware payload (AsyncRAT)", "value": "e922b9d3d9b7c8c01c18cf19b22c9596af7ce5545f6a77bfd6fa779e60aae7ec", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155158, "uuid": "020e106b-193e-4549-9363-5fb0b748cec1", "comment": "Malware payload (AsyncRAT)", "value": "f11aefc5568f0a86fee35809420da22d6fb331d8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155158, "uuid": "0c099019-6b14-49f2-b9b6-bda79f0f6c1d", "comment": "Malware payload (AsyncRAT)", "value": "ceb1b58021b378d0f416a376b79530d004626c25e6e506c537be06de65812094a8cba0cf1d76b080383772bf5ca3fbde", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155158, "uuid": "b6aceef1-880d-4df7-bf24-fd2b94c1792a", "value": "T14315E02966238612E4B66FF00E72E5B05779BCAAA131C61A5FD63DEBB5773003C14327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155158, "uuid": "d3875aa9-b0a9-4d77-815e-a9619133a12e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155158, "uuid": "893c51c0-8b12-4abd-90d0-eadb1e632e73", "value": "12288:kpG5Toqi3y+eK+jvD5FYBlLn2l0hp6XbvgTDLMY74JmjSXXdmyk6WHmmY/xW0LWx:kpGsiVb+V2Wh0bMDLSbdIHmmSxW0feZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785155158, "uuid": "b1cb728c-083c-45de-b353-82049971b789", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785155158, "uuid": "c8615dc0-30e1-4a4e-b2f0-d746fd0d3198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155158, "uuid": "92844510-0b25-4f55-badc-163710e64f3c", "value": "Nostro Ordine 264418.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c97617-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133170, "uuid": "85c66ef2-6796-42ef-b107-68e8189c79b6", "comment": "Malware payload (PureRAT)", "value": "323fed78fc8aaa86c3d35aa85313645d", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133170, "uuid": "916f0d72-e48c-4ba1-ac60-b337af483e09", "comment": "Malware payload (PureRAT)", "value": "e937e353759cb981feb958f6fc54cc4922169260a9eaa8f1d7266c14b53fe7ce", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133170, "uuid": "0259023b-17ab-45da-a625-585a98ee1cb4", "comment": "Malware payload (PureRAT)", "value": "0cdc9d6c5c58fd264d138ab9cec71364d12f4fa9", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133170, "uuid": "1cf91259-3608-4ddb-b5de-555522ac745d", "comment": "Malware payload (PureRAT)", "value": "ce1bef00a36c1858938da26c06776dd3126d637084b29ad018967f7c193d7a844cf6644814e971fdb9174ec05949198f", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133170, "uuid": "3be0cdd1-5478-408f-8fa2-f8f0519e1118", "value": "T1BC210A6060A99750EF9B0A3FAC10741922BE1842654D7CB712258E5DFC0C0C02BFE5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133170, "uuid": "2225ff43-ef2b-4bb7-92c0-e34bef66f2a1", "value": "24:9IbbG5HjoaY3uT7acAiAq/RbaUrT+JpVpgM/QfpqQnxFmSZuv/DYJJxVMOCNbb53:9IfG5Hkd3uyce+QpVmcQnxFPiK7t4bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133170, "uuid": "4ee2789d-78d3-4d97-9123-17d7db888ae5", "value": 1221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133170, "uuid": "37a8f746-2c57-4d56-9239-20b2d990fefd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133170, "uuid": "2a897957-35eb-4161-8735-78f34f705a54", "value": "photov_088383300662.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165c9e0a-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132723, "uuid": "326aa1c0-d7a0-45a4-80fe-6cca82089a8b", "comment": "Malware payload (PureRAT)", "value": "310cab989aefd83630cfec2787d873e3", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132723, "uuid": "7acef56f-193d-4d58-9703-5ed477a82131", "comment": "Malware payload (PureRAT)", "value": "e93e25240171c351628e148dade914eb550dbe90a8dd1c9d8684a6c8729c215e", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132723, "uuid": "7205ae20-dc03-4bd4-ad9a-e1ca11d37373", "comment": "Malware payload (PureRAT)", "value": "a28aac0709eae15edb765bafd4410c77e79be7e7", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132723, "uuid": "bcd86b53-b29c-40fd-b729-6c8d081c3664", "comment": "Malware payload (PureRAT)", "value": "8e4815aa97c447f71b936822a93cb6de244650d3f908d74fc48632fd611040c73a118061b8d76a71eeb92a2c95e15662", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132723, "uuid": "5ea26f63-e904-42fb-b8c0-dcdf99a5c7f0", "value": "T18321A704ED2F2F93C2027E33DD0D6A193A1BEE90504950957D0674F438952962F34681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132723, "uuid": "99e22000-9db7-4891-bf5e-67cf19c6bf8e", "value": "24:9IxyHdT7yv1huAOrl+iMK/quamSB1b24R8RZw63YzC+x7xSoNuLK:9Ixs3CZUJ7aPqw82x7xkLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132723, "uuid": "6b7b855a-d522-4cd5-a636-e7ff34f85878", "value": 1196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132723, "uuid": "284f94c6-9605-4c39-9c4c-06c5cb5b2806", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132723, "uuid": "9f0aa23b-b27f-43cc-8b1d-7fcfc884a460", "value": "photov_297173993732.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434c03e1-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143536, "uuid": "52da83bb-55e6-412e-b9be-1df8668d4d68", "comment": "Malware payload", "value": "d69d881dc5329c3f9c165ca9945b5542", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143536, "uuid": "33bd6221-618d-4923-be29-47659f45c8b1", "comment": "Malware payload", "value": "e963b8b1f2b916edfcc0eee4fe6a9e026a9578ea89395733fe0ac3f2ff0f5c9f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143536, "uuid": "eaea9b2a-8b65-49bb-b9f6-c4fba5f59a35", "comment": "Malware payload", "value": "c13b86d6f8eeff80edec7968d9de5d76372fb738", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143536, "uuid": "77c76d13-c5f3-4d83-bfac-dfa2fd789fdd", "comment": "Malware payload", "value": "c943219132572eca9db4d828ee6b92ccedea7c16032e05930e67bf653a19d450eee4b48e94094343760fb9db2e9d0946", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143536, "uuid": "46914f0a-b5fb-4cc3-8cc8-cd816b500162", "value": "T1B511A52440EDC5D2F85292F22817769DE331FD81108370E3E35F3A7039BE89A53440A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143536, "uuid": "41b991d7-e442-4986-9d66-3324e4402eb6", "value": "24:9xOaid6SVw4H7YyZ+j3Dd2ZmS+bWHUbzYsX:9Iaid6SVt7Ya+bDdSPmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143536, "uuid": "69666d96-8faa-4a2b-9d9d-6e2f5e84a110", "value": 1042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143536, "uuid": "31e43331-3f7a-4bdd-8795-1707f7d9aa9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143536, "uuid": "1adcda67-f4b4-40f0-82d9-98eb542c992a", "value": "photov_390990734403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc63a24-89b9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785156516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156516, "uuid": "3daa2300-a513-42e4-ab25-cd5ae8b60dc0", "comment": "Malware payload (Mirai)", "value": "1ebeeb96e370353a18d0d6ba575a2d0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156516, "uuid": "cbad93af-df30-40ad-84fb-0f4c5da5641e", "comment": "Malware payload (Mirai)", "value": "e9897eff21ced56a8b21770f8f716de8fb0058245e084cbc46efaff43aee999e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156516, "uuid": "a8576d85-6ccb-4928-8af3-b46dcda11d92", "comment": "Malware payload (Mirai)", "value": "2f3bdb301604c3cc24b0f8e9a1ac0969f861d854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785156516, "uuid": "613891f2-7b5f-44b9-b0be-724bf80de079", "comment": "Malware payload (Mirai)", "value": "9a6f154abd11098bce6d20023c647a9d8002a7e05ddef1e9baed7ee78f7c23ba8b2f9a8bc4a3d2c731ce203990c51260", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156516, "uuid": "68a5ad64-10d0-4ce1-b427-70785fcf0b50", "value": "T14F144AC3F900D9BDF80AE33788134916B130B7A214925B37B257797BED3A1990577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156516, "uuid": "68754d15-43e2-49bd-a0df-5eaee123e357", "value": "3072:nZ2xzwEkB6m8DbVX1YbkQZ2na8WFoAu2XnTxVpjbiBLly00yxjHDKi:Z2xz/kB38QoQZ2npW8qnTgLlqyxii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785156516, "uuid": "2ae862f4-5a4a-4234-aa00-a30af055a09f", "value": 191072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785156516, "uuid": "40a68fdd-29e2-4cc1-a4c7-dfc59f9117ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785156516, "uuid": "ac645d7a-52a6-4f4e-a52e-f074ea2da956", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ac4140-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143325, "uuid": "e2f885ef-f326-468a-ad97-f9ae790ce195", "comment": "Malware payload", "value": "2a82f4e57436feb1ff2a89c796ff32c5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143325, "uuid": "fac34fc9-6aaa-4dd4-815c-97665dcf5bee", "comment": "Malware payload", "value": "e999b2b6e78074c347241784f88fa6c737ca069072f5f7daa37a59d48948645d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143325, "uuid": "c3c09ae0-4972-41a8-8f70-946411abfa8d", "comment": "Malware payload", "value": "f74faf8a817f50fd5e88ed4f09c17a19ed55ea22", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143325, "uuid": "2071b166-db31-4898-b4fc-b798e9aac0f4", "comment": "Malware payload", "value": "ac267263aa842574b3b0e8c2d8a7b580f6653507a24d873f5864e749f3a1ade1db09945b0a9c1b8467db367380f4a858", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143325, "uuid": "394d9616-5054-4171-b3c5-423395ef4285", "value": "T16921A3F5ECA68B83C81705743C014D3900AA4187E3899671828C3F9BED16C28FB71172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143325, "uuid": "6680a56a-6887-47c0-8d69-a5a9228820d7", "value": "24:9D60KaGwSguW9CzVD/iCplxjOmXLEDqmSTbdWq4Ng9WS7/0VQ0:9D60KYSzWAzVDiEx6K+qPNWjgfT0VQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143325, "uuid": "1dd6d16f-d481-45b3-8ca1-dcfecbbc7182", "value": 1202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143325, "uuid": "91d47ac5-1f03-429a-a3d6-798ff4f7fc59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143325, "uuid": "2fe0bc92-8539-4d55-b74b-21c357cdab2b", "value": "photov_733857419369.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324222d8-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132770, "uuid": "05e8a17c-4735-418c-b6a9-a3331a478c98", "comment": "Malware payload (PureRAT)", "value": "07eeaabb9fae8ba2205086f3c98c6feb", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132770, "uuid": "c514387d-5b38-42a5-a60d-8f1122d96892", "comment": "Malware payload (PureRAT)", "value": "e9afef6f4daf292bf86921d6782c92bfce933198c1cd8b99395dff67a3129cd4", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132770, "uuid": "bed67c04-98dd-4ab7-95fa-235ccefdd627", "comment": "Malware payload (PureRAT)", "value": "6e061c02b74313d90dd9354363ba0e3d73854dd8", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132770, "uuid": "ce67a362-de74-40ad-b4a5-df2cc7db7f2d", "comment": "Malware payload (PureRAT)", "value": "9f1915b78800fc55508fd8956aa09f760f12bdd73c36897a6eb380d69d422661b21c328c5665ba14c3fbeeb0da0a936b", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132770, "uuid": "77208323-1f44-49d8-8474-c1a0651c48d9", "value": "T1C721EAF09F13AD86C0C6E33348FAED804965A3219A94473A425F65FD3750DC4A21E5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132770, "uuid": "e91a6418-2566-46be-ad6b-6274081eace9", "value": "24:9Mcn/ysOVU5/oUFwbZha4YoUqbg8FXwkmSY0h6acaSJAnJ0CbnST6ck/UXT3:9Mcn/ysO+AUSsoUMXFPYQvvSGJ/bnbcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132770, "uuid": "8f7345b4-ad91-4a86-bea3-d5c6f604462e", "value": 1369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132770, "uuid": "913a03b9-5f64-4cde-8130-02770536e039", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132770, "uuid": "48d90583-8c3c-4ddc-bbae-7fbc928c9434", "value": "photov_490019686817.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d2272f-8988-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785135383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135383, "uuid": "f6508341-5a38-4605-ba77-6e2262c44e28", "comment": "Malware payload", "value": "ded7c36a38fad16d324f5dcb40cd75f0", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135383, "uuid": "5dbfcc38-642d-4578-a29f-e9faba363935", "comment": "Malware payload", "value": "eb3842afc9fe1f3dc1cfc579f465766f1fedc6e64a0d2224e1ea7c272924f66a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135383, "uuid": "e6b1fd77-c280-4787-8969-4d7029fb1df0", "comment": "Malware payload", "value": "c2ba5959b0f6b7264e621dd564291d5d48cc6735", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785135383, "uuid": "7084bfcc-421e-4c5a-bc32-eab897ce25ed", "comment": "Malware payload", "value": "71487d91f9de154a00435410f949b038d5798e14f0bf1a57c2de0adb8c11464aaac02168ba1e111db42ce84a672eeeaf", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135383, "uuid": "40ee0820-4c41-46e7-b226-87486dbc2ebe", "value": "T1CED423413C993BBA1E7A4BA418FB05042EC2B9BE541DE7C136EDD489A7CF9430656CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135383, "uuid": "aa94e545-485d-47d6-90be-86914d601a96", "value": "12288:dIACxiJrxPct+e+WPmoDYBTrVVLosHSfdm51NvLGm3q46tN:tzJlPK+e+x2YREhdm5f/atN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785135383, "uuid": "f53c33e8-5eda-4000-8dc0-5c498f1361a8", "value": 600093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785135383, "uuid": "05ac9df3-ceee-4f83-a063-7654fcafe3db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785135383, "uuid": "7e3d8564-1f71-4cbe-836f-e928cdfbede2", "value": "eb3842afc9fe1f3dc1cfc579f465766f1fedc6e64a0d2224e1ea7c272924f66a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a061683-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180967, "uuid": "00b6686a-3361-4a25-92de-7fe6a6175eff", "comment": "Malware payload (Mirai)", "value": "06f42c4798f736d80f1590f05cc66a1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180967, "uuid": "08d43818-9d64-4dad-82bc-9f1a929808fe", "comment": "Malware payload (Mirai)", "value": "ebfe929a1285bc3a48b466b6767be1cf1242f66b9ab4a916e197f26ebc346332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180967, "uuid": "ead26b3c-1091-4787-b9fc-209d2209b99f", "comment": "Malware payload (Mirai)", "value": "4d6a6307df8302cca426099c6f4460e4fc130802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180967, "uuid": "b9b9c06e-b512-4624-80ee-855c2c529346", "comment": "Malware payload (Mirai)", "value": "7c508a3d5ed55f39ef921b8a63cd6a2600703e81ee991c9ec8dfa703cd3b1ec28fd19a80431cdd8b0b7cd3575c4dd394", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180967, "uuid": "0b849fb8-713e-458b-b785-ef19246ac9d5", "value": "T1A6832997F400DDBDF80ED77B4463490AB230A3A105830F36A79BB967ED721A45966EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180967, "uuid": "80b54c27-7a85-4846-a7a4-2db7ae0725f0", "value": "1536:6+KGZvtQA2unEQaqxSo2r/X2ZN4r8FXultko/smObZJvHoVQiacnqvfXS5/:6JG1FnEQaqxSoI/X2ZaSgts7bzYacnuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180967, "uuid": "fe3c93fd-8246-453a-8dd2-f19b34226194", "value": 81656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180967, "uuid": "c933731b-79d9-4558-9635-8da132ad9741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180967, "uuid": "67266bdb-5bd4-4e87-a79f-3061e433b8e1", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166ffce1-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133153, "uuid": "2ffce66d-6135-40b9-8da1-b2ebf4e71f6e", "comment": "Malware payload (PureRAT)", "value": "67886fa402577550d9cf8b8d8ecb5799", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133153, "uuid": "ca814733-5db4-41e9-bdac-cffa287033db", "comment": "Malware payload (PureRAT)", "value": "ec3b222aca8546457caec95130ab1105c08b2e6de9fc0d4c23d5613ab057329e", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133153, "uuid": "c1c1c8c6-65eb-448f-98d4-17819ae36662", "comment": "Malware payload (PureRAT)", "value": "435c42474359cb339520d0785432133ccad1be14", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133153, "uuid": "20d79ed6-b211-4e5d-bb4d-dfaeb12a8b63", "comment": "Malware payload (PureRAT)", "value": "bdf033302b364680bc075fd63434808ceed8003dc8dd97d872d0569c5289e193eecf6e5e0561de8631ad38313855496e", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133153, "uuid": "bb3ff53c-1709-4a7e-81cb-d34105853053", "value": "T11B113E68904BC9C6CDCEBE73B99A7246110E0181DD10E05367CE29F92C9EE4A2B12E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133153, "uuid": "68c7cbf5-9053-41c1-9438-3c6c05c7c741", "value": "24:9UXibjU0cxUHVtrC9yCExmGUCR1Wt4JzzNmBUQSvtsHwdur8z8NFn:9KifU0c21tWyCx4vu2dkPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133153, "uuid": "309d2c61-8a4d-4ce1-996b-a96d2a39a63d", "value": 1025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133153, "uuid": "f4882612-da4a-4f11-bb26-b986d0e7f14d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133153, "uuid": "ef6d981c-a33a-42ba-a175-b9c8ead0b9d0", "value": "photov_299389298181.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78ea113-894e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785110767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110767, "uuid": "9b47118e-6ec4-494f-96e7-ee76fe99c3e6", "comment": "Malware payload (RemusStealer)", "value": "3ac8576f45bb73244f12a00976fefbae", "object_relation": "md5", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110767, "uuid": "5e8737fb-177b-440a-8763-baad16158405", "comment": "Malware payload (RemusStealer)", "value": "ece6e9395edb8935c993a2945ac196a614149d65f10212e912e4654981646e37", "object_relation": "sha256", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110767, "uuid": "25fcb2d2-9ecf-4cfe-813a-a46f54108484", "comment": "Malware payload (RemusStealer)", "value": "c57e06f49f785ae408d42e4b2fb139c0e7c0b4f1", "object_relation": "sha1", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110767, "uuid": "fad3cb4d-ae40-4762-b9a2-2f8eb8c55624", "comment": "Malware payload (RemusStealer)", "value": "bb0aee53ef8cc9b184f978dc4891b6e321b6c887c45afc005afb3ad286ddbb6977b51865c6be6589999f50b470de61e5", "object_relation": "sha3-384", "Tag": [ { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110767, "uuid": "879ec854-cae4-4a70-9ecf-8ad376b92793", "value": "T16B24096BD25370FCD652C07852666232B733BA3C47359EF702A3C3359D21AC45E7A929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110767, "uuid": "baa51a6f-90c4-4fe9-881d-bb4f58f7e4e4", "value": "934864fad2e0d984459abdc576cdc4a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110767, "uuid": "0829ab8e-1d71-48bd-8ab0-6cc98b682cd3", "value": "6144:FejlHWFiEBx+QncAE0EfFnyVUjYcapLFC18CGiics:Qj5WUEBx+Q7PEfFnQU+tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110767, "uuid": "0d56aeb4-bbf6-4d39-9209-b4a2a45d4004", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110767, "uuid": "0dd2f52b-e603-4c2c-aa47-e36f4fd2ae5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110767, "uuid": "d621a8d7-ba11-48ad-bfd3-7ab29e84d27a", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b2128b-89b6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785155135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155135, "uuid": "9d91194a-38a4-4de8-b932-42a60b5c6312", "comment": "Malware payload (Formbook)", "value": "adf16430b4c278fcf6c9c71fec17c75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155135, "uuid": "49dd0785-5b7e-45e5-88ec-7be8b3d74604", "comment": "Malware payload (Formbook)", "value": "ed1f71433e9f55140d1c854ef5425e27357c46616710662407ddcc02ef4a9854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155135, "uuid": "d2e6a8e8-809a-4a23-8782-d0aaa572f82d", "comment": "Malware payload (Formbook)", "value": "459842f88ff6ad6f34f6538475dfeab3fe385b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785155135, "uuid": "959c1d7e-74f7-42a1-8a25-4a085c134a01", "comment": "Malware payload (Formbook)", "value": "a911a3c4b08c782cb628fedc06345a3910597043f1486b6ee055e1c0bd5a78556d55de7a0a502c03534d217ec0467ab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155135, "uuid": "6e73c3ae-efd9-4000-9648-934577422825", "value": "T18735235AE7278507E4CA1B718AA8EA348B7EED9CF561DA074AFC7C6336B33541910343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155135, "uuid": "97d70c13-9925-46e1-81c8-73ec7de13dbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155135, "uuid": "c224d197-222a-4932-9142-c33cade72b80", "value": "24576:94605GXRRZ2+3Mlr1lDSUjHTu1mLZrAEvS7aHkfeZ:+L5GhH7+plmUjHTu1YsuS7Iye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785155135, "uuid": "d5c02b47-8471-4c6d-9c34-7595cc7d529c", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785155135, "uuid": "4483d00a-870d-416b-95f1-b940f0d4d3d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785155135, "uuid": "41584ea0-f9e7-4d5c-8e55-c6b9efa52860", "value": "Our Order 2644OP18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9966f70e-89f6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785182765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182765, "uuid": "f4bbf1b1-4b85-4301-be8d-c8bbd06afd1a", "comment": "Malware payload (Mirai)", "value": "834519ce4f2951f189bf9b331af42d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182765, "uuid": "b12d54d0-eed7-469f-846b-fcfade9d6f51", "comment": "Malware payload (Mirai)", "value": "ed35e07d9a91e36eb996e234a7f7fce0243b206976ba5c67d05ea6a05c07233f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182765, "uuid": "025eaf8a-184e-442f-a3dc-09e03fcb5ef5", "comment": "Malware payload (Mirai)", "value": "37bb516679a2818cc79eb7254bc3a6e6f6aa0935", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785182765, "uuid": "79add1a2-9603-4e6a-abf2-10f035abb521", "comment": "Malware payload (Mirai)", "value": "19376ef6be1bf85a6ab468dceb04d1e5059e3ca1d7ba482bac373bb5dfc002b4bf211f871b5a8c7606cb4c36fbde1e48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785182765, "uuid": "6e129dd8-d822-446e-abf7-898fa2684c01", "value": "T15DE2E107A5135D09C4BB32F279DE760044158398F38E9EA6EDE4197FF572F12092C76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785182765, "uuid": "e8f995a0-52ad-4e34-b176-e5ff77630ba9", "value": "768:B0Mdl5ORifs2jdOdH9flj1FcN01Mhm+KXEwqZOOnbcuyD7U4/2q:SMdSif56H95DcN0ehJ4EZZTnouy8Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785182765, "uuid": "e026cc18-1ef0-43a8-b8f3-0c3c30b92970", "value": 33608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785182765, "uuid": "a5db8454-64a7-445c-af06-50c2233145f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785182765, "uuid": "3aaab7c5-61a5-4dc3-8df7-aebd59c7ec42", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7f5187-89d0-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1785166505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166505, "uuid": "04129de9-993f-4add-a7a0-3f0eb689552e", "comment": "Malware payload (AsyncRAT)", "value": "1625da7558b52226c5fbd151f8b96c3d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166505, "uuid": "73ecce7d-5244-4348-b0a2-3bb427c4eaf7", "comment": "Malware payload (AsyncRAT)", "value": "ede9c431d764668322e68d0ed9277e3d2aacc4904fca4f3a09f11d8662d3365a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166505, "uuid": "a0c9901d-7038-4f19-b9fb-2007667bc00a", "comment": "Malware payload (AsyncRAT)", "value": "96107ce1969b19a786fdfe0ba810bbb49c03aa1c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785166505, "uuid": "8f702ee1-4d6b-461a-959e-7e3e17467f44", "comment": "Malware payload (AsyncRAT)", "value": "f54ff093e102a007e2e05f00ad86f0380b4cd94f4e2d00cb27e088ed9fc8c8c8d08837a1affcfea165b0e9fb932832f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166505, "uuid": "ad9e253d-2283-4024-93db-ead109d3c61b", "value": "T1AC53E7013BF98125F3BE8B7468F6658146FAF4AF2D12C55D0CC950CE0632B869A41FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166505, "uuid": "139e1f9e-97dc-4341-a7cb-935895b80bf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166505, "uuid": "de7ee59b-3190-4855-96cb-2755acd9a253", "value": "1536:B2wukvF1ak9gcKu5UYFLGXw5bfAPwP0IxUrPlTGhx:B2dkvF1ak9Ku5UYFLGXw5bfVcIidax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785166505, "uuid": "56748523-446d-4cab-9c77-00b8fba9483e", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785166505, "uuid": "bc34d9d7-ae42-4bbf-804a-f81ab582300d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785166505, "uuid": "8a69a649-2117-4b27-825f-0e30472cb206", "value": "1625da7558b52226c5fbd151f8b96c3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b79ca91-899a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143201, "uuid": "0d243301-400d-4f77-825d-934203392961", "comment": "Malware payload", "value": "d2a144ade8aef362578a72f001188d25", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143201, "uuid": "58d39797-7ac9-4075-b951-8c34e72d21f0", "comment": "Malware payload", "value": "ee9a2bebfb8f251e1783ae8b475be83004788e5bc5d26e2ff87087dbdd43781a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143201, "uuid": "12040721-e0d5-4dc3-82a6-1eec273b846b", "comment": "Malware payload", "value": "b5511327e550ada6adc95283cd2ea1e4cff62469", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143201, "uuid": "7650a5ea-7142-4027-89bd-9c7d390a24f3", "comment": "Malware payload", "value": "739112c87504355329cd63f8ad2169d6f7614fac758e8f9f49272c43d32050ea4a127b7c56a7c815d0b3bcb95040313d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143201, "uuid": "601fea94-1e09-48f8-b49f-8e868c40283b", "value": "T1F1217766C22FC954D532D3313E657B4C4D1F0AED0F09322B8E3CB1BF3514458539A045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143201, "uuid": "040f5f65-19c1-460e-9ae0-058a654b01b3", "value": "24:9IS95tAZgV1ReHfbw1Xlxj7VrmVa3tESw22+us:95rtHV1E/bkVx1rc8XL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143201, "uuid": "d4957a07-74aa-4fb9-8af7-d3fa8003d5f5", "value": 1266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143201, "uuid": "002a444f-8f10-4582-809f-c7c4287f4883", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143201, "uuid": "36ef6dee-b05d-4dd8-a425-b0c258626c31", "value": "photov_648450167110.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10c3eee-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132607, "uuid": "978185cd-2b09-4568-ac63-b14c4031e407", "comment": "Malware payload (PureRAT)", "value": "31017343f19d0c8c49b1abe4336776f3", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132607, "uuid": "aa0ca9b9-250e-44f7-9a94-2cbba3cae6ce", "comment": "Malware payload (PureRAT)", "value": "eeb858881b5751982c513e43c767aa99fbb828798e1fa9e1de97b3574410dcce", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132607, "uuid": "2f7f9e95-2122-4de0-84f8-ac9bd1591aa4", "comment": "Malware payload (PureRAT)", "value": "a5a919909e9f45c6d593922f83b6344c4ff8b7de", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132607, "uuid": "c6ae5a56-246f-4804-8ad1-45f56d48fae1", "comment": "Malware payload (PureRAT)", "value": "9a9fbd47b384b71de1594e2d241bc0f7ba9ce66061bf293bb18089c3d954a9bfd2ced240eb90e12fa76a436e8cac31a9", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132607, "uuid": "e50dd4f8-8621-4348-a9c9-985d7f8f2985", "value": "T1EC21DAF3D5BCD498CDDC4EF5DD30058D263D4289A70C294724E9759A39F07DC0529E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132607, "uuid": "70afca0d-1700-46c7-8279-d6811e3f6565", "value": "24:90eFoXRTu6Mw+gwx51wZrBnIcs6GtqnIDZtOLmSwO+sv/3JJxEDA5Rna1X:90eKBTMnxQly3VtqiZULPZy0WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132607, "uuid": "45563eba-7eee-431d-81df-afca5d716c79", "value": 1267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132607, "uuid": "57095c5f-fda4-4dd8-a7b4-ad11b5c7252a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132607, "uuid": "599d3e8f-7465-4972-abc5-2d64f9d606da", "value": "photov_760723061657.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ad2c88-89d8-11f1-bd95-42010a9c0009", "comment": "Malware payload (HijackLoader)", "timestamp": 1785169976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169976, "uuid": "ac9fd59f-b088-4004-8191-c3a4a8f6bebc", "comment": "Malware payload (HijackLoader)", "value": "72990e94e0316066e2fc625b64fa0626", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169976, "uuid": "2e21665c-ec59-43e6-a2a4-1cbcfc4c31b3", "comment": "Malware payload (HijackLoader)", "value": "ef56d1386af7c97a5cd0b70c261de7e87f6c00894e3f30856adfc750a7b73b3b", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169976, "uuid": "d7025397-314a-4cd8-b237-1732dcb6dc75", "comment": "Malware payload (HijackLoader)", "value": "e0d61ce862f8bcfde7643cd1230bb14441516fb5", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785169976, "uuid": "990cef2f-3f95-4d5c-b96d-8470ce6d7770", "comment": "Malware payload (HijackLoader)", "value": "7cc8c5b9b0194a25f6bd9af2f4a7a7b2ebc25b6b8bfc978c75ee8e3f98b7def10605c352cbab091d4ca5373baf8fec75", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169976, "uuid": "531422ac-968a-4b3c-a1fd-ce6600d840b1", "value": "T126C6331BA79B8E75E16AA435556AC022DE1B3C652DF27045BDF5E9CF0A30388B03D3B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169976, "uuid": "0a16deb5-4df2-4283-85a9-f692346d7ece", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169976, "uuid": "75d6b572-9fa4-494c-a103-def547340e92", "value": "196608:b7q9w+gxmrUDCmTUH9UCwkuHxqWxzjpBgjzgmcK7gkmP2sZ9ZObwWa6zXUOd:y9wTmIjm1wkuRqWxxOzA6g52sgblzXUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785169976, "uuid": "7854c3c8-6f7e-4386-b532-24661fbc651e", "value": 11746006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785169976, "uuid": "a702d64d-99b6-4fea-b338-72dc96b52d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785169976, "uuid": "3bfb97ae-2386-42f5-82ba-eb72b3acb880", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdfc40a-8a00-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785186905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186905, "uuid": "49083bd1-74b0-43a7-85d6-f05d6720146f", "comment": "Malware payload (NanoCore)", "value": "510950ff5cb5d12c8a9d4a71d2a88d2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186905, "uuid": "711a6c5a-15da-45ce-9f81-700d03895559", "comment": "Malware payload (NanoCore)", "value": "ef876baf02db22ca0d03a888226bea7728b508e39e75f84dc894ec900b296fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186905, "uuid": "1336dcf8-b982-4123-ac30-e924874425ca", "comment": "Malware payload (NanoCore)", "value": "54d65545279a44223699a0c9731fd21b1d82b7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785186905, "uuid": "189a4b34-133f-4f3a-850f-b86c080ff1c1", "comment": "Malware payload (NanoCore)", "value": "669e560c86f528ee2820763d50045a74b3addfc3bd568464100c42588948fbcaffa62df73d5b2051af679ee8204498d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186905, "uuid": "09246eca-046c-4f56-b774-939539297501", "value": "T13A14CF267BB8492FE2DF86B9612251528379C2E3A8C3F3DE28D455B74F127E40A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186905, "uuid": "277a7ad1-4c26-4af8-9114-4ae440af5e96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186905, "uuid": "a8096c8e-0247-4031-adee-95a47bb4c20b", "value": "6144:wLV6Bta6dtJmakIM51q+HjVCuSj2OjrtJrIOXv:wLV6Btpmk8q+DVcH8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785186905, "uuid": "ef2ebc78-614a-448a-bfd8-08677112e3a3", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785186905, "uuid": "fa86465d-5e36-47a3-ae90-ff754f73c0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785186905, "uuid": "1a31a836-637f-499f-a49b-98def8abc4cc", "value": "510950FF5CB5D12C8A9D4A71D2A88D2E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936184de-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154408, "uuid": "89c73b8d-04fc-4986-b252-925245fb68c2", "comment": "Malware payload", "value": "de87cf298f58bc3f64681cb4760646c3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154408, "uuid": "440b2c3f-714c-4c63-be52-dd7be613d24d", "comment": "Malware payload", "value": "f020bbc4be53e62489acd8ba715ef66a3f018a34c05de1709e715e4fe2849e1a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154408, "uuid": "e948cb0d-c6b1-4350-aae2-a518d2cd94fa", "comment": "Malware payload", "value": "71becc1cb3714cd097bf5506cd87d156aed88f44", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154408, "uuid": "4f328933-73fe-43a5-90eb-f57a6ca874ac", "comment": "Malware payload", "value": "ab83efe05c7d0d9fea71bcec119f8ac58ba8822dd0595f2bf0bcc831ccbf8c2bec32471ac2012db495aa5151f50a78f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154408, "uuid": "68376fec-36b1-4c80-bf29-4bcd1f7f4f0b", "value": "T19D218751D89EC641DE8B4F32D48456546964D4BF60055EE52E055CC93A3CD2B3B372D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154408, "uuid": "e42b21c1-07fa-4c3e-a1d2-c7beebe99015", "value": "24:9mjNMhz9BqUi4bqtrrDG3lit2QO+oZmL4mhHMbJjXi+sGiDBjNF5ycVqO:9KcXYvDG1io+0xJjy8ifF5ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154408, "uuid": "eb74a33f-74ae-4504-b489-41c9abfc6902", "value": 1289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154408, "uuid": "9e971944-f09c-486e-b344-3dc0acea540b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154408, "uuid": "c8e40dd6-d16d-422b-9033-632aee46468e", "value": "photov_457696073689.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28792ac-89d3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785167801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167801, "uuid": "dcdbb505-4d93-4d34-8054-72f92c51d0a7", "comment": "Malware payload (Prometei)", "value": "026d948a23cd5fda7f8b526d465140e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167801, "uuid": "405bc1bd-7ec9-4138-9a68-0b495dec38ba", "comment": "Malware payload (Prometei)", "value": "f0b81d67a4298aa1fccc84a4d0b9b1dabd68326d77d2fe75e100325645269050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167801, "uuid": "cfcc1956-d42d-41c4-a721-35ac96e93e12", "comment": "Malware payload (Prometei)", "value": "95489050a7e5a773a38873eb0ad69eac132dd6c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785167801, "uuid": "03c26b78-6157-441c-896f-031566337d9c", "comment": "Malware payload (Prometei)", "value": "b98b73badfac5046c29934365a9f6a502f84ddfe68b00eb9555f6fabc111fc2d6ae46ce5f18ceb233c7212bad1d8e895", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167801, "uuid": "7f974bd5-41a7-42d0-bdd4-705f4be13922", "value": "T140A423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167801, "uuid": "2a5c958d-fb93-489f-bbd4-1a48d40ff645", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdc:Fs6pyCC/Ya2hpi6T6N4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785167801, "uuid": "88c39b28-488b-4b58-a2fa-a3009303b6c0", "value": 449086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785167801, "uuid": "252a159b-6edb-43ad-b5c1-b55ba1a4d1ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785167801, "uuid": "d4d637ce-8b2c-40cc-8e5c-fa3efff5b6fb", "value": "f0b81d67a4298aa1fccc84a4d0b9b1dabd68326d77d2fe75e100325645269050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de1287f-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158076, "uuid": "a043d1d4-0bab-444d-b30f-f0c4349cb66d", "comment": "Malware payload", "value": "d26ff3f05c2876ee5b3798f6d764d183", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158076, "uuid": "f4ad38b9-7602-4d33-a4d7-e486cec5f54b", "comment": "Malware payload", "value": "f0b8edb95bcf6454f231b87efa017310d14e62edd58ac745fa37d243b352193f", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158076, "uuid": "8bc9caaa-4674-4e0d-91f8-9183d60c3a71", "comment": "Malware payload", "value": "f4e6777915745cb43cf1a974d989f59e47046ce3", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158076, "uuid": "c68bbfb8-5e58-4683-83a4-d5b7a7df1ad9", "comment": "Malware payload", "value": "2567172cfcac9ca626e4db3b983b3cc6e4c7c24d02a4c701f51f618c1ee858ba6cf04dbea70b7f8f8d572bfa19e1533b", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158076, "uuid": "62bd10cd-a051-4f6a-bf55-651d916141e9", "value": "T1EE16335E09D4D507D679A3097E481973F832916FE8E60D26BBCB3A8087C6FA84C325DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158076, "uuid": "1b634959-af3c-467a-94a9-c3f88ccf4224", "value": "98304:ac4hipA1fYlhYQ+GBBWnykRfidbauatP0:xA1AbYQ+SafYadtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158076, "uuid": "0f62fd3a-1ffa-4718-848c-197aa872c73f", "value": 4188646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158076, "uuid": "e72c670e-11b2-4205-9dca-d55ca0669406", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158076, "uuid": "1559f1a9-c55e-4b14-8d42-0bc681d0f67b", "value": "f0b8edb95bcf6454f231b87efa017310d14e62edd58ac745fa37d243b352193f.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79649b5-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785181071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181071, "uuid": "e52e2719-1967-4e9e-a484-217d33ca0cce", "comment": "Malware payload (Mirai)", "value": "786084c225d0e808960b1dd7e35dd9cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181071, "uuid": "3dd010e2-e326-401b-8fb4-f92ffccae5b0", "comment": "Malware payload (Mirai)", "value": "f10f83559e3c7a4e53b023c1ef06bc0fa91e06e48947e1360653d129daf64460", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181071, "uuid": "e8d82f2f-0ab8-4180-a99d-a97c031e5c1c", "comment": "Malware payload (Mirai)", "value": "7ad67ef91f8b9ee9fa8ac9db113333175b2a94e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785181071, "uuid": "fe71dad8-3632-42d4-b9a8-7803301b0f92", "comment": "Malware payload (Mirai)", "value": "eafc33716b1a8e0ccea201d07c541fd180201577251e00c90da2db26a1af8658d31f07047e098e9d5e0876d0d5de8228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181071, "uuid": "67ba6107-09d9-4ea0-b68e-a07be0d3edc5", "value": "T1EC535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181071, "uuid": "e8af3c1e-a4da-4683-9a68-eb223ca44aaa", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6mQSd++CMq32UFSTGhk15uJnaroXy:ahqo3lVDKbd4b7d+zf2UMT2M5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785181071, "uuid": "8fab3124-c1e7-4bc0-bdfd-ede62d1d77f8", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785181071, "uuid": "3c71c930-1452-48b8-9ef4-e7e58f204123", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785181071, "uuid": "0c47247c-7bc9-46cd-983c-dd879496efca", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c632490a-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133018, "uuid": "93bee2d4-eba6-4611-9fff-e480cc788e14", "comment": "Malware payload (PureRAT)", "value": "e29fe20af61bf86f54aec5001b497fc0", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133018, "uuid": "9dbe32b4-ff5b-4f04-ac4d-1bdf7c9e3f80", "comment": "Malware payload (PureRAT)", "value": "f179130f68a4fdb360c30bcb0469d9b4b6f878db9b1c692b8e3c72db5541124c", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133018, "uuid": "0bc9d141-d987-4c3c-a09d-a8662329faaa", "comment": "Malware payload (PureRAT)", "value": "86c747a168b39974b88d211b3520efdfb2f0e23a", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133018, "uuid": "c38834ce-29c7-4b3a-8cfc-2dad2a61b72e", "comment": "Malware payload (PureRAT)", "value": "d56402ca094590970f0194b136430ef14daf961277ec90bcac35966cf9d52f979ba1d346d935d1bd324b85890f1e7fa1", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133018, "uuid": "19bf9719-e0b7-4c89-938c-b6aceb5b8868", "value": "T1E921C6C0A02DCB00F80DF932A5693CA83A262150B08A938B5312A62B9887ACC17005E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133018, "uuid": "eacd5dad-b709-4454-8804-c78ce9405b91", "value": "24:9dnElMWqKVRtFvLZ47HdFM/jCfgPJS8JRtqHmSn9e4NWyKCgn7T2tJm:9l4MMRtj47LMbMYAmCHPn9Waiam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133018, "uuid": "88362a1d-6899-4669-98fb-518bce0acdd6", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133018, "uuid": "93763991-bae8-4d74-bfe4-ef011d52de38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133018, "uuid": "bf4f2ab7-d19f-4439-8be0-a05940b0141c", "value": "photov_784191223155.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f79c24-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154203, "uuid": "c2b940f1-22ff-48b6-bff8-545a069ef1e2", "comment": "Malware payload", "value": "b40c7f30ebd91328521c31d0956d7e36", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154203, "uuid": "da978bae-5450-4085-8c7b-9db74cd6f3c9", "comment": "Malware payload", "value": "f1dc53a3893be33af448e298c87dfd0eb116b5c6cb21416ef1b0cfc26d9ed9b4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154203, "uuid": "9c8f82c2-4287-45f2-ae9e-0041f99b702a", "comment": "Malware payload", "value": "6ff0b5417520fad260536929f531e84006c2a865", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154203, "uuid": "dc965845-45e4-4e0d-b873-c739b2e36efe", "comment": "Malware payload", "value": "b8a5caf64b7d9ac3281657c653748f4500c27df4b6226c192df08bdf9d51e965d2cb2b2a1dc9e722870911dc58dcd084", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154203, "uuid": "97fa2f85-5bed-42bb-b581-b9b2ae5fa0c1", "value": "T1C92182B8500DD990CA0BC23E7E25788B591E8D3D0A2181BB63CFB0E16C068BDA752F00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154203, "uuid": "ee197220-fad1-4094-8dfc-d529aa9912e0", "value": "24:9J33tW2JnVODBzpf9ZITnu1njlsaamSeH4n99DgnSRES8A5UG7U:9J0EOdzpf9ZITaZsaaPl3cSREpAb7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154203, "uuid": "4a151f7e-130b-45ec-9a1b-d6a463d5f005", "value": 1119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154203, "uuid": "ec468607-2ba6-41a8-9464-0dc56a8a690a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154203, "uuid": "048f5523-a095-470c-8df9-05ddbc2dc7f8", "value": "photov_222223920714.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06a3699-8957-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785114594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114594, "uuid": "23bee42c-37e3-46dc-834f-29506778aff1", "comment": "Malware payload (Mirai)", "value": "4f824e050493f0ada9253977d59769ec", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114594, "uuid": "b31a3d51-dbc7-4fd2-b986-6c313d6a4c5a", "comment": "Malware payload (Mirai)", "value": "f29c23e3ce0a393d9cd5927b4873e8b9a4a8800e4a1270abfd8f279ae4041729", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114594, "uuid": "46c1910b-23d6-4362-83a2-0c4a6572af8d", "comment": "Malware payload (Mirai)", "value": "cce6d8b57236e0ea6f3dc047f28b63e666f07ca6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785114594, "uuid": "90ca1b5d-cc7f-4d55-916c-b5a5cdfbb139", "comment": "Malware payload (Mirai)", "value": "44efc4d2379acd94c0a335254d75703fee1102805912d548b659aebd1f5e6735894f26d8af0b81fe060f70d5e5d573a4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785114594, "uuid": "cb472696-99eb-4abf-a69e-59e0ce289e32", "value": "T1F61104C6100243341FD2E923FABA8C1930AAA5D654D79F1965D9B8F188CDD0D3955AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785114594, "uuid": "0349624c-5d77-41af-a909-c22951434385", "value": "12:JCkp0F5AM7AtX0F5AZPx7AZPIhOf0F5AB7ADVZX0F5A97AtNX0F5AzQ8i7AzQ8GY:ItGPtsGd6dIhOEGKDPsG2sGzTRzTGFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785114594, "uuid": "3318025d-b99a-422b-86d6-bed435ef8cf1", "value": 954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785114594, "uuid": "6c51c8a8-5e3b-46fe-8378-a2db3777c7c0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785114594, "uuid": "9a6e980b-7ac4-47ac-973b-9c3e7318981e", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07ea8b3-8985-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785134244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134244, "uuid": "6a7f6081-678c-4025-a2c2-2929c68a7f88", "comment": "Malware payload (Mirai)", "value": "2e7ab55743c600a02c7ed1697bddb93a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134244, "uuid": "f41763a7-9638-4bff-b8ca-347a645e5cf8", "comment": "Malware payload (Mirai)", "value": "f2ce01c11a6433ad96ff8f8aa78b67bf7fbdf06d216eae404bee9eb3fb111185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134244, "uuid": "5e37a822-a20e-4643-a594-8e27a491c894", "comment": "Malware payload (Mirai)", "value": "8c2e41380e39b966e1c9283ea7393bc66609402d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785134244, "uuid": "83193354-4ff2-4e38-8df0-68854c759a53", "comment": "Malware payload (Mirai)", "value": "07f448c50f1165c805dbf6422450ae9e0add20ab6d91cef3e2b565eb02eb2ce08fd0f30200de070231375489d6941e6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134244, "uuid": "20cea07c-e044-4f00-b65b-3f3247c3332a", "value": "T19C41121E6F801F37DD66CC36054B275139CC842BB16A63916334E960BD3E605A7D38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134244, "uuid": "469a583b-765c-408c-9dbf-6c644312ec1d", "value": "48:kff2HUnuDW3l6df9HOScTLmPkOTb5FSXZ:kffsUnuq8f9uS4LmrTb6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785134244, "uuid": "0a8c43f0-c099-4548-b546-ea9d0d047f99", "value": 2016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785134244, "uuid": "182ba49e-233e-42ff-ae1a-dee0a91763e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785134244, "uuid": "04e02f72-4b08-4454-8907-7cc2fffff5ba", "value": "dlr.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb158c32-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132678, "uuid": "f7735731-7507-401d-84b0-d3f9e022c7bf", "comment": "Malware payload (PureRAT)", "value": "8f8fc17c5856bd3b46b4d9248d9704aa", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132678, "uuid": "bb2c3fb9-77d3-44f6-863e-03cfd18eb1d5", "comment": "Malware payload (PureRAT)", "value": "f356d45aeff316f6edc1efe417c8ec816f718f13d6bcc8d94292d10f2963ac13", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132678, "uuid": "aa601f2b-200a-4610-80fb-028f35816038", "comment": "Malware payload (PureRAT)", "value": "3ea6fbc26c77695702bd79599285c53e3e44441d", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132678, "uuid": "6835f6b7-a16e-4bfc-a408-96c704e39e92", "comment": "Malware payload (PureRAT)", "value": "2528ce90af9c548f34b7affcccbe73458048ca87242aa950bda047e5600682e8c86cb082b1649f178c2488f5cab8583c", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132678, "uuid": "a8c07a02-9523-49dc-b1ee-c2eca40f3711", "value": "T10B21966C20E888C6C7CAD1356C4FEE7116118014D8C7BA4216932BFA3C03295A7BA6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132678, "uuid": "0498cdae-bf5d-4c71-9a2e-21356594a90e", "value": "24:9n7XfIg77E0ncERXeQbSvK1rnhPJgmSKghGY7XMXD9BKxhQbJptl:97XQ7/QWvK1rhPJgPKMGY78Da6J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132678, "uuid": "65e37124-2def-4198-977d-aada16669d2c", "value": 1154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132678, "uuid": "9b8372ed-b090-44f3-a6d6-39c204f6948f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132678, "uuid": "e82a6f25-1e62-4349-a114-b6ebc96f8481", "value": "photov_572044780860.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa08a36-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158071, "uuid": "fc50c603-6647-4cd6-aa75-ca08e968b368", "comment": "Malware payload", "value": "fa99ca0607e958ca30ca64b7b0d6b8b5", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158071, "uuid": "94354495-dad0-4801-9834-717cc29406ab", "comment": "Malware payload", "value": "f3f0f43af684cbbd22f1cb5d16f3417fed24baa642f5a2e2522c824e7a53ea59", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158071, "uuid": "d31f95be-ed6a-4888-adba-45d4cddfa439", "comment": "Malware payload", "value": "dee1d0309a2a2e0de63ff636eb553a352e1b36d3", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158071, "uuid": "b0ca6ab3-d497-425f-adb8-46ab5c7dbbfb", "comment": "Malware payload", "value": "0028098a613c3c54493465aa633f05e4928b46e8c6dac97b86ea9372acafdd2116fce1e1c0072a6ca57d8628714fedb9", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158071, "uuid": "f0dce9d6-d46e-49c0-9839-3edd3c61cc21", "value": "T10A47AD17AEDC13BCD463DBFC8AA69232D6F278060735A48B0699C3051F73A916B7B315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158071, "uuid": "14d3973c-f20e-4713-a5c3-bc0a49a9b5df", "value": "1d460d40d677072556393e27fe74ae8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158071, "uuid": "44937395-eeaa-40dc-8199-8e1a06146550", "value": "49152:Xrr9GSdzWm59fI9gkwTKJ/710V+SutBB1Fo0bW1:ZM8JmtvLW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158071, "uuid": "5f0dbb2a-bc56-4c77-ab57-c7ff696aa786", "value": 26923520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158071, "uuid": "8902d016-d8e0-4dc4-8bee-e32e611d85a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158071, "uuid": "df7784e5-37d7-448e-9ed9-aaab089ff39d", "value": "f3f0f43af684cbbd22f1cb5d16f3417fed24baa642f5a2e2522c824e7a53ea59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5938de7-89e4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785175108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175108, "uuid": "dc78be1f-59cd-404d-9978-e5546737dd83", "comment": "Malware payload", "value": "276ae0bbbf2b2cbc3a32d809f1562cfa", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175108, "uuid": "603ce582-a115-4174-a6a3-86458517ae78", "comment": "Malware payload", "value": "f4b60c5084055d4b30b3288bd253c12610d4bec7f02739e43930a830db6c9d17", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175108, "uuid": "fd083794-912a-4c5e-85bf-16ebecc1bf8b", "comment": "Malware payload", "value": "7b5903254e100b884c1ad907bc6973700f7bbb9f", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175108, "uuid": "6fc2f1ec-abdf-4da5-b94d-ab52dd009def", "comment": "Malware payload", "value": "528ac4f5bf838fc8ff283b33b489c95269072367aab29aafe0bb08f40682c6e28e16096d6846cfcce5f9f22a6ca95668", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175108, "uuid": "de9a7824-2200-4053-841d-a4a56b20dd1a", "value": "T1722633A36FB0559BF25C2FF04AE775281728E3D1EC8F5AA63374921AB57A601200FD1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175108, "uuid": "48013929-6b4e-4fc4-ac45-bacf4a816323", "value": "94d0b1085d2c348c96db0edea60c0a76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175108, "uuid": "b895bd94-604c-4a31-a69b-b15086eb4ceb", "value": "98304:46++VvioPhA1yc9yoo3da02xFJtN5SEZINFuVIz7Zl7+:j++VTpA1ycSijtNKNyIzd5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785175108, "uuid": "6f5b5b70-aef5-4908-81cb-a5d558ef5cea", "value": 4788912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785175108, "uuid": "47afe5bb-56f6-40ec-836f-9a7bd38e8a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175108, "uuid": "9d676750-5dd5-40b3-aa08-dccf52306625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160f75aa-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158063, "uuid": "315e27dc-b0e1-4e6e-9455-975466ab955e", "comment": "Malware payload", "value": "46f99a99415d7a1e0974e0df43f882d5", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158063, "uuid": "151e5f6a-d493-4062-a7e4-89e8502b3169", "comment": "Malware payload", "value": "f4f547edaa49aa094e382e673cf822c71a110558f27392aa6adbbcc46f14315a", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158063, "uuid": "4f0cd638-2bd8-470c-884b-c0cba82724a9", "comment": "Malware payload", "value": "c5de84a8d08b2fb18190fd4dbc62bf5f74e00ed2", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158063, "uuid": "608744cf-4bef-4b27-b425-f47c904dbce9", "comment": "Malware payload", "value": "c3833c0bae0885881b4e144395d54bf239882a650a3ab0a218b08eb97bc63477ffbf714d191ebcbd24357f713cd56286", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158063, "uuid": "633f0647-eb52-4b59-a691-39a7d9575360", "value": "T1CC47AD24E2AD11ABD423D634FAA5D233D6BD780E0774A48F0799C2052F73AA15BFB315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158063, "uuid": "a754aff1-0cc8-4173-90c6-af3f81482d36", "value": "1d460d40d677072556393e27fe74ae8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158063, "uuid": "c667ced9-e790-4566-8a28-108305d9c177", "value": "49152:qFx9noUoYgkNokwAMTxynzpmmUoIDUcjTMMQgK3nTTmByH12V1sqO+:iWAce3n8yH12v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158063, "uuid": "a1b6e81f-cbb3-4100-9efe-7f5477c14c44", "value": 26927104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158063, "uuid": "4d273600-eb4f-4188-8aad-e9bd0cc010c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158063, "uuid": "44a43ebe-377a-4970-b92b-38930d6ffde3", "value": "f4f547edaa49aa094e382e673cf822c71a110558f27392aa6adbbcc46f14315a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4db30a-894e-11f1-bd95-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1785110668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110668, "uuid": "6f58578e-1473-4797-a342-74d5cf06306e", "comment": "Malware payload (ZigClipper)", "value": "1cc9617281fc4505af569a4915e42a08", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110668, "uuid": "7acc1dff-1c3c-4f97-9877-088c87932e0b", "comment": "Malware payload (ZigClipper)", "value": "f50688b538fecc5ef7c893e148ddbb3cc1919fcb7c6462033fb72cb469242461", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110668, "uuid": "1e29d7ca-feff-4e52-aac9-7ef714822f89", "comment": "Malware payload (ZigClipper)", "value": "c3e2dbb3515bf9e9c2202c9b489df627b512abd1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785110668, "uuid": "b0d048c3-7aad-4e31-9505-45dd14478dc5", "comment": "Malware payload (ZigClipper)", "value": "c4ad8b91dc39f5407adcd926b271b92f17f6353898f486c5101c662055ac69442666da3da1222fe11187cb232b124460", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "aethersyncmatrix5-lol", "colour": "#DE4107", "exportable": true, "hide_tag": false }, { "name": "app-api-metricsengine-cc", "colour": "#C5E7B1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Uncrypted", "colour": "#8D045F", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110668, "uuid": "b868c5fe-968e-4f76-a2a3-0efe1f41bea2", "value": "T1D1C46C49E5D2C1F0DE4385B2336FF22B6B311D0A8975CAFADBA16D959C233746A0F481", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110668, "uuid": "d7f2bc09-c923-4156-bbe5-f7e7929243db", "value": "12288:4lwOsm0kanafpalMx2aL4W9tkB1T96fOi+qoQ4ERZJ3b8TJBKUtz:dOn5QafpJ2akXJklxZJMXKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785110668, "uuid": "4e99fa25-fbba-444f-b9d9-033cf899296c", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785110668, "uuid": "1bd85a19-03b0-4235-a803-518c75e1445a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785110668, "uuid": "5005392c-0e8b-4653-99ae-08024e0e893f", "value": "KLHdfs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47aa776e-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132806, "uuid": "4ef497e5-a003-4408-9994-a6d7ae7f1b31", "comment": "Malware payload (PureRAT)", "value": "fab7a070c4c781ae3d6da6baa4a47c23", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132806, "uuid": "07ed3e4d-90cb-4342-ae93-38143cb7899e", "comment": "Malware payload (PureRAT)", "value": "f50dc57585585a79d46526e4ca4425255b29a9122bcf242d270ca8d195f7816a", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132806, "uuid": "d4b1e103-ab0b-4e84-adb0-2bf2fc715914", "comment": "Malware payload (PureRAT)", "value": "645c7f63bc934a23ab9eb5fec0a56a77caf2b89e", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132806, "uuid": "0d6a3231-0b6b-4ab7-b7ee-8fb9a0f7fff4", "comment": "Malware payload (PureRAT)", "value": "8d9ccb0c98c4bcdde0951f7cafcb82d81f33c1510c2f0637b1dfaf3c2fd61b9d056e7d8fd6460969706dea7086eb3fc3", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132806, "uuid": "469349e9-8535-4c7f-b3b3-e76ea6192085", "value": "T1DE11B95989054B45E76B4131B827C453523065854A7F789B2F30314D37B19EDBB25B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132806, "uuid": "9c380719-341f-4ae1-8ec0-fe212ba64931", "value": "24:9kwKmHDjGRgJkzNXy//x8EfgvP/rrVNQBc65mSK/yp24ccmpRb4KLw1nmMxBc6y:9kG/8AkY/p8IgvP/nVOBcgPeyIpfLHM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132806, "uuid": "4fa43580-a27e-414b-ae9f-ea0ffe0ab93b", "value": 1110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132806, "uuid": "ad93df57-e6eb-4d00-bcff-912072062715", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132806, "uuid": "7d87ae9a-f611-4d23-b033-564a05ca2357", "value": "photov_565006351218.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f0a1bb-8981-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132620, "uuid": "b1d52894-c24b-4f90-bc9d-26f2a8594116", "comment": "Malware payload (PureRAT)", "value": "e7d98319202b5a16acdddc0124491f8e", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132620, "uuid": "3abb1249-0e62-4c24-bf11-86aedd14a0f6", "comment": "Malware payload (PureRAT)", "value": "f656f2c54546b145dcee04ced28605d4cbef557c4bb1d9ea7d77fa2925062dff", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132620, "uuid": "16673cf0-2cf7-4824-9e79-00592758d7e8", "comment": "Malware payload (PureRAT)", "value": "1a563830a31ced92d6c64cd5e95131da9f40cbb4", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132620, "uuid": "8389186c-c67e-4bbe-8ba4-261e6171047a", "comment": "Malware payload (PureRAT)", "value": "7694c49f5725a45eba59e6f30e66b08bb7ec3155459766ca3094f52e0cf1f515108fd2e2790d629ee2f9d874efe33162", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132620, "uuid": "852bdbf6-4dc8-4fce-8c3a-b209b779054f", "value": "T140219DD78019CD15CE96EA765C2D5F610171161FCD90D10B0FA1767519A2ED137147E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132620, "uuid": "e2174d4f-9643-44fc-a478-a037c12da8ec", "value": "24:9puJ4yasCofIfh0VnBoMwBbSbJRJv5mSbMbMHk2Iy:9w+QI0BoMxbDJv5Pbky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132620, "uuid": "fa59a244-124b-49bb-9b7d-11178b8a57bc", "value": 1199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132620, "uuid": "1b35cd0c-2450-40ee-b866-4548f5ca3ba6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132620, "uuid": "fef563a8-2049-4588-aa0e-73d13a7b6493", "value": "photov_955838701572.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ae31b7-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132695, "uuid": "d14a4d6e-d287-4b58-a297-052c94c4016d", "comment": "Malware payload (PureRAT)", "value": "d64b7fd3d1daf6ffe87c0dd1797481b6", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132695, "uuid": "94015624-4db1-43a1-82f1-0a96e2c14ad7", "comment": "Malware payload (PureRAT)", "value": "f65d2b92dfbc4eb00248392d1e50a1a248ab9a5012b1d12ed967b9eb0e8d37f9", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132695, "uuid": "7b12bf85-a4af-433e-997d-22b6454973bb", "comment": "Malware payload (PureRAT)", "value": "e409ed68d1f31ce5189c931438cb3695c0cf4b7c", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132695, "uuid": "a903a62a-e03c-41a1-9285-eef9deb81a39", "comment": "Malware payload (PureRAT)", "value": "b2c29dee8d56a0ea4c7e801a22d700356ac915ef241f76fc16b05b1d8c3408ef6b3e4a0655dd130ebee812be0001010e", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132695, "uuid": "d02bff59-465f-4608-98d8-8052387c0ede", "value": "T1A121965B4096CCF4DC12C93A1D3ECD1204578015C8A4F65367617AFC2D27FBA2F0696D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132695, "uuid": "a96ed130-f0e3-4421-8612-0e6599180752", "value": "24:9HJPNmITgEdCZWZyYic/VOmS3WEkbMHDwn18i:9HJPaEFVOPj8qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132695, "uuid": "a857c412-161f-46ff-a9e0-8cdf7aaa4a94", "value": 1181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132695, "uuid": "90972cb3-bd75-4710-a484-bea487579580", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132695, "uuid": "87d20e6a-fd1f-481f-995a-22b7285cbe1c", "value": "photov_647136879985.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce5859a-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154290, "uuid": "fa431158-d02c-4c75-8ac3-f0d4a21328b7", "comment": "Malware payload", "value": "895b4b9f750e7740d378e734d39608e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154290, "uuid": "ae1e892f-4536-4dad-87fb-0680eb0f509a", "comment": "Malware payload", "value": "f67c3a45237f05ce15c5f73d320c3b91a3d5b46510376922570c29fb714accc9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154290, "uuid": "6172c2a3-7b67-4edb-9723-7171de67c2c8", "comment": "Malware payload", "value": "4052a36dcadfaf68e65997bf9210c5a5bbd2e4d8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154290, "uuid": "8e349ac2-7107-451d-bac0-e1093d278fa5", "comment": "Malware payload", "value": "8f071e63958be97512749065118b2fff56a6bba5fa872462a17b21db4a828c1763e0f1a40b080131087e227803f8906a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154290, "uuid": "bd023c0c-5c2c-4d80-a88c-02216dc9943c", "value": "T1D811B5B0C424E94BCC175E3F74989D0E6012684D8521287B2BB49573B91AE50A701A80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154290, "uuid": "f3ea9272-8854-4501-824c-0ecca1cbbc09", "value": "24:9BUC+2uY8gOe2ASLPiT6Dcf+OPW0UUmSunE4R8IQCRopnO8WUct:9BqYx2lqMcZrUUPunz7S1WU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154290, "uuid": "2896359b-375f-4ecf-8398-e88c787ef755", "value": 1045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154290, "uuid": "9ed5cade-2fd4-4732-a9f3-445c97bbdc9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154290, "uuid": "7bccef91-fa9a-4665-a7db-7749de832f98", "value": "photov_283025374521.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190741f6-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132728, "uuid": "3e1733d1-c91e-498e-889e-df91ecf22424", "comment": "Malware payload (PureRAT)", "value": "9097576cc735d88610c8cccbf795278b", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132728, "uuid": "e6659097-8b8a-4743-981c-38fa21562b35", "comment": "Malware payload (PureRAT)", "value": "f7fc85d327f9c8512ef8819aa1579e4f37f769b8251d792b41702c162accc217", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132728, "uuid": "9d04bade-6b5b-4881-8989-d6e5b95297c9", "comment": "Malware payload (PureRAT)", "value": "f290949ac9db848a1ace69517927391c67acba43", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132728, "uuid": "5da9f68e-1109-4f69-be0e-556a3bbefbed", "comment": "Malware payload (PureRAT)", "value": "8f57b9b2cc09a7a55923a6a8555f576cd4504821526eba57046a8b6ef5153ee50733ad3540c34e2d412c31d637243649", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132728, "uuid": "e266032f-9ef0-4328-aa92-a22321949c95", "value": "T1CB21D73C807EA241C702EAB9A58CE606366FD880F44CB45124F29DB33F62D44AE241DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132728, "uuid": "c9e6d28e-ff08-414c-bf53-80f3bed0361f", "value": "24:965dEuc0+RW9h2D+dP+rd4pBnuAOuVP4bLvYmSf+sb+Jl89WugjKt+V59EmX:965dEKYRDm+yWQPfXb+SWugOtA5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132728, "uuid": "79fe0043-a663-4e53-9e19-c0884c8f7b72", "value": 1219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132728, "uuid": "e99e8dc9-8887-44cf-9bd7-d524cabcb68e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132728, "uuid": "56ec37fd-d258-4407-8d06-be89c90ae5a2", "value": "photov_967840575221.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1e9151-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133084, "uuid": "8642a481-06b7-4748-963e-d6109b83b093", "comment": "Malware payload (PureRAT)", "value": "f6b9d840429807a815a545cac15d2ffe", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133084, "uuid": "31bb8634-b21a-4b95-8e75-7af5b0ea9bf4", "comment": "Malware payload (PureRAT)", "value": "f8a994d0991a8a72dc3fd789dc1bd538e7d45048b9eb413769ec4306f7f63157", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133084, "uuid": "c73da7a9-5c49-412f-9f24-2024316d46f5", "comment": "Malware payload (PureRAT)", "value": "eb6fb828665fec2e442b74b052e15b13518433db", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133084, "uuid": "28b9264d-cb8c-496e-8f97-10aa1fd8b536", "comment": "Malware payload (PureRAT)", "value": "be82889bf547e31df46e6d58a1fa4482111af150634495a6420d0ca6efab32bc747f505de0ca8e47a9dfbeb0800f4862", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133084, "uuid": "59e244bd-72ff-4946-917d-4e45db54b213", "value": "T11921A7A5A668CB50CC83CB379E569A25B416311FD981ED633BD830E6FEB28587782052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133084, "uuid": "c7699d3c-749b-41e3-8d6e-ca23b830e61f", "value": "24:9eiSrxbQurotUq1WKz4uMakSezrGsoGmSqblZsWqp1gH+VRusX:9y1bFroTVzESeLoGPHWduRus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133084, "uuid": "0fe957df-2bc7-480f-88c9-91d31bfac799", "value": 1235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133084, "uuid": "0ac3e887-f2bf-4115-afb5-bb0c7afd7f90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133084, "uuid": "9d71c934-4212-408d-b124-db535b1bc9f9", "value": "photov_145939711810.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16448f98-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154198, "uuid": "a192e055-62ec-47c2-b6d0-aebebd828ffb", "comment": "Malware payload", "value": "a2513e1c426845fbf2f9fbfe84abc15f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154198, "uuid": "4fb2466c-1b7f-4967-8f15-acbcffc2abb4", "comment": "Malware payload", "value": "f9193602469d3245c18d6e77da9c3e5137eb2d70a8d014a59950277cf2d014d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154198, "uuid": "4b02d8f3-95ea-42bb-a9e2-452ce8b2220a", "comment": "Malware payload", "value": "578fa119329224f5991e828e86ca47a219e1c806", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154198, "uuid": "e8c5fec8-3714-4155-9556-1ae70a705513", "comment": "Malware payload", "value": "56e17812f6cc6beb9256d0868870df7bad431405809db59642313dbfe32acdc7737cc3de6bfd3e247fb93f36bcb266e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154198, "uuid": "655a2a62-1e98-4f1b-a585-5b90fd837789", "value": "T1F3116168880FCDC1FE27DB35F2966184902A909184A531F3679438993B7FBF03626798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154198, "uuid": "12d0c83e-4f7b-4047-9fc6-fcae6506a360", "value": "24:9OQWKckm2CJAb/9R3gAZBbKmSrD754JuPuhrj30iQn:9b+ktCmr9Ng1Prflu9D0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154198, "uuid": "27bb71d1-61d6-4bce-9542-4e374b42d961", "value": 1054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154198, "uuid": "eec1c235-ec52-47e9-b98e-c840eefbcd58", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154198, "uuid": "90b9ff51-15f8-48ca-b83c-3af2d0588a37", "value": "photov_170848803488.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb67d9fd-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785133027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133027, "uuid": "ca74574f-86ae-4ed6-8d7a-4e3d0278c4f0", "comment": "Malware payload (PureRAT)", "value": "2409fa63f6814f1bd92de6ca83ce7a08", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133027, "uuid": "020488f2-b3fc-4b40-941d-a66704446efc", "comment": "Malware payload (PureRAT)", "value": "f9e38ac9a3b8bf129d54d7ce8aa4f19e56dfd829b43f362fc4692d4c8213c59e", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133027, "uuid": "f9607b6f-815a-4b09-b8e1-a07b12139b30", "comment": "Malware payload (PureRAT)", "value": "0e0063daa6e71a761d53e1ed674574b6633f5a3c", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133027, "uuid": "4df323a5-b7a7-42c3-8a14-f636496f201b", "comment": "Malware payload (PureRAT)", "value": "9ba96a8473582228e81f8b6aef0bb1e013081fff5721439db844c38568c2cd293711e389826c4f4d30400bbb073d6550", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133027, "uuid": "e2e7d6ac-3012-4c60-8582-ad3df7fbba52", "value": "T1AC2167F8C6EED130D81392B79C255636A77280C90003767B1EFE79652FF3948160D511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133027, "uuid": "214f79a0-02c7-4cae-91f9-46c1e3925f3b", "value": "24:9eq3s8z79SVORY5B0IrLRN9Bri0S3KjKmSI2zyblZsWqsZGzyiCXF:9FTGMC79w0SkKPI2jWvZakXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133027, "uuid": "3211f4a3-4383-4233-a763-27a6b20a3ca3", "value": 1193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133027, "uuid": "2f6aa63f-aa3d-4ad8-b7e2-a83df759406f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133027, "uuid": "6ca6da15-b8e4-4f70-ba4e-3d0a69b59c86", "value": "photov_303795533153.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f84d422-899b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785143610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143610, "uuid": "0432ffdd-6dff-4b5d-8ba3-2292422a9a16", "comment": "Malware payload", "value": "f2220f75f8f392f1da742298b5346383", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143610, "uuid": "20d852a8-416b-4d07-afbc-0e7592a46215", "comment": "Malware payload", "value": "fab595300e58ff1e2bfcd90eedf905053449bcdc7e6f43fec43d4bd7baba7e2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143610, "uuid": "437d7ec7-f4a5-47b6-a03a-6b0c7beccbf5", "comment": "Malware payload", "value": "523326c0b50f7a03a8b6c97cb08da09d87603ab3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785143610, "uuid": "bbf0ac32-e3c3-4ca1-a2c1-68160176e7bc", "comment": "Malware payload", "value": "db6802aa253713a39fd126b47eac831d3b973160f7b557b5dbe0ee95724ee70ebe75c1569c79f48cd53abe6955a2bbcc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143610, "uuid": "3b277bd2-b1df-4b61-ba43-1e1ad59f3de2", "value": "T10D11A518B0D9C758DA13913838AD18981333D2A352C4959357FA1466ADCE78BCF281F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143610, "uuid": "20f8475f-8fd8-43bc-b7ad-38a3e16aaeaf", "value": "24:93CcGI7znEgJ6VK59/4Zh9g1Z/lGmS1D6fMqWy/rCx9R:9ZJJJ6VIwZcHlGP1D6U30rCjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785143610, "uuid": "434202ac-7cc2-49a0-b4a4-283612110f56", "value": 1056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785143610, "uuid": "9e9ffb64-0c26-47df-9def-ce7b35e46b94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785143610, "uuid": "a96cdd4c-3b46-445e-b3ec-b1bcede61e1a", "value": "photov_995745937465.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82911fc-8982-11f1-bd95-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1785132968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132968, "uuid": "73b32196-f84c-4cd5-bc58-a474c470639d", "comment": "Malware payload (PureRAT)", "value": "d95814b1932addb75ef3aa377ba33e06", "object_relation": "md5", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132968, "uuid": "9466aa50-31da-454f-ad67-c635bdee45e8", "comment": "Malware payload (PureRAT)", "value": "fb0f42ff125f9759808c5261bfafd2ee8916eb1952fd73d6492484b7d30bfdf9", "object_relation": "sha256", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132968, "uuid": "237ecb1f-7828-4822-a55d-cfcbecb4f284", "comment": "Malware payload (PureRAT)", "value": "eb356a11ad87eb5f5662304c780eaa74af9aa0bd", "object_relation": "sha1", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785132968, "uuid": "a91a45b6-0c67-422a-a9c4-f6b955bdda60", "comment": "Malware payload (PureRAT)", "value": "b199a0c64c505865dbe93ddf6fc2919ca3bfb2f112f4f6012e23ac019686a2ff428d3498dee5ea2300aa850612cab16d", "object_relation": "sha3-384", "Tag": [ { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132968, "uuid": "4cd9b908-c8a4-4aa6-80ed-f5a515f9300b", "value": "T1E221C8E0A518FC9AD48EC7329C65295E1038B552720F541001EBA6FF510CEF8B7A9646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132968, "uuid": "d7a9d120-6752-4c13-9681-935827fb8255", "value": "24:97B/7ErX6NLHru6Bj9N+6bEs4oTBAQmS2T7hZ79qFYdHvkHhuArn:97mTca8Es4e5PIlZ7gY4uGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785132968, "uuid": "0da7a0d5-edb7-457a-8c85-0b7d11d228bc", "value": 1333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785132968, "uuid": "76b0a02c-3f86-46d2-8dd6-66a6405cfd21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785132968, "uuid": "eb0233d0-23d1-4998-ae39-d70d5c5d6387", "value": "photov_613067252982.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f72e60-89a4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785147478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147478, "uuid": "4b16d2a0-ef0e-4d5f-a569-b5f982025f74", "comment": "Malware payload", "value": "d7837a7227b7b6e218a124477aea92d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147478, "uuid": "a3c1b0be-81f9-4107-891a-2e96dee53223", "comment": "Malware payload", "value": "fb958f3f129b88fffc6c5fa8eccbf9bf25dd05685041c0bd1dbc8a1dd73992a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147478, "uuid": "0f065bd3-be4f-489e-ace7-2978efce51bb", "comment": "Malware payload", "value": "395112a75a8049d8a8d8126cd2575c626ef9c4dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785147478, "uuid": "d226fbb5-eca8-4562-a21d-981b83d0ed42", "comment": "Malware payload", "value": "2d0a7f21784320a6c7d92c8fb45a3475759b9ec3b4460fe98bfec5efc1d3bf72febd201e20899dedd8bcc6a6e78cc129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147478, "uuid": "03f01ec1-4a2a-459c-9e56-66e3dd215f4a", "value": "T1BF2833BB6264D52BD72DC13BC4A29EA0653B71B20372C5DBD99101A6EF0B6C19E7F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147478, "uuid": "233b1e4c-029e-4c26-9cbb-1deefd05835f", "value": "1c8abb0d55065ed8370628959ce78804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147478, "uuid": "5bbec79d-1e7c-4c0d-bdb0-4816bc1d6bea", "value": "1572864:vXqgR72V+466f70gQ7fG0Hwzhg81A/pQu4oMgcnKTEc+waU5c4I2oUgtgBsDQ4Z1:C472VX70gQ7fdw1g8OBwQaU5Q2ggBsJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785147478, "uuid": "17924788-8906-4b46-80c5-721b0cf1c1dd", "value": 97962903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785147478, "uuid": "7e803d2e-dd86-48bb-a617-5cedb2301dcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785147478, "uuid": "f9092cd6-f354-4eef-b4f6-a27cd232f57c", "value": "3.6.0_TotlSecuity_4.8.5158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddef2ac-89c5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785161673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161673, "uuid": "6efd0b78-7201-4c6b-bdbd-f821b3a4f8ea", "comment": "Malware payload (Mirai)", "value": "78e87a86cb43c454a540d090c33d896f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161673, "uuid": "6215506f-c0dd-4381-b533-f01f8ee53683", "comment": "Malware payload (Mirai)", "value": "fbbb7cf19348e346b7b0c69bcb2d13e83492b53916a0b49034754b16c7fc4141", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161673, "uuid": "fb16b1f2-8498-40df-9670-4d1fa6b80834", "comment": "Malware payload (Mirai)", "value": "2ad615a3b83a3e0e47ec022cfe51aa5b01ea033f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785161673, "uuid": "32ed07d0-4c84-47b6-8cc1-7096bd34a89d", "comment": "Malware payload (Mirai)", "value": "0cb224ce7a5ae39ddf09f83173f2e18aa462c5e822d88b374edb09632ca8807f33663f54a2bb1822c87ff5dab6f2b91b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161673, "uuid": "31cf7f30-8eb0-448f-b2bc-5bdaa8f09013", "value": "T177F37CA3D8256E6CD218D4B0F4219F7C2B23E57581831FAA9967C6794447ECCF9053F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161673, "uuid": "689dea7e-efaa-4cb6-a863-6a61e3ddfa70", "value": "3072:7k2gcA+jf7CDn1M0bTIqi2DO0AW6MsvfcpBXK:7k281MqTIx+J6rfc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785161673, "uuid": "3a2c338a-9b34-46c4-8a27-0ad5e792332c", "value": 159172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785161673, "uuid": "325173a5-8980-4a91-88ea-82d10c413697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785161673, "uuid": "11f63754-1005-430f-8a1b-e5bb3f751b75", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675a9d83-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785180963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180963, "uuid": "4fb63ebd-aa50-4366-a179-10dc2e7a38f7", "comment": "Malware payload (Mirai)", "value": "3ece1443541cd12ea380e387d7eae9f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180963, "uuid": "0b3dc268-601a-4673-847c-0583d0055bc4", "comment": "Malware payload (Mirai)", "value": "fd730d78cce9761781424291954d8ec27bef2bb31864574606450c3a4eaa359c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180963, "uuid": "51d7e507-3c7d-40d0-85f3-25d61c6fe592", "comment": "Malware payload (Mirai)", "value": "f0dcc30484d81ba12c4745dfc32dec93abcd39f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180963, "uuid": "f1e5fe78-55d6-450c-82ea-f361550e4d4c", "comment": "Malware payload (Mirai)", "value": "dc7fd6a21b762d13655287df4403c862827661c71d1b29f5c9159d754e0f2f8be2be4391284f0a7427a16b4f714efb46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180963, "uuid": "c449c845-dd1a-4a17-93eb-219505a4728e", "value": "T12403E1AFA9F497ADC94E5EF5618F1B0286493140268B8B4C73008DD9BEBBB4F71850F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180963, "uuid": "68664a0b-1b02-4329-823e-3b8945c63dcb", "value": "768:MVyIwYjG0JFXIjKUVjz/ouVrma9R7PH/WU:MVyYjXJGmUd/ougaTvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180963, "uuid": "a1bdf426-1eee-480d-9758-7530dce3cdd8", "value": 38104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180963, "uuid": "80e74e70-a72c-461e-9bcd-8bf676526d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180963, "uuid": "34d9aae8-2d44-4114-83b1-b6358558d29b", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f541ad-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158056, "uuid": "511e3cca-ebaf-4123-8ae6-ea1041d2af3c", "comment": "Malware payload", "value": "4ea22ccc86b8d7fc2dd9c40858c9d4d1", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158056, "uuid": "f80d2869-d213-4d8f-808a-eaaa1b8baafe", "comment": "Malware payload", "value": "fdb0675dac72fc8fdda65a83269040a33bb101bc7ab48de07c557e544a570607", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158056, "uuid": "58727b27-5eeb-4051-bc6d-a7a8fd98bee8", "comment": "Malware payload", "value": "2fffe27bc9d7c212e7e557402e1aac22e54fcc8f", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158056, "uuid": "8564ef97-e799-495c-b9f7-e03ca0ae3b77", "comment": "Malware payload", "value": "3c3c79be7ef2b61f3820d286cdb93aacdeb4f96821a47730dad313670809204317bbbc7a9e1e817b19a92720d2961789", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158056, "uuid": "32a9d280-e86a-46c5-b0be-51f83a0a0c8f", "value": "T19AE38F6962EC560DE7FB4279FCF513844EBDFD713202D22DA49251916E00FE66E222B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158056, "uuid": "e2f952de-1d0b-45f7-9cff-c9e91186bae0", "value": "3072:eW//kSed/T4pxzNiPXcLizVGwPKagTbTICPg:BkVd/T4pxzNiPXyihG0KagTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158056, "uuid": "8ebe8f76-728c-4a2a-80c0-1d9b3fb81349", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158056, "uuid": "2266b937-0188-429d-8e68-39cfd58c2222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158056, "uuid": "e53f1fbb-4dc4-4987-a10b-0ad43632b5df", "value": "fdb0675dac72fc8fdda65a83269040a33bb101bc7ab48de07c557e544a570607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f43ddcb-89e5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785175259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175259, "uuid": "bb78a32e-53fc-48f0-b285-6b767af5246d", "comment": "Malware payload", "value": "09f7d18c373623b35f2479d31fa7ba47", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175259, "uuid": "b98cc3c9-6188-4621-9600-47da41680ee6", "comment": "Malware payload", "value": "fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175259, "uuid": "e888d322-1880-4e87-a4b9-f0d154f00309", "comment": "Malware payload", "value": "42f6a4f6b21eca1df529e71fe40e303d1e530692", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785175259, "uuid": "4674cabc-2675-4654-99fc-8ac0155aff8c", "comment": "Malware payload", "value": "a62606fcf0e1d58db2c81c03790f2fc8d24ae554608d3178fc9d1769de9409f63a4d3fe8103e9f0d69971198dd5b9f49", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175259, "uuid": "fb6b0390-d586-42a5-8775-3da2eaa741d6", "value": "T1B03132DA56555E368303CECEB3A33618720C92FB2C47D7A4C9490EFD4A881CDB255BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175259, "uuid": "cb281fe9-527c-459d-b886-2d7ab7ac963d", "value": "24:0ac6maCaQv/riDBwfXQ50nhOBqToGsYV19u2YTW1:5c6mawcB2FnhOBBGsx01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785175259, "uuid": "5660bc6f-5e79-45a2-be1d-05d7fc561089", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785175259, "uuid": "50020463-99d5-4ea5-9b11-96753bc03551", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785175259, "uuid": "4d6d995e-dcc6-4a72-a68f-ebd8e6062fd1", "value": "fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5058bcf-89bb-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785157525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157525, "uuid": "f7ce0165-4e69-44a0-909c-eb933400bb51", "comment": "Malware payload", "value": "44fb96375157c4149dca4758fc552999", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157525, "uuid": "f4491709-b06e-4f95-a7fd-97f79741ad5e", "comment": "Malware payload", "value": "fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157525, "uuid": "3322a8f2-5df6-4b66-8755-3f688644554a", "comment": "Malware payload", "value": "bf63a98db3c3b5c7921e12219af0bd002ed8abaf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785157525, "uuid": "cd15913d-cbd6-4fc7-b7e9-6cffd09d69d1", "comment": "Malware payload", "value": "360ba443e4d4994d2cea7d63203225a410302c89ce67f4b42839a336debbf4ae48c959cad9ac6a733215c02dfc304b7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "e3aaa940c8c30f0571cc42a6e9260f60", "colour": "#66AD55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157525, "uuid": "d708bda1-01a7-4348-a207-14ab8b233e89", "value": "T19CF67B15A3A356E8D2268177CA96CE32F7B578410760AACF0E54D3192E37AD47E3E313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157525, "uuid": "bfae3a3b-95af-4726-8fbd-1dfdbc18da2d", "value": "71b008ad892c449add994b5e45fffabc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157525, "uuid": "1ace2aa0-0b53-4da4-804a-fa7bcb983f74", "value": "24576:nY6TYOe2pP1y2DjTHcmQhPT+mP82giMYRu8XEtN5Fs9:nY6TYOEmQB+mmKzUtN09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785157525, "uuid": "b2d69b0c-14d8-4349-96b4-80b56c7c21a1", "value": 15732224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785157525, "uuid": "01a0f938-9a1d-4372-8651-7b8009295a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785157525, "uuid": "4b31405e-5e2a-43ec-9dd6-705b73cc766c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f7a44f-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154216, "uuid": "bf519f4b-92a1-4d16-9786-b67013ca7550", "comment": "Malware payload", "value": "bece008c345370143911f37435fc2ad8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154216, "uuid": "41286dd3-3390-4d21-a88d-21a1947fbae7", "comment": "Malware payload", "value": "ff29183d83b5e1da9cc2effebc90676fd3f5db446318c36c10439f8a530b77fb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154216, "uuid": "b2afa5ff-edfe-4ab7-81b1-983404f30a09", "comment": "Malware payload", "value": "3c6363430d59264fc924efa1369f9144a944b373", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154216, "uuid": "5dd9e15c-5d34-45fa-8019-fa607881f006", "comment": "Malware payload", "value": "fac8555dcf8449e45cd95dc4cd4862a8862fbe06aba6b3e3fa0b67630939d30cbec705828dead56558736d3f2fccd8b6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154216, "uuid": "98fa6717-49ca-4ac2-a885-9238552ea754", "value": "T15D21A77EA1A2EC06D0668336281256C6D10B07502621B6F7B279EFA539E41B5D37CB63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154216, "uuid": "7d8b2639-a51b-4369-8338-beb4fd864713", "value": "24:98dWHpjt8Zn4ImvNQ7fqHJNU5myQWOIXfTmSjQox8fLk1OvWIXKpi:98MpjqZ41NyyyQtI7P3kqq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154216, "uuid": "85fa218b-b39b-4b78-88b7-55ae6f8d3244", "value": 1223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154216, "uuid": "bfa7686c-288f-41bd-a1a1-e46d7e6c489a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154216, "uuid": "3f2a4b77-8edb-48ee-b754-994567aabfad", "value": "photov_123012156647.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0d9397-89bd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785158051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158051, "uuid": "d339dbda-8eab-43a1-9e96-2fa6a6d5fe18", "comment": "Malware payload", "value": "4f939286517f598fff791136304bd080", "object_relation": "md5", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158051, "uuid": "c2fe1963-62e3-4c6e-8b4c-b9ffffd3419c", "comment": "Malware payload", "value": "ff3f141c82c0618e5c16baf586371a39c47bb258e1cce7a6e4577760ef173513", "object_relation": "sha256", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158051, "uuid": "6614a102-c427-4190-9280-ce989436b583", "comment": "Malware payload", "value": "472123084a328c38cfc18d2520ea8fae1f3e0a37", "object_relation": "sha1", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785158051, "uuid": "07a12d46-eefe-45e2-ae4a-7b6cdece5ac5", "comment": "Malware payload", "value": "e0ce48a35ff52610333d7d3cad007a183ee27a277791d93137443b0d022c604a7b81eaf500c3724c83ba455e0788f694", "object_relation": "sha3-384", "Tag": [ { "name": "46-225-151-177", "colour": "#6AF30D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158051, "uuid": "b8880009-ffeb-4bd1-99ad-94168cbb9aca", "value": "T13285BE25E3D811A8D433DA34CBA69233C6B279060775E4CF0699C2052FB3AD1AB7F716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158051, "uuid": "1571bdfa-5b86-4d11-a2cc-1894b51e8d21", "value": "1d460d40d677072556393e27fe74ae8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158051, "uuid": "8d898ef0-47c3-41ec-ad18-aaa07faadef4", "value": "49152:BQHVgDcWgpI+dyc3DU1jTMMAgdgYjoE1+BL8+:qEcvJjMmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785158051, "uuid": "7ea9dbab-d7f9-45b0-a11f-19cfac0797db", "value": 1757696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785158051, "uuid": "df6e6164-7ce6-43cc-aded-4d79da0dbe65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785158051, "uuid": "df366c09-2722-4f1d-b1a0-decad7436e64", "value": "ff3f141c82c0618e5c16baf586371a39c47bb258e1cce7a6e4577760ef173513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce509e9-89f2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785180838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180838, "uuid": "bbe17432-0a5a-4839-953f-9019c3a46feb", "comment": "Malware payload", "value": "06348093c7524496786a6b31820e706d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180838, "uuid": "dbddeedf-98d1-4fa8-9ec6-e5143dc891d9", "comment": "Malware payload", "value": "ff616f68ba7dec323309da2efa9e8208bde98716019d0e554ba18251047d809a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180838, "uuid": "f44c54d4-109d-4da6-a996-bf277e802d4e", "comment": "Malware payload", "value": "dd5fc702a00af336071a2c1c6b800dafc703ff91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785180838, "uuid": "f29aa543-1939-4216-ab67-cc5834e0a8f7", "comment": "Malware payload", "value": "6c0615ff9532fe4940c3265fd445f7827df27e33140ba480ba6c3d3c694ac1630b6d6f5d693bfd3f58c2ba9a5f923adb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180838, "uuid": "5d6fb0d6-3a69-4d75-a0cc-a2a30f99b4bc", "value": "T156236C6516857C14AE99C8365D7F2F0CB9AD43E6314492EE7FCE3CF28C4A6AC920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180838, "uuid": "28d4d19a-f26a-4d25-9228-4f4bd745d5ad", "value": "768:Ur9NyXsZztCT9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:SHusZxcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785180838, "uuid": "07014b32-524c-491c-9560-9037227e525e", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785180838, "uuid": "99c1a526-3e97-4c41-81d4-fa11c489f8b2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785180838, "uuid": "1f1e1c2f-3ed3-443b-9439-0c335dbbdfa5", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9874a679-89b4-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785154417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154417, "uuid": "bc886f5d-3627-44fd-85dc-fd42b8f32542", "comment": "Malware payload", "value": "70a23a145a51d1f0b5c6e5eadb163f69", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154417, "uuid": "b9eb1dce-aee9-4c3d-9a27-1985cb0a1e90", "comment": "Malware payload", "value": "ff84d11896cddc9b28da090163fb69ffb7b0a0016e9100e2f956570996656f14", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154417, "uuid": "591af832-c7ab-455e-b34d-c1ed7464ef16", "comment": "Malware payload", "value": "44f3695703af3e955125906661d43bff490dc85a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785154417, "uuid": "2fa48d44-e43c-48e0-af79-668f40b41936", "comment": "Malware payload", "value": "6f78243ab2caa11ec0514e7447ee1348700e92767c150cfa65cb64616abfedd6a77a4f54218aea7c64ff02d5985da6d1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154417, "uuid": "dc6002da-ff9b-4b9e-940f-1e1e2eba9f88", "value": "T1361194BAC2490C10C842E0B42C5166493F2E29E439B2A9770A05B3131F494ECB36949B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154417, "uuid": "c13c12bb-c960-4ddb-bade-e69200e808ab", "value": "24:9ab7orgYZCnkPF4r02hRMj00/imS4+Jl8jGGC/dX:9ab72gYZsc4wsMj00KP4+oC1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785154417, "uuid": "095dd145-1e09-467f-8e8b-cfd7880f4422", "value": 1008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785154417, "uuid": "a960f537-6060-4267-bacb-52880d22fc74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785154417, "uuid": "63de44e0-a3df-48a7-a607-71dc5d864a7c", "value": "photov_097378008727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f482fa61-8a01-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785187642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187642, "uuid": "583c93b1-d46b-4da8-92de-41859ac669ef", "comment": "Malware payload", "value": "05d81eb0e76fe59df6c6fe6088e85eab", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187642, "uuid": "cba6e5fe-96b0-4e20-9cf9-13ad95e8612b", "comment": "Malware payload", "value": "ffa5c396a37ef0dbabf541cecc4e1bda84675eace39d2a8d2ccf355f08a9ca80", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187642, "uuid": "57a6e2fe-e0e0-4042-b9f3-8fe1b0c57398", "comment": "Malware payload", "value": "b8421d746f47c9c61e3aa98102b484b9b60f7bad", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785187642, "uuid": "5506dcb1-e606-4d19-b87f-8fca40687589", "comment": "Malware payload", "value": "524c0baa59e6cd597e5c57e0be72eae46c74204d195754f7fae111afd9d77c4730916fadc3da79967f20e199669a7a7b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187642, "uuid": "bfaae4e4-25a3-4b7e-8c84-7ea1bcf8d3df", "value": "T1BF07336BA07869C026E1A1DF58E29F3153712C4BC8C7A48B4CEFF7DDB60B38515A9D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187642, "uuid": "86166588-9a2d-4122-9584-39425fd270ad", "value": "196608:N4qfRgeCageCggeCdgeCEgeCSgeCOgeC6geCcgeCHgeCm:/fVVT2HRJ5zwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785187642, "uuid": "02c349e5-b7d7-43d6-91ee-3817857f8de1", "value": 16911100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785187642, "uuid": "b517a867-2577-4975-9222-8d9b534c239e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785187642, "uuid": "4327d136-d25c-4d89-92ed-a7b4eed30a0f", "value": "oxmaul.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25cb628-8983-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785133441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133441, "uuid": "dc0775e1-a9a2-4eac-9d0a-f1911e391b31", "comment": "Malware payload (Mirai)", "value": "9720272855ffd07cca9ca643e5874dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133441, "uuid": "ff4a06d0-9343-40e5-ade5-f3200278b986", "comment": "Malware payload (Mirai)", "value": "ffc5041190ac4fbdc6312a47cdd06de7164691028f9c19d4c71f7f1e34e756dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133441, "uuid": "8872c4ce-fbcc-41f6-92b2-0c46b6a79c04", "comment": "Malware payload (Mirai)", "value": "1faf58b596e042ac5f7d972de4283077c6822ba6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785133441, "uuid": "7847e989-3eb0-4a93-af11-1d99eeb95681", "comment": "Malware payload (Mirai)", "value": "ee9fe086e828001605be2552c97f02a65fcfb344d54a41d49cd7e310e49420efc3fe188edb9528be9c46e98fa73c1bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133441, "uuid": "366f8305-9dea-47bd-ba9a-46a8ee29d70c", "value": "T174F3975E6E229FAEF67CC33047F74A24975D62D623E1D684D2ACC1142F2038E545FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133441, "uuid": "b0d3d21b-d6c7-4831-84c5-daff40e8f26d", "value": "1536:AuIVDYjI9Gu2vL+hSscAviblg/QRebNFFrhrPPCVnATFBENpYgnoMoG8QU:AsIR2ahSscAvolgoW/rPELNignC1QU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785133441, "uuid": "c3eb2fe5-4196-4eed-98a3-0f3c944434d2", "value": 161236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785133441, "uuid": "2f84d4e1-e180-4213-8536-1f64c2d91585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785133441, "uuid": "7157af9f-cd7d-42ca-aad9-75c9d612b9af", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }