{ "Event": { "published": true, "date": "2026-07-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-03", "timestamp": 1783123382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "537500df-02a6-475d-9499-4597b1658579", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c8ab0b-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101741, "uuid": "bf478f76-7096-43e4-86cb-564f492c302e", "comment": "Malware payload", "value": "34d280d26df5ce29c125e334cd7fa43e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101741, "uuid": "2dcdc2f2-7e2e-4553-95a8-4f7d6b809dc7", "comment": "Malware payload", "value": "00e49a5eb1918f2760db2100a14e780ceeeab547e75e3ba915a38831c33e8587", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101741, "uuid": "07f0a08f-66eb-47cc-b9e9-95136e1ba5a3", "comment": "Malware payload", "value": "426885e4a4740bbd8c57e9d42b354c091bcf5414", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101741, "uuid": "8c32a8e1-6d48-46e9-b229-6f94156bc127", "comment": "Malware payload", "value": "9d20ec3f3a7c1ef6624ca02790c7d20cb3b814a0429404f4ebd5152c69a1e4072ebeb7726621d24f53bf058337630b43", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101741, "uuid": "d5b3fd37-a986-4a80-bcc8-ede3ea1c2536", "value": "T1334533397A7010A5AF3C81E86FECEC27985D1F8A8C70FD8C0B295F36A151361AE75522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101741, "uuid": "b2c17a28-f4ce-4486-9645-ff4c5d0a9882", "value": "24576:E3bGuQeD2mrdDLddc5nxcyEQonPgb+71dYC95boE1hMA88L7Amgk2SGXTK:ErUPm/GnBEQ9S5dYCvc0hMrjmghSAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101741, "uuid": "af9a62e9-400f-4076-b294-728225b2c93f", "value": 1230648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101741, "uuid": "53120097-7676-4ef7-ab55-18bae6659986", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101741, "uuid": "c60adb96-4134-40ae-8422-89b16cf6ad7f", "value": "Remittance_copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621623d5-7694-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1783051509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051509, "uuid": "0d190bbd-456a-4b9d-9aae-826d7be572e3", "comment": "Malware payload (MaskGramStealer)", "value": "c1cc183b4feb7f01efb4e39d1465c323", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051509, "uuid": "f6d38e92-704e-43d0-998f-f11f82859d37", "comment": "Malware payload (MaskGramStealer)", "value": "0275c6cf588a7e26e97cbd3a8d301370ebeb18470e86b21d295c8d93ca778d86", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051509, "uuid": "61824f77-a8a8-446c-8dbf-293a24a5d4b0", "comment": "Malware payload (MaskGramStealer)", "value": "3e49d1d2f401a5bbfc33926fee77b30f0c5f8f67", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051509, "uuid": "864ee400-5c19-4eb7-9532-3a03c8a345fb", "comment": "Malware payload (MaskGramStealer)", "value": "902defa771c5f377e7437ea893eeb34018293dd383ce88ca87425738e58dc34db4cfa82f61703d4657b366687e8835d1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051509, "uuid": "19370126-076f-4447-94c7-f3862bcd255b", "value": "T120044A5BD8D540EDEC1AC6748999E237A8B2F85A1936BA4F1BA0DF061F90B30771DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051509, "uuid": "d8497440-a7f8-44c4-ad91-c9377c8ca057", "value": "d1c35276ff2b8e9d448afb940bccb1f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051509, "uuid": "fde0cf5d-a422-4dbb-9b3b-52c2357a9c72", "value": "3072:crNBN2eWx8Adi2MdtBcdEOPn9SL5g3QJTw9wAu7TkJgY/r:Wydt8tBc+Olo5gUw9w5WgY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783051509, "uuid": "fdd47bf8-78f1-41de-9260-75073f021055", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783051509, "uuid": "bc7c8417-f73c-46a6-8c5b-f5dd9b1597bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051509, "uuid": "80ebaeb0-2294-40c7-af56-b39bd62f97b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11cf172-76af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783063238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063238, "uuid": "01d3f4ab-20d7-4c5b-8e75-82254eec6513", "comment": "Malware payload (Mirai)", "value": "f50f6fae3b94ffca8b03ac3fbd0346a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063238, "uuid": "b9a677c4-72fa-416e-b54b-25bb1fb25bb4", "comment": "Malware payload (Mirai)", "value": "03fb4001144fb24d6a64758f6ab009920437b136a83c9be4d843b4b472adea65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063238, "uuid": "9bf44a65-865f-4da8-8780-adb21d863267", "comment": "Malware payload (Mirai)", "value": "2cb53a571a93955be010328df05d0c75f7e80976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063238, "uuid": "2dda42bc-9e88-4d16-9dc5-bbf3b4e72017", "comment": "Malware payload (Mirai)", "value": "9e67de5f1456ffe15c91fc6eae326a4eb6a6e6d789ce99c63e6fbc9d126c8a3ff62f07c0a39491e1a676444b6dfc1026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063238, "uuid": "5a5f74b1-3488-4228-9399-575af17139d3", "value": "T1E3932A97AA41C973D50310F212E29F674536FE3F58A7D9C6E7943CB0EE181819621BBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063238, "uuid": "11921af1-fda5-4e59-a687-67bd3f243839", "value": "1536:yEVgyX15MNVHHrxreZqdwvpPU2Xy6JGNSS+sYT73b5hlpOBH0g:yE/F+HLZeZgl2PEA3s25hlp4HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783063238, "uuid": "93c60cb3-39be-4679-981e-da498d0a8dea", "value": 91320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783063238, "uuid": "73fe5c12-8794-42a2-bf10-33295f248d12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063238, "uuid": "3b2f9c80-5702-4b7a-a415-e6ef933b568b", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510997f4-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783101302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101302, "uuid": "6f114c95-f454-4a22-b7b9-1331516586cb", "comment": "Malware payload (PureLogsStealer)", "value": "4d2954fdf41a1526f961933d9dac4c9d", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101302, "uuid": "dd444a3e-214c-4aee-a337-47a484c081f6", "comment": "Malware payload (PureLogsStealer)", "value": "05ea919c7db1aa97b69825995720d383fa936fc02db8294cf1796c8b4883f9e7", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101302, "uuid": "c35e098a-a0b4-45b3-a058-a1e28e0a1552", "comment": "Malware payload (PureLogsStealer)", "value": "4ec827cbafdcd5f84ac9038628fa38faf01ed626", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101302, "uuid": "406c68e9-d07e-4194-9452-e0764b55e09c", "comment": "Malware payload (PureLogsStealer)", "value": "acf40250dd9b98efef972ada73cd0d7ca7dd3dd0a23fa31bd411e66afb2bb3f58894e46cab47789330f02c3150343c0d", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101302, "uuid": "82d21077-9707-4ba5-a9d9-227a74ab2fcf", "value": "T113B313226676DA203BC5F32489D0732ED99706761F5A72E2F8B35818F73467C8D22F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101302, "uuid": "0f9805d5-497a-4493-b24f-b7b1faed58fb", "value": "3072:moVJCEJYbJ3NYufqzFUhtZksKVc1JEcza2FtzkmXN:moJJY13NYMyotZfKih1XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101302, "uuid": "c6df2084-8731-4c4b-9c8e-be035d98c05f", "value": 111919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101302, "uuid": "e5b97edd-ffb9-4000-aa93-a64b14fd23d5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101302, "uuid": "f014f41b-18d3-48c6-bdc7-9966e5395a44", "value": "Requisition_Confirmation_2026_Order.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3691d864-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783101687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101687, "uuid": "fd35bd72-530a-4c44-be99-da02a707206a", "comment": "Malware payload (PureLogsStealer)", "value": "fd1ee25f514405ec3c3167435ecdf080", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101687, "uuid": "f00bbbeb-00a2-4fb1-b51d-1500cde9d13e", "comment": "Malware payload (PureLogsStealer)", "value": "08693f66da4a44c36e1a690f055876c763c0c0742c42e33faf39b9519c3d9dcc", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101687, "uuid": "e9d8c265-6db2-4557-9e37-322a8fe5e240", "comment": "Malware payload (PureLogsStealer)", "value": "dbbf7dd5a2189f56c670c7c3b9c7fe06d12aa040", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101687, "uuid": "9de78130-252c-40b5-a3e7-271747efa903", "comment": "Malware payload (PureLogsStealer)", "value": "fb37aedf38a5b123abc3087b2e82bd27c1ec951ec4d8760ca784c4ace4b46972b54bb4f32a94b1b16436163ffe3cb374", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101687, "uuid": "a3f001d1-f373-422c-86e6-586aa5bfba26", "value": "T19454230667AF426EECA6831487E9DC0D8CFB556B07E68A05C197F9BB3D0171C24CD98B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101687, "uuid": "799308d1-4f39-463c-a471-2080c8c80bf1", "value": "6144:xNzw2hgyoC0yfOsn+6sNm69DhjjbokDVJ4BM10Q7tGnW:xlwelowf9sNmUD9jr4BMHtGnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101687, "uuid": "1c2d1995-1959-4b77-b924-aab9dc06f268", "value": 305838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101687, "uuid": "8f8619e2-8d2f-401c-acbf-98aa0f1a9d11", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101687, "uuid": "2742d192-c123-4481-95b2-03d58655ddd8", "value": "Purchase_Order_Quote_Confirmation_November07-2025_pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301eb265-76db-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783081920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081920, "uuid": "a70263d0-4a52-445e-a348-22d38433f566", "comment": "Malware payload", "value": "9f7babb837030e4d4c5ee8d72cb5f14f", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081920, "uuid": "22bb2fd2-9d9e-4fb9-92ca-9d49084c756c", "comment": "Malware payload", "value": "08a133637df59e3731e5fc0cd723ceb098a86a1999711eded4e5945c9e9cd3ec", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081920, "uuid": "89ba3d05-f247-4e5b-af58-97faae923c2a", "comment": "Malware payload", "value": "f253ede820fe1429d716e26e4d9d90388fad3e1d", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081920, "uuid": "6961c08c-3058-4600-9c5a-5d3b7a026856", "comment": "Malware payload", "value": "3325b85112f1b8551b564024ca28a771dc2ab3e55b2721faa1e500e88db7a0b8699ae4a0f1465621fa406900d4a72525", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081920, "uuid": "95384e2c-5b60-4337-80fe-b4d518da4b54", "value": "T12426BF4FBA9907F8C539A1B154109211BBC1B9028F20EFBB78663D660D7BEAC1F35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081920, "uuid": "32cb58fa-a1c4-4319-a299-6082dcea0c1a", "value": "62914711e3e0566df9b84cbc5a345ee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081920, "uuid": "fa207717-4830-492f-b917-326431293c50", "value": "49152:S3XunXLYLMPKy/FQsQE/g3pS49mA64lsMut+EnkWNHVL52N7AZegoB8GUXNvSF7x:BXdpvdGU+3wuDS2DMwLs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783081920, "uuid": "cc49899c-7c67-4b20-8562-8e4d4e2abcba", "value": 4738560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783081920, "uuid": "605b0c32-a666-4004-9d71-5ec30beea596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081920, "uuid": "3595c858-7db7-4a4b-81e0-603e9cd22f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2f28c4-7674-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783037756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037756, "uuid": "1bc9c8b3-02ee-48c3-a0ee-09dc5ff6bf59", "comment": "Malware payload (Mirai)", "value": "1db3e73ca525221c53ffdfb422bbef5e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037756, "uuid": "28aa7634-ce0e-46fc-9b1e-c6952494817e", "comment": "Malware payload (Mirai)", "value": "0b0bf190c3d68ead801da7152302540fa34f2ca5d81c8263dd2da0b3faf0bdc4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037756, "uuid": "3e51e885-9560-4ce3-b279-41b857078f46", "comment": "Malware payload (Mirai)", "value": "0d8a66ffd60eb27b52bfb6faeede119740d4fc86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037756, "uuid": "6705169c-f908-4513-b113-8753134b60be", "comment": "Malware payload (Mirai)", "value": "6d12e0b2b28e4e108d47d8d92ba02d67461b228518b3cf3c8a652555f6777cd502231d78f0336380ca82c6929031c361", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783037756, "uuid": "2693ef5a-a283-4fd6-aef6-81c45e7c3073", "value": "T1B6118C8D02A05A3E6FFCCC6CB06FD208AC71E5C430B14F15DA64D42395A71606C15F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783037756, "uuid": "76c6a512-e4b5-405c-9036-43019da57aa4", "value": "24:3J3Tm3zBxm3Tkm3xNIIpm3dKSKm3jT0m35uqaOm3pl9Am3f9rm3Dqxm3z/0m3rE4:FwBxUkGpqxKgT0cuqaOA9A29rAqxU/06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783037756, "uuid": "fa9ca7a5-b73e-4f28-88ab-26ab6760d3eb", "value": 936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783037756, "uuid": "7930e463-ddd4-4557-a7ee-a4d2d5626e4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783037756, "uuid": "d1eef426-c9ed-4b3f-b2df-91f04f0a27b6", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8950bba-7735-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783120911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120911, "uuid": "050f5ac2-2d3c-43af-a55d-4ea55766672c", "comment": "Malware payload", "value": "0d6b27a00e79e8138b3d93b2c56b24d7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120911, "uuid": "44d01859-a778-41bf-8f8f-0999f1e42d66", "comment": "Malware payload", "value": "0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120911, "uuid": "bee973a6-fca3-4fd2-8da5-144a6722b9c9", "comment": "Malware payload", "value": "e4571f7b27285ddc0e39d005a9f1109a9335820d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120911, "uuid": "a27f5b0d-7913-4c70-ac04-d242b993d5da", "comment": "Malware payload", "value": "d8ae466fd559804b3654579dde6ee370c033c7d6d7143a5f1f44d817f8dce0c89762bc84f6efd26953419dbdd43ee6d2", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120911, "uuid": "1093d4f5-7a57-417a-a8c4-cb2c4d818719", "value": "T12925E04BB3E460EFD6A7973089764606D37278A18761CBEF329C42211F173D49E7AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120911, "uuid": "2a7d8c6d-d821-4f48-a69a-f9daf9d569d4", "value": "13f79e8b30893cd8b53f6528763b9ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120911, "uuid": "b85d73dc-7de3-4f5f-b5a7-d43219d22bec", "value": "24576:RVP2hh0cMo02cVGjpo/jE27Ii8dwqOc5S:/28cjnNME27ZQwUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783120911, "uuid": "40104152-ce6d-406f-bd1e-1956897c7535", "value": 976858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783120911, "uuid": "4ab9943c-133a-4349-907f-72feeb02be2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120911, "uuid": "63a0657b-717d-4021-94c9-df4f894e8209", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2923fabe-76f1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783091357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091357, "uuid": "06d14d4d-fb50-4945-b8cc-f7b6a00e8e90", "comment": "Malware payload", "value": "79d7a3612b333acef6c158f0c3fca926", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091357, "uuid": "5ecff9a7-b333-45c2-aeb9-a42945fc56ea", "comment": "Malware payload", "value": "0d4db6a203ff5d801b673e7d5ad34cd0dc88166dc01757d8d8a9ab5798ad1375", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091357, "uuid": "5c21485f-db9f-47cf-935f-dcafd9124669", "comment": "Malware payload", "value": "306e283e9b0f8b488d687f3d419f6ef0e9cbcf1f", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091357, "uuid": "3408176b-3268-44b4-83a0-f3206343d1d4", "comment": "Malware payload", "value": "9e560bc639491be2628ff0847144a138f424bdca5bc6c3e2a9cbda60d8dc1bb2e640c10a0c31cf47f1b00b5971fc8ca1", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091357, "uuid": "4b74e38a-8527-42e5-81c1-4d7c795834c2", "value": "T1BD35338C6B714FD6CE7F573CC242EE4F7688761D99810F4AA19D609BE7EE08C0C92568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091357, "uuid": "69865ddc-cc27-4cad-8597-612b0a295277", "value": "24576:9LCiEJ0Vz2Kaj4KKNUdbM6UMy3ColoOgKEqtLTYRS:9LCIqKaj4KKNUd5UMyyKoAEqFTkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783091357, "uuid": "7e923858-4871-4fa3-9e76-36b51f738e66", "value": 1102407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783091357, "uuid": "c2b37253-83c0-4814-8317-f6cc95924d49", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091357, "uuid": "776fd377-15a1-4244-bacb-f3b1336c6ac7", "value": "1.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd02445f-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101108, "uuid": "f42744f1-1612-4c0d-9c52-44cd5d818fd8", "comment": "Malware payload (AgentTesla)", "value": "1b078bdc1d38238a4dfa077db4978e32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101108, "uuid": "6164e113-a718-4f82-82b1-77483a2f4621", "comment": "Malware payload (AgentTesla)", "value": "0d8ce4ac8e61edcfbb200f354a262f879abc40c114ea238eb77f2e0349cee42a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101108, "uuid": "33282e26-eec3-43e0-a51c-d01c1c11db18", "comment": "Malware payload (AgentTesla)", "value": "0cf4dc780a81be2923dc18b863cc822d32c416c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101108, "uuid": "a5f4cbc6-8adc-4d7a-8bdc-651d485356da", "comment": "Malware payload (AgentTesla)", "value": "7c224eb1ec0549197e5727d3ab35d22248316d93737e797f0226be3240c9009e8ab53fba0791e16a18fbf11cf3e1a944", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101108, "uuid": "f7f276c6-ff0e-4e8d-84ed-09f4a2fb0b0a", "value": "T12DF508340314E762D1A81EA25E5D7E58150D9DCFD8F5FB033A6A4BB50339EB2A37A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101108, "uuid": "247c44bb-f180-44fd-ac52-a57c301bbdfb", "value": "98304:BdtBqAo0SzG8ji58qCYhqjJF2ABObhT3BfktEq:Qy8jiuYEtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101108, "uuid": "786a0f46-deb2-40c9-9656-7ad0bfb294f5", "value": 3615656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101108, "uuid": "6a72fc42-0aa0-4225-940a-f8f4cbdf56ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101108, "uuid": "00fc2c41-dc59-4929-9263-07efbc661d38", "value": "Order_No._MP.S.006025-08524.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0165422-76b1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783064203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064203, "uuid": "84c26981-2fc5-4b58-97bc-f288f56d600d", "comment": "Malware payload (Mirai)", "value": "dd8d686bc4a96269d2ef06d8287d0f30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064203, "uuid": "22b295d4-fc0e-4c3e-a467-baf01fc1fed0", "comment": "Malware payload (Mirai)", "value": "0d97f33b586a7d3194af3ee17708fb0406ae2e44babcff5c992cf46191f662e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064203, "uuid": "b1b4f062-a571-4370-8fcd-8d2a427f2c28", "comment": "Malware payload (Mirai)", "value": "8f557099ff3ab3b802b221f5cc35ed306b211a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064203, "uuid": "2ca2ab83-3738-4cf9-bc10-9761c40f87c3", "comment": "Malware payload (Mirai)", "value": "26000cb8625bd035c12ae7a24b6f338a12d2fce426cf80c9374ccd1f4fd4d842d17584a1a5a4b807c574a0b064c5eaa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064203, "uuid": "432ecc64-01a8-48f0-a099-ce6855b87110", "value": "T1FFE37C80B743D5F1DD934371503BAB326632E06A862BC642DBED6B72EC55641FA1A3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064203, "uuid": "0f1e0fca-5298-4f70-a7a7-230caf8f8e95", "value": "3072:FVxnSLXJHZOWIJWpuKZMbp+1tYR03zKU/fGtrw5468m43jCm:FVxnSjJ5ODUQKZMFi3GAGSCTCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064203, "uuid": "88297d0e-199c-4b52-bf05-2474de161f41", "value": 149996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064203, "uuid": "2c9a0978-1621-41f5-9e0b-a5f260ae25eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064203, "uuid": "07a4ca35-618f-4ece-bc8a-909a6bbe3698", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5871689-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101551, "uuid": "666ff04b-a878-4e24-8a63-ff6f3fcbacbd", "comment": "Malware payload (Formbook)", "value": "6149ac1589632550a06a99a64813e64f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101551, "uuid": "a0d384d5-f203-49e9-8633-2a4909a0fb1a", "comment": "Malware payload (Formbook)", "value": "0dc5fa7227eba10aea47e2b03ff5ca75c8517dccef43a5b39bb42bf3e057619a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101551, "uuid": "bcebdade-2cd6-4afe-b945-20f2107d7b95", "comment": "Malware payload (Formbook)", "value": "a25590415de62641606f84bfab73052184f8cd94", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101551, "uuid": "62aa545c-3d82-41d8-8374-54f0be710ed0", "comment": "Malware payload (Formbook)", "value": "62343b103c61d28b0995553d241e174af8c8e405adf0ff14934d53d94912b388de8802b52bc2f73e222b2d20303e947b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101551, "uuid": "c2ddc96b-ce34-46d3-b52e-e346f1a65a52", "value": "T108434E8E0DBEF5018CE1E5097A961F3FE2186568E2F89686FDB0D96004504678FF3DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101551, "uuid": "782bbeb7-6991-438c-bf1c-95fcb7b947a4", "value": "768:TUc75uJdIpdwHL3Ge3PTdHwHZsJ1y1+PxQjq2prriISSsMXXjwkwrd8vnSnXK:TUdJKpdwJ3rdHwHD1+P7Mjwkwrd8vSn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101551, "uuid": "6fd18783-1386-4458-93db-7c28172978a0", "value": 60326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101551, "uuid": "e538217e-89a8-47d8-b09c-26670945fe0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101551, "uuid": "98fad04b-9123-4e21-b24c-eca7c5b8314e", "value": "ProformaInvoice-5628.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d18424-76b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783064320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064320, "uuid": "88e168c6-e391-4a7a-b099-f4703fae7789", "comment": "Malware payload (Mirai)", "value": "e73a9a891fe38f8d86bbbfc4dc03f6fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064320, "uuid": "d9c4639d-cd53-436e-8afb-76fcf5cb54a3", "comment": "Malware payload (Mirai)", "value": "0def7dd8ebcc861d03142a1ef526d92eda15719f2c16733e4282fabdfbd22e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064320, "uuid": "024bc244-22c1-4ed3-b6fd-75b9cc19e550", "comment": "Malware payload (Mirai)", "value": "b4ee57f3132d6bf19e38d52812cb8ad341b565f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064320, "uuid": "f8245839-98e7-40df-b83b-053d9dc58c0d", "comment": "Malware payload (Mirai)", "value": "0714586cc64cd54f664dac66f9f5abd5d6ca86c915170f5272806c751e31949b0f43b2333b409032e0419040562101ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064320, "uuid": "fd0211b9-1971-4229-be14-2be9f5f3ae8c", "value": "T1B0B3F8C7FD01EFA6F80AA77645930809B230BFB60D5219B6B227789BAD360D51427F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064320, "uuid": "6394bd22-78da-4d0b-9c64-5ed09137675b", "value": "3072:tBFZaTGE5hyTZ9Ut+9H3K7YvvKJ3pZ2K9A:tdgG+yTHUt+9XM7J3KK9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064320, "uuid": "349343f1-24e4-4da7-ae86-f7353be1b0df", "value": 116968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064320, "uuid": "9af2d4db-536a-4df7-a468-449ec0078409", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064320, "uuid": "89e630e0-fe91-495e-8d2f-a695708e6b9d", "value": "M68K", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e8245b-76a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783057681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057681, "uuid": "a5cc0e69-116a-4a43-9106-64e64527aa06", "comment": "Malware payload", "value": "ff0d48f809265b62edcf40f5aea1500a", "object_relation": "md5", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057681, "uuid": "16e7cfd3-9d52-4b9a-93d9-15233b3b940b", "comment": "Malware payload", "value": "0e2af9029e88fbd6de13c64c74f728a268210c52caea5208088b0e67cdf84c02", "object_relation": "sha256", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057681, "uuid": "a4a77f63-e303-4028-a821-1546a362ae8d", "comment": "Malware payload", "value": "1a12cde869766fb13b47e5a5e15d0962e9f9a831", "object_relation": "sha1", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057681, "uuid": "ed37ebf6-e23c-4ff2-9b90-24e470cc13b9", "comment": "Malware payload", "value": "378207dcc7bd7968ce2ee019acd9b17d48751b017b1389c64f341fb57c21851992bcfd3d5ad61909215446099e667842", "object_relation": "sha3-384", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057681, "uuid": "2c1ea37f-9967-43d0-bf37-0f15bdd1d545", "value": "T1F582FA0A36B804F702C71678E1CED219A729811B54495F60BCDCE7C4EFA166B93F63E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057681, "uuid": "b37f5163-14eb-405c-a216-d6b0e84981dc", "value": "192:Gfyxid21CH8T8AExbmWbewfb+qLbbzPI/bu7byjzMvmAQ3DDbSI9SI1FjOnyUHgn:kiZw5IPMUDnFofoLgiV3ItIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057681, "uuid": "44256a20-a5de-4fa1-9108-22802f558930", "value": 18814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057681, "uuid": "02443ff6-e3ea-420c-ba65-4ccb4ffdde24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057681, "uuid": "c08075cd-ece7-4366-babf-f4fd13e8e5cf", "value": "bonuo-expo.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f64030-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101285, "uuid": "7b7538d9-e997-42fc-8700-12b68eb10ffe", "comment": "Malware payload (AgentTesla)", "value": "8abab788aa45c2603e4ed2b1a5678336", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101285, "uuid": "9533a287-24db-4053-9c89-f161e44f6fa4", "comment": "Malware payload (AgentTesla)", "value": "0ecc6893276663a9210cdaeb4940d409e1ee6d0f2b5c21a3341247df4c371d89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101285, "uuid": "ce24618c-f325-464f-835a-bc2677285601", "comment": "Malware payload (AgentTesla)", "value": "f0f08d5e8968d0eb1caac8a9ee7b796980f3ac1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101285, "uuid": "066e4b13-00cf-4074-a7f9-8e6cd272dbe3", "comment": "Malware payload (AgentTesla)", "value": "0a162a2d3619c5acfa63191c95201ec6578e3d558a22c43ee0d26895f8302f4e7fc6c8ed95ab7e63235da79c5ce0a9c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101285, "uuid": "57a69b57-cd45-4f76-a0ba-8d5d38c8f39c", "value": "T10D65335ED7BD2890632302AC5E55A1F257EEDD4C6273C65AC5029602280BF93F3F7AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101285, "uuid": "1b159567-6637-42a4-9211-2e4e3f228c85", "value": "24576:VZqbSZtfme35pJdKOqkjjzjaNaQONQukEB6K1CT6lsaj/HVrk90nkRPYad:XLfX4kjPPQSkEB6K1my/Hq90nSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101285, "uuid": "d5d18d6e-8a8b-456e-a340-250b3b45f44b", "value": 1465728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101285, "uuid": "162c745c-5c94-4642-bb5c-dcf440f0da9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101285, "uuid": "adad0b16-bfb6-45e2-9daf-f21a668df9db", "value": "Vessel_Desciption_Particulars.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3e4480-76a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783057674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057674, "uuid": "6d08675e-1de6-43f0-811f-4906f33dfa9a", "comment": "Malware payload", "value": "554f5d7e845510950b8acda91091c00b", "object_relation": "md5", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057674, "uuid": "eec3c6f1-eb7d-474d-8304-859b6c00f8ba", "comment": "Malware payload", "value": "0f6eae4499f2c7922ed2e60c5573d2dffdcb819024ccb362bf1429180a9fd25e", "object_relation": "sha256", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057674, "uuid": "a4badce8-16be-45ba-8b62-0b4cdef8a0ce", "comment": "Malware payload", "value": "c95221b1cbd14b8556948c16bf9a103e149498b4", "object_relation": "sha1", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057674, "uuid": "46ba44c3-5ce3-4f97-9d24-1f69226fc7e1", "comment": "Malware payload", "value": "41a4bc4f80dac0295c56fb63bbe894e3e85756b85d7adc4e2e7a0aeda1a111b627d16c97076216a909fd10e71bc127b1", "object_relation": "sha3-384", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057674, "uuid": "2338b208-a54d-4196-9d7c-df6fa38dc873", "value": "T15331E1190BD95311C6F2C63A94BE9322CAB63D41E5624E2E01C526C85D50711FD28F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057674, "uuid": "9929135d-4945-46fa-b6eb-15771dbc9716", "value": "24:8LJqpVBDeHayupJhUx+/rxCirdrVi85KRD17A17/abUjm:8A9KaJZDYRBM/aC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057674, "uuid": "da60a91a-65f3-4fac-aa13-aae3493f8acc", "value": 1855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057674, "uuid": "6055dc74-e9b5-487f-833a-e9d93df9cbfc", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057674, "uuid": "858cc96b-1857-4ef1-8bf9-d692a62a91aa", "value": "photos-88456224889 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76445b5d-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783101794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101794, "uuid": "c643052f-178c-4b84-bf5d-14cdfb7caf1a", "comment": "Malware payload (XWorm)", "value": "a9ce90d57ed01ac752d9f85be87041ff", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101794, "uuid": "3c1dc425-1929-4887-91c3-21cb4e75ab87", "comment": "Malware payload (XWorm)", "value": "1145e36db0b83afac59e0949e16fee00a65a6fd40ebcb4dc5f20e7690f3dec8c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101794, "uuid": "b1cc9fc3-6943-4533-b8b6-b04e4436c8f0", "comment": "Malware payload (XWorm)", "value": "d9d0e6c215f10c7a4b8f8622b0d74cfe74c480bf", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101794, "uuid": "ee02b38b-6ca3-41f6-98b2-5956f4f8f9dd", "comment": "Malware payload (XWorm)", "value": "9007e4a71ac4bc326b2e4532ebb80f1006d64ef52ccfe9224d807d1cf9188ac50f79f78d639ebe0d76491f04dc19bbf9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101794, "uuid": "4b29136c-1de2-484c-86cf-a25cf79946a2", "value": "T1901523D58721D603C85155FE9DF8B09E80AE5EBBF90C0844D476A3AFDF39618A99C23C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101794, "uuid": "573e2eca-3587-4c09-a291-846ada0f7031", "value": "24576:34vdXZdosi48s57a+bcZr4fe9pa6p3ZjIUcC9+RMf75:34VXZCd1s57a+Krf4eIcwS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101794, "uuid": "c009b5f5-89a3-4e91-9185-b9bc2cfd3deb", "value": 882254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101794, "uuid": "c4e0257a-e90b-4b1d-beae-b287a825d40a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101794, "uuid": "49bb0d92-fe2e-497d-8547-bff1eb3a4ba0", "value": "SCAN_DOC_FILE_PR_0001000265.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7e640b-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783106959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106959, "uuid": "a17249de-da71-4741-b6b6-6bffefa6a6d3", "comment": "Malware payload", "value": "d82deb8bdcbe9e6d28d0755ff271b39f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106959, "uuid": "7bc708df-27a2-438a-9f90-fdf47ba93031", "comment": "Malware payload", "value": "11ab28dfe32b4bba5c69ad37b1a898b519212036adec54d0cb306759126454d3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106959, "uuid": "9ae6c6d7-947e-44cb-be41-8712b6aee1c5", "comment": "Malware payload", "value": "1bcbf17a6be3dd7a0a3f22823f1f037432ca6fb3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106959, "uuid": "feaafc0a-1553-40cc-81ea-11d53dd35337", "comment": "Malware payload", "value": "8ef90a7a2d46874bcb7945dff6ce2a32d2d5e447b8653a3a021512616c188c859f7461226e3ca3b9854b9399ade5d89c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106959, "uuid": "4a9b5455-0428-4962-8968-1c969c60540c", "value": "T186236C6516857C24AA99C4375C7F2F0CBDA983E6314491DDBFCA3CF28C49AACE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106959, "uuid": "0fb425ed-5c4c-46fe-8df5-ab3866e6346f", "value": "768:0r9NyXsZztCq9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:yHusZGcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106959, "uuid": "f69c7dc6-afcc-4a49-8985-79ea5e38fa82", "value": 48376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106959, "uuid": "1eb07b14-7948-4e83-87f7-f545be2bc8e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106959, "uuid": "58b8d175-8447-45cf-8e8e-7da65a247c9d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925236c5-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783100982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100982, "uuid": "8b54b4c8-8f55-44c2-9bb2-018d72b5f5f5", "comment": "Malware payload", "value": "9b362ad6b1fbd2b4b09628dee5f0fd35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100982, "uuid": "84e1dcf9-8ab8-49f2-8d82-23497934bf21", "comment": "Malware payload", "value": "1210aee0d4d9a53fbad0227c4134341ac27f665666df2207cf5be3ea72c30f2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100982, "uuid": "c23100e8-5580-4b1b-ba8d-74774ab1123b", "comment": "Malware payload", "value": "4ad3c4fae967bdb9e9932b757d1a01bcb3545087", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100982, "uuid": "2df7df43-ab81-4b78-8266-8da65c451f05", "comment": "Malware payload", "value": "72cecb9e6dbf364fbda4a1ee9e003d59902eedebae9d5514c47c54e4834aea94bd9380f5f7c37ba53c5781707b69de87", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100982, "uuid": "8e1b2576-c4d6-4e3a-97a0-9fd8ac9506c1", "value": "T17FD5F73CCC29023EC172D52DC99A4A0FF8922907223DE94B54D7779B5E63583B7923AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100982, "uuid": "42d67e5f-263f-40e3-a08a-86ecf33b9484", "value": "3072:9Zdo/2Zri/ORLqMeAAhw39N0cfA6zTElKjokmqBd4huJ/nkrgDH1hzhSoEwocnWv:5pW+n0e1i0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783100982, "uuid": "b991b883-e6fc-4386-ac93-22754014c4b4", "value": 2825326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783100982, "uuid": "c4ee331c-3e4f-4b2d-a2e1-57ef757d6d38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100982, "uuid": "db8395e5-db64-44a9-a653-7266498165ba", "value": "newfile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7a4dc2-7680-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783042915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042915, "uuid": "c6eb32cb-48e9-450c-ba97-d114a5ab61cd", "comment": "Malware payload (Gafgyt)", "value": "306e9a2a9886a7c2ec9d8f74f51074df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042915, "uuid": "47d4425e-7b67-4828-8209-4f009ed9ee17", "comment": "Malware payload (Gafgyt)", "value": "122797288af9166cb10192292e0edf66abe21704010b5f93389a96860a614780", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042915, "uuid": "a35b1a61-8da3-4132-b48c-fd2e790c51b3", "comment": "Malware payload (Gafgyt)", "value": "b95a40ab0e7cef1e408d542f09c85e1ade20fd6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042915, "uuid": "4ed74355-7e2c-4cd8-8083-dd9f021e1ce1", "comment": "Malware payload (Gafgyt)", "value": "9697c4027a383c5851f23bd008e419f844f05acb27d3ee4775fe7fb2b2e744c7602a9eaf50e4a210792d8e22fcc93c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042915, "uuid": "c58b762f-5321-4f0b-a134-5701bb4e22ad", "value": "T19A047D48B74CEB07C19093B79D6F0623633138567B4B87627A19361DEDE27EC9C2631A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042915, "uuid": "0bb0f5be-e5da-484f-8249-57e4c1fa5982", "value": "3072:DIdLXg+1gYsMmN4hWCiDSfQKVX0MmTGXM6TFQWuw/z/vJE+r:DyLg+1g4niG4KVkMLXM6xQWui7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783042915, "uuid": "af5baf69-8395-4e2a-a201-2ecae848a978", "value": 189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783042915, "uuid": "92d966d2-394e-40a0-8c80-a82dac0303cd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042915, "uuid": "8618b126-a384-464b-aefe-3689f74715f0", "value": "aarch64.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84f86ee-76cb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783075357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783075357, "uuid": "577e0704-499f-4c25-8d48-eb2d8dcc4ea5", "comment": "Malware payload (ValleyRAT)", "value": "abac4685e9242d39df9e89a0c3ac1aa6", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783075357, "uuid": "d7f99298-aee0-47b9-bd46-32f9b6296afa", "comment": "Malware payload (ValleyRAT)", "value": "1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783075357, "uuid": "bdc2f6e4-c1f2-43c6-8e4f-0756eaf157ba", "comment": "Malware payload (ValleyRAT)", "value": "bdf21afb938ef0746945fb843090716bf3caa6c1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783075357, "uuid": "dbe576a6-b8e5-4746-89ea-b075527493ac", "comment": "Malware payload (ValleyRAT)", "value": "30e809fb9a8695c67bb5c8c0858aa043fba952c1ce498e9921ed94560b9d69739eeb2a112c495f3176aa9f67b86b5bd1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783075357, "uuid": "b296585b-dc64-42ee-9962-9dc14f91cb42", "value": "T1853833A4547CC6F92A6B4B0DD0CE134915E0752A79AF60BCE60834F931AF14EE8FF469", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783075357, "uuid": "cd695262-7feb-46cf-b75d-9fb105d37f6a", "value": "3145728:QIfax28BgYSXX/lokxkE1yK1NzdzcDrCl/ZLscDl:QYax/1SXX/lofE1yWqmlBYWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783075357, "uuid": "4bf31ba6-73c3-45c7-8de6-da93e43f5089", "value": 104585019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783075357, "uuid": "bf239afd-7e3d-4f3e-ba03-d66b68859b74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783075357, "uuid": "d5c9ad6f-5564-49c0-a0a5-ebbc4ce05e66", "value": "LetsVPN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99104a4f-76a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783058044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058044, "uuid": "f178f7b9-1ddc-444c-a3db-c153d1b26214", "comment": "Malware payload", "value": "d47b74ba704c7adc88f0ceb9482e448d", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058044, "uuid": "9c68fed5-e15a-4871-96af-c85d1ba63b31", "comment": "Malware payload", "value": "14381889755a603d08a3191c48912cdddf7e0fce3ad244966789abf8d1390550", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058044, "uuid": "1848c921-4d5f-4fd6-ada5-33a2e6d6b235", "comment": "Malware payload", "value": "ad12199992ccc4b29884ee94c8f5cca0d3f06da0", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058044, "uuid": "ad07e650-1db5-4001-b55f-c01dd5bb3133", "comment": "Malware payload", "value": "9c7d3e9c200d02999beb8f70800d8b077d11179dd6587341b55f0a3711b6aa169cb77bfa26fa18beb2644379a06b16ee", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058044, "uuid": "3e014f47-7010-487b-8a65-3b7bdbb78399", "value": "T133942B6772A64E20E1881633C0E7451193E56E87B5A7F70F768423AA2C033FEDD47A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058044, "uuid": "9667dde2-e588-4a0f-9c4d-59058887451a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058044, "uuid": "a4437c3a-2c99-4b49-b344-825030e47c3d", "value": "6144:2AWgCQ+X/rpdcYzymRlDVejYzw/UCQ13Ktk57TWwcagTL:HzC9t+I8jAyUvKtk57TWwcagT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783058044, "uuid": "e7fc488a-6413-4685-974c-4f26d2a04de1", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783058044, "uuid": "d48ded0d-9980-4adc-9d5c-5fa9dcf29cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058044, "uuid": "300fd105-55d0-4dc0-84de-5470b2e92f36", "value": "14381889755a603d08a3191c48912cdddf7e0fce3ad244966789abf8d1390550", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76798e3-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101447, "uuid": "dea24cff-38f0-4fc3-92c8-4f5724d0fe5c", "comment": "Malware payload", "value": "09e7cb823c741959fbfcfcc1269ab6de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101447, "uuid": "777d5237-37bc-4ce5-b6b7-bfe5eb8ddcfd", "comment": "Malware payload", "value": "1671f1215731787096fc66b05d26acd5553395ecf306c1545d8d7a0013d88746", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101447, "uuid": "99b81cb6-00a2-4916-849e-0b0e174e4b3e", "comment": "Malware payload", "value": "3d8faca79546847187c3129393e68d22fed91421", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101447, "uuid": "0e91dd88-d6ff-4a59-a881-c7adbb2722e7", "comment": "Malware payload", "value": "75a81beacdf609949d6c15d785a49b07bba61a903ecacbef28f296673e693072203addd86622d962ed9fd88b81dd8537", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101447, "uuid": "db46a9a8-6e53-484a-ba76-6a042b9a96d2", "value": "T14FF4073CCD64813EE172D619C8AA484FF882161B622CE90B54C73B5BAF73986779735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101447, "uuid": "8d08e1eb-dd57-47ed-a85e-eec05a0ea193", "value": "3072:KVzjDr1PxzoavfqJjFsCDnqRP4zOBLXV8TxIkBk5Ev86s+Vctq47AqYWBEJ/bWXR:khxTI6BLXVH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101447, "uuid": "3a5f8ae3-899b-4363-8899-ce3091a40dac", "value": 779696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101447, "uuid": "bd826d09-7435-4989-b4ab-d0cc532713e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101447, "uuid": "abfe6626-77aa-4062-95ed-11c62b4038c4", "value": "output_lyhuucoq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cc1dba-7713-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783106147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106147, "uuid": "433789e8-05db-4b9c-905a-b8b4ab3ecb0d", "comment": "Malware payload", "value": "bb4f892713157b9a4db7ef66aa798826", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RTK", "colour": "#49D934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106147, "uuid": "abc377e9-6f6b-46f9-b4e0-69124bc08b15", "comment": "Malware payload", "value": "16f0b77fa4508cbf1e11f11ff7d22bfc6b5c5ce997320ddeb58cbbdff6572605", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RTK", "colour": "#49D934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106147, "uuid": "c1cd2848-c3d3-4b60-ab17-9632d96edfa5", "comment": "Malware payload", "value": "44dc47e80a9d6a8ba6d19c20d6521df28b2132f8", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RTK", "colour": "#49D934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106147, "uuid": "dc8690dd-0890-44c3-8c70-53c5502e0556", "comment": "Malware payload", "value": "22adcf7b7fb8d36e8a91a779fffd48ef1394bba1f97683c2ff16f7932680e07296ca725ccafdff0e6832ec3cea802e71", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RTK", "colour": "#49D934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106147, "uuid": "3afc7ce3-097a-4ba3-9942-5992da79e5c8", "value": "T1B93523427BD08CB9C7DB66B051826DF4D1A9F7350504864BBBD08E0AAFB9391FB4E127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106147, "uuid": "796a0b6e-9d61-4196-8d07-5179b0375762", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106147, "uuid": "131b3511-c81f-4e09-9e99-915168546e5b", "value": "24576:P2yePUjJdPVOqP8sY3yQQ3KaJVn81V+2oDFRY0vV6kY:PpfNDOqPZFQMJeoDDYEV6kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106147, "uuid": "aa34fe81-8e8f-4cd5-a2f7-bc6e821cf5f4", "value": 1111792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106147, "uuid": "b6239ad5-2a99-434a-8b5a-b9407fb5493a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106147, "uuid": "82f92e91-2628-47fe-9ec0-1a8488d5ae9f", "value": "RTK_NIC_DRIVER_INSTALLER.sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2f6fff-76a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060603, "uuid": "8242cf5c-91b6-4d21-91dd-013aa8cb0eca", "comment": "Malware payload (Mirai)", "value": "3278780313124dcee0a989d5e775d337", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060603, "uuid": "ef2b6a48-3d27-4494-b93a-7b42f7de99a4", "comment": "Malware payload (Mirai)", "value": "1b68b78ec310e5043964aefd6b72c217b29b79ba8e372a939994b9264b2a4d31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060603, "uuid": "4e1b8f50-5ca1-441f-9ca9-3f92df47de8c", "comment": "Malware payload (Mirai)", "value": "71ea654101f028ac0a6609be57029e4767ce5dd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060603, "uuid": "0ed10c44-df7c-41f4-b00d-7e4cf7292e67", "comment": "Malware payload (Mirai)", "value": "3dc8d1940047df93dac3d14bf14a14be8ac333e752dcfc4f5d74afc36739a9c43ea538d354afed0aff77ec8887a3c3ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060603, "uuid": "7d016c8e-0924-473c-b7b9-76c800d86fa4", "value": "T12AB3285ABC81AF05D4C6157AFE1E534D33532BACE3EE7112FA145B2C32CB95B0E2A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060603, "uuid": "87934f8c-06b5-4cb5-8d65-9d4b4f542d2c", "value": "3072:soq8DhjzQ1bma7p7vX4pRtugGBba4E7stfVlab:Nq4hjzQ16a7NvX4pRtHGBba2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060603, "uuid": "3da92dc9-676d-4a1e-bb43-9fc50964882f", "value": 112900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060603, "uuid": "77fb9c54-991f-4433-9c7b-3aa8fdf370f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060603, "uuid": "b302ba50-b6b5-49af-81ea-20243808faa4", "value": "fO0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35ae738-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101145, "uuid": "4df251db-f4ca-4e0b-b3a6-b98ec41ebe42", "comment": "Malware payload", "value": "6d64834d9af216dc69c12c8f11e68abf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101145, "uuid": "efaa8cd0-cf3b-48ae-b8c1-cfbeb354b542", "comment": "Malware payload", "value": "1ca0e8ce7b424c3943c465ceeed7381002c86b7d304e2e0504a1ecf1b0d717c6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101145, "uuid": "27a34b26-74b0-4781-96f7-976bfd4b5a5f", "comment": "Malware payload", "value": "d77d97b33154f0ea4af35963b8d734b9d8b34877", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101145, "uuid": "b1b1bed2-58f5-4eab-bcda-abb12f28f7f0", "comment": "Malware payload", "value": "0147154c93e1c861b973d16d234ecf68289489a694c1e95313add8f407056ebb0f2a00ca266d582d27659b1d13128cda", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101145, "uuid": "a0dccd07-4372-4095-892e-fb1b5fba0282", "value": "T181C2E1A0A9F6C3B03D304434F3D388B3AB94D46C3725657AA6E99CF136744AA36C465F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101145, "uuid": "c9ee7c9a-d523-459e-adce-2db868034709", "value": "384:Ygax27XqDXCIdWVSVnuBiABQFKqL7ew2M9YQQ0kOzT72rQQfKcIeBi9Os0N4nuRS:6sXqDXfWUUiUhqLjvFn0f99SOsqc80F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101145, "uuid": "0e1aa063-bf00-4c04-843d-bf13fc7c2d2b", "value": 26857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101145, "uuid": "ee9ca114-3b07-4e14-94e8-81fd70013b85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101145, "uuid": "aa6ee01a-99bf-4e90-abc5-5f9f684fc9fb", "value": "Request_Inv001_File_details_scanned_pages1_13_headquarters_06152026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12827d4f-76c1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783070703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070703, "uuid": "59af2565-0488-4eda-b652-1aee1a8a4dc2", "comment": "Malware payload", "value": "0372d04a9536fdeb561a8f848d1eceb8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070703, "uuid": "a14fc290-fd4c-4542-9c68-0fe0ab75a34f", "comment": "Malware payload", "value": "1d5657e571c5f9ef5b220a4881f09f63b44576158a6bd02104d27e123ad947f0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070703, "uuid": "b30e41e3-e728-4d3d-836b-33cfde24d8d7", "comment": "Malware payload", "value": "2c34bd7133092484757d4798d62f463239596acf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070703, "uuid": "d94e6684-dc4b-4130-818e-f8d97daf399b", "comment": "Malware payload", "value": "3cf6e894013cf0934fb3ab8f89fff3bba0f6f49259be87e2bff540912254583c9fa082bb311fb26e62b33430717685e3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783070703, "uuid": "185b22ff-b0e3-4db6-bc25-26f82963a17e", "value": "T1FCB73372D5C19F3EE9065A3A8AB5164E56903D8309010B77CB49F48C2773886B6AFCFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783070703, "uuid": "dde4cf52-83f7-4ecd-aa27-d71dc1dcdc8b", "value": "1572864:F//x9zCC/9Xw7jTVugJMaY5f6pSwoPJl:Rx92Clq0eu5f6pSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783070703, "uuid": "decf1325-63c6-413b-a371-8319cb23867e", "value": 51490816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783070703, "uuid": "bd99c4ec-6637-42f5-9992-b31b7d66ca39", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783070703, "uuid": "1e7d69f2-88ca-4619-b9fe-be5b7c87f483", "value": "exoesbrasil.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f36320-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101290, "uuid": "7c52918f-dcf6-48c2-a836-6cc796c4aa0e", "comment": "Malware payload (AgentTesla)", "value": "db5035441c63496362f6a71624648e34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101290, "uuid": "2b9bfc55-752e-40cf-96fd-68f2b22f2a3f", "comment": "Malware payload (AgentTesla)", "value": "1d5ee8e6b6daa36ca0b4c6e8bb59d58df94a3cae81bd1010be07adf401fcdc78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101290, "uuid": "467f8530-bf45-4266-bea0-388b5c9c9a33", "comment": "Malware payload (AgentTesla)", "value": "4b7d0c3a74fbca2ec0ac2e95b5f6ca5aa089cc43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101290, "uuid": "f44d9363-1806-407a-a521-4b282ef0cb5f", "comment": "Malware payload (AgentTesla)", "value": "d084a92da975987c50611c66bce528294ba7b29b38a777081c074d5ceb695da0badb57134061ce7b2de3b3f0ba22f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101290, "uuid": "770b15dc-44fe-4b2d-8ed9-63082b9a437c", "value": "T171D3380BB5AB8D4793F8793679EBA821CF0321690B63186A0512477FBF05C1E35B279D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101290, "uuid": "400da52a-9b08-4824-988d-56977f774dd7", "value": "768:lv1pLcvEEx3GKOWqbiKOWqJOWqbiKOWqPUaOkcRUaOofWXjwoa+/lJlJlJlJlJlm:pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101290, "uuid": "2605550f-9031-4a8a-a1bf-4b646ef8159f", "value": 136253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101290, "uuid": "0d55faeb-befd-4889-86d3-c75cf89fb73e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101290, "uuid": "5ac63f3c-387c-4f9e-ad2f-c961b9c376ec", "value": "PO_5778.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6667af-76b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783065544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065544, "uuid": "b329b878-d947-4e67-b31f-53cf638fd273", "comment": "Malware payload", "value": "04c1e535bacc25706183f4823b327416", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065544, "uuid": "30b75908-214b-42b7-b958-e42fa7d0dce2", "comment": "Malware payload", "value": "1df1d52b1ba9029fccbbc97dddf615305381c5a5ec938961210ed7a3d94a7a8a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065544, "uuid": "26179c25-20ad-41d9-82fa-6ccc6bcd434e", "comment": "Malware payload", "value": "b8671c2fa61c355b38f645d38793e699a2614bd7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065544, "uuid": "6a8d57b5-cb7e-4a82-822f-0ce61dcf79ec", "comment": "Malware payload", "value": "b6b65fc04b6c26288b17a8ce3cbdbd43da30bb56819ff4a836e16e7364aa0f0a9dbccab9b3bd42150f537f6d1a4d89b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065544, "uuid": "39539f43-d8fd-40d6-9ff8-704aa4772ceb", "value": "T1B026BF4FBA9D07F8C93D91B084149212BBC179068F21EEBB78573C660D7BEA84E35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065544, "uuid": "75f9bbc4-bde7-4e21-945a-76f73ad6a5f8", "value": "52c0d5ce5d7923a876fda0005ddcdf27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065544, "uuid": "cd2c0b02-4a3c-45da-9fdc-0b24e7a2594f", "value": "49152:EfmRAbdXZs0gui36K5nkdluXcFw571Py5g71hpnWwqRO1eOphIpgGwb/XznfV3ud:YlabxjJHtfRX+sP4d9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783065544, "uuid": "1029a835-e721-4cc9-ad86-4577248b805f", "value": 4861440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783065544, "uuid": "21d6fafd-dbf1-4472-ad9c-4772db11d0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065544, "uuid": "ffa4d534-2bde-4722-9246-b807534ec6e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5f94db-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082746, "uuid": "1f094973-996d-4c20-87e9-d96b8b33326a", "comment": "Malware payload (Gafgyt)", "value": "d10c208adc8fa457c574611621f6f500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082746, "uuid": "675d1a7d-e2ae-4284-854c-b8ce31676b57", "comment": "Malware payload (Gafgyt)", "value": "1e7243b3f2b7ed15f022de756fbea855e3b43bca6e1792c9f756951b0e07e108", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082746, "uuid": "2c8bd665-e6f3-4257-bb6c-83e176943653", "comment": "Malware payload (Gafgyt)", "value": "80573f60eec644d53c8895fa4e599f05cad0c545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082746, "uuid": "d8088311-c23d-493c-bef9-a10bed7bafae", "comment": "Malware payload (Gafgyt)", "value": "6ea46c004ed7a884e22272deeb1d25fcf401070904226e3adf0d4ca5d9c27e2b0b8ae70f5182f43b577595fc358e11fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082746, "uuid": "d0d4f23e-6252-4b3a-8a4b-8f2bcb812245", "value": "T13E833C02E743C6B3CC830BB2029BAA665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082746, "uuid": "350b93ef-14ed-432c-a2a3-17c818d50d76", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LmWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yi2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082746, "uuid": "a0ffa2e5-76fc-4ea0-97b2-e9ce1ed3c84b", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082746, "uuid": "27fc743a-aa5d-4bbf-ab19-8c8fb6e52db8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082746, "uuid": "b6a024f6-b232-46b7-9975-b6f203e9a6c9", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba54fed-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082744, "uuid": "10840b7e-4ea1-46f1-ab88-28a248886c0a", "comment": "Malware payload (Gafgyt)", "value": "ccc8ca4ac9ab9bebfb63857dd6b49ae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082744, "uuid": "ed8d3d1a-bc9d-4638-b192-8aac03a3cdeb", "comment": "Malware payload (Gafgyt)", "value": "1ef7533a8b189dce105a718e9c2ad1d54763cefa988daee311777bf779c2ec83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082744, "uuid": "d56ee812-4705-435b-a6ff-f7576ff3c137", "comment": "Malware payload (Gafgyt)", "value": "15c2ff6d4b7ebd0bec1d7593c334913947f992b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082744, "uuid": "ea2642de-9e4c-4173-a3dc-acceb42b9301", "comment": "Malware payload (Gafgyt)", "value": "e3da4cb7f23fd6a26e63af13368f4a5e6a7e1bc7603d3e93b40ada995401dd70ea6babcd4d8c470f9981b63f48a8f91d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082744, "uuid": "8b380e20-c5de-44ca-8c24-6788d485f1e4", "value": "T14BB31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082744, "uuid": "2b0db90e-610d-428c-bbd5-047b5c9729ee", "value": "3072:MSY+46m1qOzssYFPPKNy+AmkZrQAhPDCXFke:06mgOzJYFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082744, "uuid": "6e4e0e58-4cf2-400a-a642-0d7d5470eacb", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082744, "uuid": "8d2ec821-1775-4268-b743-b7c60ade5b3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082744, "uuid": "c0888772-2ef0-4a66-97e1-67bd1e4cd989", "value": "p-p.c-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcb8bc9-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101703, "uuid": "f3086cf0-59ce-4db4-a032-e2bccc9f7f48", "comment": "Malware payload", "value": "d333fa540dae07664fb108a9a527000f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101703, "uuid": "be0e3b99-65d4-4be9-aa34-81ede877f851", "comment": "Malware payload", "value": "1f4aae47630d4419d1f86755ca8e44ccd2297f3d3ee1a69455c4868d0631f6bb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101703, "uuid": "be0f50fa-fd6b-4274-9b61-ad86c77eea22", "comment": "Malware payload", "value": "d3846b568ca8ff3b85cec06809be60490a84c73e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101703, "uuid": "55a6f645-8ece-4731-9adb-0da4cac9a3e5", "comment": "Malware payload", "value": "f5b513bc4188c2734688234b63a9580dc8d5f4bcf05c727cb2b91afd330a16e704189c31a5ff099a18894d0af3546eaa", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101703, "uuid": "0459d9e0-8d4c-479b-b734-ea17c251caa3", "value": "T1AC4423AAADCD5096856163EDEB9A0B806D580CAD83CE17FD6EE3B7F0D2CA0CC45D4354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101703, "uuid": "d2631b3d-2359-433e-bf3c-3d3a1ecbc2b0", "value": "3072:0dnsZB5eIpDaELFGOlT6waGyKqJsdTnM61pcpJL3HoFOs5OfrsjdHnQs2wTC1sqI:JJpDJYOl2lN2MG6RKOD42H1slL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101703, "uuid": "cfefdd80-2ebd-4ad0-9399-ef5831e71f1d", "value": 253613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101703, "uuid": "5a476079-eca7-4323-a647-b785df86ada9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101703, "uuid": "61d20a27-f33e-4bd4-bbf5-9936f40f1f4f", "value": "POD00000917.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58135f04-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101314, "uuid": "63a75597-32c8-4e81-8aa5-2c362b2110eb", "comment": "Malware payload (Formbook)", "value": "48ef1984edf48c272dc583bc592c36ef", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101314, "uuid": "a19523ed-6000-4d03-b3cc-fcba108a76bf", "comment": "Malware payload (Formbook)", "value": "2067fcc97df4f0b345e1b9d283270c3257abdf21b6da0eac20df9363ffb378a9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101314, "uuid": "19a01ce3-1af8-4012-a059-cf1b43eb26da", "comment": "Malware payload (Formbook)", "value": "0b7721f28d2107d4e450e1be742fe01676a4c0aa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101314, "uuid": "923131fb-4905-4050-ad01-7695cfc78957", "comment": "Malware payload (Formbook)", "value": "acbd8b9214aa8587d9b93c582db6234e2dd7ed59423971652e19ee69aeb389237e23972295908903592f731d8b4591cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101314, "uuid": "22a90c3d-499e-498e-95f1-4c60da28a847", "value": "T18DE18E265917B50F7FBD8D3403C6A291E4F7C19A1D17C88321318A73981665E3F8E96B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101314, "uuid": "7f0d54d0-6a72-44f5-9cd5-8e2161cdf267", "value": "192:ttMXkdvckxADtbpigJY+QgFUIF5uPOfuR7OemJ3c89Ge:vrPxAxRnj50OfZemJNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101314, "uuid": "1705e793-1af1-4638-ac9b-39368aaa582d", "value": 6991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101314, "uuid": "19d042f1-d5a4-4a57-8796-1ae3d5825273", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101314, "uuid": "e21ff83a-0a1e-4450-8364-6285c12b8d9f", "value": "ProductsXSpecificationsX-XPO110692.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db13b47e-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783077482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077482, "uuid": "d0cf43d2-67ec-4896-b8ca-6f5880882311", "comment": "Malware payload", "value": "f523c804a6767dea7c8cc058b14961a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077482, "uuid": "4a05ce04-c4e5-421f-8846-1b05da8d1e78", "comment": "Malware payload", "value": "209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077482, "uuid": "e5f0f31b-21fc-4f2f-8233-64a65047f0d4", "comment": "Malware payload", "value": "f86171bdb7d70fd2e89bdcc51e7f6cd3599ea8e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077482, "uuid": "d05bbe93-0fbc-4976-bb23-27af32904ee6", "comment": "Malware payload", "value": "11d25110442121c9cd1e750e5a4357846b70e04ef2fd9704fdb1d41bae3a2b8b726f839d5acff59e57b7178bdc9e1fdf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077482, "uuid": "266014e0-1da9-444b-a46c-f72348d8d17b", "value": "T129319E0AB41234F1BBAED469D35B71521586C0C38075AF9433CCA35A5FEE310B5DB6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077482, "uuid": "404dda08-3c84-482a-909d-d8bfbbf918cf", "value": "48:u9B8xM0qyhZ7iLnjDpIYranhlUc7rs6vlwxsTXSqm8cG8K5f55:u9B8S0dnirvWZhikQI7SgJdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077482, "uuid": "116c782f-6996-4555-be98-4eddc0221ad0", "value": 1602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077482, "uuid": "0b4aeef5-21cf-4595-9877-b7363e92c422", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077482, "uuid": "a2a23353-2ce9-4a0c-8eb4-b5bc5a633442", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3452af03-76b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783067324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067324, "uuid": "62ee446d-fc47-412a-8246-0daa663ec1e6", "comment": "Malware payload", "value": "c917f0be3ab00a62435b37ba868b8d02", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067324, "uuid": "63de08fc-6092-4119-9fbd-f7b8d268d4f3", "comment": "Malware payload", "value": "22302cf76c98f4f9162d39018746c9616ac176138889f3cabaa952807148c7db", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067324, "uuid": "156f3b97-303a-45e8-ab62-50c8e07e83e5", "comment": "Malware payload", "value": "65289d1f134315af21617c9925cbd1cd2f80e4cd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067324, "uuid": "bc8dd072-5dab-481e-878d-72075ccdd9e5", "comment": "Malware payload", "value": "b02f83bb03c5d078b56df0732caf28db5f1f524d2b3487d4985c61c1f449541ce6b360003da2be2067be06cc1ad0c09c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783067324, "uuid": "c61976ce-3e8a-4ef0-9eac-1df1d4d5bd64", "value": "T19F21DFB1A1F12D793B7444983106D13037E97B529B9D8CE2593C5EA23B17680F094F10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783067324, "uuid": "f55c3b5d-1d2f-4faf-a264-4af86407fc84", "value": "24:w1NLHve/Q0Jr+SrNvNSL5lOKp0TGz5lOKp0TGP:wTzc6SuOKp0TGGKp0TGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783067324, "uuid": "0c9665b7-fc1e-4fd0-85ac-625e566dfb83", "value": 1185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783067324, "uuid": "17821d2b-9065-422e-aa96-c3b96eb79cdd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783067324, "uuid": "ecdbf1c7-017d-432a-be3d-e9246dcce596", "value": "rev.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71afdfab-76b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783065279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065279, "uuid": "7ed20fc7-fb91-4cf0-bc11-bc93edf54dba", "comment": "Malware payload (Mirai)", "value": "c19b3eaf53671f568fc2d0d5ddf78d7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065279, "uuid": "bd5141f4-d7dd-4f09-8acb-0f8e7ea3ef47", "comment": "Malware payload (Mirai)", "value": "2470d537fbf8c0aa85309e03f95cf244475a5317d7f0a5d7d00583bcaba20dad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065279, "uuid": "2ae4fdbf-4c06-46f9-aad7-a589aa902443", "comment": "Malware payload (Mirai)", "value": "8369fd84bf083037d0446bc0e6152c0d3b14ea32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065279, "uuid": "764e40b3-04cc-410b-8a67-6ea5d58a9b22", "comment": "Malware payload (Mirai)", "value": "fa57eeb64090dfed641cef7777233aa76bdaae12f047fcc8b6b082cf9170350dc7d0d02e337d1450580a06a65ca2d74b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065279, "uuid": "f7335491-901e-4640-a424-af81c181f069", "value": "T1F314F915BC519E22C9C752BBFB5E438D372A17E8D3EB7202CE166F203A874572D3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065279, "uuid": "1cffdeda-b3d0-445b-90df-8750b94d19fa", "value": "3072:BPGHlP1a7ACCa2nGiOMP0E4GSTBgt3c7oxEr/7mckMqyszj6x:BP6RCl2GTYv4GStgt3ccK/7mUlszI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783065279, "uuid": "e71e06c2-641a-4344-888c-26c7ee6ea814", "value": 196832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783065279, "uuid": "aacf0ffe-0ad8-4d6c-9b72-3d26911e7072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065279, "uuid": "8ed41f79-16c0-43bc-8a92-3724a8ace9f5", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0ea9a3-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783101670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101670, "uuid": "062a8953-b68b-458f-93d6-af76c5a3c144", "comment": "Malware payload (PureLogsStealer)", "value": "7af43e69251cc5218cab301b5f085012", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101670, "uuid": "2cf677f6-2c0a-40e5-b9c3-c69f3220718d", "comment": "Malware payload (PureLogsStealer)", "value": "2478e8fdad997076bed0cb36bd3a523edae4a314e2b1b7c28e867c72a67fe2d1", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101670, "uuid": "1851a208-7998-46c0-9bec-24c8286ddb8a", "comment": "Malware payload (PureLogsStealer)", "value": "fa0e0bc8ea428c22c188c12d189422078afab4be", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101670, "uuid": "1f2323bb-9e6f-4706-94db-a1291ae4012f", "comment": "Malware payload (PureLogsStealer)", "value": "74422a2b742cf1f5f71b94d2e739292a6bfbc9b4a9942bcdbe41551e5be20d7d40d2f864e13f5ad592cc645c87872d47", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101670, "uuid": "eec17cc3-dfe5-4075-b6da-45a5988f47a0", "value": "T155541392EB4444D09EB9D15DBB7725C02B1FF727EEC11EA6E28731A7260B3C464F0A64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101670, "uuid": "882e7e88-b9e8-4f36-b1f8-25a1c8eb128b", "value": "6144:ZRtF6ogOrJaPYhYamCO/BFw3jI4gnIclLjlcKckxXFvRaiNARGpa:ZJb4jLCO5Fw3B2IkKKXXFv4kFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101670, "uuid": "81e62313-29ab-4965-8f34-99d87c86a744", "value": 285025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101670, "uuid": "30c644c0-c009-4c3f-8cc3-634f3b51c1bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101670, "uuid": "526af51f-7827-43f9-9c72-20cba2bdf9aa", "value": "NEWXPOX36732011.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7394521-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783077476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077476, "uuid": "2759c314-7d81-41fb-a7a4-00bc825a7df7", "comment": "Malware payload (Mirai)", "value": "f00cdc68eb2cacaa8113622ef381a46c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077476, "uuid": "4bdf364a-44b2-4af6-bf86-a6232b5725df", "comment": "Malware payload (Mirai)", "value": "24addfb06b221348bd99e72e4977b8656aacbf663baf9dc04da70adc4ccee627", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077476, "uuid": "cc1758ff-abeb-4c78-a916-1af22ddc9436", "comment": "Malware payload (Mirai)", "value": "f7a77937d338fa43646ef963e3f90c766911cea6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077476, "uuid": "52e65192-e25b-4ef9-9039-a95f26c91fd8", "comment": "Malware payload (Mirai)", "value": "7e2a387caafda0be3712b8a924c37df89ad831df73397418f7b349039f97be6c97a52a7bc105d5b4798f7d8fc4308b22", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077476, "uuid": "7ec16454-0762-4614-b41b-771995d64dd0", "value": "T117D35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077476, "uuid": "bd88f39c-4076-49fc-bd5d-4d7fad069e89", "value": "3072:79eSuygEPjt6qkWqVd6mDnYMb0wBd/gQyVGsdqml6Uaj:79eSuygEPjt6qkWq2uH2laUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077476, "uuid": "409aab47-4273-4b0a-9257-fa1259119aad", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077476, "uuid": "fbfb9cde-eba2-4703-a676-4ed1aadf2988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077476, "uuid": "4eed0744-2a6b-4688-870d-e35a90a3808b", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a1fef8-7678-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783039676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783039676, "uuid": "5236971c-3975-4a3d-86c1-28cd752e8d38", "comment": "Malware payload (Gafgyt)", "value": "8dfb4c14c8510f77bb4e04d0407a1330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783039676, "uuid": "125a154a-271b-449e-8626-249cd4366084", "comment": "Malware payload (Gafgyt)", "value": "2759a1bc0be90cca057cbf9a76cd4d7cb50a8c052e4d9896d2c69e7ae11adc8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783039676, "uuid": "cab633a1-abfc-46b5-9f77-9a8eb7888209", "comment": "Malware payload (Gafgyt)", "value": "033744f650d6f7ea32049d145bc8853cdc867b9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783039676, "uuid": "e5765084-0c81-4caa-a153-35e5e4a16b62", "comment": "Malware payload (Gafgyt)", "value": "6e916e7468f95da154fe5390e0d61e5cdd51a1794e9cb37076c0eca37a2147cfcaa2973bf00630078c1f085b7e8c1226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783039676, "uuid": "3dd605a5-7b1e-41fa-ac94-ea76ed9e84ab", "value": "T14EC34B46F792C4B3E1C301335053C7A55771EA32014ACE0BF7087E759D6678A8A6BBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783039676, "uuid": "56a24e8a-f9a5-4c17-94c1-f0bccbe0258d", "value": "3072:baNv2L8VfSL99oIW403a6VQjQDoCTTS7XFHrHlorjXbLf:2Nv2NoD/nDU79rMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783039676, "uuid": "effb427c-8fe7-4109-86bb-7ac26ce09346", "value": 123664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783039676, "uuid": "9937778a-53d2-47f5-82a7-cbd18a8b738a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783039676, "uuid": "64d20ff7-07b7-4354-8b80-06a380fe1a5e", "value": "i686.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e95e71-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101228, "uuid": "7b5f5fbc-3abb-4a86-96cb-dc9eb657d118", "comment": "Malware payload", "value": "2e4fbf9f905d0a2c73cade39ada651f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101228, "uuid": "08b42df8-7836-4b15-9eaf-6e55b48d0d73", "comment": "Malware payload", "value": "2799c8611c11e763c22b41c4ed530c52808d7b4983170fe90b64fee85435131d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101228, "uuid": "a5c85c30-211e-453e-a715-a3dc15b8fb12", "comment": "Malware payload", "value": "7d4d71d7f98abe9c268cea09bb5be962ba8a222e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101228, "uuid": "72ff137f-e3f4-4f69-963c-2d402f835314", "comment": "Malware payload", "value": "479807d6b4cf22342678834035093aabbac4e0ecb5833d1abdb41c24ba31333569c4c9c9c0777cd80e52caa7d4576843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101228, "uuid": "24fe6cd1-0770-4200-bae7-1999baefff11", "value": "T134741225F340A791E7BB0F3A29B5A4309971A177EB2662B74DF061F3635E7F106A0342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101228, "uuid": "b2db913c-b259-4a9a-925b-75935341a0aa", "value": "1536:UP1BAyxtsRKw3RLi2ucZBkoF/mfAcIwF2OjfLG3Fls0R7n8hMfIW74JZbqzVxS7s:UP1BNQzuSmF/K0QIqcDkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101228, "uuid": "0741a5b5-337b-432c-8c22-9bbdf44160d3", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101228, "uuid": "da2471c8-b8d7-4ffb-b9ee-b127dfe08616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101228, "uuid": "cea3cce8-940f-49ee-afe2-a688963087db", "value": "vrdccbank.com_suelarweek.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877c0f06-773a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783122869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122869, "uuid": "108c3a56-f720-4dbb-bb7e-6114ddff5f8f", "comment": "Malware payload", "value": "98006c884a359668964ba2fa91770f35", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122869, "uuid": "96d45131-2a9b-4f9d-b503-b625fa133ca8", "comment": "Malware payload", "value": "27e3c9b676e96ef69a0043ebf547748ac7189207dc2100cc188ea024be596266", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122869, "uuid": "23deefea-b450-4eeb-894d-d30ae267d7c4", "comment": "Malware payload", "value": "e373a6356acc578039a720e6a4ad0d9929424f64", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122869, "uuid": "aa49fdf5-5d29-4cb5-919e-462ffebe707c", "comment": "Malware payload", "value": "a4f9dda404445c86bc4b1862245ba482a138afcaf7e342920fd75ed4b65f20a24bd45be088ad24d8e631dfc77e41c92c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122869, "uuid": "f27fea48-38c2-4fb4-b04b-38333564975a", "value": "T11CD58D0B7DA009E9D4A6933249B751967B75BC588F3233D72E90B3382E72BD08D36794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122869, "uuid": "742cc6a8-6421-490d-92fe-9adbf795feb0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122869, "uuid": "864dff94-d95e-419f-84b4-7fe9ab579e25", "value": "49152:+cCobsiyGNoGCiBNyJzXZ5RNQyjx453xJPgrb:+c65cmzp5Rf4533Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783122869, "uuid": "c4a244d1-6fcb-4421-92cf-4370f84d7b73", "value": 2971488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783122869, "uuid": "a0182e55-7b6d-4ba0-8f8a-b453d9b0cc60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122869, "uuid": "e0aa2c90-f920-4eb4-9ee4-c74ace60463a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e90dfa-76d5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783079463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079463, "uuid": "db1e551f-5b5e-442f-b256-13e77ed634b3", "comment": "Malware payload (ValleyRAT)", "value": "dfa94b0185b88f097d6eb93b215ebd1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079463, "uuid": "a9bccffd-52f1-4e3f-8199-9bdb8bc5934a", "comment": "Malware payload (ValleyRAT)", "value": "27ef8e01f2cc70843dfc973156abacf1f2abf601d3055476084ca8991a2f02c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079463, "uuid": "9b61c4b3-1028-416a-bf58-6e4312da9e3c", "comment": "Malware payload (ValleyRAT)", "value": "b3d8eaa541259bc78a1f11b304e55a3dc06c59a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079463, "uuid": "e8c065ab-325d-4cf7-8a19-8d4d0f0fcc76", "comment": "Malware payload (ValleyRAT)", "value": "ae2ef6b3d455df166b85273f09c3f055299f1fa7a0292fc5ba5278923939b9faf1e0ccca2d2412fae5d2e32104b0dc5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079463, "uuid": "d22ec0a9-05ab-4380-a946-5d51b0e84330", "value": "T186B5AF9573F9074CF2FB963DADB04919E03AFC2ADE32D65F0051318A5D3AA2149A5F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079463, "uuid": "3186f9e7-7fa3-462b-8b39-7985e60d37d6", "value": "1b45d79d9bf15e81b192486371131e04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079463, "uuid": "8a34b08a-1b01-44c2-aa9a-a598bda251dc", "value": "49152:iik/x1UlttWsdojw60IM3SbYETMaw8J2wo30yQ+1Rg1+mole:ezQq0kYbapJtoEylY+Je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783079463, "uuid": "d4dc1100-182b-4921-b61c-4e7edf20d3a9", "value": 2397128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783079463, "uuid": "3cee4fb4-ce5e-4022-837b-f4d7cc4b8b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079463, "uuid": "b18f6c7c-4a3a-4295-9e30-fd96a8c09454", "value": "Quark_X64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2e337b-770a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783102210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102210, "uuid": "4a38e033-a50b-4f33-a3e6-e5bd685ac23b", "comment": "Malware payload", "value": "2e84cbc8ada3fec312bbeb89cdf16899", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102210, "uuid": "0094840f-c445-4ef6-9293-db141aa53c5c", "comment": "Malware payload", "value": "286fc32a88aaae7d0a379231659b31e34b318f7accbb0b95ef04d19fb6664a61", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102210, "uuid": "2af450a8-a999-4351-82fe-2820820f1fe1", "comment": "Malware payload", "value": "4987e49c708da735e65be23c7ec60c2a68110264", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102210, "uuid": "6fd36912-0739-4be8-8873-19671230ee7e", "comment": "Malware payload", "value": "673773b426092453c11797d92bc43a08ad06006f5b2552efa1c0d4a0411011b34078344561af6c13d35530a451252645", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102210, "uuid": "6331b156-2516-47c0-8ced-35cf85fe1225", "value": "T198E501027F40D502D1965E329AB6D7F86731FD4D9A5A834B30E3AE0BBDEA6D35D022C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102210, "uuid": "2cfe3f48-5aa7-4042-af54-8ad77b585d98", "value": "a5ef44db574ab5725b21145405f45cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102210, "uuid": "5d7a1aff-dbb7-4f69-9f83-afd89c2ed2b3", "value": "49152:VqJlwIyNAxOeA8VPmV9jcKpbDS4DCvgBGMYMGi5OtL6eTcoyJPtT9lT+BX06:0DiyOz8Zy9vbDSCCYGx+5O0eSdT+BX06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783102210, "uuid": "65911d9d-2e60-481b-b93b-f0626c24ffb0", "value": 3045032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783102210, "uuid": "debd0dc2-5cc7-4dd5-b4c2-64248d56ee8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102210, "uuid": "fc9c0b9b-6203-4def-bd29-98626f737973", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae20024-770f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783104540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104540, "uuid": "4f6ba500-7873-41ba-91e7-5199923a035b", "comment": "Malware payload", "value": "9f13faa8f36644c4a897bb66c1d8203e", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104540, "uuid": "8507d4eb-4501-435b-918f-e6d7d86d42ab", "comment": "Malware payload", "value": "2a13ab4f0f16e535a4cf4193fb0ed1487ab9fe651cdbaceb3059b8035425dbfb", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104540, "uuid": "faa6b4b7-1d18-4d87-81d8-a4c879ae7cb7", "comment": "Malware payload", "value": "0f9b8710916f470b44c1bb0e4a381539a9d04bdd", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104540, "uuid": "883409b1-324e-45e4-bb6a-7a54b957047e", "comment": "Malware payload", "value": "d56b853d7e08c660b525d30a4a9e650960528cd2a480a587fc5c8aa14a80232121f1bc1807512fc0e7b821067c1532cf", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104540, "uuid": "c4fa4978-718a-49f3-bf9f-779fba0c29b8", "value": "T1F4D59D07BCE009E9D8AA92314CB651967B75BC590F3627D32E90B7782F72BE09C35B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104540, "uuid": "b3b58931-caeb-481e-aaf4-624e489480ae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104540, "uuid": "5e72780e-8e0e-485e-9e5c-bf81f92673d9", "value": "49152:4jt105bE5qsCAIiHtQdxXU847NMO1wsW1jpLgvyy:4j0I84taxXU8472O1kjxiyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783104540, "uuid": "d7f11650-8112-49b7-b9a9-5d8669b90c54", "value": 2967392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783104540, "uuid": "c771fafd-1fbd-409f-93e3-c9e195f3c4c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104540, "uuid": "f612d445-6872-4679-acc4-8edfb853a07c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742fee40-767c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783041232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041232, "uuid": "4846e23c-1b67-4354-9123-7eb9c44b90ed", "comment": "Malware payload (Mirai)", "value": "e342284fd3cd0c877437f3e1eca77d0f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041232, "uuid": "c25b8401-2977-48cc-8b6e-87d20ae51737", "comment": "Malware payload (Mirai)", "value": "2c27b5e45366cc70af89e5f00a6b8adad2cb842e6249f9649119b8afb87905d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041232, "uuid": "dde5a069-464b-4ed3-824a-206f65687e96", "comment": "Malware payload (Mirai)", "value": "4939e5cffa5fd552d888522304363ecf0b97f016", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041232, "uuid": "57914a19-ce48-4cc3-acd9-d529d9db9083", "comment": "Malware payload (Mirai)", "value": "881728e6ce619afa0c8d3f0e80d3dea7f07eaa0bbc29cd3721c0e44b862c0d24ae24748fe486a07e4fce8bc62fe66bc2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041232, "uuid": "acb54d5b-17eb-4967-b8c5-2e8055e96513", "value": "T178019ECF2795A2831A4CCD6CB46BC54C6A41EAC4F4B44D1AF358E8795EE63083056F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041232, "uuid": "db3aa1d3-b9ff-406a-b4eb-b85f7b14e5bd", "value": "24:3J3TQQehuNI7fOKQqqWZIUJs8tBDrKyYHR:FQQeh3fOxqqeIUWiDr1Yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783041232, "uuid": "d69f4f48-714b-4ac9-bb7e-c680f9331013", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783041232, "uuid": "b55fa45f-3e8b-4ceb-b289-cdc4908d27db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041232, "uuid": "357537c2-a9a2-4109-a9bd-683482534110", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8735183d-7704-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783099675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099675, "uuid": "8a000d2a-bc9c-479b-8407-3097ad9b1b16", "comment": "Malware payload", "value": "1bc9a72a39ca6b37300b883fca97eb94", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099675, "uuid": "0975bf2f-b216-4db2-adb9-0949c4a983f3", "comment": "Malware payload", "value": "2cc755a2c9dae64ea5914bd32aa6824a3bc1f0e3be1f2d03c116ffc68f7772d0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099675, "uuid": "3c0d9e7c-98c7-4d36-bedc-b3e18a71b694", "comment": "Malware payload", "value": "457e2b696593fd35cb3279da938748ae5cf33519", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099675, "uuid": "b9427014-7a54-4419-950b-21e76ae2f84e", "comment": "Malware payload", "value": "e350d91a0da93695932a7abb8ff1df9402a213398f72c6482c1915e4ac3a869a398c173b9f93e406d3fb98936f4ccc49", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099675, "uuid": "d955b0c9-b325-4c03-af1c-07d7a28b086e", "value": "T1CA9633D7B2FB2E39C0FE2238B02511173B3A04589B097E85F4543ABC5657C0BAF5A99D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099675, "uuid": "740e85db-34b9-480a-bbce-3deb545b18f6", "value": "196608:DMnTYOVtAktgqK7GRfjYpza2rJ8BZoFFrBx4aIiKXEFxbQ3Uog0PUPHu5dp9ETzN:DMnTY2t3qqKiRfjIv8PoFRkaIl0vAUoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783099675, "uuid": "6b3f8b74-acbd-451d-ace0-1063f5178da0", "value": 9142934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783099675, "uuid": "6bd02217-80be-43ad-8971-816ed5c62607", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099675, "uuid": "e8185c53-b048-4eb8-8332-536729ac0d38", "value": "\u06e6\u06d6\u06eb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316d5510-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101249, "uuid": "4d0a8220-9ac8-4bb9-bb1c-0bd55ea94492", "comment": "Malware payload (Formbook)", "value": "56f499e701fcb0bfc7f6561d06878c83", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101249, "uuid": "1f31b192-d8f5-4989-b78b-937b9a96377f", "comment": "Malware payload (Formbook)", "value": "2da49e36c7fdbed7f0dc6222a78417a487f16db630bd24ae12629e1061c87321", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101249, "uuid": "ebe49a5a-276a-4106-9f8e-51cd2e91be0d", "comment": "Malware payload (Formbook)", "value": "5bba837a43db4af1e990b6291ef05961f3504eba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101249, "uuid": "598b2359-54d4-4f7d-8236-e80287414d7b", "comment": "Malware payload (Formbook)", "value": "3aaa2d92b4752afac2e30d17808d46848d1c40acd31aa00ff9a2cf98109e38a121bd831f657c245041177c5206bb20e4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101249, "uuid": "e1e78b5d-505c-4b72-8d68-a253d1b7de91", "value": "T1B26286E7BBDEC0E751CA5193A417379639387B489DB07F98EB4E8A340217E8A45C2D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101249, "uuid": "2cfe2aa2-c475-4e7d-9b3b-ce3b83e7859b", "value": "48:9qhQUDvgP7j4KX2bNq9vMBmQb7s1ZHQNfS9MOUgZ3VJ4myyNcaiJ1RiiZagGkPEG:gfDvA8KXU+S76iZM283sBeNeagRWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101249, "uuid": "a0dec19f-6192-4737-8227-e224e4274130", "value": 15413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101249, "uuid": "d6f08a7e-de1d-4c84-9215-88cc313a2f09", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101249, "uuid": "5e3a9f98-2ad1-4127-a357-33292f0f0ff2", "value": "ProformaXInvoiceX5628-1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca72460-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101268, "uuid": "a522b311-2eb1-4c3d-88e4-a424cd56bc80", "comment": "Malware payload (RemcosRAT)", "value": "4f4d5b38a53118440bef0bf050162e20", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101268, "uuid": "93e53738-5389-444b-acd5-73f70b2b6809", "comment": "Malware payload (RemcosRAT)", "value": "2df999997d8533f13020269a70d366bd7226c2a48d7119f1f4354b6c4cf93031", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101268, "uuid": "17743fa6-05d7-4907-ade6-f0483023082e", "comment": "Malware payload (RemcosRAT)", "value": "8470dc1136e88104c7c9e30c394d147f1a9b71a8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101268, "uuid": "c29adf9c-db56-4860-8ed2-953984048bd6", "comment": "Malware payload (RemcosRAT)", "value": "1ee5b744e378e03190e5dc68cc955b245b14642bd56a72027c32362c668a6c82f0465ea7f71e74b23dea914f33f42f5c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101268, "uuid": "6987de37-ebb7-47ba-86c7-e766c7ae82a2", "value": "T1BE45336BC040428E175202EE576183B3F62F51EB6E9B6E149326F3765FFE896400F6C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101268, "uuid": "56ecfe45-f604-426a-b9dd-1c67220874b4", "value": "24576:SSDBWetesCb9/w0ACG0LYt/0Ij8cajtIOluBUaNHXE92w:TVZCZ/NAZHeIj8cajtIwaNHXE97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101268, "uuid": "3e9b8b74-795c-4a32-8bb1-b0fe94e9db49", "value": 1231396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101268, "uuid": "71c4f654-e206-4a9a-a80b-2f5d4ac7b6c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101268, "uuid": "440ebcfe-ea97-4c63-b4d5-964510be4bdf", "value": "SwiftXCopyX41,5332XHIKf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f84603f-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101273, "uuid": "1cf91858-2eb7-4c90-a89d-74896d9a3f9d", "comment": "Malware payload (AgentTesla)", "value": "891949ec55cc87885b39e4f31ea599f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101273, "uuid": "27593556-0c7c-4096-9f25-5f883212141e", "comment": "Malware payload (AgentTesla)", "value": "2e674510f4ae196a39f1804730fbab7add5fa3c79e35727c4efa184d813c4245", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101273, "uuid": "42021f43-98f7-474c-b843-b8ba6e240c9e", "comment": "Malware payload (AgentTesla)", "value": "ca46674095e4651959f53b0dd3576adadceabedd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101273, "uuid": "2dd24d02-9ef8-4edb-b691-c27b50e83fa6", "comment": "Malware payload (AgentTesla)", "value": "3d84b7b00552b91de1631d5977efbe2c75ef0809834c6b173cb19a5645abd344da5df041f869ac78ce252f92ca2d40e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101273, "uuid": "c38d9b9b-e651-41c7-901c-bcc49d6174eb", "value": "T15965331C872E616CA474D2B948BAEFE7FE34E622B24E7F40868D397BA01D5446F35D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101273, "uuid": "159fa2b1-4bf5-45a2-a758-58f55a76e593", "value": "24576:jXTUqgAiMNOq6KLTqhWe+Wev8JzhWHgd1LZTr1I7s1ud0N685PNL1WIQoXpBp51a:NgAiSO7WfE7esZf1s0xPNL7LXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101273, "uuid": "a413b65a-1224-42ab-945e-83c33b0a221c", "value": 1423054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101273, "uuid": "5d125942-7e37-4b6f-8e48-34be0d287f2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101273, "uuid": "286d7902-1361-4c79-886d-3d116f2b85ab", "value": "Invoice901.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2e4d96-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101751, "uuid": "d1076cc3-a391-438d-a5a7-d3f2ca440997", "comment": "Malware payload", "value": "6597b409bebf4cced8bcbf62a07118fa", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101751, "uuid": "3ceceeb0-af19-4b7e-9048-33c299af9586", "comment": "Malware payload", "value": "2eef68facffb3462da2ccf1e3a547ad3dc46f803a6865cfede271972706e9ca2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101751, "uuid": "399b3fa4-bb6f-4183-ad74-7877cd645820", "comment": "Malware payload", "value": "e50bfa8007fe5131103d5031aa81fe3c7ab9d22a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101751, "uuid": "a9ea0a33-71f5-488d-b290-04ee496f2886", "comment": "Malware payload", "value": "e03fb84ddd43e1c660c4054a005a100364bb52e06fd85225e98629e9a7b9ecfc7991f147fe9111eac9a5a782896c5169", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101751, "uuid": "55429294-c0a4-48d7-b74b-594d4d89ce46", "value": "T13F92E826DA45AEF4046E3292298F1C27AA510B127674750DF9CED89D3F7E360DBC48F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101751, "uuid": "b7b5b82b-bcb9-4314-ba68-599c4cef2c8f", "value": "384:K5DMk9CuQ9KZNpE3iiFc9XCGHh4KdX07evT4/x7AZ:KRMq84N+yiFGBUyvT4/iZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101751, "uuid": "ed08a683-cbc9-4266-b3bd-5616ae965a19", "value": 20290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101751, "uuid": "5a5052b2-c34d-42cb-b20d-d77db299ca43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101751, "uuid": "223dea9f-be6a-415a-ac03-e9ae07bd1bec", "value": "Purchase_order_4000373697pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee737747-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101566, "uuid": "95966253-03cb-4c50-ab2f-1e5f69758282", "comment": "Malware payload", "value": "c8288b92b7329b51cda048f218ba35b6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101566, "uuid": "1e757dee-9339-4b57-b1c9-77a34abe30ed", "comment": "Malware payload", "value": "300822e28e48fbd0ddb3689fc3a2f55901cd630ef4d1770893a4e8728601f6ac", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101566, "uuid": "999e46b9-af56-415a-93fb-84d2f8c1c7d4", "comment": "Malware payload", "value": "ae82038392f51cc248b3e53b79be6f6f77bf76d0", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101566, "uuid": "2296b2ca-6235-48f9-b25a-a76f922cdcc1", "comment": "Malware payload", "value": "88afa8449090eb10caa98aaf238947fcfcefc222feb3119a0adce3398a58601eba7e3e890b41a1e8b249a0e33dbf2ecc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101566, "uuid": "c78a9a12-c978-4c06-9cd9-e815eaa88ead", "value": "T1C533024DA5F7E8AC385F996653BB03C19647DF378AA862FFE1D64808D60715983800E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101566, "uuid": "56d52478-82e5-4375-984b-722669e91177", "value": "1536:KEL3kdBThOxAVSXSeNELjXS21tyCoJ0IKE:DL3kPhOaJ4ED1gSNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101566, "uuid": "87c5fb6d-bb96-4357-981b-af1f0a17d399", "value": 53668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101566, "uuid": "74304d99-ea2b-4f2a-8d35-a48003ff0936", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101566, "uuid": "1704cf03-acbf-4004-94c6-48cf959ddcfe", "value": "PO-00034009654Q.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef796f7-7700-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783098078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098078, "uuid": "c1349921-1c22-4ef0-b991-9234b1e89804", "comment": "Malware payload (AgentTesla)", "value": "e634daa853d4d5a55ad3ee5d20d336a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098078, "uuid": "a8bf999b-ee61-4982-aec4-0c60cb1dcd96", "comment": "Malware payload (AgentTesla)", "value": "31d293ffa5e55ff2df504ab951b785e902b335974826a9bfbcd4dfb29ab59068", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098078, "uuid": "aec11aff-f4f4-4392-ab27-43b8085880a1", "comment": "Malware payload (AgentTesla)", "value": "8478c8424b0ba031bd8b911e2ecddd344ce65a1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098078, "uuid": "74afaefb-161b-4458-91fa-dc054338c77e", "comment": "Malware payload (AgentTesla)", "value": "bcbfcb9a6c2d0f47e4f799b4c025b8dea13e983cbf35b02b431200c17cce172db57796b90d1755e5f1d4c4d4c29fe6d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098078, "uuid": "62ed836e-88e7-4873-b56b-090f702bb6f4", "value": "T1CF35020423E9CE02D0BB1BB06AB0E27117B42D94E962E34B4EF6BCE77D75B165815393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098078, "uuid": "ae7cc6a0-4004-4b12-9339-035f2d16c298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098078, "uuid": "a2e6bfd9-66b8-4dd8-9163-178f0694af8c", "value": "24576:tsZkYeJaaAsAw3lSwKgxKfld7jS9UMQ5YWE:WZgwMEg8DXGPSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783098078, "uuid": "e027b594-44e4-49ee-81d1-ffcb7edd5028", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783098078, "uuid": "0b46e610-182e-4b58-8222-c68c8c201b6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098078, "uuid": "cc909259-bc79-43b4-8245-94a2d07db6d1", "value": "Productos deseables.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1a06b8c-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101115, "uuid": "c5ab32f4-0201-4742-9f81-0c5ef8241449", "comment": "Malware payload", "value": "ee733ea0bd41966ec86b176ecfc52caa", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101115, "uuid": "64705b40-b464-4ff0-9c08-573abccc5014", "comment": "Malware payload", "value": "31ef377368581ad4d713deb17a3aed8c21eb243d276925d9cf6165c061c53f54", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101115, "uuid": "a05a945c-2e94-469b-9939-be8d06e06b8f", "comment": "Malware payload", "value": "8b31c8b2f59ffb0f230c183b541f337f7163a35c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101115, "uuid": "27938ccf-716a-4ff6-9d19-42a972750b99", "comment": "Malware payload", "value": "92ad1beb4f18481c16d84def60b9a8d6c42efee4c8bd4037e2b7d1d7b6bc901e0ebdd2df7d40a616acff7833da2162fb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101115, "uuid": "ccab878d-20af-4666-bfd9-e4ac4d4800ac", "value": "T1C173E02A32E8C409D592C6769CDCD2D75B68FC179F03A34739C4775E1CB22E0A64372A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101115, "uuid": "bfc28bf6-9b40-4a86-bf10-e5ebd5214433", "value": "1536:XOAACUrZtsY9RNIdr7mv0ALLTJZzuTnTc9ZjE7j:XOAAJrZtsY/N63AfT3uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101115, "uuid": "72575c12-6b22-42c0-8370-fcf66e29ff04", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101115, "uuid": "94aa2056-41b3-493a-9236-6bc1622b0d35", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101115, "uuid": "952fb5c1-21fa-4d9a-81a9-71ddc1cb3cf6", "value": "Solicitud_de_Cotizaci_n.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daffe61e-76ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783062879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062879, "uuid": "678a477b-128d-42de-a07d-59f02b142d8f", "comment": "Malware payload (Mirai)", "value": "a2af8e861612240c6d9840f7942be962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062879, "uuid": "06c6b8c4-22c8-4546-9226-e587ab1f1647", "comment": "Malware payload (Mirai)", "value": "334e740f01b9db15c709c92ca07b32d8a9ad1d68468d8c2796c93eb4da51a8b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062879, "uuid": "fc037c34-72a0-417f-9de5-b9889789a0ee", "comment": "Malware payload (Mirai)", "value": "dbaf371411a876869aa1dfc40ae6b391633c4a68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062879, "uuid": "749fb925-1a67-40be-b986-1f540c008daf", "comment": "Malware payload (Mirai)", "value": "dc23fffa0ae0c1351af00f078622eea7263d4c74a1be6b9738ca46dee4841e58fe660177ccaa511866dc75fb296045a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062879, "uuid": "533c92bb-8e7c-439c-8bd7-280cbbfe09eb", "value": "T168B3D649FD04A72EC6D372FBFB5D03CE362B1BADA7EB31129A305E9133C56915926210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062879, "uuid": "c40b3cd1-d3a3-4193-8af2-f0d739934e35", "value": "1536:cxrR4Nc6nqF0xEFGo1Glx8dgBa92RK3FC2IOPDRmSjO9NQjengeRXxka9B5h9p/X:WrcxO6m2ICkdinlRXB5h9p/sN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783062879, "uuid": "ed3b6e11-b016-4522-8017-2f2a221eaced", "value": 116084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783062879, "uuid": "2058f8d1-d11c-4a98-bdac-0107b9f70c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062879, "uuid": "850d8360-e733-41bc-872d-b5e5f96057a0", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e4791c-76af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783063240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063240, "uuid": "a2193076-3d9d-4860-b7cb-4714d5ad735b", "comment": "Malware payload (Mirai)", "value": "e2a937b54bbf40bcf0aa7b8af537cd9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063240, "uuid": "29555bfd-695e-48ad-9001-bad7ffea4582", "comment": "Malware payload (Mirai)", "value": "33994fc3030bd7f7136d1e7a6ef0bdc38ddfde0166fadcee7832abbf5104b4a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063240, "uuid": "0687c060-0a8a-4b5f-99d9-8ede9671c478", "comment": "Malware payload (Mirai)", "value": "2220d4767814d2a8cad97f0fe485af09d6b32fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063240, "uuid": "71b05a48-9967-4c91-b9b8-bce0ec7eae08", "comment": "Malware payload (Mirai)", "value": "d9f8cabd98ae0dca911666923bb59be1be1d850099edb89039a903de353160235acef4d499d699c099b2fc5a5c99d5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063240, "uuid": "6723e340-cd44-44df-8045-41903e45f89e", "value": "T171143A06B1C099FEC8C5C3788BDEF5359875B18D6226B25B6BC9BB212D4DD207F2D680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063240, "uuid": "96729364-5ce8-48a7-b442-d7aa9b6f5725", "value": "6144:2jOaQMnN7WFVOlPfuxoNZnQwwJh2STKcSW:2tQm3ZnQf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783063240, "uuid": "64a472a2-be22-4aa8-a8d7-080cfb67f7e1", "value": 200616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783063240, "uuid": "9369e60a-6782-4f6f-b28b-fae6fef5a16e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063240, "uuid": "bcf1cfc5-808e-4394-abe9-f46fc311dfe3", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce3b66b-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783101430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101430, "uuid": "314518b6-bd7e-4dab-9869-e2bc1d1aaa7a", "comment": "Malware payload (PureLogsStealer)", "value": "5c64432733549826c22ccd653cfc5241", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101430, "uuid": "c6c5afc3-ca68-4885-a4ec-ff133b31729f", "comment": "Malware payload (PureLogsStealer)", "value": "33ec7a0269d517ba25751bf407391854f49d20f87e161271a049dae728a03a6b", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101430, "uuid": "d8c67af1-1888-42f9-819b-128088ffb1be", "comment": "Malware payload (PureLogsStealer)", "value": "329a52f194206115a550ac645bf81eb93cfec1a1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101430, "uuid": "dd54519c-6db2-4eab-9b9b-473ef5161f59", "comment": "Malware payload (PureLogsStealer)", "value": "4586cd62a8cb2b01e56b9f662a41dc656f386517e25f167f6fe58436ca38fa6be09f7ffe87e5631e48198f7ca465b520", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101430, "uuid": "de0395c3-3580-49c2-9cb1-447e8868116d", "value": "T104A6A28682ECA305EFFF3F32F47901444862BD955C78426CA65C0819AEF9ED8CC75A76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101430, "uuid": "b16406c7-b25e-40c1-86c4-7d982277188e", "value": "768:Y6bItI1dXYam8zEOKpcZTyd2wqyut7y+THKT1JUFjwWTADRh5c6fXfasxHAWeAtG:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101430, "uuid": "7665e363-1b81-4b73-bc13-b046e07d7f65", "value": 9502720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101430, "uuid": "b1d2d82d-aa80-46c2-b4ad-4486c2559972", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101430, "uuid": "17f083b2-7d29-4814-b3db-e3e72398442f", "value": "DE0039-029302-R_IMG0029002.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c80a33d-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101295, "uuid": "e7cc4695-89cb-4e20-bf6d-a5a50137c439", "comment": "Malware payload (RemcosRAT)", "value": "7d23e2de621a22d5103fa287e825ce70", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101295, "uuid": "3f750e19-2c97-4b9a-b852-777370393ca6", "comment": "Malware payload (RemcosRAT)", "value": "3401c2aaca3a00145c37086dbb1b35b4a10347e77a1f492cd30cf626c5ebfcbb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101295, "uuid": "e9dadb1d-7f16-41e9-b5c2-6e6adbea8758", "comment": "Malware payload (RemcosRAT)", "value": "ecba91658b4e4e58691944060bc09b57395ed09a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101295, "uuid": "f77adcfb-b6fd-414c-9eb5-24f97c379a2d", "comment": "Malware payload (RemcosRAT)", "value": "a6dcec47ef18e919cf945db5e6a152e860378a915d5b141136c954f4162e6eb3c0a401a9af80a986a7da4657f741019b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101295, "uuid": "ed1f0ef4-319c-4076-990c-b4332c7c7bf3", "value": "T17C453358D72EF2614CBE15858F8517C836A2AC7D30B44A6447A61FC8BF6344BCDAA733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101295, "uuid": "adf9cfa0-b58c-4037-a1bb-ad472225d427", "value": "24576:/nxqG2k5jb6PpaJzw7wfyfjdsByXp6e4yxv7eRP9kAtH+:5GkB4xHhUde4AGage", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101295, "uuid": "1c7e7f12-f261-4b69-be92-0bd7195ab947", "value": 1235900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101295, "uuid": "ebc4d711-6028-462f-afb9-06f3f75130cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101295, "uuid": "c69218fe-43af-4bbe-94c6-1e4fa9576590", "value": "SwiftXCopyX41,5332XHIKf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152c167-767a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783040502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040502, "uuid": "a2b4f7ce-baea-4eda-8504-28f02b3eb6d0", "comment": "Malware payload", "value": "67bd3c671b8cdc08d5f762955189d211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040502, "uuid": "79da0368-bd6a-438c-a80b-fa6e47244df4", "comment": "Malware payload", "value": "344b34cb507ea23dacfb1ae97a02e50eeeb3934066b64061c14cfce0de0ed60f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040502, "uuid": "17a7a719-41d3-4dd8-ac68-adc62fd9a81a", "comment": "Malware payload", "value": "c03972760df6e184401cc83df5ea6e8e83a88a2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040502, "uuid": "1d00cabc-b7b7-430e-b611-071a85b1437f", "comment": "Malware payload", "value": "904cf84c4b0471892a6d083a45b13f7b051c0232f0335ef1609126132a7c232f84d322496f5e0cc573ea4ce47fa9d4c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040502, "uuid": "b519796f-6461-4748-8ba4-a4d7e7308cf1", "value": "T1A307AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040502, "uuid": "5010e8a4-f6b9-479f-a5a1-77bcc61a2cca", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQS:cqYUQuVDt0TZEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783040502, "uuid": "36800192-797a-4373-b117-654f3cf65aad", "value": 18382848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783040502, "uuid": "23a9d00b-c340-49e1-ba22-a2c078d7b1d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040502, "uuid": "4b785477-3bc6-4057-ab73-cf8c1050937f", "value": "344b34cb507ea23dacfb1ae97a02e50eeeb3934066b64061c14cfce0de0ed60f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7305ddc4-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101359, "uuid": "370a67c3-d8fb-47b4-b0bf-ff189ecb66c1", "comment": "Malware payload", "value": "68270104b3d488fb8a9ea4587237f949", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101359, "uuid": "128fc5e3-e17e-4376-bdda-a23d830a7cd5", "comment": "Malware payload", "value": "35f74da6c49611a7b894568d02b19640d9c9a4a74bad291f5f52bdd7c7198f81", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101359, "uuid": "a09726bd-c597-4db7-affb-4d8e04dd5f07", "comment": "Malware payload", "value": "4d1e39079f45847321ae7d63fb918af8371a9cb8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101359, "uuid": "74e9b1a9-6dac-4f75-9df0-1a7dfe41a8a3", "comment": "Malware payload", "value": "5faeeca8cec9a7142ce6fa4b927eae4848ed91614f2a8187741513ae9eed9f9b23120a67714768191eecaff94734ca40", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101359, "uuid": "925ef969-1522-4997-a6ae-04707afb313f", "value": "T1CCE6DFF3CC579746A01F562E9531826287226F903C2D7247D192BCDCBC9CD3A44AAB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101359, "uuid": "ca5996d0-3374-4c77-9649-89eb763116c9", "value": "1536:dR1NOw+vF+X+YkqvtSsmDHaIF9y1ycd6O88HBidkRizUJSfIyN66exAKlWl2ks5L:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101359, "uuid": "1a05e4dd-3ec5-4e06-ac6d-a4f801d9bc39", "value": 14944780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101359, "uuid": "b6da0838-57e8-44f9-9925-c6a3e83c6289", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101359, "uuid": "37f168c0-72e1-4034-81ce-60b06bbaed9a", "value": "DE099303-R00390-CH_Rechung_R-03003.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0507b207-7703-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783099027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099027, "uuid": "e905d10d-c8e7-4dcf-855a-333cdc148add", "comment": "Malware payload", "value": "3bb0e65e16ce410dd5e81c85780eaa00", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099027, "uuid": "d726823e-52aa-4c07-973c-258d9b45acaa", "comment": "Malware payload", "value": "399f5bddd1e30bb612522c9c770e073f5e304165df170c4668550de34f34f7c1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099027, "uuid": "13c9ed37-4696-48ae-b4a9-22cb41a31dd5", "comment": "Malware payload", "value": "d6bfe22dac35255f9b6f1975f4867aaf761b89d9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099027, "uuid": "2bef7f3e-8cb2-4e9c-81ab-fe317330e681", "comment": "Malware payload", "value": "45052cf2a73b877ce1d01b3136231f2cabcee8a424464822376066c9555fd6cf78824be870c9b28ecc5fdec1e5392b26", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099027, "uuid": "64ac62c9-f512-431f-8fb8-73a9f7b2d0e9", "value": "T1DE66F141F7D8956AC4BFC1365366033523874D168A82EAD3AD0DFB6C3CFB4911E8A6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099027, "uuid": "05033737-cee1-401b-80f8-f191f39a89b2", "value": "98304:upOub+/zsIsiiatsbb4cRD2wBo+O+n0Esr4q8RWWteJYBDE2kqsJfI2vNGITEm:kxyRcRD2WPVNvROYBQ2kqsJfJv4zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783099027, "uuid": "da7e80dc-19fb-4d9c-87e2-12d22cd20710", "value": 7034730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783099027, "uuid": "8015bffa-4f47-43cc-a4b6-432a4911e6e3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099027, "uuid": "f8ab8d61-5f0e-4eb6-93df-63bb60487c55", "value": "s_1773322694518.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12cf0ee0-7724-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783113224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113224, "uuid": "7abc8c60-0e0a-44e4-8a2d-41e56cfe0c7e", "comment": "Malware payload", "value": "f8ddfddc6469d2619e784bf88adfbd29", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113224, "uuid": "58d81884-161a-44fa-8718-07272d89331f", "comment": "Malware payload", "value": "3a03b35a4c614d651954f8298d5bb75abe33223e0791bdc1b9bdb2af69d3009b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113224, "uuid": "44ac9641-e99d-4b9a-8705-344ed9faae3d", "comment": "Malware payload", "value": "bba517b3bfbcf28a6e0de7c6b002b5b7aa70c6c2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113224, "uuid": "a1ad1f99-bd1e-4574-b2e9-26d9f0b3f7e4", "comment": "Malware payload", "value": "2eef90909d38195034702a0894a8061d67d93538f3839d6911c59d59d21dda249b28f0215cb1cbb67468286b089d2621", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113224, "uuid": "595ff2c2-7293-4129-b20f-12b7846d7f19", "value": "T15F562281FF46D82EC0B7443B1A860331665ADE1EC697A34795EC361C5C7BAC84FE8AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113224, "uuid": "613818f8-12be-4749-9f1c-feba6b3536a6", "value": "98304:IsatFB3It8ABAdhkMb88zkrkRQZx0MOMvG5aXke9U3HbaLGQ0wM:IhP3q8AB0mMwkkwRKx0HaUe927wVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783113224, "uuid": "20e3a72e-e0a7-4854-9e59-b5f84b77e899", "value": 5942604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783113224, "uuid": "f117dbf5-3a3b-48e1-a8ac-fce42e422a86", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113224, "uuid": "f9230064-c856-4fde-bc68-d9e8c3fc53ff", "value": "T\u2c93\u2c95T\u2c9f\u2c95\u2ca3\u2c85\u2c93\u2c83\u2c81\u2ca7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ef129c-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783077472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077472, "uuid": "61ce4a71-d6c7-4fef-a324-816fa047025d", "comment": "Malware payload (Gafgyt)", "value": "40c0d610792cb03b8dcbda5395fc87d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077472, "uuid": "e66da46c-1d9f-4144-88de-ecc8a88a8e32", "comment": "Malware payload (Gafgyt)", "value": "3a93967ea364b1efaf1c20d04071ae5a2fcb66fc453259851d2f85544506e246", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077472, "uuid": "b2bdeb2b-51a8-4800-a85e-e31f61ced52c", "comment": "Malware payload (Gafgyt)", "value": "950554588813a8fd150ed0f2197681d1ce07165c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077472, "uuid": "921126c5-120d-44b8-8586-353f7236a841", "comment": "Malware payload (Gafgyt)", "value": "6cbc953f77c0cb721b2c5e00bfba6b440ce26ef2a08d7717095ce13e039d9a040d9d5f6f7ad343347857202f7b9131d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077472, "uuid": "91708991-afe3-4259-a780-3949ca1d529e", "value": "T197A13FE770319139A4468D2072BC90D16EBAA49AECC09ECE70526E146D7FCC47F36A73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077472, "uuid": "9ce89dd1-7cc4-4987-95fb-706445badb1f", "value": "48:JH56NgMqqfVFisPUBckaryaC1d3sJmKB1Os13WxHs1Cy183yml1MBAne1V4i1rYO:JH589nj0cRmZpUBNcTAOs9oQXck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077472, "uuid": "801b0eec-8d59-4010-b7a5-6ed2acc6c30b", "value": 4722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077472, "uuid": "830db7af-0df1-4744-b43d-1472b2e07818", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077472, "uuid": "51cac219-43b7-4961-ab7e-a37e61eb1617", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294ca8bd-7719-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783108537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108537, "uuid": "8c6b2652-1982-43f3-a231-30425dc55fd2", "comment": "Malware payload", "value": "3c927201d6fd149f0a03bab69d93571d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108537, "uuid": "6be97093-f704-4291-9948-61175379ccb1", "comment": "Malware payload", "value": "3aa68046fedf7a769161be75092ac65d7b9c7c20ea3b6fc2a0cc3547c783add2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108537, "uuid": "97e46f8f-3329-485d-b4cc-a5a0d8711855", "comment": "Malware payload", "value": "52b03e1918f67c69f851e46c2a31920d6245ba09", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108537, "uuid": "df10178f-9b34-4924-b88d-b84d9c8f34be", "comment": "Malware payload", "value": "564040f29cc3b983f4dfe9835f24571b09fa46ee7ec9ad2d7be6c16b1ccb884ce6724cec95bbca3981e554d7df65cd8e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108537, "uuid": "750e2f05-129e-4b71-966f-991e309aed43", "value": "T1B272C1801F070DF6EF6EEEB7B38DA1527B0CAB9A4141C1B526057A8C4FAAB55178C631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108537, "uuid": "63e742ee-c863-4793-9097-5db48437a865", "value": "384:4c3dMawOeDQEcIqxcyOu7uNnee5jhzQDpaTkEYJ/N4y5:4c3dHDUvKaa4ee5dkDATg15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783108537, "uuid": "3ed5b2ff-bf3d-48f4-8c6a-e85cf27f85a3", "value": 16192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783108537, "uuid": "9599be90-17a4-4a60-901d-94450ace520e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108537, "uuid": "c7a67671-1f17-4762-9611-97ec7f4bdd0e", "value": "photo-220665512.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd39b6c4-7732-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783119630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119630, "uuid": "5051d5e3-30ef-470d-8ac1-af95097ae980", "comment": "Malware payload", "value": "8f2cd1586b4ba7ea752f1565ec40054b", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119630, "uuid": "39265e28-f9b1-481a-bc82-50b2e9319c5e", "comment": "Malware payload", "value": "3c279bc94d37eeaf2b81f78820ada90c8e40814e45818c7c5666ea8c49688d67", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119630, "uuid": "f40aafe3-54c0-4ce4-b049-c3c8b060d8a9", "comment": "Malware payload", "value": "227d392fd7934a429b2485a3381328e318215e85", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119630, "uuid": "21dee160-5878-4195-8d89-d2defb4cf474", "comment": "Malware payload", "value": "d96deed2893bf78216e17f258e10c2b2f7d7f0d358fa92e396c20b0967b0b11a91ab638f601da47edd881fbe68ddc79b", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119630, "uuid": "86c84388-d936-4db0-99d8-277f561c6a2e", "value": "T1A0C59D03E7A580EDD49AC138C71A8227FB72B88A1730B6DB57D48A253F67BA15F1D305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119630, "uuid": "2580d788-0db4-4baa-8418-27eb57bf6eb5", "value": "0743036683f1e0b2d10d2e3d2a175580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119630, "uuid": "0be5c0ab-6825-4656-8f48-5ebd2ff08f92", "value": "49152:jFOAJFd5i4E/SXawspQ9PkhDlvfHOokeIf3qC:jFOai4EC/iOSqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783119630, "uuid": "c40aed9a-4baa-44d0-bb50-1317af27dd83", "value": 2743296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783119630, "uuid": "1857dc35-d173-4789-b324-1496bc897745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119630, "uuid": "06ed5bfb-ddf7-487e-b046-798cc4406979", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9673e6d-76a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783057669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057669, "uuid": "2a5534db-2295-4056-8091-5d5450d4ee4b", "comment": "Malware payload", "value": "86687f748a72287ac9118313c2089c85", "object_relation": "md5", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057669, "uuid": "55262f50-3495-4816-8e9e-c8c36435ba53", "comment": "Malware payload", "value": "3c6891114e5b9a46b20712084c45a67089e55f7b281b711442daa8b58e407945", "object_relation": "sha256", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057669, "uuid": "9df88065-1f66-46d4-98f6-43eeb736fd89", "comment": "Malware payload", "value": "c65f6353f7f0ca3c302106061d2a9d1b63074d1d", "object_relation": "sha1", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057669, "uuid": "236c7b78-58dd-4a46-9319-9d75598e33c4", "comment": "Malware payload", "value": "b5cedb5a0e76c7dd1cd1490c6c24b882508696514cfe72162c6f991c5d63cb6dd0cf3ac79c96b06c1b9348879e6783b4", "object_relation": "sha3-384", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057669, "uuid": "455d5e37-df04-423f-9223-fcd964f0940b", "value": "T1DB011E5B511678F1DC7672785C8E7BDE345580A8BA54F4A6CEAC23D74E024E803C28C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057669, "uuid": "e4dd6680-c8a1-41e3-b7ac-fb0f7c47fea7", "value": "12:5jMMUy3YzO3ZUIiG7Z7u9YyOLipxbTfvFurnGWwPsi3vjF1Wu5/QnOHPbwQYuIfH:9MMjV3CfGgmLipBrQngvTXq8vOOMvwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057669, "uuid": "cdc24b18-c0f0-481d-bd64-37dd8254d4da", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057669, "uuid": "50f33385-07fc-4332-a29c-b18cf51df481", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057669, "uuid": "d5687b6e-297a-476b-9bd2-e1f32089d674", "value": "photos-88456224889.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb7b203-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101354, "uuid": "d4e8c846-0217-4dad-855d-131bfdf20095", "comment": "Malware payload", "value": "910f132f5f460b604a8a9b92df5d8773", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101354, "uuid": "2c55dc45-f221-4f33-a706-51cf4915d9c9", "comment": "Malware payload", "value": "3c8baeaf226a760a287d707273a2dcb3d6ff547130480635e232629f6bfda555", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101354, "uuid": "4f95914c-28a6-468c-913a-cabbd412cae0", "comment": "Malware payload", "value": "bbb96213da8ae0e2ce7dfec8236b8dc760aee583", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101354, "uuid": "91c4bcf5-4be7-4d05-9570-3506f3caa104", "comment": "Malware payload", "value": "8cfc54d7c129dff4d25c8a3d460ed1de1991edda1ceacf058c4683375e6f05edbd4abf2f941ad274322fe3204ef0acc2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101354, "uuid": "e6cd5cbb-e50f-4e1f-83c3-f97db6a531a6", "value": "T18CC422E58FA54A7BD680CBBA22E13356528D01C9D38D34E8FD617667F34E37602B3984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101354, "uuid": "58f9ac1a-7147-48d1-b2be-7cbb2c4de6ca", "value": "12288:auv51wYd+F8ErfYoPoegm7hxnvIgDYdrrIscoBjJQDzthmtMU:J3gHrfseg+RAgo7RJQlhmOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101354, "uuid": "a3fbe8ef-2763-42e4-83dd-72d58eae16ed", "value": 548852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101354, "uuid": "459225d1-ae62-41fc-816b-47bde1d84e72", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101354, "uuid": "791f34fd-f2d9-40e9-ba00-bba6484f500d", "value": "RE-LUMRCZ_Rechnung_vom_18.06.2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf5a635-76f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783092541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783092541, "uuid": "b0d60944-2942-4c72-8a94-b4c31aa0abe6", "comment": "Malware payload", "value": "93098ea2dd98e6bb37beb7fe08cfde20", "object_relation": "md5", "Tag": [ { "name": "airashi", "colour": "#1A97B1", "exportable": true, "hide_tag": false }, { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783092541, "uuid": "e417b425-b71a-41f2-9d7b-4de5b75a1c2a", "comment": "Malware payload", "value": "3cc142e97d6ad3f518a6f496de11c8120cb7a32905abcf11f88afee7b896a152", "object_relation": "sha256", "Tag": [ { "name": "airashi", "colour": "#1A97B1", "exportable": true, "hide_tag": false }, { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783092541, "uuid": "781329a5-e90f-4151-960b-45c01d536259", "comment": "Malware payload", "value": "363cd53324c413ed9a9814902078657994967ae1", "object_relation": "sha1", "Tag": [ { "name": "airashi", "colour": "#1A97B1", "exportable": true, "hide_tag": false }, { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783092541, "uuid": "79ec4af2-3c04-439e-bf7c-beca4f2b66c5", "comment": "Malware payload", "value": "ee173c6745e11a040fa35477302e1a281dc88979bda7a185ee86da4ef1414802f7795e955176173f17de578bf879b4c4", "object_relation": "sha3-384", "Tag": [ { "name": "airashi", "colour": "#1A97B1", "exportable": true, "hide_tag": false }, { "name": "aisuru", "colour": "#B49DAD", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783092541, "uuid": "c842d21c-2879-4dbc-872a-3d4ec97b021f", "value": "T1F7954A22E8409B52C6D0A67AF76DC28C330317B9C2DF7106DD144B7467EB99B0E7A687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783092541, "uuid": "dfdebd43-3c32-429d-be9c-3ba92a99e7d4", "value": "24576:l1O99XdQ9PGVfFBfkQUr0+hxsDPvK7RtKZAQq7TKFAyIFMnj9bhU:l1mN8LRRtKZUaAymIbhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783092541, "uuid": "9e9e4104-24ed-4a4f-8fe0-786c40f860e3", "value": 1984984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783092541, "uuid": "4ea04f6c-0f3d-4e7f-a259-84a3c3c98bed", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783092541, "uuid": "f7a31221-d691-4fb7-8569-327f0db692ba", "value": ".n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2a3339-7687-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783045837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045837, "uuid": "6a4ffb9b-7d76-4606-ba71-3fa19c4ee932", "comment": "Malware payload (CoinMiner)", "value": "3dcad3fff390dcb7acbb7a379e3cdbcf", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045837, "uuid": "c86307bc-87a3-4b19-aead-5557bcc3814f", "comment": "Malware payload (CoinMiner)", "value": "3d4d751665fc9f5247f34d7c3db5381d83c55cd1d49311b3570f2c002b36cb1e", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045837, "uuid": "269de2d6-0e3d-4812-9489-4e4c92ac5ac3", "comment": "Malware payload (CoinMiner)", "value": "39d84147173f4274b80a3a730d1ccf12ee91fdbc", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045837, "uuid": "0c6206bd-d8c8-4f56-a825-6f2d9b38ddde", "comment": "Malware payload (CoinMiner)", "value": "4b12517f994ac27c73190d51d34ac29ed048063c32105afe77fed3c5a8c0e3e38f686c2919b202e85e7fe70bddd93f03", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045837, "uuid": "44519f5a-49f2-43d6-a624-22dc315ee0b2", "value": "T19F76D013D5E68EF4C11BEABD8A625332AA14748C5E32B12C25E5F3665FF0E34A15DB30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045837, "uuid": "36e3479c-d1fa-41cd-add3-79b28c87bcc0", "value": "efac5a148b2811065a6dd0ccd3f84052", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045837, "uuid": "3f334e4d-3797-4802-89f6-0cc8316ea426", "value": "196608:A3FsbYYpSTgKKOxaSZoYvBvqmgmInErzvD:LYYpSTgKKOxaSZoGvSmInErzvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783045837, "uuid": "d200148d-5a2d-4b06-8cc5-4e0c569fdedd", "value": 7372288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783045837, "uuid": "0682dcae-6437-4382-9f69-8ba6954f1b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045837, "uuid": "21b0bf17-dda4-4dd3-b002-30abaca9fdea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b154ef-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101256, "uuid": "75ba746a-eed9-456a-826b-0f0174858a3a", "comment": "Malware payload (Formbook)", "value": "20112908bc6ae179949343f72b27a55f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101256, "uuid": "53e9ce03-37db-4217-99e2-89970b28da1a", "comment": "Malware payload (Formbook)", "value": "3d6bae246cd5b26065ebc3259bc955c5be5410e0313a9ae5c31fbe680bbb6798", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101256, "uuid": "1ab89a2b-c7d5-4e86-9419-c9d421215ae3", "comment": "Malware payload (Formbook)", "value": "62ff201f0f1dd265a33b9793a980fdc067fa2670", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101256, "uuid": "17dfaee8-5a60-4485-8f4d-ceaac15b41e9", "comment": "Malware payload (Formbook)", "value": "9f60a6424a4bfb11138df5a6c25835b6e8cd2f012253723ef03d7d3d292465b3701f6ca372fb0f51f4aa75f58fa1e5ee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101256, "uuid": "bba7f1b3-492e-433a-9501-0b48dd12fc24", "value": "T1481533C402A97A7B9E56344EF603FDE9F5543B895A5C936E34D23E96CCB539340C430A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101256, "uuid": "23718a89-8445-4502-b4b0-3f138ef9c532", "value": "24576:pHARdacQUrf0iTTTaa/qV0F+EQbcQENAY1MJ5Nri:pHARdacQUb0iN/qKqbpENAY1MJ5NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101256, "uuid": "7cd7e955-86e8-4c70-a5b7-9a28fe92ac05", "value": 957459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101256, "uuid": "c68c14f3-9fd4-4149-aa38-9ebd4afffc36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101256, "uuid": "021f4124-dc67-4000-825b-732259ae7f16", "value": "JJCSHKRY600_NOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a709779-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101640, "uuid": "0dadcf02-9a9b-42dc-bdf7-effac862cef7", "comment": "Malware payload", "value": "f26679054e31880e50beb99b4c015a6b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101640, "uuid": "4e1eee86-31a4-4ea8-a677-1ad99158f622", "comment": "Malware payload", "value": "3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101640, "uuid": "7745283e-e7f1-4aa3-ab65-ce2ef71c8b52", "comment": "Malware payload", "value": "397442d41bb52da2502482bf5bd037ae3c6aaf41", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101640, "uuid": "21b1ff27-4b2a-4330-aae6-ff5a25e88d34", "comment": "Malware payload", "value": "3c9f6bc8a00bea7286d4e9aad4b562c8799ed14e1f4db9b37fda217a8aa4bffb3de948c9761060adc507963f092e6c37", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101640, "uuid": "bdbd5c25-bd5e-47dd-9643-b5f9b5d19f6a", "value": "T16244234BBE09C7FC8AD7C0107755ACE7024FC2855286989BF39E1481A6FE74A967CB70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101640, "uuid": "49cd0cf2-5a37-4d50-9473-7cc40d32aa73", "value": "6144:cvvYNQIJmCnvsz/eNhsbeAcSOFS6TFGZBZJGrVbriE5OoynNhLz:cvqQIXn0yN2mSAszurVrEoyn3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101640, "uuid": "fb2baa81-6bb5-4e83-a114-c8792371bf53", "value": 269765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101640, "uuid": "45d6d14a-a76e-40f5-9de6-d73bd5945477", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101640, "uuid": "c0e8e908-be0a-4393-b090-e550cdb9cdb2", "value": "PurchaseXOrderXQuote_Confirmation_November04-2025_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6667cfc-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783077474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077474, "uuid": "5be2fd79-9d3a-40c9-bcde-ba8ab8708d0e", "comment": "Malware payload", "value": "5ceea8862c93e9db4bbac11423ce0717", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077474, "uuid": "fb187044-820f-4369-9f26-06dc44cf9638", "comment": "Malware payload", "value": "4025796683b0bc12a6ef01a2b48b33afc384255951b78486eb762058b9480284", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077474, "uuid": "4f10a9da-339a-433a-976d-635a9cc084a4", "comment": "Malware payload", "value": "5df8ff8a4e6af944390741ffe1644d0464a6b471", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077474, "uuid": "babfc48f-7aba-4855-b070-8d0674fa8a9f", "comment": "Malware payload", "value": "425d6b5d766d048dabd5dfc55d1e437edf628822cc8de3d3bc5f712156d6e3fc1e54b7a0abf9dfc880bae6599549a0a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077474, "uuid": "50177a2a-f26a-4fbf-a85f-cce4e92fec13", "value": "T16B915C6BDBD25E37D69526B3C5034EE67CFFCA34ED0C3202D09139488BA2954945A689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077474, "uuid": "61088ef1-d51c-4c37-9e0b-d9acb0874bc9", "value": "96:9r+CWUN22TjW1VtAS7+jnPq4whEZQtFoTOsV+Nc+FKQ7Ah2K30:0JUo2TjiSlZwhEeoCg+8J/30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077474, "uuid": "579be110-73b1-4e5e-bfce-4fabf0bd9963", "value": 4284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077474, "uuid": "0077e370-c583-4398-808a-02815461834a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077474, "uuid": "bcc42fbd-93f4-4b63-909e-c0140689868e", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d69788-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101814, "uuid": "30d54840-742a-48ab-a4e4-fc935651081f", "comment": "Malware payload", "value": "e0fac6a909ae0e56137aafe35b246fd9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101814, "uuid": "7a19591f-779e-4e13-8884-1ea8efcd02ff", "comment": "Malware payload", "value": "404db5e6bd73b2284fa19734a8335242c20c102321a54478887b939e96152f03", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101814, "uuid": "cb8e8386-16fb-4c63-81b7-e83442b3a00f", "comment": "Malware payload", "value": "ad939429f6116d34569ebecb8cf84793fdc72cac", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101814, "uuid": "3b0512d7-6b8e-4d5c-b90e-51339e13e0cf", "comment": "Malware payload", "value": "744df189fe00055bae762e0d85a45058bf6a923c43d577e325e8b98f47ba0a039a6821ea03af10be647f7bc82caeef51", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101814, "uuid": "4a7e8419-ec0f-4744-a2e8-31f797a8955e", "value": "T1F103F2BDF1EB57F946AE24890F1A2B05063A3D5603AFE43A301B0EF870ED55BD98C512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101814, "uuid": "9aa5d09f-d42d-4dec-8982-824ad03383a2", "value": "768:IchrF4XkskuzEAzeCACPFSbFiDQ27ogQwjRONxnQqU2BaSCDjb+qsl+QwxTEj:IchrF4XuYTiCxN+FEzMgQwVEOqU2BaJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101814, "uuid": "03bd09e3-e656-44b6-9e5a-9512bbdec8c2", "value": 38736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101814, "uuid": "1af91576-0d41-441e-b64c-50ad001d974c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101814, "uuid": "d7525ea8-56ac-46bb-bea2-7759bbe3a904", "value": "RFQ_EMS-PFC-2026009530.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dddfeb2-767c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783041114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041114, "uuid": "a76fd249-1500-46b5-bea6-69319cdbaa6b", "comment": "Malware payload (Gafgyt)", "value": "d0466c3b5cb3f9a2bc40506582f7b6ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041114, "uuid": "c19d3328-232d-4336-b813-ef728f9a34c5", "comment": "Malware payload (Gafgyt)", "value": "40fd96e5c870ccefd680bf559b7f72e7e994e3ccb4d0cb5d68836db41180bf64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041114, "uuid": "89f88cd0-0f15-4630-a01f-c422602f4746", "comment": "Malware payload (Gafgyt)", "value": "2c60ea7298c62fda2037e65f95c8e41bc3938c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041114, "uuid": "8c4dbd39-e1dc-4daf-bd34-edd19eb2d180", "comment": "Malware payload (Gafgyt)", "value": "24a891f574bd0b3a124bb8ec4be576cf12570962c29035bd4b359e0c31eb803258a6761b75d6ba61d5547d2000280b3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041114, "uuid": "507e4666-e5f2-4030-a413-a38fd1130825", "value": "T1EEC36C92BB197E3FD176893AC48783057B38AD409E462613902D76576EB32D01E3B7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041114, "uuid": "d4bdda8e-cbb6-4870-9f45-39dd31ab11b8", "value": "1536:V+WZ485cfj57Acp3dsM4SzW3oims27oCvB6n0UMaGjQrRQrYso1wwBWh6m1aLnNg:V+WZ3UiM4SzKKR7JvFwvoY/1BbmoH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783041114, "uuid": "5863d2bf-415c-4664-8003-b49abd380ef1", "value": 125080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783041114, "uuid": "019d4791-4493-449d-a0ac-8c9726debdaa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041114, "uuid": "a331b983-94fc-40df-a42e-2cee1ca04032", "value": "m68k.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97549d4e-76a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783057182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057182, "uuid": "b18219cf-1cb1-4113-b6e7-57fcd454f97b", "comment": "Malware payload (Mirai)", "value": "7f23440dc2661081a7b8ca7a7758ddef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057182, "uuid": "0a738662-36da-4107-9077-e4a547ebc35c", "comment": "Malware payload (Mirai)", "value": "4169382903429aeff24b14eb04a4dcada79f63e08044d9e1f28af10dab81bcfb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057182, "uuid": "befede21-6f91-41b5-b492-8a62792bc101", "comment": "Malware payload (Mirai)", "value": "43bc0991486188992f3fa04f58cecb1baf04e37f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057182, "uuid": "b992e530-7b1b-4224-a55b-ddf6dcf844a8", "comment": "Malware payload (Mirai)", "value": "6781cee8e8aea9f6f561e23215f0ece369b38f6faee5c98d8f7d715e5fc783e364bcc0c643a20aef427dfd3381cda9e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057182, "uuid": "495e281c-8abe-45dd-995d-3a4a40315fcf", "value": "T18B145A02771C0A17D2A31FF42A3F2BE093AF95E121E5F6446A4FAA459172D323459ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057182, "uuid": "5b7c2ca9-e8f9-499e-8ba1-2ead993b2989", "value": "3072:XRUw9DrCKRVx0D63TwuAPh2B4ckMqysI+A0V:BUw9DeKRVxI63Tw1hJUlsI5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057182, "uuid": "1d6874e7-e7fe-43ce-b3b5-558ad0545fec", "value": 197208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057182, "uuid": "40b4a972-ba8b-4830-845a-03e0700c6160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057182, "uuid": "07dc7e06-b9b6-43b0-bb14-cce1e9d54a18", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6430d5-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101701, "uuid": "3991a534-e82e-4ea1-9067-95b7d2d9ef8c", "comment": "Malware payload", "value": "c5aa116f5515e660b53ff4bc50f4b4f1", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101701, "uuid": "58480ffc-2a9b-4c2a-8993-983233070a6b", "comment": "Malware payload", "value": "41b48f4d9714d0341dac4d33baca3c2c8e6ccb0f255f1a07f82f0c35162067f4", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101701, "uuid": "b951ebf4-e2a8-47d2-8860-9a3959e08810", "comment": "Malware payload", "value": "1bdbd8ca44f9ca79dc2316291c37b21cc09f0c9e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101701, "uuid": "ae78ca64-6c11-4802-9472-80ce5154b4d0", "comment": "Malware payload", "value": "4994c9cf79ef636eb53f60d3fa2220babb82c51e423fb1dd0806cd1f5fff3986f95a3cf02d0da4b5d8cb4ce762cdd506", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101701, "uuid": "b91a196f-33eb-4764-aa30-3e8bbcd3fbea", "value": "T1CAE4F14A75A9D98AC3BA57F15FC2C0D7820EBEA28E8A4127714E775F2F32E51EC03141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101701, "uuid": "725ede5e-eea9-45d6-914e-a2960cd66a51", "value": "12288:nXjP1wRBME1LrwCGyzcdd1OJZ1gbvUxnoZXc:TPErstOJfgbvUxoZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101701, "uuid": "7a5686e2-f28a-4929-b2bb-759ca96bc201", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101701, "uuid": "5c653cf6-b8d6-4ab0-9e8f-dd9de680b0a3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101701, "uuid": "068cc9bc-b158-4fc8-8867-0a70b6c4da0b", "value": "Fraud_Awareness_-_Bank_Records_-_Debits_Made.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b43bd9-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101022, "uuid": "f9d94058-42db-41ca-9421-d6d9aa720fe1", "comment": "Malware payload", "value": "4dc6574363c2c300d01bc8c0cd84a6f8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101022, "uuid": "fbff9c02-1395-4c33-8a4b-7597fbb4cc2b", "comment": "Malware payload", "value": "41d5f3d7248164c110416a2558037f2cfaa87de694dfa6d2c4dc6685e7473f9e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101022, "uuid": "f9877bca-67b6-4624-8336-40eaf8597c79", "comment": "Malware payload", "value": "3e64085c64c590649e9543dab1682cc93e13570b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101022, "uuid": "ab660b50-71eb-4dbb-a1a4-3c75152c5c6b", "comment": "Malware payload", "value": "7e37d2ba8af8af285e3907e93e75df40f4e1ea5ebf994c831f8c959fcea9c8ce9516e9ce2a15dffe4c575368e169bd6c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101022, "uuid": "d5200dcf-3c72-4f5c-a89c-f6def9003d55", "value": "T10573F17533B1DA09D180C1756CD1C6D74A20BC9BAE07898B3984B34D1F7A5D2FE47A3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101022, "uuid": "639aad22-ff09-4853-9b4b-0e6fe48747c5", "value": "768:dqSYWVUhNeLD4nzvVK8Ul75wAw6tnqtUw2mOLt88aGnEe6khlIOQ+i+hBDPbQeh7:AOAZ57U7tnNmO88ie9xQATcehwPB7Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101022, "uuid": "677cf14e-49ad-4b82-8161-b9cf4d25f0af", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101022, "uuid": "d7af4942-8bf5-44ff-bafa-67f229336cc9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101022, "uuid": "d8e65a9a-edcd-4024-9c35-ef9e03a8382b", "value": "3178350XRFQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00687dc3-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101597, "uuid": "4ef18dee-3e6e-4d25-b668-f9bfe604d718", "comment": "Malware payload (Formbook)", "value": "a1df7065598fcaf9e0ba7e09155ccc18", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101597, "uuid": "6d065b84-33c6-45eb-a086-7598f31a4848", "comment": "Malware payload (Formbook)", "value": "42eac9adb1b75e7d48cd13879eeeb6dad3d5cfe8e8267243984367056906e46b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101597, "uuid": "99519fbe-d5ec-414e-b919-1aed830b80f3", "comment": "Malware payload (Formbook)", "value": "38f7c938e399573256e8377c1bacc5669e99440e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101597, "uuid": "5f2aceb4-0511-4c3b-929e-c7ea2a799e11", "comment": "Malware payload (Formbook)", "value": "2189f37605974858dd013c1ff1f0254a017b885cd125dafc4d46ba00f9c069120f3eff26fd484b488506a310690c931c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101597, "uuid": "b04ee393-91cc-442c-8e7f-fef61cdf0528", "value": "T129434E8E0DBEF5018CE1E5097A961F3FE2186568E2F89686FDB0D96004504678FF7DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101597, "uuid": "7d0d779c-6afc-472b-aa8f-63be5272ecba", "value": "768:NUc75uJdIpdwHL3Ge3PTdHwHZsJ1y1+PxQjq2prriISSsMXXjwkwrd8vnSnX0:NUdJKpdwJ3rdHwHD1+P7Mjwkwrd8vSnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101597, "uuid": "6ec517d9-47f9-4c17-abb9-a991d79b6592", "value": 60326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101597, "uuid": "a6e8f24d-7c56-41ca-9a81-ce71e0027792", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101597, "uuid": "7b681a5f-da66-4148-b59f-afd4eb63fc33", "value": "WhatsappXIMGXFactura.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a840bf62-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101019, "uuid": "94c40945-72f7-4e06-8f70-59213c94399b", "comment": "Malware payload (Formbook)", "value": "a3c3eb34618e2a876eb20b3ac835c2c9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101019, "uuid": "273ef3fa-c256-45b6-b262-07f0bac9c016", "comment": "Malware payload (Formbook)", "value": "4396df17b8d0ac18e67dca30b4c76591ee4d803f29af209db7674858bb4ca6cf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101019, "uuid": "f28f5741-5e24-4ef5-9a34-2e40c95177ac", "comment": "Malware payload (Formbook)", "value": "381c6a23c97e0687387b187c865dad86a96a9ec0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101019, "uuid": "5a11946a-223b-4cea-ae84-83634c969a1e", "comment": "Malware payload (Formbook)", "value": "6afd3f076100ffeb6ea8e3b6f0d0cdeb9899379470914942ec4865231dd5ee25ec28a2042e7768600c280535ed38ec83", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101019, "uuid": "85be0060-0089-414e-ae5f-eaeec39d9e5c", "value": "T16D2533934F514CC89D57D52DCCB76B234A6BF47F4BE09A8E900C49E89E4AFB143A8D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101019, "uuid": "1ee73e2a-d80b-4613-9004-68679e0660ff", "value": "12288:qwHK56ENFIciU17keO79VIKl7c+B33qv1rY0e1A4gTA0TjRx78GCb2ybLL83Aja2:jOxFIcVtKlA+BKFRZaQAjal8UmpIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101019, "uuid": "cf240bc4-e25a-47dd-874a-80f0ba2dbb11", "value": 1012462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101019, "uuid": "59f97d7e-03a4-4c20-bc08-2fc5d24a5099", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101019, "uuid": "75572342-429a-4a62-9ad1-cd42ab417f66", "value": "OrderXplacement-PO-061506.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324bb08a-76f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783091802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091802, "uuid": "3140def7-c158-4c42-a1c9-09948041e917", "comment": "Malware payload", "value": "9d77d53316271fb4b2b5ceda1af3d099", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091802, "uuid": "2d234116-4ebf-406b-aaa0-4ce916bdbb5c", "comment": "Malware payload", "value": "44ea1b8e643389a7ce7aa1674da5d9e54e6d410446227d0fb87925a8149efdea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091802, "uuid": "56a3973a-1de8-42dc-b6fb-8c184a679c08", "comment": "Malware payload", "value": "b0f62f00e487ef4b75341ff502520814889c74c6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091802, "uuid": "e1b27b18-e8a5-49ca-88bd-6bbce9eb0a25", "comment": "Malware payload", "value": "c0ad99aa2cf8a00d4146da87e636cf6a504ddbb99c7a5170698dd2b2a8a05c7a0726bfbd512ef9421fd81ae042f76181", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091802, "uuid": "92f3ea43-6ad6-422e-8902-de12ba8b18c8", "value": "T1654523BA8B142DAF4F6C833D306B2A0F52D30A20D6EEE635DB69504B33BCE45495657C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091802, "uuid": "39aa6d1f-25c8-4d46-9575-0ac6f58c29f6", "value": "24576:ZypI8f/r6OSevEBeh6J38i2+xulE+ad3xjdLOu9cmw3FKo8rd:QSeM+2IqM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783091802, "uuid": "e3bd6a08-4bda-4561-98a8-151b30a4b9cd", "value": 1278611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783091802, "uuid": "b1c0c1bc-338f-4b68-a3ad-4785484a47b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091802, "uuid": "48c17f83-8531-44e7-9893-8526ade38508", "value": "PO#158082.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc176c72-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783101052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101052, "uuid": "05d5f8d9-cbc3-45c0-8cfe-974d6934cff8", "comment": "Malware payload (MassLogger)", "value": "9e28a0d635ac9b731eafa03c81c6adfc", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101052, "uuid": "695975a3-c50f-4477-aed9-0372fb6513e0", "comment": "Malware payload (MassLogger)", "value": "4589624333de445da41e4e568629eae231fdd5df84d8a0d6345a291575c7e045", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101052, "uuid": "977c47b3-abbb-4446-bf0c-6686c1eaf79f", "comment": "Malware payload (MassLogger)", "value": "a5a3327ef3d8d38c1644c89261ea0ff51b2ebd7e", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101052, "uuid": "39423bad-0bd1-4be0-9da6-72127bf4f485", "comment": "Malware payload (MassLogger)", "value": "d39232b9a102c03424fd6bf2a3bd6e5d3264f7cfcc9ea4279cf48ce00dbba5d8145f86fc1452e443a60763b1ce45e633", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101052, "uuid": "cdaa631b-ed18-4066-a46f-be6556da2449", "value": "T171B423AB72747603B943D2A3D04A494FC7FCBB884E995C7A8A5195EEE140D6BF10780F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101052, "uuid": "04b9ff4c-a587-4dfb-a71f-bd537f8885cd", "value": "12288:+ZtcU35V7sCpa/1qYFVdz6pkDKL3dsNG61lm5ZiA:OuUpV7sPqYVt6eesg3iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101052, "uuid": "02b00735-f094-4377-8597-3b3b7c9f23af", "value": 517558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101052, "uuid": "505c51cf-7166-4c67-960e-061f53fedffb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101052, "uuid": "d865ca70-37e8-4cdd-8c9a-db8312e9ae54", "value": "ORDENXDEXCOMPRA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc9029e-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106957, "uuid": "72533180-73fc-43fb-94db-67cffc121581", "comment": "Malware payload (Mirai)", "value": "6b24e3aac943da76de9a14c40efbf991", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106957, "uuid": "5e898e5c-3ae3-4510-92ce-8bd158d5d068", "comment": "Malware payload (Mirai)", "value": "46f10062d69ebabbfe405bbd79eae9e9243735997d4353ff771adbe8f4f66607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106957, "uuid": "4699d345-2b80-4075-aad6-21c52fb93981", "comment": "Malware payload (Mirai)", "value": "df6824c06da131ed55ef6cde34b1b5ecf0795c40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106957, "uuid": "6bfde9b0-9c46-41d0-8d40-f1429db9a8bb", "comment": "Malware payload (Mirai)", "value": "95e0e4c865e9183c7a5fe0cc9574d3ace253dfd10ae438e3e50dbe122b83a2bb48c47c38c91c12285b529a1555c72ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106957, "uuid": "2b138409-0d36-4a44-b7f0-4dd5641f4031", "value": "T146E34C85B8C28A22C5D513BFF92E018E331267E8D2DE7212DD621F24778796B0F77A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106957, "uuid": "19263056-1591-4be5-b98a-aed3a6904821", "value": "3072:/efSIqzlwrJuD8oThT7RB7aV/5VgkaU/U6FVmqzeee4o:rIqxw1ugoThXRBo5mkaKaqzW4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106957, "uuid": "4eaaf7ee-959b-4f77-b042-ff897d56fc28", "value": 153204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106957, "uuid": "e010bb6f-6d38-4c25-916c-9c4e6811a1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106957, "uuid": "5b27db47-3cd4-47d7-afab-d05a8cd30264", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8005d968-767a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783040393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040393, "uuid": "fce82bf7-27cd-4d79-9b75-b28e2ee75394", "comment": "Malware payload (Mirai)", "value": "ca61d932e862af25e7100808d3cf2318", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040393, "uuid": "30d45ae5-b8ea-4fdf-972f-80dde09d09f1", "comment": "Malware payload (Mirai)", "value": "472c62f3dd43ab1d2bc83e6366f136de3f21305980ab965a1ce9399fe79c3637", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040393, "uuid": "711443c6-9c87-46b8-ad8b-f5ca78d8d254", "comment": "Malware payload (Mirai)", "value": "fc644b2e529d8d41c2a7eba3e6b7e810d20d6226", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040393, "uuid": "498e1ee1-94ee-423c-9da4-1883b1407b33", "comment": "Malware payload (Mirai)", "value": "4b17c1609b3e988bd06d7b8dceae9bceff45edad03a36aa120fdde25c49e9bb116443962b45f3e83213b23d277d67873", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040393, "uuid": "2e52ad91-6f16-449c-92b3-e6fb152cf2db", "value": "T1BA1173CF1395A211088CCDA4746BC8186944EFD074940F4ED78CE4B66FE6B1C7157F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040393, "uuid": "ac5558db-47e4-4b82-964c-7bb4d211e9cb", "value": "24:EQgke7kuNI75kOKgkqikWDkI8kJEk8tBlk9kKakYHR:EQgke7k35kOLkqikukI8kWkilk9k3kYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783040393, "uuid": "40e001aa-b815-4c48-a4ab-4944ca1c3861", "value": 922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783040393, "uuid": "d5bfb8ba-85e8-4f85-99c0-89114727624a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040393, "uuid": "81c4a6ab-e7d0-49e0-b343-3c0538c2fe26", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351a4791-76b9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783067325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067325, "uuid": "986ca611-6173-4184-b89b-8b75504c8fe2", "comment": "Malware payload (Mirai)", "value": "4feb7cf631b7226412451340470fb516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067325, "uuid": "d4d71bfb-6433-40dc-b451-fb382e09edc4", "comment": "Malware payload (Mirai)", "value": "496e34b70c8099e6af1332ab836a1a6eb70755dbe4e36b4417095f1fbc3be900", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067325, "uuid": "0df4d1de-44d4-413d-9259-bc817b0b0d1f", "comment": "Malware payload (Mirai)", "value": "f55be6d403a1c88a1e95c1cfa7e786374222307c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783067325, "uuid": "b06583c1-7d12-46bd-a6f6-999ead68a2a6", "comment": "Malware payload (Mirai)", "value": "efda19bd294c7c34c85ae0415c98843c9bb27a5254b9daab15cdeed9b22acaf0c8edafc40443d05c2cbcc77007b9a179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783067325, "uuid": "9a1f1154-d58a-4937-bcf8-99556502782d", "value": "T1FDC3E73B2B631F33C4D220B112E30271F9B6D75938BC8797A8E05C9D6F599803156BEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783067325, "uuid": "89fce2d3-45cd-4477-8e96-516aeec4a26d", "value": "3072:Y1kpITTRic6FqRybjg7U3NPdXphaqJZYR:1vbjg7mltphaDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783067325, "uuid": "85b240c1-ba96-4461-a603-f7f46583759e", "value": 128288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783067325, "uuid": "8ba05434-b7bb-461c-8992-2859b6d5d632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783067325, "uuid": "b563b8d1-5926-4340-8b9d-1331b09f1668", "value": "SPARC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec92ceba-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783101134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101134, "uuid": "bba17d33-af25-4caa-b0d8-b3449a8a87a3", "comment": "Malware payload (MassLogger)", "value": "7578b81d0c3de0625ae7d9521fd9e3e4", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101134, "uuid": "6fba46b6-0285-413f-a1c3-ab68a79c34af", "comment": "Malware payload (MassLogger)", "value": "4b182dcbe3a35a0d48ee1cafc0499896399c9c464e49fd9b82ff4082b7eca8f9", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101134, "uuid": "19eeefb2-b14f-42b7-b7d9-c73802c0bed0", "comment": "Malware payload (MassLogger)", "value": "c56099e7284295705f62f735c74121eb3118610f", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101134, "uuid": "217cf387-956a-494c-baf8-944867fe6b21", "comment": "Malware payload (MassLogger)", "value": "eb9604d52b2508bf3183962be306325725b566b4d46c98e7ebe0d0c64aaa395397d5f5561d1787b0b405113431e81f8d", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101134, "uuid": "ffcc3506-33a1-4ebb-86ec-e7365283bc2a", "value": "T1F3E423D0C8CCA23593F33085FB39D57C6A68526ADC276530B1729BCB5C28941ED7D52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101134, "uuid": "43d10f42-7fb1-4b42-aadf-45c62da452cd", "value": "12288:HnYgDJmQK5Q0ph+LSB06AjQaXzXxAH9xMYgz3qhZ+7VJcEIDzobrmFEOfgO729L9:HYqJmQS+LGw0aVAH9x8zahZ+7kn8ekw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101134, "uuid": "25dd33bc-177a-43b3-a005-8b1619998f61", "value": 692674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101134, "uuid": "77be16e0-30e8-4b6d-aea0-fc8a17b33513", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101134, "uuid": "bb98219b-60f2-4a92-84f6-23ec49e79ccb", "value": "RFQ#5500783919.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c631f6-76e2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783085154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085154, "uuid": "25db7c88-2d2e-467c-b4ef-d3fd85618353", "comment": "Malware payload", "value": "7b61cfd2d6b53c6a627e9b2dd0c914e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085154, "uuid": "549fdf40-0ddb-4006-a72e-26174bc02a27", "comment": "Malware payload", "value": "4c47ca0f34a4d4288a462b440de6a87b27def02c9a252b8f3a6d1e385af2c4d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085154, "uuid": "a79654f7-4d41-4934-bb1b-114ab53892ec", "comment": "Malware payload", "value": "298a041701bb4226125b3c21b31d26c8e8df6ad6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085154, "uuid": "869ac300-05e9-4986-b1ac-fb29bd032a85", "comment": "Malware payload", "value": "8417b0f6987006e12c15eb05e9c287bc19442f634c01c9ead45d644c43d076882fa456115ab10f99ef83afa26ed02c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085154, "uuid": "0c928124-7090-40e4-9548-5a45435d8d14", "value": "T17208333B1235D35AC3E19E7055F52269F220932DBB236C8DF20D60BD6BA4346B57C4AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085154, "uuid": "c6f1a8da-ee08-498c-96bf-4ff680c3ae74", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085154, "uuid": "18207e1f-21f3-44be-aae4-4aa473db8148", "value": "1572864:dt9IKPiQt2RWYi4ZRyxMlMcGBc3kdUF91CAnpbOu/f7:dUKqQt2RWH+LlMJBSkGFGAnJOu/f7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783085154, "uuid": "5e7a4549-a7ee-44b2-90ab-a7b9556c42f2", "value": 77778663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783085154, "uuid": "dc797385-204b-4512-ab9b-eb5b0dd681ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085154, "uuid": "927503d7-dca4-4956-a7b8-0543fc2e6957", "value": "butt_in_the_toilet_win1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00136b0b-7713-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783105891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105891, "uuid": "ef04db8b-689f-4e7d-8a8e-75799a0f22c0", "comment": "Malware payload", "value": "f88e824f8c10e6712c8e74fc8ee00f44", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105891, "uuid": "c09dc2cf-16a9-45a8-aeb1-8f51b17d1c5a", "comment": "Malware payload", "value": "4f40cb6ebc6025a25428b99a475567d2907c83c788f99b24a46046d74e756fb4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105891, "uuid": "38f58053-d423-4136-ab37-c8b9b717d904", "comment": "Malware payload", "value": "9a193b47209fada133566e894794105d39e628f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105891, "uuid": "413923e2-cb27-4a19-ae9e-04fe920b50a4", "comment": "Malware payload", "value": "beb0d6e929814a7e789848fe45151d4e9f21ba7adfb4ccdd6d116a58fcf7dec94bdc798355149e4047acb069ee06b093", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105891, "uuid": "d7e7e86b-4f84-456c-a9e6-1a755a84ed7b", "value": "T10D014CC98544680080ADD96D32E75454F820D3CA195A4F6ABF6C6A3DEB98814F067FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105891, "uuid": "41deb187-9766-4fd8-b6da-c35d39bf1b2c", "value": "24:kXCKysE2hi0ziQvZoha4Y9mjRztMVRYDIX:e9Qp+Ms4Y9y9IYcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783105891, "uuid": "d58b8b2d-b5f6-465e-b999-f6bc46fc363d", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783105891, "uuid": "7737459a-1701-433d-8b0c-6195c56c5b83", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105891, "uuid": "988c9b68-20da-4807-b2b4-a015605abda2", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8a88e0-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101058, "uuid": "5a77ba00-1bf5-4a67-b171-687bbfa0a694", "comment": "Malware payload", "value": "85a3d8eefeac4ab1e7a944ca6dc9da5d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101058, "uuid": "bbab9dd2-1882-42ce-950a-a007d5d75cb6", "comment": "Malware payload", "value": "4fed24364f238e7165f9f634cb220db4d332be07a26ee68e88158626e0a9e298", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101058, "uuid": "140cf717-a011-468d-9487-26baccaf7a61", "comment": "Malware payload", "value": "28115b5b474e478d789dd1084f7ad3b98e1da455", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101058, "uuid": "e70b140a-0db8-4ca4-afeb-d6abdb73cf89", "comment": "Malware payload", "value": "3fef395d11b41b771169dc0e8d8b2ed55602cc53ed720e4dc57ee6c3ceec184778e7e920f9af62ca516a6a34b0506a2c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101058, "uuid": "d6ee1ee1-f7c6-4166-b5d0-72536639fdf4", "value": "T15BB3122214C38FDD72A251C1285F072CF9DC4B282AF61B11C65F1BC49A525BA2FF3E65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101058, "uuid": "7c404656-866a-4da2-bd91-a7c90c8bedc0", "value": "1536:IoS2CS6Vj6hZBkDYu4GKz8EivbhIyYtDY/8B7+W4Fdx3DKd7Bz45k/uT6tISOL:1Sxx6Zqgmvt34BqRX3DKpp2SE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101058, "uuid": "d90e5ccf-f3d8-413e-911f-a97568b9c4fd", "value": 113919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101058, "uuid": "eadb89b1-75a5-401b-8b2a-27d0c04a7aad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101058, "uuid": "e6744fec-805a-4bb8-9500-84dec4f621e8", "value": "NEWXPOX94120875.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6c2505-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101139, "uuid": "bc832c92-59f1-4a85-ac72-2b9723d7b883", "comment": "Malware payload", "value": "0e8841c9b213e537b4222fa6e891a1b8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101139, "uuid": "360fe454-caac-4c65-9cae-36d0dda4b6b1", "comment": "Malware payload", "value": "509c3bfbeebf39b4e7acde2d5485b7e435b082602ac419fde8911bd190833fbb", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101139, "uuid": "a90f21ec-9f51-41a4-892b-dbe1fbb80a1e", "comment": "Malware payload", "value": "f910fe1d84f7bbd0bea5e0a3896f6081dd28133b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101139, "uuid": "972d8028-ddd4-498d-9f28-246d30827d0f", "comment": "Malware payload", "value": "f4f22b715b72937a972a429db73f0ac278b736b3d3b0578e67ce715234d55b1b9da9948965d9d74ce90466d312d64b00", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101139, "uuid": "d0fbab8b-e527-4b55-b5a5-fdd3cc073687", "value": "T18BB2E0E8A18A5EB1B2D6A9591B0FDADABC34D1756D3C3090C5F20564FB4EDF0638221F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101139, "uuid": "3ec56707-8c94-48f6-91e5-529be1de7439", "value": "384:jErV1S0f5hQp3FlCHZAqyyUr9QC9YN3QtH9nTrBJMvtYOM7nWnyl5NNFJJC:Cwm0p3Fqjyy+9nYNc9XBJ6eP7Wyzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101139, "uuid": "973873d6-6ef3-4e78-8674-f90acc006fd3", "value": 23739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101139, "uuid": "e440db65-6662-4982-a853-696a8913f49c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101139, "uuid": "2d805488-0dd6-451e-bd03-ead56807ff60", "value": "Bank_Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1156366c-76df-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783083586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083586, "uuid": "af4b73b6-f408-420a-82d3-99cd849cd71e", "comment": "Malware payload (Mirai)", "value": "78390c2fe3dce720c7dbf9a7cdb156bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083586, "uuid": "2c9909d6-c6d0-457b-9cd9-2947d117ca44", "comment": "Malware payload (Mirai)", "value": "50d21dbf380006ed82f9ddd3620db9553d46bf562777fc5853e0bb761a06024d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083586, "uuid": "f6eb4276-98ef-43bd-8adb-0abe1fd1dbea", "comment": "Malware payload (Mirai)", "value": "f209647a752e1578e06ed59dcb362b3c6b1a98b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083586, "uuid": "0dd4a8ac-a83a-4811-a89a-acbb678da6e3", "comment": "Malware payload (Mirai)", "value": "e85a9352f42066a9e98af6044f3a5bd0da58fa4099fc8656abcf771a8f333f7c899d5b418f758cd74390d92e39963ea1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783083586, "uuid": "1280b015-9b33-44d6-990d-534bc6771481", "value": "T1BFD3F749E911A729C2E271FBFB5D12CE33271FBCA3DB3126CA304B9123C56E6593A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783083586, "uuid": "036a6f52-4d3c-4a5d-85bd-3cac9400d8bb", "value": "3072:qcKx3ocmad+6M65mLxUoNkuf5h9p/NBp6:qz3Yad+X65uNRf5hV76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783083586, "uuid": "e67d80f7-7bd9-4c68-a922-4a782e2469d1", "value": 132728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783083586, "uuid": "cab284f1-5b8a-426b-91a0-58bf6f82962f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783083586, "uuid": "09a77650-76ef-464c-be21-5413961d1634", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b5f88e-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101797, "uuid": "a11973c4-a0be-4b46-941f-8a0398a768dc", "comment": "Malware payload", "value": "d2143b66bdea3a291d30c67859e11d13", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101797, "uuid": "cfab3936-2e44-4e59-a5a1-5e7ec81348ce", "comment": "Malware payload", "value": "5107be85b62d663bec44ea73324a7658e7cbdc8ec5fbb5953ef8051398610f8b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101797, "uuid": "7edfcea2-e30b-472b-9b97-b03b51a0e2b2", "comment": "Malware payload", "value": "8e5fc89017f3807a103698d76bc0917b3e2e88d9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101797, "uuid": "7fcad632-5f6c-4c00-b440-0653016a7209", "comment": "Malware payload", "value": "86af6acebed0dee6f38f3eed2b49f0e8f70c5f0ef3849f9bf19a98135cc20972f64c3c7a0c47ee64c9f464441f3be0c6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101797, "uuid": "69af001f-03c6-47be-ae79-1dcff8f67ab7", "value": "T1E255336BD73899B4303AEE565C7DFFADA91D48236B8B944952B3E00F50D27039EAF410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101797, "uuid": "7c85518a-890a-48b5-86af-fbc10059354e", "value": "24576:AiTVzckOlpChZH5ExgRGMtbiI3RyZuErpn+PIZRK+jRYFnuihgDy/Q2x0I8KC5Ep:AixaTChZ5EyDtWIDErh+PIZRKyquGAy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101797, "uuid": "8b0dd161-ac82-4f99-8501-9f239c915003", "value": 1335788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101797, "uuid": "dfa53d81-991c-478f-b101-de897063efe6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101797, "uuid": "e518b259-76d5-461b-9ff9-cdce86b2f6e0", "value": "_09889778009.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f32a24-76b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783066546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066546, "uuid": "7c77e364-6834-43bb-9545-8f26f94e1511", "comment": "Malware payload (XWorm)", "value": "88717efb68bf2be1bb65908ff31722d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066546, "uuid": "8f69151d-0935-49f9-8570-abdc6e1f4f2c", "comment": "Malware payload (XWorm)", "value": "5171ff3fdd768bad81b6c139b60a782ac3aeaee0706b6f6bd77f69ef158ad009", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066546, "uuid": "b305ecdd-e45d-49aa-9419-e023b6bd62ca", "comment": "Malware payload (XWorm)", "value": "cb89d8237d88da560b2adc3f45be15ad7cfc6d40", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066546, "uuid": "18c64970-ceae-4a9c-8d62-9e47bd23df67", "comment": "Malware payload (XWorm)", "value": "0f1842f109f065965de9de39e025b31be6491066895cb511f02c935e459584b325049d21b5cc73c330230f2b1521daa1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066546, "uuid": "00254965-0545-4597-b344-c13788654106", "value": "T1A9C5D6208738E576756CD76CE03A9F684C0E680728E9DF4D346A86347959F87D38CAE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066546, "uuid": "e2ad27be-6ff5-4679-8aac-5d38e72c0970", "value": "49152:Xoqjb24+dhpG/wUPVc7mYTSqq1ziQPuQLaKftDr4:XoEf+vpK92armgaKftDr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783066546, "uuid": "4216bf34-568e-484f-b444-3541136020c8", "value": 2589382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783066546, "uuid": "814bf282-2b0b-4eee-802f-8a0bae7e1789", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066546, "uuid": "db7f8d9d-69d5-4f00-88d1-e6e19be20673", "value": "PO-14000083954 pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcc94a2-7723-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783113135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113135, "uuid": "b0332732-4a84-4666-b7c4-4042ed5b7a33", "comment": "Malware payload", "value": "633a412d244673fe619181df3a78e094", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113135, "uuid": "0501b0f5-56b5-4b06-a498-4cb5b9e72bcf", "comment": "Malware payload", "value": "518f5438a21e9aa9a91f0dd589088e443fda111d8ada5ea67d1cf14d6645974c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113135, "uuid": "bfe8f43c-7a85-43cf-9263-0525915e94a4", "comment": "Malware payload", "value": "a7ffe833dfd357387e56420ff8684cc6cb3db65f", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113135, "uuid": "1a3793eb-583b-4d59-ad53-66d6706de975", "comment": "Malware payload", "value": "76f02ce358ab0439c9c3c831bb1a6555af6460f45ce549cfefc2c064308e8ce6c5e572e1dfd0b3bf62eb63124032a2e3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113135, "uuid": "3e7a9335-644e-425d-bdfb-500a9e6d350c", "value": "T1CD662382FF45D82ED4B780370A9247351265AD2EC693934395EC7A2C6C7BAC80FC9ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113135, "uuid": "394c6750-4b86-4473-81e0-5ffc71aa45f7", "value": "98304:357u4q2N54XKlSNfo430cm6B9ahRPw7NEec2+4sS8QqTwj86YUx+7:Ja4BohTjahRPCEX2LsSokj86+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783113135, "uuid": "71b24df1-5e04-4764-9016-85e2b1a31ab0", "value": 6687934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783113135, "uuid": "6ded0ecb-45fb-4f81-ba30-7a6ad9dfa23b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113135, "uuid": "a098e9a4-1f3b-4b53-83b7-17a4d73036de", "value": "S\u0435ks18+.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b5cc54-7677-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783038954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783038954, "uuid": "e7ef5e55-83cf-4077-8404-07cde37a4012", "comment": "Malware payload (Gafgyt)", "value": "0d08914985a890b964d6381691360f0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783038954, "uuid": "739f1df8-7b4f-425c-b4ca-d29bddaa1e7b", "comment": "Malware payload (Gafgyt)", "value": "52bbf76f3cf2dddd96c72cc97a701e06e650af628ecdb119c5d448ea5a961b34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783038954, "uuid": "3d50b916-163e-47fc-bcdc-fbeff966ab11", "comment": "Malware payload (Gafgyt)", "value": "281bda2fb385e1e6495dc9c54085adbd50f7e435", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783038954, "uuid": "f81f4bd6-21d3-4906-bfdc-84fe0580a646", "comment": "Malware payload (Gafgyt)", "value": "574e0ffb8219e2654bc0224c1c3aa7c0b9d2121082e61d893a5d44c42942fdff97b23a83034ffce8e7425e353a229141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783038954, "uuid": "7f7c76db-31af-4a08-94d9-028a640c4488", "value": "T19DF3195CF550872BC6D0267AF69B128C33725B64FFDE3705E9147B283BD2B299D2A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783038954, "uuid": "5d2e0633-cd91-4179-800f-4c578aaac8f6", "value": "3072:k/TCXUoEEVYA/0SJdnt2a7PHMlDkzM7hkqxysTQNrki:kBXmYA/0uBtiDkzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783038954, "uuid": "e014afd8-b62e-4129-94af-1d8fad77d045", "value": 165372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783038954, "uuid": "4e937d86-b20c-45c5-8b04-bdd2d5559061", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783038954, "uuid": "27e59cb3-7dcd-4def-87b3-d633f9f43f70", "value": "armv5l.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb6def4-76a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060600, "uuid": "6bd5eb77-a96b-47d9-a04d-83e20747f8fc", "comment": "Malware payload (Mirai)", "value": "21309086538f94db6a03802969816f2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060600, "uuid": "69344e24-1451-4579-a3e8-f1359c5f0204", "comment": "Malware payload (Mirai)", "value": "5346c531627987f260c115b3839aeb729cdc1d43ab2fe79f522b8da6672e3bf7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060600, "uuid": "451e5fd2-74ad-4d93-825a-1e96fb076ed7", "comment": "Malware payload (Mirai)", "value": "ab37b96b1254a961fc4611787e22755035c40fec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060600, "uuid": "cebc488c-cb80-4207-9d42-e3dbc92ee0f2", "comment": "Malware payload (Mirai)", "value": "5702cda3e9295fe5aefa6967c51a7ffad88a3958d24b4d63d0028234d4874fd4946fde18769aca6f8cbc9e8bf55ea4a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060600, "uuid": "b897b8ef-b7b7-41af-b945-7ea6361d2962", "value": "T1F0A3285ABC819F15D5C1053ABE1E638D331327BCE3DE7213FA146B2C378B56A0E2A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060600, "uuid": "af44beb9-c584-475a-9b59-c2ca8daf7091", "value": "1536:JxnZjLWoiLMaDO5fKAMHyqN3alAjpVjDEiXrorGMvat+lFin53Yok0a/QU:9LOoG4MHyqN3almrorGMvatwonZTlaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060600, "uuid": "ab0c30d9-9231-438c-b984-c199f9c34f48", "value": 99300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060600, "uuid": "b92db19b-64c2-4f28-90d5-928124136293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060600, "uuid": "92b6ccf9-2315-46b1-8750-87258ee4e0e9", "value": "TwnE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c334a537-7731-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783119103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119103, "uuid": "ba04db1f-969f-4b39-8455-a0b1cbb275ba", "comment": "Malware payload", "value": "d20efa9cda3e0d0da16e5593bf3f7644", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119103, "uuid": "e63c5adc-d534-495f-896b-c7c15667abd9", "comment": "Malware payload", "value": "536cb0e2ffffa40d1ccd096eaaad43f094813bae15d8f6316dc35fb998d5e4cd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119103, "uuid": "3cea4022-c37a-4426-80b0-de410d463542", "comment": "Malware payload", "value": "b9804301439f239f31288ce89db8be84305c45e1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119103, "uuid": "f445a4fb-23ce-499a-86d5-68b42712f416", "comment": "Malware payload", "value": "c9f287cee1fc33d31246f02a2c92ee435a594bdc667ef143c5d726d4069c33006757625af27194150d8abdce25742ef7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119103, "uuid": "7aed2e3c-3f0e-4e97-be20-aa148b78bbff", "value": "T17D56F1B57741D93BF8370532656A7231B78F9E168E8F8683A544320C69772DC0F9BAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119103, "uuid": "e9400580-10a6-454c-8898-a38b8e159ef1", "value": "98304:p2MBNMhhsCvQHXLOw61sJD0J/faSUZFGTwCkwkFcajec9LOAiSt1A/LO8ftRrI9V:pRqTQ3LOw3YJ3wmlV4t9LO1STA/wV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783119103, "uuid": "12c2cf1a-38c5-419c-8c5e-c22476ba93aa", "value": 6020944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783119103, "uuid": "86be58a3-4371-420a-a4e9-bb2fb2fa21ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119103, "uuid": "17f08f6e-6182-44a9-8494-43b61b6b91ae", "value": "\u06e6\u06d6\u06eb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6d3ff2-76eb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783089113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089113, "uuid": "8dd4d924-d0f4-4f94-bba3-1879f74b190a", "comment": "Malware payload (Mirai)", "value": "4c90530decf60bb5da7d445948ebf438", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089113, "uuid": "ce2b0ac9-b78c-4c28-b8f5-e597e57be4e3", "comment": "Malware payload (Mirai)", "value": "545526a718616bc8dcdd4e3ca29f02dcabdf712fcc413fc369dcd36fb9517aa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089113, "uuid": "f72f3ecc-24dc-4397-821c-eab4e448fdfc", "comment": "Malware payload (Mirai)", "value": "306c66682b8e0ca43cdc38ac5891c3a1b6f9c97c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089113, "uuid": "2adef93b-2684-4af7-bdf3-ff97513776b8", "comment": "Malware payload (Mirai)", "value": "558ca38c025f92f00e7ce45274bf984151d36ebf36657862c5070c259523e3b063a9c03f4a215c14c530767e0068f94c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089113, "uuid": "5e98eeb5-3707-4a2c-9e67-4d320739d208", "value": "T12F1419A67711AF6AC168C53504F383E597F6239127A38144E22DDA2C2E7234C1DAFEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089113, "uuid": "f93ac152-9637-48f5-a4e1-9c21c6084737", "value": "3072:a3kaQZoZOMIGqVJJD2rB9+oe0aLj9VodCJFRSVZHwE:a3kr22Z/0nvBanxJyZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783089113, "uuid": "99b73cab-300d-45c6-8245-778cdc6910e5", "value": 202352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783089113, "uuid": "2520d9df-6925-47c9-b15a-e1322486537a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089113, "uuid": "7ae1d746-4606-49ff-8f97-e42b322d18c2", "value": "mips.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df535257-767d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783041841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041841, "uuid": "09bc82a5-0476-4e6b-8e47-01897a8eb1c8", "comment": "Malware payload (Mirai)", "value": "d34db49b84c9debe60162cd201e7f92b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041841, "uuid": "ac0fb6de-2998-4989-94fd-77369db0bd22", "comment": "Malware payload (Mirai)", "value": "55489cc3ce1f7d3129f1bebc8103631692993a66bc05f5e136ad3f4760c13fe7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041841, "uuid": "c1bf65e2-aae3-4d39-a8ab-433243e57834", "comment": "Malware payload (Mirai)", "value": "d12117d1a8e0cb98365d4b6357471665c1ff837e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783041841, "uuid": "3e78ceff-7ec8-4d9d-86e5-d76f5376a0fd", "comment": "Malware payload (Mirai)", "value": "46e80e3115d40ef1a0a8a18c0b03f464c187cfc8e26398707bdfef6820cff4b262ef8a29ba2715dc30a2c9e02a13b884", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041841, "uuid": "d267318e-fc6a-420b-a35a-65459dd2ade3", "value": "T1BB011ECF27516245044CCD68746BCA045B46EBC0F4B80F1EEB88A87B5EE6708705AF6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041841, "uuid": "3f75556d-5277-4bf7-98e2-e5c5471b133f", "value": "12:UjQj+Jjeq+JjqNNIl5zA+Jjz0LKj+JjxgOs+JjveC+Jj1ON/+JjJSE+Jj8taKA+E:yQ+etuNI7/OK+qEWVIyJ68tBDbKcYxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783041841, "uuid": "99093dc6-5fcf-44f8-ac01-f3a6e0017bf4", "value": 813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783041841, "uuid": "3207eaf5-5062-4e9f-a754-3c346c857075", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783041841, "uuid": "d0dd4124-6b2a-4751-a9fe-a1606e441c70", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e48831a-76db-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783082024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082024, "uuid": "2b921a2f-b9e2-4e16-bcbe-12c9a7e84108", "comment": "Malware payload (Mirai)", "value": "2c80cc3c25917f7313cc5e79dd0e9acc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082024, "uuid": "b4cbea38-aba4-46c9-9e40-70361023b518", "comment": "Malware payload (Mirai)", "value": "55a195fd83d3cbe9a5d0b4f88c59833776d32a65e807d137bcfa4f9a7c8e1f12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082024, "uuid": "cda6ed5a-b056-4440-8519-5aaa73e21709", "comment": "Malware payload (Mirai)", "value": "559dfbaa2a1c8000ee20f5c05eb91e8af0cf0f8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082024, "uuid": "e9085877-d654-48cb-85e0-c12203573068", "comment": "Malware payload (Mirai)", "value": "894245f9664ec88a4bbdeb1b291920f82d54126b76545cf97f2585db83fab978e5d48b9f22a90fabe09c956d5e6d38c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082024, "uuid": "4d7b08f9-e3ac-4d35-b8df-ba47dfaef264", "value": "T1C0D3D809BF500DFBD81FCD3305AC170635CC961762A92B753674DA2CB68B94B8EE38A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082024, "uuid": "0ad37592-048c-4f03-b37d-0fe0a95ed6cc", "value": "1536:zoOXGpSJoA7nkzUFuqR5NYuas/miu/NW9ZplKigcI0BB+8slJk0a/VIL3y:/XkSuAWW+uHl1BB+DlatIL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082024, "uuid": "1ac2b99e-6b3e-44df-89d3-9a327b4b5d19", "value": 131516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082024, "uuid": "02dd70c6-087c-47b5-91f0-546ff61da70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082024, "uuid": "99c1d733-43e1-4c1c-a08f-93033f438c70", "value": "0Rw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab3000d-76ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783062932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062932, "uuid": "e8d32032-ff88-4431-972f-cf886bc022e8", "comment": "Malware payload (PureLogsStealer)", "value": "fbfe4c2ffe4f4eba18c3c784bcd27528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062932, "uuid": "0c64036e-ad8f-4f08-817b-61a92ba8ef8f", "comment": "Malware payload (PureLogsStealer)", "value": "57d26f045da134f570eb745cee88057c0c3872d6aeab9477fc17ae46853e93c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062932, "uuid": "3523721d-8023-47cb-ba39-0d424349fc82", "comment": "Malware payload (PureLogsStealer)", "value": "3efb2084f2eb98eff1ae58e497c27527d89192f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062932, "uuid": "75c76699-d5a1-47cc-a394-eff9bdad863b", "comment": "Malware payload (PureLogsStealer)", "value": "2a2ab0ec194b5955f43d0b880251320ef600426dfdf5c752eff23c5a84b21a89b2a1eceea7c084f94b2d8aa444357acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062932, "uuid": "abc05891-11d1-4fee-9099-a703ccc3d222", "value": "T1F2347E0B776CCB32D57D5AB4B2CF070613F5B28A9E23E70AEE4916F41A873522D5214B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062932, "uuid": "9c78ad60-1e98-49d9-b3c9-cb2ba21a1567", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062932, "uuid": "5fe979fa-4b9e-4350-8087-eb0b64426eb0", "value": "3072:MCgpH9cd7O5ohSk60DOqRTjV6kjm4l2HLcGTlCyrq1e4QTlDgAhyZ6skoYmabM9K:MlF55lcjVQvTlKXyDe6sBCM9gQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783062932, "uuid": "8fdd0c03-96f8-402d-bd37-92e81c7cf02a", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783062932, "uuid": "a21517fd-438b-407f-93d9-1708a9f5a26e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062932, "uuid": "422a2be1-cb6a-4fed-80ff-8ffa4f02d05c", "value": "Yjzlxkdoi_Slayed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8852174d-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783100966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100966, "uuid": "a6a81910-9325-424c-9be7-bcdc510f7b88", "comment": "Malware payload", "value": "d1c737906f59e5fad6dd565b9fec1165", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100966, "uuid": "563cf0ef-0abd-4b40-9322-06fa92fa3c7f", "comment": "Malware payload", "value": "585dff47509a9286892dc8237096793bbb5a39411d95c8f3277b23e63a0cb8d0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100966, "uuid": "9351933b-c75c-4736-8611-52e07ec2b687", "comment": "Malware payload", "value": "2e898453cb1a9f1f5819fe4c14bb256f62af891e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100966, "uuid": "8e566261-d2d4-4c20-b20a-ea515cf4e077", "comment": "Malware payload", "value": "d33d4c7e3b05f841e74403574d5db7e8ef190f742324f58edd6e788e7d0dee11779bd00565faa516c4490cd5b1f94568", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100966, "uuid": "75cb3dd9-ad80-4107-8462-29e77fd688cb", "value": "T1917423C1930BD8FBB8E11BA53C809250DA36F5EE0D6CD498A1752B05017BB76BA5B07F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100966, "uuid": "f1dbe746-1517-46f7-8836-8adea49bfb86", "value": "6144:W+8wzFKgnaQ129OXcuwfAEfJuLoxEmj+YuDWgze2uBwBXcCiKaUECnEeOCGgSGo:F8wzFKeaQw9D9fAEuLoOma1WauBwBXpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783100966, "uuid": "82d9ea95-fe4a-4b02-a1a8-1cd92b863e29", "value": 363823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783100966, "uuid": "82b4e500-48ca-4004-bbd4-d4047d4604a6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100966, "uuid": "a95badc7-7604-46c7-882d-952020af6543", "value": "recibo_de_pago_anticipado.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d031568-76c0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783070399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070399, "uuid": "7d56f0f0-c34d-472c-a8b9-d3cb3eeb5c47", "comment": "Malware payload (ConnectWise)", "value": "f1f5db70738290fece1f1ffa22d208cd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070399, "uuid": "e56305db-06b0-407c-915a-beb0378ad573", "comment": "Malware payload (ConnectWise)", "value": "588e6ed7f440ff77b3dc294d6edcd72e23d8e367e07c905d92fb93404eed09de", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070399, "uuid": "cf5f854e-8eda-4c3d-9608-54ad79899294", "comment": "Malware payload (ConnectWise)", "value": "e394956695b1ad977c4eecc71298c12b63b5b359", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783070399, "uuid": "bbe5ef2a-e46d-427d-b9ce-d4b5b3f9c6aa", "comment": "Malware payload (ConnectWise)", "value": "12e7010dab5a478f438eedb1dd756156ea7897c1b62496560577f1163d40be827ded132310dff616aa4d34a05bc62318", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783070399, "uuid": "0da3dd35-d666-40e0-a286-0e3dae0626c3", "value": "T1F773F6CB7019566B2F0FE44B0AD8AB98EF8317F1407953DBAA1435F0710AA1F5CD9B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783070399, "uuid": "554f360e-7092-4020-94c7-64bd575b2633", "value": "1536:JncSrboem2MzRwA63waXFRWbGDefKRYmP+6/yO6GUA4:XrdmP96bWbGmKRn/PUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783070399, "uuid": "07aaa448-705d-4dd1-bd3f-f6ec6894d33e", "value": 80473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783070399, "uuid": "0fe2e1cd-e261-4928-8f52-a25a70fde557", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783070399, "uuid": "193b18c2-12c5-447c-a3a2-8c797d662e8b", "value": "Statment#596018662.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaced66-76a6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783059448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059448, "uuid": "d7574a28-e756-4da9-a93f-06917d2ed586", "comment": "Malware payload", "value": "a88d0448596e6fbaf86dc025581c6817", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059448, "uuid": "5ba577a2-e6a4-47ed-b52a-9bbdd02f07b5", "comment": "Malware payload", "value": "58d9528e161486b9f30aaa0315bcc4413c4f9a9bd945ea8714b8972eb3723cc9", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059448, "uuid": "ee85fa55-ed54-423e-86c3-1698976fcd97", "comment": "Malware payload", "value": "f43c93b4d71d8035a6467d95b92a7dc7b729c63a", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059448, "uuid": "0d7c2ee8-c53b-416e-9df2-21c853adc920", "comment": "Malware payload", "value": "6502eac1633d33622570e933d2f20271ce6ea7af9c66de344a6f5080d70f6b336cc16ed4c4eabc5e40103cb2a0bc883f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059448, "uuid": "9d4e8864-bd7b-4672-96f3-c5bbaf455d92", "value": "T1A836BF4FFAA907F8C93DA1F550149202BAC178028F20EE6F78573D660D7BEA85E35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059448, "uuid": "56e8fde4-af98-45e9-b275-a6ce62c0897d", "value": "52c0d5ce5d7923a876fda0005ddcdf27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059448, "uuid": "e5673cf7-157b-421a-b549-01fdf1a64346", "value": "49152:dlsdxuqvFwmv/TaN8++LkPgg1YmGXiJZfVkmsMuY7uRrHGcSKdG9mVz6ZByPR+I8:diX59IqWMRpRmk4wVIDPZkhiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783059448, "uuid": "9c3bca0b-6ec9-4344-ab36-88856fb5170e", "value": 4870656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783059448, "uuid": "8da22df6-d359-4ef4-b820-2aa0219a7e01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059448, "uuid": "d8df2c5d-07a3-46b3-b0a1-e9f9f5275409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a851244-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101184, "uuid": "e172a54a-8d69-41c8-b41e-67993591e131", "comment": "Malware payload (Formbook)", "value": "bbd5dd6263af978ebe7ddc57537204a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101184, "uuid": "922fba58-5aca-4067-88b2-9c943934ebf1", "comment": "Malware payload (Formbook)", "value": "5971c4311611d94ae809f00b0ac2142e3e2db8b9a7ee5851ccd6321274c20c73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101184, "uuid": "9a1e9e85-776f-41c7-bdfe-8fd2c6fba3b0", "comment": "Malware payload (Formbook)", "value": "9582e63fead023ffbd4e1b14e92db89e7e563ef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101184, "uuid": "f94d2c8c-840a-4ac0-b4d5-acfc26e3dbda", "comment": "Malware payload (Formbook)", "value": "a298242a4888741b7f0ecc779677f0033b96d0eb8b6ab3fc51ac790848f441169a2201f17dcf85362e53a97092ffa2cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101184, "uuid": "c2a8a00b-6a56-4f10-9b51-38ba21916b8d", "value": "T1B13501186B59E607DA861B781F70F274067D2EDAB512E22A5EDA2DEF7D32F400C14393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101184, "uuid": "a2cf19ad-ce43-416b-972b-dde45618217c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101184, "uuid": "0e4d7638-5913-44b5-8b16-a227d171ce90", "value": "24576:pcJr+Q12p5WVLs22OW3+Db8g4pOBbf4RVo9hKKkBo1zP:S+Q15D2OWuDeOt4U9Mo1zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101184, "uuid": "8b0504ac-47b7-49d0-805d-05645975c609", "value": 1121280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101184, "uuid": "272e4788-a89e-4693-bbc8-bcdd95da7d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101184, "uuid": "c0efdb03-97ca-45e7-9fc3-e535910d445f", "value": "Order_placement-PO-061506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce46bd3d-76b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783066723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066723, "uuid": "c5345540-3a4e-4f0b-8cf3-0a77e24c38a7", "comment": "Malware payload (Mirai)", "value": "fb753813513a222d26c86e419338a18d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066723, "uuid": "62462fb2-4ed8-41b1-88c8-c90c901dd4d1", "comment": "Malware payload (Mirai)", "value": "5b4faea96a95e9d448af8710a08e959eb6c0e01af9af630f50ec8417f6440eab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066723, "uuid": "44eda017-a6b8-40a5-9370-c8a60b524570", "comment": "Malware payload (Mirai)", "value": "1ff62e3ef56bf4b44970c6f7118dda54eb8ed77c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066723, "uuid": "b24a0bcb-d498-4f63-91f0-28ca01f55f6f", "comment": "Malware payload (Mirai)", "value": "9510325b2e906669eabebb0a79e818c844048c1e6a93b4d9f833689e07683cf43ae72625b78491836032cf4a7c7a3840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066723, "uuid": "ba784223-a44e-45a1-86b4-667dfe298f60", "value": "T16FB32A8A98219FBBC025B0B174F919351719A8A64B1F1EE9B4359ED4438F5CFB00FB78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066723, "uuid": "c5465cd3-bd33-4ac3-8677-18d9b368d401", "value": "1536:R3o1i6jc0RZXCLXemPp+KhLkVyuOSAeaxz3C7mP5V1G5h9p/s8:RXiZXaXeupxh4OSFaxz3hxG5h9p/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783066723, "uuid": "69104627-411a-4716-b972-ed22aa383eaa", "value": 107944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783066723, "uuid": "dc6b11cf-3ae6-46da-993e-e239cc459c3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066723, "uuid": "db39711b-c2da-4442-91b0-a936b01c0237", "value": "SH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3813eb8c-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101690, "uuid": "b96ca3da-6ead-40c6-805a-9097cb0e705a", "comment": "Malware payload (AgentTesla)", "value": "49e333d1595c369ee80a83e264aadc46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101690, "uuid": "bdc708e2-2a6c-4a92-9d20-3a138e525650", "comment": "Malware payload (AgentTesla)", "value": "5ca9689214b6ae5c0b4c1a9ea2f5256b39b016bba3bc26741981f50a35eed240", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101690, "uuid": "96350719-874c-4e7d-8bd3-2e38e03c3dd2", "comment": "Malware payload (AgentTesla)", "value": "d9a4d22aecb2a63571670253466e40cad8ed368d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101690, "uuid": "c5f8446b-a049-4af9-9677-2de8dd22b47e", "comment": "Malware payload (AgentTesla)", "value": "51be93a28e6697f038df630aab00c05ea4e21d7f5e1707575cd9501a64eababb89a8ee82c7796f52c896a0482f3e956b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101690, "uuid": "d3cb6fd5-48e2-4901-92ea-fdc53718bf98", "value": "T12625335BFE2F380A906464EB1A383D42B9DD9610332CB5F84E364F45B8F5A895DDB81C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101690, "uuid": "ba99dbea-0941-45bb-a3c5-36815d585f55", "value": "24576:CLciIZCec4pcji3dkKZp0R9/5+SizA/j0QPQnUtePi2b9B9:hy4qSOK3Yr5izA/j/PQUmxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101690, "uuid": "af12777d-9391-47ab-8c03-859c87f3df48", "value": 992470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101690, "uuid": "55958e25-317e-458f-aeb4-3b1ba8c2a546", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101690, "uuid": "d5f3ebbe-58b7-438b-8654-c44ac62859c8", "value": "Kallon_Group_July_Order_Request.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0a64ee-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101349, "uuid": "53e04e48-03c2-4b11-9a3d-e394cdd9968f", "comment": "Malware payload", "value": "5884a9a26bba5454cb4553d6cb824ef4", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101349, "uuid": "32a49e81-2d12-4f2f-9eb9-ef1ba88c4c8d", "comment": "Malware payload", "value": "5d285154c98e55f287a69e2ab081cdf74bd999703de34d0c521b601176dcde4d", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101349, "uuid": "7de6b951-300d-480a-85ae-d866cd826bcd", "comment": "Malware payload", "value": "1a669c989a2ba0fb374a007f9cbb822f85f930d7", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101349, "uuid": "24d98b7e-bf91-44ab-961d-2cf64558c1d8", "comment": "Malware payload", "value": "2d706a7f759b15873ad941b3cd4953074090f3d069cf8a3d619af2cc24cffa6281339b8844c37ea4a858f8f5689a6eda", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101349, "uuid": "53135e62-6dfe-4e17-bdba-cee812d12b1b", "value": "T1C9F6DFF3CC579746E01F563E9531826287226F903C2D7247D192BC9CAC9CD3A44AAB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101349, "uuid": "95561445-7979-4cdb-9f4c-2afd4c508204", "value": "1536:O0R1NOw+vF+X+YkqvtSsmDHaIF9y1ycd6O88HBidkRizUJSfIyN66exAKlWl2ksH:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101349, "uuid": "99131e66-c771-4ac0-8683-8ee55dcdec6a", "value": 15532032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101349, "uuid": "c8732b8e-9826-4be1-b728-b4b7496266c9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101349, "uuid": "69830b3e-fba3-4af2-b479-bce9072db6a7", "value": "DE0039-0300-02026 Rechnung -R039030.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41959d6-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101120, "uuid": "33162723-ee6a-400f-8841-af48da37330e", "comment": "Malware payload (AgentTesla)", "value": "fd8d7b1a9e8b1308bb3da6d6c0cdbac4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101120, "uuid": "e42404bb-43f1-459e-90a9-0fd0ba8b4092", "comment": "Malware payload (AgentTesla)", "value": "5e4eb9f4385d946174ab9f26d773cf870afb150102e9f580ca530b70e10f61c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101120, "uuid": "b0586eab-f0d1-4332-b36a-b43eb39e7865", "comment": "Malware payload (AgentTesla)", "value": "c0c2e646597769fd1baf5fe613aaa2a7c7da0dbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101120, "uuid": "83477800-1c7a-46aa-81cf-8e141dfe8e63", "comment": "Malware payload (AgentTesla)", "value": "c6c77efa61cf07646c41ad2c785538e43c8974b934b6f8c3fdcc6c6357ba311b0479a03a27560e6dc3791d232abc0cc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101120, "uuid": "f6b3b5d6-de2b-4deb-9ed4-b3b4017d513c", "value": "T15265335ED7BD2890632302AC5E55A1F257EEDD4C6273C65AC5029602280BF93F3F7AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101120, "uuid": "aa45a376-cfa6-4325-8a36-e06f6b1cace9", "value": "24576:dZqbSZtfme35pJdKOqkjjzjaNaQONQukEB6K1CT6lsaj/HVrk90nkRPYaa:vLfX4kjPPQSkEB6K1my/Hq90nSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101120, "uuid": "fb255c9c-afab-4291-a07a-a9d924814577", "value": 1465762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101120, "uuid": "7399ed82-bc04-423b-9f0e-10a031e4355e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101120, "uuid": "796a3f79-88a0-4e6d-b408-d5e5a0445e8f", "value": "BULK_EUROPA-2_SAILING_ORDER_VESSEL_PARTICULARS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d994366b-76e8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783087788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087788, "uuid": "ab2a44fd-78f3-4557-a4b6-582200c3cc3a", "comment": "Malware payload", "value": "80898ff2fc8c57ebe50b5fb89ff1e055", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087788, "uuid": "c62929f2-4628-4f90-82ab-a52bf9d4f968", "comment": "Malware payload", "value": "5f21261f94d4c0503a146fccdc0bb8f92d49c379917424b6dace70848a76e784", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087788, "uuid": "5c7ca088-6596-421b-bbfe-fd623331de46", "comment": "Malware payload", "value": "26a2edab3aea6b8480709ce3ba7352c111341808", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087788, "uuid": "05632660-7e4b-471b-86e4-b06a94b2f5af", "comment": "Malware payload", "value": "3268a773e78985666a98b89acb94c85b6130557ced4f80bdb725d5703341426bbbe7632469e7c14ba2dc6c9c38b31b39", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783087788, "uuid": "5eb71f53-f459-4e3d-99ba-3e9d6d05b9b5", "value": "T149D09793A0A3427440AA8919F0D6F800F800C7BE0C82C62CBE0368342F00309F1E23E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783087788, "uuid": "58d2b958-75f0-4155-8e6a-005ce536e516", "value": "6:hTiMJ1nSycFET9AulNXYq9DG+NjVsNXYrkJ:ViVyvT9Piq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783087788, "uuid": "6ffe7cdd-c94f-45bc-8d4a-82a195485d83", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783087788, "uuid": "afce4aaf-e30a-48ef-886d-28451f170fdc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783087788, "uuid": "f204baf3-c751-4a88-bb62-00f45b8cac34", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b509769-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101695, "uuid": "497dc0e4-bdca-4f32-8102-efa735d0bfdb", "comment": "Malware payload (AgentTesla)", "value": "06257c367ef4ace49ea3d9c1fbf79e9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101695, "uuid": "e8a8a835-065a-4b92-b249-7e1cbd0d58b2", "comment": "Malware payload (AgentTesla)", "value": "5ff9baa90800ff12412917b6e881c2e21553dd9c0a71d69ea09d8c815314dd29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101695, "uuid": "53296e93-de3d-4fe3-8181-3e6911570e1e", "comment": "Malware payload (AgentTesla)", "value": "3b1a2d5745f3e2f3f9a5d48abc02b63b8fb9e460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101695, "uuid": "615a82d7-3c34-48c8-976c-c130ee3538ac", "comment": "Malware payload (AgentTesla)", "value": "8350082cd27432c33f89ae16aa587b831befdf64b4042e5439fbebb027ba7de5d3e94d26f4a0284f586aaacba4211748", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101695, "uuid": "5e3b6783-59f0-4c97-a32c-e836ff49848d", "value": "T16FA5339C4B7D2C458CA520E6DF0772389E8927A39A837445D15EB273AF4DE199D20CCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101695, "uuid": "a61422f3-3962-4397-8255-55e508ad0dfd", "value": "49152:tEEcRqWjX4/eda7EW3zYJP5zJ3h1OBLR01T0KUWVIqqSZYgh15YmBXK8dU9E:SEMq9b733z0P5zlh4uT0KXBqSZth16lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101695, "uuid": "80b65ff0-732b-4d60-a921-f0dd227b28cc", "value": 2139841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101695, "uuid": "138ec361-5d97-4521-b970-d6e6046c847e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101695, "uuid": "1261b9e9-bc4f-4f63-8775-c0e3b5960c54", "value": "SOA_MAY-JUNE_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d73de22-76a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060601, "uuid": "06bc7e16-dbae-48bc-8fbe-8f02dd4dc2cb", "comment": "Malware payload (Mirai)", "value": "89ebef16ef84c93afd92a02f4dcffc12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060601, "uuid": "df838e4d-d002-4c9c-a75c-4619f212e59f", "comment": "Malware payload (Mirai)", "value": "609ebd0f88a38653e61a25d6d68ec130c006eafb891085b7ce6dbcb299dfdc61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060601, "uuid": "f9402ce7-b065-4ca6-846a-a6ed546c7ed4", "comment": "Malware payload (Mirai)", "value": "19f64649b3c1236394629f54a7abc2fcbd719320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060601, "uuid": "f1144baf-ae44-434d-8164-76a992446a79", "comment": "Malware payload (Mirai)", "value": "227fea7f67e88575c29ccfc39bd58180e38af86dc304328e29888b39f989e5f3fd376ed8d1bdbae37d99ab07dab223d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060601, "uuid": "8163e273-e8f0-4467-864b-055d32a864ce", "value": "T138D3D80F7F729F6DF1B8C23457F34A71939822D526E5C180E1ACDA082E6434EA51F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060601, "uuid": "a63dbfe4-d681-4b1c-8eee-8e58d741190b", "value": "1536:k0pr77BcDVNe8ovrNA9put08srjh/f98+dlfQthKNb8dt9pCX6lMjODloDrMQFpE:SN3ovrNADkehRciVMwtvr0bstZnc6fZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060601, "uuid": "ebd7f2f8-9a32-48b7-9d1a-16f094cea4ca", "value": 131452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060601, "uuid": "2a26f211-c5f2-4296-9f8e-1909a68418a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060601, "uuid": "cc7c2430-9a1c-4b9a-99ee-e68a97e1c42d", "value": "Jvbm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee8a4bc-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101003, "uuid": "1a856a98-e224-43a6-9370-cc9a14741d3d", "comment": "Malware payload (RemcosRAT)", "value": "1f931aef160df5738d3a462e21625714", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101003, "uuid": "f831de2a-2472-478c-a158-230dc0365b01", "comment": "Malware payload (RemcosRAT)", "value": "61232799da2bc49bb8c17ff355e8863ad5e64c47aed917311f56106f11b44917", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101003, "uuid": "1e42af17-9d67-46fc-b73c-6e2151388cee", "comment": "Malware payload (RemcosRAT)", "value": "44426c4676aef6bc30d729b266814022a24cd291", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101003, "uuid": "8ab109a1-07bf-44c5-8004-cd5458107386", "comment": "Malware payload (RemcosRAT)", "value": "92cd2fd26f6e9a286894329626d70f8ae7c109f129f08cc22a7dbc1813dd5cff4cd4f429c197ac6b90d349c85ef0d157", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101003, "uuid": "24c585bd-cf22-4627-ab5a-9356a3ade808", "value": "T131C2E1F02A99460EED59AA7D36456787B460B3C9CD832938D507A2EE4F23AFC51C8360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101003, "uuid": "6ed4a60d-0e03-45eb-afae-36c36f5b9849", "value": "384:l0AYc8ffGJ7QdZpilJfCU0CR1MGiCsjsJJap9VtWYQmtpqIm1me8i9zHUQ:KAP83GJ7ki3KzCTMGiCWwJwcDhQipHUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101003, "uuid": "66918905-52d3-4057-9c1a-59149a78b736", "value": 27031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101003, "uuid": "a179bffe-a2e4-4691-a71b-eb01d52bfae9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101003, "uuid": "4eca2838-9c3a-4412-996b-7bd74eb1861c", "value": "MT103XWireXTransfer.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2337f0e9-76af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783063000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063000, "uuid": "a86a9fa5-e4cb-4591-94e2-be26b0ca478b", "comment": "Malware payload (Mirai)", "value": "d6625a2fd1dce98693f937fe0ec8a800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063000, "uuid": "5d9da5f9-1c7b-4904-930c-cef754823f12", "comment": "Malware payload (Mirai)", "value": "62c83c1d1d9c25f424e9a0d36f3c9f7d7cfb13c72d606b055c9db784354d4320", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063000, "uuid": "ffd83e78-a029-4c2e-ac30-49ea4d6fab01", "comment": "Malware payload (Mirai)", "value": "e815d3b487f9e65e5d2d97f8c5888cbf23e55587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063000, "uuid": "50151698-9e9c-4f87-84dc-faa77346b6cb", "comment": "Malware payload (Mirai)", "value": "b0fe636a9bb95da8e7a97a16927bcfb91e074dd374f80a7fa1aef91338f378f69ff2e7475944b970790e2966129bcfac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063000, "uuid": "973c9ae2-9c4e-4570-b28d-e8f303619de7", "value": "T10B443B42AA408F23C4D327BAF69F4345333397A4D3E77305DA156BB03A8779A6F26605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063000, "uuid": "90110f6e-5eda-4e4a-8574-51eb9cb4fd90", "value": "6144:ffIulUO0V5dA1y1IQahlGAqy08RfTrUls+S8FwXxHrM/RVJuP0vv:ffIuyF5sy1IQahlGAqy7hcxbKHA/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783063000, "uuid": "efa14742-1550-459f-af1d-3e369c6cf54c", "value": 261362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783063000, "uuid": "79fb8632-2da2-4fa7-83f1-fcd85f917cf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063000, "uuid": "3361242b-e2e8-412f-8109-bda7930a458d", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c695b502-7702-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783098923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098923, "uuid": "d51f6cdb-a70f-4e81-8be5-c4b880735a23", "comment": "Malware payload (WannaCry)", "value": "a20ea51a49e18c2d2dc9d385fc4e2424", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098923, "uuid": "ce98f097-627a-4c9e-9926-9f680986b8ca", "comment": "Malware payload (WannaCry)", "value": "62f1532516f3008ca2e15699e9862cd1c72eb84c7fb42289e81259d64c89b4f1", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098923, "uuid": "3586dc1a-ca8d-4718-aa2e-c30b763f228f", "comment": "Malware payload (WannaCry)", "value": "2e3d92b2b654ad638e238fc3824cf870a617b613", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098923, "uuid": "20fea954-452a-4e25-9bb6-9a44009e4c7c", "comment": "Malware payload (WannaCry)", "value": "a2fa7dfc81bc01788d603be99a98651733641857fa4998ade7e0f56358021d687ab5a51d5a10527f791f64338804706f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098923, "uuid": "83e62db9-7a1d-4482-a98c-7e74d08dd042", "value": "T1DD363358726CA1BCE0410EB444B38E1AF7B37C5967BA4B0F87C0866B0D53B9BAF94751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098923, "uuid": "bdbafd02-f59a-4dd1-946e-58aad013124f", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098923, "uuid": "05471800-1643-489c-94fe-68acb6de5dde", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DI8qP21Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783098923, "uuid": "51620542-84d1-4f8b-8a7f-fbceccce3444", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783098923, "uuid": "78d6eede-8c97-4929-89dd-28dd3386f993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098923, "uuid": "b2a770a7-1f4d-46ca-9c86-6a16b8903121", "value": "62f1532516f3008ca2e15699e9862cd1c72eb84c7fb42289e81259d64c89b4f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690ec2ca-767e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783042072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042072, "uuid": "dac2cf0c-e2b1-48ee-96d3-1367e42da55d", "comment": "Malware payload (Mirai)", "value": "e7fc768b36e73fad53a00d4101cb62f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042072, "uuid": "76ba525f-978f-417f-a405-ff2d284e5d52", "comment": "Malware payload (Mirai)", "value": "6453182787fa76dc0043ca1fb77af822584066d02b1491b25ae042a40b140901", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042072, "uuid": "69fd9997-f70a-451d-ba7a-256afae9885c", "comment": "Malware payload (Mirai)", "value": "ae64d1cca4b098304fc0ac00aa382019f0431c2e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042072, "uuid": "5e54c5f5-e81d-4dfa-8fe6-abc494203635", "comment": "Malware payload (Mirai)", "value": "58d9076f41387cc818e8ad49a27a997050c27128fa92d00af6af938d46d659f2642196d613bf5938b399ec613a9d5a47", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042072, "uuid": "8bdd57e3-552d-4a4e-af8b-1349e4dd4e23", "value": "T16E01AFC64750BA4080299A1E669751A4F421C3CF06464B787F9C5D7DFBA8504B027F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042072, "uuid": "a5a3227a-5c43-4889-919e-b2804cdd9124", "value": "24:kXCKysE2hi0ziQvZohaIjg7IF0oX5ujVqjN67:e9Qp+MsIk7IF0oXAxmN67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783042072, "uuid": "1b345432-950b-452f-ae0f-d2ca7f4f0580", "value": 839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783042072, "uuid": "e26feb97-6fe5-44f1-b213-024363f8d736", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042072, "uuid": "d5e805d5-06fa-4291-a222-5ec777b34401", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4458000a-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101711, "uuid": "eef5a2a9-fcc6-465d-80c1-022ad83bd283", "comment": "Malware payload (AgentTesla)", "value": "7d15c4bc8cf9946571f860c167245c46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101711, "uuid": "fb3107b2-8618-4419-8029-714bb14faa43", "comment": "Malware payload (AgentTesla)", "value": "65151e84ff1f2ecc46124acb2024dbd628accf91dd5e83c27dc0984cbab97272", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101711, "uuid": "c7e2f7aa-0cd2-4562-a0ea-7746468f926d", "comment": "Malware payload (AgentTesla)", "value": "75aa396f3c6caf5cd2ae3398368717a2972c3540", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101711, "uuid": "7a66f727-e795-4f33-ad56-86e50e02a6fb", "comment": "Malware payload (AgentTesla)", "value": "86bd1099d22e9078beb9c78bedf21adba406bdf1a805b528f815f39e0040469f4398b91afe48448a62628d3562576b1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101711, "uuid": "e945ecda-5776-466b-859f-d288452389ae", "value": "T1F165F10146C02EA49BDE5B3E62FE35C9E2B90DAE6416558BF732FC46FEF76009142274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101711, "uuid": "b43da721-40ee-42bb-9d19-8bc743531bb9", "value": "24576:2yLxqqeHd0LuM7I4UuKjHaykDmHWcA9vez2h2ReoaC3j8F6v:sYruHad9vehMjF6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101711, "uuid": "3e29a5ec-93a1-46a8-884c-5591b0a1a948", "value": 1504043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101711, "uuid": "4f753c34-21eb-48e9-acc0-e8c0b7ab9828", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101711, "uuid": "253d4141-bab1-41ba-a310-d2d55bb8697b", "value": "Kallon_Group_July_Order_Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea086c02-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101130, "uuid": "fbd79377-22e4-427c-b7d3-fb1d1d6daf17", "comment": "Malware payload", "value": "ff7d9aef7eca0a1633a59b2e237ddbb7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101130, "uuid": "9f8e0260-3657-49a9-a3c8-bedb51c61abe", "comment": "Malware payload", "value": "6597df067b41cad7e487cff2976e068fc1acb408d254b7fb6b15fc9d662f72b1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101130, "uuid": "0375ba30-ad5d-49c9-bde3-f062076175e7", "comment": "Malware payload", "value": "c5131fd2d0226840d362de0ed8e7ed632157c8d5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101130, "uuid": "020d27bb-7d37-4a20-b21f-4c2f74d4b682", "comment": "Malware payload", "value": "58cbf676ca8f12785562053fca4738281f06b72e76eafe0a8a464bf224bab830672bb3585d7054f4826bb1681f461b89", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101130, "uuid": "08bb4c0b-2cf0-419c-a7fd-222f829c484f", "value": "T16E52139280A52AFE40304CF5B62F136547A2A93C21CBE232D0F846D996F73A633F51D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101130, "uuid": "95a0db27-0d01-431c-a140-9049b2152acd", "value": "48:9RS+s2N9YTM6E3INfw6/mEYQfGMgsiyFW6+rl48i8DK7GGfmwerOIvMQ/x2OkyxH:c2KEYe65YWGuiLrD0Yw9mMKx2OLxb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101130, "uuid": "a80d1f2d-b7c2-4b74-b9a7-ffde24e94167", "value": 14193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101130, "uuid": "6658266d-a5ac-45ac-8c6e-3131b7a1f2d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101130, "uuid": "51d4e163-c9c3-45c3-b39f-174f06dee592", "value": "Swift-015062026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d71773-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106864, "uuid": "40f4548b-3a14-43ee-8661-ae8e6c740787", "comment": "Malware payload (Mirai)", "value": "f690fe3d3343dd018806acb02b8e92ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106864, "uuid": "e8c08ed6-1722-46c5-8b3f-bfac4b6d979c", "comment": "Malware payload (Mirai)", "value": "66f20c6e83535b714269058d69bfc620e1752526a10d6c851639825f55549659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106864, "uuid": "a3eae55e-e2b1-4b58-9fb8-9d8681b8c281", "comment": "Malware payload (Mirai)", "value": "a4cf4fea9023bc2a45f213d4c75b1fba2d814940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106864, "uuid": "baeab6df-a7da-4060-9186-5f5b1eb031d7", "comment": "Malware payload (Mirai)", "value": "17ddbad3c98e8a828c51275a496ecad87b6face356aae9911cc157e71ef2465d78250d4b8e2ee5befa30eacde2c4b464", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106864, "uuid": "20a825d7-fa6f-4e4c-8f20-e5622477fe32", "value": "T160B33AC1E64FD4F8D91641702267EB379B32FC76013EDA93D7A49B727C93A4198062AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106864, "uuid": "607fd9a3-65fc-4ec1-afa9-dce32e610312", "value": "3072:KJFrpq7W7PTL9rH5crC3MFZnKOiKYWFiHGNIiP4r:OG7WDTL1H5crIMFZKOiUL4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106864, "uuid": "c9258dda-764f-47b7-95d4-c76d59678bdd", "value": 116016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106864, "uuid": "79e555f2-187a-40ec-9c28-43f63af29755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106864, "uuid": "c5a253c0-2a1e-450e-aa2a-2a96d1dd5e51", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb4e5bf-767e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783042189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042189, "uuid": "f5d69a69-d41f-4809-865a-4a16a2ee61ce", "comment": "Malware payload", "value": "06708897fa510f0dc35e3c2cf1ce8211", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042189, "uuid": "71bf2e52-6946-45d1-b938-a6435f90f27a", "comment": "Malware payload", "value": "674fc0b5ead7acd834747c2a568ef218640b7787a2201d4724dd8d43292904ce", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042189, "uuid": "570e4230-6f4d-4d22-99e1-2ff3b1f2eb3f", "comment": "Malware payload", "value": "96c2f631ebf5c45f152d36e0273f9a875ac3489d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783042189, "uuid": "a83eacb9-4472-49f9-a562-4c4874443da7", "comment": "Malware payload", "value": "efa21258c61495a053175ca2da9d6da1003b61238313997b368c56c8e68c4f508c6c66a5ee725f05d344136ae59ff937", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042189, "uuid": "a92c1358-b2bc-49d6-baad-39dc0ef371eb", "value": "T1DDD05E927663053050A24C15EAC77910B6285B7F5D94E32EB98716302F4575AB4907A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042189, "uuid": "f85ab574-a892-4539-98ca-722376f983fd", "value": "6:hTcFpW2cWo6pAulNXYq4HvXDG+NjVsNXYrkJ:VLv76pPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783042189, "uuid": "ad495550-5038-4d7f-a356-7389e6e39950", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783042189, "uuid": "d3ebb6aa-2e42-4947-926c-42ad7c74fa42", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783042189, "uuid": "8e7bd318-d051-459d-a909-db81ea24629c", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0c01ba-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101270, "uuid": "551bb311-83fb-4a08-a858-7388353a1f8d", "comment": "Malware payload", "value": "ca31e62c1e8d37d93a6f350af15aefaf", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101270, "uuid": "42b4f1cb-a30f-4ca5-bb49-fd470013aa35", "comment": "Malware payload", "value": "689b4ed3c44126bc035c292d02370a0bdcec81ad4fc3e315df7541713e2e1ab3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101270, "uuid": "28811394-6c8d-40fc-bc95-622d77a081cb", "comment": "Malware payload", "value": "a3857b8611406f49b16f15418602044993eb049c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101270, "uuid": "86b3f588-795e-46e7-86ab-c52254c94643", "comment": "Malware payload", "value": "12dafd9c1c2e4137bd536e7e12d8c88b5d86142773eff2389d4c2c12cbf83cb74a8909861973a8c490411df45f618527", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101270, "uuid": "32e48c52-af44-489b-9259-acaf793c61ec", "value": "T139D4F111B451CA59CB160A364F86CAFA071ABCB3EE1A434772CEB70F2F726537D12166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101270, "uuid": "7747cccb-3b54-49da-b299-25f347ee10e0", "value": "6144:W4Z+RwPONXoRjZ7SezmfDlavx+W/WGuhuYd20md8iDa88SZyz1+g9hoAGgR+gTzX:Wb5E03oZK0WBG13Zd9/7RTcaLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101270, "uuid": "2d459d02-8c22-4034-b0d8-4a866191e780", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101270, "uuid": "1cf56f87-1284-454e-93b1-88768ea18eb0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101270, "uuid": "fecf6e58-0fc6-49e9-aa08-534629410313", "value": "Invoice900.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe087723-7702-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783099016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099016, "uuid": "d5ca100b-2a00-41bf-b70f-6a3c978a63bd", "comment": "Malware payload", "value": "db0c26646324a6ea8fab16883a8c8cd5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099016, "uuid": "9f2f074e-a31d-4473-ac4e-77776f5bac9a", "comment": "Malware payload", "value": "68b9c7ae6b51f211ecd0cfdd656bc3b14840627adc7073faf9504acdb0e52dae", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099016, "uuid": "56bcad09-82fb-4e62-a910-5f0b50ccf210", "comment": "Malware payload", "value": "ca2477fe4e2b80df9c3d61ea706261ac90aff39c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099016, "uuid": "dac08f1b-4272-463d-b03b-619303d9449e", "comment": "Malware payload", "value": "b156582bcfabeb8da6dd3f89bce44b2adabfe883a4e1b7d8e86d2674bcb6be4a30787a777748c6f06f12d1aad1a80376", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099016, "uuid": "75353e83-f223-48bd-8813-f5b8ceb0d46d", "value": "T11966F141F7D8996AC4BFC1365366033523874D168A82EAD39D0DFB6C3CFB4911E8A6E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099016, "uuid": "823c0c06-ed7d-480b-91c1-5ee1a0f6bf86", "value": "98304:uphub+/zsIsiiatsbbAcRD2wBo+O+n0Esr418RWWteJYBDE2kqsJfI2vNGITEi:ZxyBcRD2WPVNeROYBQ2kqsJfJv4zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783099016, "uuid": "90abca70-f40f-4537-8a3d-954cce5a95ff", "value": 7084073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783099016, "uuid": "dd3599b5-0e1b-4cd0-8a8d-d7d54a2b6408", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099016, "uuid": "677cfeab-491b-4782-b416-fa2c6467b6a2", "value": "p_1773322694470.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302667c7-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101677, "uuid": "f715866f-d259-4478-9b75-8d7cad36d9d0", "comment": "Malware payload", "value": "1cdcec5939f84df4dfd3b11317b5776a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101677, "uuid": "2078aa7e-0bf4-426c-9d12-1856f27d5528", "comment": "Malware payload", "value": "68befe694a386c1e01cbd5a53b7e3aa458b11a128a7a8cbc3d23ebb89b4ee7ef", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101677, "uuid": "a4c667d1-dc2c-4f33-acde-68c2155ecdd2", "comment": "Malware payload", "value": "1d2a740ad2444ce3be757eb7f7b3db3810272e45", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101677, "uuid": "ddee3afc-0d40-4428-9bc7-0f6014d7f4fa", "comment": "Malware payload", "value": "4118a65d47a732e93c14faab7ad28eddc9912f24aeb4b99e1db2fe94a827e053a099c1329081f4bcf3b8fbce18785919", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101677, "uuid": "f4b96cef-581e-4c74-a5e2-1907fc16dd50", "value": "T10ED2E1E5A3898921E14BAC5F9DE129377073BEDA404374328413EF4FE02A99F3799917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101677, "uuid": "1fff8a89-9047-4371-8f07-15887919a004", "value": "384:lAJ6evvtCMGuUTPFzzlZa5psSaqYOg9dHTeTMLyk/cISxLw4FQE+nrZxjg7p9Sh3:ags4AWdzO5pbYRYT+yk/3ywulsn4SzLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101677, "uuid": "dfd7be36-d3eb-40e1-9bff-c99e3d434cbd", "value": 28310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101677, "uuid": "e1955383-f4fb-4285-8916-369eba447d4a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101677, "uuid": "5cd7ee09-b696-4052-b7ca-e9d659e0f723", "value": "CIXXXPLXConfirmationXforXtheXOrder.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d8bacb-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106869, "uuid": "fee8265d-ef13-4e97-b1ba-1058a5b93178", "comment": "Malware payload (Mirai)", "value": "a9e6c6a4b2c306695dd177faa15055d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106869, "uuid": "f0c8ff84-500b-4bc4-80e7-d5efc90a624c", "comment": "Malware payload (Mirai)", "value": "69cbe4f3ad816def514f1ec5c6cada7874be2d0230ebf89ec1aaff8179daa0d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106869, "uuid": "5ab97d91-9bd3-4137-818a-375d6dc2c45b", "comment": "Malware payload (Mirai)", "value": "64618c69a12d740bd66666bf7c2e5ae06a58dbac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106869, "uuid": "b7d81c15-dd1d-47ba-a9fe-0b525eb30573", "comment": "Malware payload (Mirai)", "value": "235aa60e0e02a121f6265ee6171f02a90be94d2671807e609c56f2d89bd87764af56893d33a7980d4551486815f0ea40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106869, "uuid": "359c3ffa-be27-4b82-ab2c-7da848339d3c", "value": "T1A9E33B9DB402AE7EFC0BD57E4CA70E15FA31E3B12153172A629BFD63A8321650D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106869, "uuid": "31b3bb75-86ef-4f94-8048-058685ff37ca", "value": "3072:SwzwVQJr9BDFuYEPG934Lbw6hkodsdb50MHp5FEAYt:EI5uYEPGhd65sZ50MlEAYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106869, "uuid": "bc1c4ffa-b271-411a-b198-6f394bc4659c", "value": 152520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106869, "uuid": "4b379296-0f91-4dc6-8819-192f4372b71a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106869, "uuid": "6457d840-842d-4df1-af09-840c16837015", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef1e6ec-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101514, "uuid": "4694cc78-c41d-4fed-a137-83c09e5081ce", "comment": "Malware payload (RemcosRAT)", "value": "3a829b6902b45ceac2baa11df986f3f8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101514, "uuid": "730dd541-5f55-4b46-b519-d9327cc18312", "comment": "Malware payload (RemcosRAT)", "value": "6a592b97c9f875b52a6114c895b5d69b03ca8cdf8b85decd12bc0a9c8ce3dd10", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101514, "uuid": "d5c18d18-a5bb-4ce9-ada0-9e196e8165ad", "comment": "Malware payload (RemcosRAT)", "value": "157bcaf4a20ca71d8b04c412a6b99bc41ddc377e", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101514, "uuid": "1ab2312f-ecff-461d-86bd-4a3d61b34f67", "comment": "Malware payload (RemcosRAT)", "value": "f7d207238569e5a9e367b87ff877d629f2a99a2087c0d31d37800b341aa0a4b25a7e9551c420692cd2f64d016e5e84e1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101514, "uuid": "7bc70c5c-ac62-46c1-85cf-bafe50ce5941", "value": "T12C330275F520E242ECDF0778EACBE7E6388B4E3A018CD249E520793A0999F0B5B54C49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101514, "uuid": "9df725b0-9daf-4e3a-9f69-2d668c8aa50c", "value": "768:hWHN7DvqH0kiKpEcVYcyL8prux0GtQjcd/USDdPhP1bghtAvN6+ogTst:QE0uprYdyr+tQjRqxPgoY+oest", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101514, "uuid": "10333f3f-d0de-4708-9335-47c66acadfe7", "value": 50566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101514, "uuid": "a1d1aa09-b7d2-437b-8c9b-6cc4ed47a154", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101514, "uuid": "2a5345ec-8f66-4c78-b6f6-7883ea2e32cb", "value": "REMIT.gz.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d1086b-7738-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783122084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122084, "uuid": "d0e90d16-f452-4cef-81e4-321e82c93ea6", "comment": "Malware payload", "value": "6c05ab37c2665353719dc535df55d6c4", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122084, "uuid": "6769c2e7-f117-437f-ac38-b441f46234ab", "comment": "Malware payload", "value": "6af02f9f08e5d6e9318ed302e4d74618148f7c600af1b394e05812b18b8ca040", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122084, "uuid": "8569fe61-f6cd-471c-a82b-6c50ca20853b", "comment": "Malware payload", "value": "2801386033834bede5f00d5442192cdfd6fe31ce", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783122084, "uuid": "98cfb1a8-da1d-4b9e-819b-33f8b8158b74", "comment": "Malware payload", "value": "184c56288ec3b27967f0016aa6fdfaa3e35244f1468e43a0fd899ea467691fc1ac04f5b93645eebe8057343c5e0f771f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122084, "uuid": "960be8eb-bce7-4b69-a8f7-665ce08f8890", "value": "T1F5B68D03F9D540E9C05AD2758BAA8222BA71BC494B3177DF1A9077352FB6BE05F3A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122084, "uuid": "2cdca77e-ef83-4b40-8816-1d0b949005fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122084, "uuid": "58eea3fe-1328-48bb-a9c2-667b4d1c87f1", "value": "49152:vrP7Fu9N/CRE6ceYo+HTbBsoyE2anHcRhfLQCVXcBRT4kWc/msgy654KUjESSsD+:vrBERnHc/DQjkv2NB8eg2dS2aZIF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783122084, "uuid": "79724865-576e-43fd-8fbd-f88be0787480", "value": 11165016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783122084, "uuid": "7ac89619-8a70-4d99-b8e0-3cdb20a340d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783122084, "uuid": "9ceef04a-5b4e-4379-bddf-655bd0770e4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8fa068-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101672, "uuid": "277afb67-afc9-4036-9634-e24bb36bca3c", "comment": "Malware payload", "value": "72d9a93fe49433830af7341c42266d4d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101672, "uuid": "c24ecbc8-89dd-4095-a21b-3ac8ad81145c", "comment": "Malware payload", "value": "6c3a7e8568bf2be5e06bcbede0a12d346b4bb14ab22d8d61100359e95af40215", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101672, "uuid": "1ed60972-f207-4659-a837-7a38476b52c8", "comment": "Malware payload", "value": "1956ffbc181ac016c5f88199e231fab1b66c591d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101672, "uuid": "db7d0a30-023a-4ca4-ad25-b485dfa3a735", "comment": "Malware payload", "value": "1a46812bef3d905ae808bf480542cab14e1da643f91d019c3e66fcd9c7e45a37169b7b78e8ae031ef64e28c6b4bc2a06", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101672, "uuid": "ff92c673-49bb-4516-9711-1473e1363d75", "value": "T1E254224B701CC63CB539CAA2886592C153E79CD77AD3813C9EE6272BA09177325498EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101672, "uuid": "0862ca09-47f0-435b-8015-4550e50bc29e", "value": "6144:zIskbBo/g/2DkOdms2of1+r7Yej76slKAKwnA8TUlyKmTYB152mRP:kbCg/gkq7F1iP1nAwUUi2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101672, "uuid": "b570a4d7-ec1a-4b48-baff-3dff9f06a801", "value": 279683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101672, "uuid": "83f3ff9f-8577-43e2-9ce0-f000959687e2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101672, "uuid": "76117690-4374-49c4-8a72-5f222040e709", "value": "SKMX6739921081.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1f0090-767a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783040520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040520, "uuid": "3d8c77c4-e67b-4ddd-a5f1-77376e5f48e3", "comment": "Malware payload (Gafgyt)", "value": "7a1ba9513c1e878831286d5bf056190a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040520, "uuid": "35679a51-9d9e-4bb6-8f94-883a4d787bd8", "comment": "Malware payload (Gafgyt)", "value": "6c84c701190032361e71713159e3c501810c42b56af1664d016f291e405c0e44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040520, "uuid": "fc38abca-36e5-4738-af01-c72533bd2348", "comment": "Malware payload (Gafgyt)", "value": "de081828272ec48c032fbe58d7e8ad33c1d93d5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040520, "uuid": "65b98f6c-c866-4f11-861d-827cb0aa281d", "comment": "Malware payload (Gafgyt)", "value": "4366e229ed55624518cb981ac9d6ecac44a8c3ae031f743835f32949ef9f98bc6dc37307cdb2df8597d5d2a56ba27afa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040520, "uuid": "34bba0ed-c229-4b73-99c9-798e54c560dc", "value": "T1F31419A67711AF6AC168C53405F383E597F6239127A38145F22CDA2C2E6234C1DAFEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040520, "uuid": "f93df352-03f4-40e4-b02a-7cdb753dccb2", "value": "3072:UB0esp+BkbxVPGD4kMIPePazOjHQedC0FRY46Hw3:UBOJPOZ/GSz8o0h6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783040520, "uuid": "309d950b-3d29-49d3-b501-467d210e8093", "value": 202352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783040520, "uuid": "c1684a91-c480-49d0-ba2f-97ff3b7c1b5a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040520, "uuid": "1372b663-a1d0-471e-98de-911125e39726", "value": "mips.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328a0892-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101681, "uuid": "e2cf0789-2e95-447a-93c2-70d7ef2a00ad", "comment": "Malware payload", "value": "6ac0f91715a9e772f83d6160b49768d7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101681, "uuid": "e3fd3b87-a60c-401b-9707-3c650fb02dae", "comment": "Malware payload", "value": "6c95e1fc4fe30c0a2c3af0cde36544b2a7b3929d18a9b2440d39ae30c95c055a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101681, "uuid": "2cd1e22c-4b99-43bf-9077-5e680ba6a1db", "comment": "Malware payload", "value": "36c3bfd310d70c3c831dc4f6a87d59f24682a9da", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101681, "uuid": "0eb12efa-ab7f-4486-aebd-6f09f2114214", "comment": "Malware payload", "value": "8964b6242ae62aac5325dd94a4cec7d0c5629c3de47f0565ae9d86b48e70c681d36ef60bf6a0e6a54ee1c69e20abf2eb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101681, "uuid": "39f84632-9ddc-4db5-b41e-3bbd94c1e9de", "value": "T19BD2E1E9A3898821E24BEC5F9DE135363073BEDA401379328013EF4FA02699F3795917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101681, "uuid": "df4cb2f7-1130-42e9-a17d-b20e9e9421be", "value": "768:Ufgs4AWdzO5pbYRYT+yk/3ywulsn4SzLpK:qrIklYYi13ywAs4qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101681, "uuid": "c1629f42-0cbc-43c7-b2cd-ad2b2f473d2a", "value": 28298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101681, "uuid": "d6039015-8cb8-4ddb-8b86-b8edf5500c9a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101681, "uuid": "ba399c55-ed06-4b70-b87f-242346d0f497", "value": "ProformaXInvoice-309-Ref-284.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73469381-7696-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783052397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783052397, "uuid": "3cbf8bb0-99b0-4b87-ade6-592ae1d9652f", "comment": "Malware payload", "value": "32f4c5c62d1fe06b7fab6aa7e8e09ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783052397, "uuid": "acd4a36e-3961-47c2-81e9-df7eb249bb5f", "comment": "Malware payload", "value": "6cbfa9286cf8719ebddec2e30b0d63b2b351d43e8fa91c0a5e55185b4be1e51a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783052397, "uuid": "6cea9abf-90ff-41bf-8a83-40212ba1bac1", "comment": "Malware payload", "value": "e3720fe39c50f859921cff8b6b2f9b4c0f287253", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783052397, "uuid": "8a6f344f-719a-4fa5-a2a4-04810ab06e81", "comment": "Malware payload", "value": "3ac8738681c196cca90b8d71c348b4fc2bd58c5056dd7fcf341146f8cab14a797592ac89fa59fd3adc8ac18859573e01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783052397, "uuid": "7f6ff427-d882-4c5a-bf67-2462b8f953cf", "value": "T160047CE1631D7802F982F67E4E7B07B2669D780B562050BEF6542A14B4C3AB4CFD84F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783052397, "uuid": "3922b975-a1d1-4891-9f8a-4dfedbef19f6", "value": "3072:3SSkERuZTWivJ4GZJKQFQIF5bOrggF5PZHmOLejjaG:CPEQvJ4eJr6XPRmOLePx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783052397, "uuid": "30dd446f-a7d4-4480-8b76-c874591f15b7", "value": 188048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783052397, "uuid": "de4293a3-ace5-49b6-8b16-b6c60e53828e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783052397, "uuid": "c17bd723-4666-46c3-8815-4edcd497fd06", "value": "SecuriteInfo.com.Linux.Mirai.9816.18257.25277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f92fe4c-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101300, "uuid": "170a137e-f708-4a3d-818b-ff483598a545", "comment": "Malware payload", "value": "773b41673ff340e209f3ba9f23082be9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101300, "uuid": "32561e1b-4bc4-4ea2-878a-0e76a4561fee", "comment": "Malware payload", "value": "6e544036d15ab4fe9bee27d304bf5f04a2008a6006b0a9ca28253ad2a5c7af87", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101300, "uuid": "3c07282c-7abc-4665-9684-3ee3e7920c82", "comment": "Malware payload", "value": "bdcb3ffd1eb48cf750daaeb48730d3157d082aed", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101300, "uuid": "ec08253a-46d4-4ec7-be87-7114e2bfca3a", "comment": "Malware payload", "value": "9b0860f09b94f5e34f7ecea8711b5b982e4188a15dce1d6b97cbc983c82144eeeaa538da00ca6f3764eda7589a87b598", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101300, "uuid": "e881c5cd-a99a-41a4-97db-3441da165952", "value": "T13FB312A7A8CE23A3A042F17D569F141F97D534EA84B5A4187AF6FFE8244432D33E4538", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101300, "uuid": "2a269e12-30da-4b54-aef0-dac38c4ddd9b", "value": "3072:OhknI+O8mJ2e6P5GpadsIp0cYPGmT5ogmrLyz:cQIOmJ2e6xIwhpB/mT5Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101300, "uuid": "17ff0c6d-f860-41b0-b601-47b0883acbaf", "value": 110174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101300, "uuid": "b69b9527-b5cf-42fb-b133-5be29f0ba6c6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101300, "uuid": "bad8209d-f5a3-493e-b63d-ae2eb50080ca", "value": "Quotation-XABOXQUO-27819082_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934be257-76c6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1783073067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783073067, "uuid": "f2409b5e-0be1-4d58-90a3-cc9a27f7c75e", "comment": "Malware payload (DonutLoader)", "value": "85658a920f18a0194f944f75bfa20e1c", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783073067, "uuid": "9a0cace5-578c-40df-b26f-17cd9b9382c5", "comment": "Malware payload (DonutLoader)", "value": "6e75302cc7aefb9254fe8c45638dddfeaef9993941a4942dfa91fa5f6aeb319b", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783073067, "uuid": "6321b4f2-b22c-4b5e-9ff1-f858a842902c", "comment": "Malware payload (DonutLoader)", "value": "5f643da83f48cf68e67cd6c4776921d5bab581e3", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783073067, "uuid": "82dcffc2-597e-4202-b46f-6decab427dfb", "comment": "Malware payload (DonutLoader)", "value": "8051be1f931e4abba019f26e7b3ecefc40147ed46855ec80da5a5e5004699cee7c66f8a74c34016bf436a893c256440d", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783073067, "uuid": "65c959b6-3ac8-4c1f-953b-452fc54eef0b", "value": "T194B423B81CFD92966916C1FF211F2027C72ABCB41698E03CD23F5D91F95D75EAAC4822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783073067, "uuid": "0e37f8fb-edcd-4cb6-94da-1174c1f974ec", "value": "12288:o9Oo/WFlOFBUYa4AAz3v7XqG9ZyUqDBJsNMlnDXT79W:zo/IGBUxQfyJDQKt78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783073067, "uuid": "e33a40a4-9654-46ef-9a49-323693e600a3", "value": 542278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783073067, "uuid": "10497811-d0d9-487e-886a-6436770399dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783073067, "uuid": "f0d7b67d-a57a-480e-96c5-b13ffa7cb84b", "value": "Anzivota_Application_Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b375df-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783100968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100968, "uuid": "e8cc632d-ea56-4e3c-bb70-7a36e074b2ee", "comment": "Malware payload", "value": "a60fffa65dfd98b94d6b9d6799e2bde9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100968, "uuid": "aa7b4cc2-7511-496b-b514-c926513a4dc7", "comment": "Malware payload", "value": "6e79ef38577cca732976732c38ee22f5f3102a7a4458da6edb708b4be5afb9b0", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100968, "uuid": "7228e5fb-a999-46c8-929f-09917da81d1d", "comment": "Malware payload", "value": "305f7b64e8c004dcff176887cd60f48a3bc052ab", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100968, "uuid": "5079d6c9-85be-43e2-94c7-4bc5d8c18e15", "comment": "Malware payload", "value": "048b7223dd0f61f3d676bc471b4124b265f6b1047a86ab16a44819b1d7b38382354c6f2e8e41348423fa977332707282", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100968, "uuid": "dc9b69dc-42cb-4587-a5f8-5d288fefeaee", "value": "T1D173F0353391C552D591913D4DC4DBDB2B283C92BF934A4B76C0B79E2AF11A28A0772E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100968, "uuid": "b907b160-838e-4b4b-8a4f-3dc5fa64bebd", "value": "1536:GOAZ57UxWrXZhAojrJ3rpLxupS1Xb4VCE1x:GOAzAxWrQ89p0pSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783100968, "uuid": "529c135d-c716-4f42-a375-fdee746d5fab", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783100968, "uuid": "d53ecb67-8252-4a69-a83b-1c27ffd9d00c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100968, "uuid": "80f87333-8863-4414-9219-226eb9c3300e", "value": "Thermo_Fisher_RFQ_TFS-1507.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90688f3a-7726-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783114294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783114294, "uuid": "908a60c1-333a-484f-a6d1-da2c44c2878e", "comment": "Malware payload", "value": "a9b0e1e3d08a4319912b72023de3ab5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783114294, "uuid": "eb67ee28-31c8-453c-be29-175a1db41c0c", "comment": "Malware payload", "value": "6eb5274407dd458da90fd988c04e30f5c14cf813fb4a4489b6a64eddc966a7fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783114294, "uuid": "dc986f6d-e64e-4c3c-8c82-275860a3e7e1", "comment": "Malware payload", "value": "d551d742d0fded65ba7dc5abcb7fdce21365ff50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783114294, "uuid": "fc4ee46a-10d2-4e77-8ddf-a1b93a66db0c", "comment": "Malware payload", "value": "c13795b26d77e690ec445a0af55985ada8d79f68ff5be6b05bff98adea0f7f78549ce43c8c9948491410a9047e5bd50e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783114294, "uuid": "d37c939d-44b8-4c02-a492-1702055f0815", "value": "T1F157CF7792167CEDE9B98DB4C01015816DA878874778E3C7BAC870E6A6EB6D08D3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783114294, "uuid": "1a73caf9-ad3f-4dc0-9c2e-3252291d328e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783114294, "uuid": "5e2ec1ef-eb0f-4095-95a8-c9b62488ba41", "value": 28835840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783114294, "uuid": "11ea5a99-453a-42ab-bdfd-ba2d100b89de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783114294, "uuid": "23bd726c-d911-408a-a561-0fc429c18703", "value": "6eb5274407dd458da90fd988c04e30f5c14cf813fb4a4489b6a64eddc966a7fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feaa85c-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101381, "uuid": "4d8b317a-3ff2-46b6-904f-706f7c4fda9d", "comment": "Malware payload (Formbook)", "value": "4da40a378b91a1231d9e3a105d61fe9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101381, "uuid": "70a51aa7-46a6-4155-91cd-d16af5a09ace", "comment": "Malware payload (Formbook)", "value": "6ebd94209f4a45ea9919b17f13d6c07a6db2be45a399e9f8db989d7e961e0d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101381, "uuid": "ed674553-39d1-4b8d-8fb5-6a185514ceb8", "comment": "Malware payload (Formbook)", "value": "758e11b9932676a5a10638f98be05886f935fd3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101381, "uuid": "6bf00992-27d5-429c-be7d-024a56832f60", "comment": "Malware payload (Formbook)", "value": "02866e54ae52e11e4932f3c134dee2058be4f6291dd7dfb24a9967df116180bb5fb71e9ab780713551e12a40bf47a96f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101381, "uuid": "8d123c41-5d56-4bc5-b44c-34e35b67b93a", "value": "T1642512986749E217CA656BB41A71F2B403BC2EED7904E3175FEABDEFB522F040D04252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101381, "uuid": "2869a1b7-74aa-4da8-a7a2-6cf605ed69fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101381, "uuid": "882003a9-c596-42d2-8ffc-c6165bf3c531", "value": "24576:y+Qb5Q/rqAJkXLWby+STpFkKNJo4gm5Tp4YA/lxl:y0T7oXTZNHCD/lxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101381, "uuid": "8a8251ce-9573-4712-b121-fbe116f7f0b5", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101381, "uuid": "e900e82f-2f2f-4adc-bdd7-0de6aee02bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101381, "uuid": "3694f76b-954a-4d2b-819c-caaeae8bcad5", "value": "ROT-20.06.2026_-_OOCU6741260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4efdbe-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783101432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101432, "uuid": "afd432b4-e4d3-4b81-82a3-c1e296426e7c", "comment": "Malware payload (PureLogsStealer)", "value": "45dccce6991cf43803c13dacec8c71ef", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101432, "uuid": "1446a9c0-e0ac-45cb-a503-4d75e933c9bb", "comment": "Malware payload (PureLogsStealer)", "value": "6f1bff025d794a0438bf300b6ce093ebf5459a0f00fc38c2f7e3db547b5701c1", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101432, "uuid": "d1a547de-f976-4898-b78e-2d5efcfb5a73", "comment": "Malware payload (PureLogsStealer)", "value": "c09023ce28ff3bc426aee187ba7e2122df3469e2", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101432, "uuid": "c4eff557-40fd-4d5f-b389-b1d081a22663", "comment": "Malware payload (PureLogsStealer)", "value": "de3f92985adb9d0da80d1726dc93ce317b32a1a42f4edb0dcf331457b6054b3abd673d7585f972e929217514793a7e18", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101432, "uuid": "8961201a-a02b-49f0-a6cd-7216e6ea69c9", "value": "T1BDB423E1D2B46453C48FD1F71A5936B43BE016DB22AA757728DB94B3061D2C23DBB08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101432, "uuid": "e61ae3dd-518d-4c5e-a2ec-70911358636f", "value": "12288:FS11eMoP62B8mT6KwmAUhGJshnFposzeW7pGpzk:Fk4czF1UyYDLzexp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101432, "uuid": "b4bb2e0d-265c-4104-8c20-ac6f279c56ee", "value": 494115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101432, "uuid": "283382a3-c76a-4309-92fd-6d98e23f22bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101432, "uuid": "8ba3c1b7-91f3-4d83-b749-6b0cefb63224", "value": "RE-KFQR2M_Rechnung_vom_18.06.2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a34183d-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082742, "uuid": "e39ccc74-9397-4533-924b-12bea84a2228", "comment": "Malware payload (Gafgyt)", "value": "529ac598353f300831daf527358753ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082742, "uuid": "b229f9e9-5f2b-4e79-a19b-08bca3f1df9b", "comment": "Malware payload (Gafgyt)", "value": "71c142a6e398c3e631d5e6be4b554c120af4a6790e5f5dfe2957514eafc9673d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082742, "uuid": "e5c41eb5-62ef-45f6-81c4-e9851246cd49", "comment": "Malware payload (Gafgyt)", "value": "83bdf01700b50cb38e46c0df1dae6d5e0d056fbb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082742, "uuid": "664c2c0f-5752-42a1-a0bc-4888596f5893", "comment": "Malware payload (Gafgyt)", "value": "7778e178924e14d414a0d0f43f14a17977c885de20a382226cafa3c1c9569b4fb78254c7fd1c4187f6c64471ad2f6efc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082742, "uuid": "33ba6a31-dd91-479d-aad0-f34521bab73d", "value": "T121C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082742, "uuid": "dfe73106-42b7-4477-b2dd-1b1d9951e35b", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Ep1+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Ev+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082742, "uuid": "f973258c-6bb3-4aff-8743-12a70ff007f6", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082742, "uuid": "64037ad4-3f22-41aa-87a6-241a6abebc04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082742, "uuid": "8f798881-b954-4d93-9948-9613dfc770db", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aeded30-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082743, "uuid": "99f3422f-dd9c-45b3-a7a4-d7b6e583b98b", "comment": "Malware payload (Gafgyt)", "value": "5bb2d2cb8c39cb12313e213b74be1890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082743, "uuid": "69689a3a-c0da-400b-a3a8-f7896152c3ad", "comment": "Malware payload (Gafgyt)", "value": "7273a46d2d79c54ed184dd03b42a3e8e48bb9deaceca01936a6ebc754868c5af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082743, "uuid": "789ff1ac-7059-4015-ba03-ca9cfef93281", "comment": "Malware payload (Gafgyt)", "value": "f2c5763ea0533f421a1eafa1040e5ef3f6c3dca0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082743, "uuid": "4b10f8ff-439f-4bc2-ab64-486db45599af", "comment": "Malware payload (Gafgyt)", "value": "5267f46d97817087fad57cabd25e6485e71623a9c792937bea5307382416967f4fddd529dee1c1db979ba2312b71ef74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082743, "uuid": "ca77476e-7546-4d0e-ae13-8b7e701b7380", "value": "T12DA30896F900DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082743, "uuid": "dac402c8-a9ec-46f4-af74-bb6ea217bcb4", "value": "3072:nkrWBIvC/IymEdH8ffK6OKmuxVqDr78fz1e:nkrWBIrym+8a6OKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082743, "uuid": "83466191-6124-48b4-a969-265f0ef071f1", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082743, "uuid": "936a700f-f8f4-44da-a91a-ebab92580aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082743, "uuid": "1251a693-f582-4308-96c4-7c92d8b5e7d4", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594d898e-7687-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783045911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045911, "uuid": "6a17ff90-025b-4280-b357-08800e515c9c", "comment": "Malware payload (Gafgyt)", "value": "de6a5be52b665c5fb7914892c4e7cac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045911, "uuid": "8a36fee0-23cc-4975-a3d3-51d4bf5aa45e", "comment": "Malware payload (Gafgyt)", "value": "7286691d7986d2ba342adfc68697a81a3c7050ccbcad3ca4600f4205993c6588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045911, "uuid": "e06afd2a-28b6-492e-84f4-15a2213aa683", "comment": "Malware payload (Gafgyt)", "value": "a3e020fd83ef612a380b79a353d6d7e9c4f11345", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045911, "uuid": "d6d8deef-938d-4759-8690-75fc8c22c9d4", "comment": "Malware payload (Gafgyt)", "value": "c6cf90bcd07e132366454721e52ce751bf6f399be188590bd354ae2f386e59a5a1238e54c5b84f6b20543572aae51d68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045911, "uuid": "f2da9d36-4c04-4a60-bbbf-50f3d966007b", "value": "T1BDF31A5CF9418B5BC5D0257AF69B128C33724B24FFDA3B05DD146B283BD2B299E2B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045911, "uuid": "479a1f99-8942-4518-9f48-8d518eac64bc", "value": "3072:RqzNsnSVOr/P++DutK2ozamci7h26MRXvEiA0QMLX1:RPSVOr/G++oz/cZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783045911, "uuid": "5f2830e4-58d2-4c53-91e8-5b00bbd7831e", "value": 159176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783045911, "uuid": "5656ce70-7eac-45bd-9098-9bd0244ca55e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045911, "uuid": "3b37e3a5-d0a6-4cd5-861b-89777eaa8793", "value": "armv7l.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8a31b7-76be-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783069566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783069566, "uuid": "4c06fcc2-9461-4118-a723-1033ffbf16e2", "comment": "Malware payload", "value": "03777c1c8235b75136f1d34742c658fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783069566, "uuid": "20680f23-e081-45f2-a4e3-dfc3122786eb", "comment": "Malware payload", "value": "7345401e4b16b1981e68e1a899e376d159be35b7f8afe549ffd06a148b5c7e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783069566, "uuid": "ccf637eb-e064-4c26-9934-561aee440c01", "comment": "Malware payload", "value": "235ccfdbba3954f3a1df7f66006de80c3c2dcb50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783069566, "uuid": "488b7fe8-571e-4615-8b8e-b4f33471d8eb", "comment": "Malware payload", "value": "d871144f8d375e4666d4b95eae782b0089bc63a8c3c980cd06887d4d9539eeacbe0f5ff81b3aae23ee9740a81c3baead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783069566, "uuid": "c41258c7-597a-47dc-8f66-40f8e5fcc60f", "value": "T1D7876D1ABED578725BFED3935BD3CCBD8517900012633C9F298A17C88409BA8AF7625D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783069566, "uuid": "90f22c18-35a2-4793-9948-558d9046d324", "value": "dc024784c4949abfe5789f50985a0f0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783069566, "uuid": "0d3c8c4d-c200-4e19-b61e-feb562d3b401", "value": "49152:GD+D8pl4zyaq5P1OWoIm6G+a9VZh/VgxFWYUtTe4s3QM1p:GD+D80e4Bh/VDtTjsAM1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783069566, "uuid": "6c1803d5-9418-49df-a176-81ee0c431757", "value": 36447408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783069566, "uuid": "64d2af94-76ab-446e-b46b-0418efb04c4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783069566, "uuid": "30851a15-9767-4d2d-857b-e7e8c0b0bba7", "value": "30-day European travel plan.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e8b298-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101559, "uuid": "a8171f21-5f6e-488f-b26c-18d9efd99786", "comment": "Malware payload", "value": "d9af426b224835a078e46a6a6069ac84", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101559, "uuid": "12d5f741-c984-4ced-a4b9-da39e9a3ea8d", "comment": "Malware payload", "value": "74c86698866f7ce92019973b25b82b039b750f479fe4d2f9a40def07d52a3162", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101559, "uuid": "1cb721a8-6939-4476-8aea-eb7ae3d76714", "comment": "Malware payload", "value": "57021a5d403fa638ae4122aba0cc59cafc35effa", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101559, "uuid": "6debf6b4-7738-4c1b-b3d7-55b1dd89cbb0", "comment": "Malware payload", "value": "3cad2c7f6d3ab12090efe7452d41fa78a4e36be8d4e1e24e6940f7a149ff2bf83d5b436486f54139a2673178b58835f8", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101559, "uuid": "cecd7ddf-42c8-4fd6-b654-b8b5cba4cbc3", "value": "T10B74011BF211A67FD99A9B7608C286A7113EFC12F88993177F56774F5039BE2F01201A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101559, "uuid": "50fef08b-d2b3-4e8f-9ffc-b4b12fc159bc", "value": "6144:ZZJ9X1hh+GE6CgTGOh3vm9bY374ucVBx3k8+xCd/DVIoFdAFr5EVkqRXu:ZZJ9zVvl37lYc8hJioTcgkqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101559, "uuid": "68579973-70c9-461d-bb63-62989c0d0e4a", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101559, "uuid": "6283e02c-b245-4165-a813-062e2e1abb49", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101559, "uuid": "77b22015-fc44-461d-b75c-91bcf73d9a15", "value": "NewXOrderX546473.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cae373-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783077478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077478, "uuid": "ecb4df98-577c-4a36-ad36-4ccb755db9cb", "comment": "Malware payload (Mirai)", "value": "cf0af5614c5d72f8a16b0abcd22ec0e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077478, "uuid": "3c1c2630-556a-4dcb-8fbc-d49c3f6b9b81", "comment": "Malware payload (Mirai)", "value": "760def1c15c00c20b9cd130d9acfbf7ecd90be8ff2dbca1054527a1f97aee8ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077478, "uuid": "09aea92d-9381-4e89-9da6-865098de86a6", "comment": "Malware payload (Mirai)", "value": "88723d0807e38f9f104f140f9bd2578abeb7c270", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077478, "uuid": "7311229a-087a-481b-888c-335eb8300c08", "comment": "Malware payload (Mirai)", "value": "35c657dbb56c5b6a4a6eaa189f4f8cf1168b92fda1016633a899dca8cff2bafe34788e84f321af8a8ae89165f8595f5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077478, "uuid": "cb2146d8-fa5c-4387-840a-42a535d7d471", "value": "T1D4D30845F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378696B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077478, "uuid": "76ac40e5-038f-46d6-b59a-ae25c68f86fb", "value": "1536:IKdzElm18uZJNb4AMFa8eAZHk4VB7fzTT7rFjg4SvDeeqZPt2Ulqawyw6RNPITia:IKp50jU8e947LLrFjzSSthtg61K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077478, "uuid": "a5feaa12-c803-4104-851b-9a8de871bd20", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077478, "uuid": "0b61299c-05e8-4a5b-a0ba-f0164269db60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077478, "uuid": "0a1188e9-e90e-42f2-a99d-745216ac3421", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f9dc29-76a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783056943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056943, "uuid": "e6b0fa91-49bd-475a-822f-b2d774a95f15", "comment": "Malware payload (Mirai)", "value": "48910039d8d0b6f32513a43dd428bd3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056943, "uuid": "eb8c3d7a-814a-4b37-b811-d2a1f7ffd323", "comment": "Malware payload (Mirai)", "value": "7630246096e94226a10bb5b13165c9d90ff0ef993c9a3b0814aebda16fc342ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056943, "uuid": "14fb2720-c802-4f0b-bbe0-e7f19c563d3c", "comment": "Malware payload (Mirai)", "value": "e62c5ab64d9d991f83212feefdb4f85bfcb99e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056943, "uuid": "7257e1af-0ee8-4e3c-b11f-7f4e7538682d", "comment": "Malware payload (Mirai)", "value": "746132ea69c3a31e011c0b83e7d24ceaee1c232e31efd640cd42f276f6e2179c8ed6074bd4965143b8b2d4e66149f4e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056943, "uuid": "23ec54a3-ad14-40f1-a6f0-f60e93812a47", "value": "T14D046C32DC746F68C965C279A4E69F382F13519182479FBE8BA7C2601483DCCF919BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056943, "uuid": "390b9e56-5f88-4ece-8f08-fb4dcf62886a", "value": "3072:DC8DAs0Ze/SPdwPb31ej5I7zV0NWL6NhDckMqys8g8U:DrDAs0jab31e2S4LaDUls8g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783056943, "uuid": "a0d97e2a-36be-442f-8dd0-da286f90ca66", "value": 181120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783056943, "uuid": "1f9e11ce-a6ef-46a7-9c82-2a919229843f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056943, "uuid": "87ba8f4d-1674-4ac7-bb10-b5585e084867", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34cb92f-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101038, "uuid": "be522c21-a507-451d-acca-551aaa71c3e8", "comment": "Malware payload", "value": "ab52ac8b9c86ebcfae8a7592f33314c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101038, "uuid": "80660fc1-16e2-4f28-8166-b8fd8a2b5992", "comment": "Malware payload", "value": "76a69097562d3d356fb8a17bc3fde4584d698bbe213f30243db998672425ed6a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101038, "uuid": "01103d16-5023-49e5-9d21-eb57280abec3", "comment": "Malware payload", "value": "01b030a0d2dcaf143cda4067e08d10325c0f8604", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101038, "uuid": "028022de-2b9a-49c4-899a-cbcd04ae5f3b", "comment": "Malware payload", "value": "3bcb1a732915fd3499ecee2093110dd81ba2e527c4c5c80cebfe3e0f3684ec3143122ae4e8bc64efa6aadaf1b72ddd5c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101038, "uuid": "268889ee-3054-4cdd-a584-803be9648f99", "value": "T1C4520268642942419B333A633AF95F12EA9408FD2DE1775C36087F23DAD87090A6DD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101038, "uuid": "6564fc7b-55c5-4638-aaf8-b34364c8150c", "value": "384:A888888888888888888888888888888888888888888888888888888888888887:A888888888888888888888888888888b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101038, "uuid": "4010b066-5be2-4e45-a695-7cef98b9ed85", "value": 13965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101038, "uuid": "4b3a6eb8-3274-4a95-8cfc-4028f6d8ff99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101038, "uuid": "298a42fe-0318-4ddf-b944-12e504196f0e", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e164393d-7682-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783043992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043992, "uuid": "2c893f79-b6a6-4a65-81c8-b7caba1e15c9", "comment": "Malware payload (Mirai)", "value": "44f4dafb99216514a2d1476e4303f59f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043992, "uuid": "39f50f4d-4502-4404-9586-90a6e21e9521", "comment": "Malware payload (Mirai)", "value": "770db614b0e7b3cd571f12eb94bc8b06c7c151f37c4ecc41656476bbb4d3084e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043992, "uuid": "afd7aa0e-edc5-4d8f-a091-bc78a0f0304f", "comment": "Malware payload (Mirai)", "value": "6ec536fa006254cfe7c1a10b096832e29b030c43", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043992, "uuid": "4e50d3c0-f463-4bd7-ac1f-11453cf8f7ec", "comment": "Malware payload (Mirai)", "value": "8128f3482d4b3533df4df30ceb48847c33b14b82155eea512a9e16cf7f181356ee04dfdfc1096024562d6e886bfce1ef", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043992, "uuid": "6942e464-1b04-4a51-9fef-c777467629e8", "value": "T1E901C2C68650BD4080AADA1D25976458F861C3CF16468F74FF6C6D7DEBA8C04B027F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043992, "uuid": "e7ed1a8c-36a0-4160-a304-b3401b0aa179", "value": "24:kXCKysE2hi0ziQvZohaIjSIFD/X5yjVq9NOX:e9Qp+MsI2IFD/XExqNOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783043992, "uuid": "117c1f29-1ae3-42a8-a14f-7afa1c423e89", "value": 848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783043992, "uuid": "dc950e91-9528-4779-bda8-d2b9f7e868ff", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043992, "uuid": "1ef230b7-f817-4b99-b478-5ea3f2ead21c", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6999cabb-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101773, "uuid": "c35a2c04-4ec5-4d2c-ac2f-abbd7ea10604", "comment": "Malware payload (RemcosRAT)", "value": "97ac4d3415c0de5985c1f81ad2997fa9", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101773, "uuid": "ac204473-5ee6-4ccb-b978-5f8b2dbbfcdb", "comment": "Malware payload (RemcosRAT)", "value": "7777f9917be9ce17233c35e1b38cbb34c45878c23e1b39d7956fa52cd7bb4983", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101773, "uuid": "29e5bd5e-7f11-4f66-8bf9-181358707b8e", "comment": "Malware payload (RemcosRAT)", "value": "757cc90ae1863fd1dbe280e970099dd9ed4fa3e9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101773, "uuid": "b8564b51-384f-4b3f-8474-c06dcf3a4132", "comment": "Malware payload (RemcosRAT)", "value": "332b0e386e08e93f4c3a8496756b941120fd77904e950afd5d8f16c368099ee15b5d0d20ae0537f5c8bc5e99659ce576", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101773, "uuid": "6861b341-9c7f-4911-88ac-724d906c6aa1", "value": "T18B1430F335ECA5AA7B579E5302B2F162D1623BAA7A0345605294BE2313F0644FF0BC5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101773, "uuid": "90c4451f-f6f0-491b-bd07-c7b26a48d883", "value": "1536:FUYOzJwNsCvSFOFZpeJD9KU2d9vFoJhqWSsmbavKin6Xh6gHwoSCBfDlpHNNnTKk:F0zFa6hpPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101773, "uuid": "f1386e89-1d16-49e8-bb9a-170035c2fe0f", "value": 197353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101773, "uuid": "755215fa-da45-4d8a-b08b-466d9ec7fa23", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101773, "uuid": "24e761f8-3a84-4b33-b595-3f25d708d1ed", "value": "147.124.213.158_46_goodforbestpeoplesaroundonmybestthigns.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbb4b63-7703-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783099040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099040, "uuid": "8e9cbb88-2b24-48a1-9fe5-f99d55cd96ba", "comment": "Malware payload", "value": "82fd608d34395c4fd6953caadca0263d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099040, "uuid": "c9eebad5-e327-4a59-bdcc-5b154d422d66", "comment": "Malware payload", "value": "77eef34639c4d2d244ba407c6e0a1b9b5ec0187e73de1ae3acb0f71f3906f595", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099040, "uuid": "e2718a0e-3852-415d-9bdf-71ce8697587b", "comment": "Malware payload", "value": "d644cd3e290159fa5429860946afb580f402344e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783099040, "uuid": "cf3f59f4-5d9c-4447-9d2d-36520a2dfbdb", "comment": "Malware payload", "value": "9b23a887b77c42b7ccf510315fc06c9d9222bd44e2f58c83fb1056bd9fc33069c610107e451df972bcbb386f5517b2d3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099040, "uuid": "df7e5e76-944e-46d8-a3b7-2e7c91f24214", "value": "T1C1C61247B7B2592ECB3B813249691231D2574D16CAC28ACFA54C360C2BB36F41F9DBD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099040, "uuid": "f3e3c613-557b-422c-8cc9-a45ed881871b", "value": "196608:OYhM7H8sMNoBr3UXQEpXN4YB/83awDRCQSqGb9Zog7cgbX9vvHvIz68:zhpGBLUXxiYBGDshp7ZvvIz68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783099040, "uuid": "33c91ae8-a521-49a0-a506-7ef0c7dc5f54", "value": 11987252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783099040, "uuid": "61848b76-2da5-43ce-a905-78eab6909742", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783099040, "uuid": "229d2081-9543-456f-a8b3-f872f3f21da5", "value": "\u06e6\u06d6\u06eb.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d194ed27-76a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783056850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056850, "uuid": "350f0591-854c-434f-b326-a7e8ee914001", "comment": "Malware payload (CoinMiner)", "value": "3de9cb6da3cc57f662e02e9545621ed5", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056850, "uuid": "69d0c002-a509-4a8a-a5b6-d4d6292ff12f", "comment": "Malware payload (CoinMiner)", "value": "78ce14986dcd70c0fcf65e9a3dea518a6a66c17589dca2149134406d3e95c414", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056850, "uuid": "d4d7fdfc-7f09-4239-aeaf-d45eca18c5d0", "comment": "Malware payload (CoinMiner)", "value": "59f1de081d64450e1eff0b060b17098646eb9335", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056850, "uuid": "b2070813-15bb-44be-a3c6-efa84e6d3b1f", "comment": "Malware payload (CoinMiner)", "value": "048dae66fd9e275b8cbae8d7e6371e7fd66bedbb6f949e0cda7786e4dd834d6c7cfaf7e5385a4a72b45c57e589a70b18", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056850, "uuid": "fb86c7bd-9e80-4475-89ac-9fc77ed2ccbb", "value": "T131E523167A5940ECC557C034CA090722AA7274CFCBA19AEF1394C23A6E7B7E15F3DB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056850, "uuid": "f0f4cc1d-19c4-4ea1-8821-28b52375bd9e", "value": "d764a70643a66f2b9c5979a12b9494fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056850, "uuid": "77d7b621-4132-474d-ad25-487b95dc23d9", "value": "49152:pO9vRsW153z/S4S87/Gz7MqcVQwu3NJ2fPTcv0aH1LBGTOMQh2bYGTIcx5Bq4sUd:pSrc7G/W7PBTuLcvLHD15KYOImUZj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783056850, "uuid": "69158b32-efc8-412c-af2a-3303ea57cb39", "value": 3081728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783056850, "uuid": "2ca107b9-9121-4996-9fcc-a44742915cbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056850, "uuid": "68ab356b-4106-4f56-849b-23134ed7a80f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebd2a82-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101030, "uuid": "eeecb9cc-4c7c-4e61-9a6c-3086dacd8842", "comment": "Malware payload", "value": "4df76e02e20a416128016b5b69125944", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101030, "uuid": "207366dc-370a-460e-9ae3-956e406b18a3", "comment": "Malware payload", "value": "792fcd3bc518a9a0ab152e6e74283066bac208a66df68545960c83814c1103a0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101030, "uuid": "208b271f-5295-457b-8bd4-827940147573", "comment": "Malware payload", "value": "08513cc1dc8b4df23407e4ce9917088576b6481c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101030, "uuid": "e13de2c8-99f6-4354-a4c6-57925eca52e8", "comment": "Malware payload", "value": "dd0c6526d25738f5f328fa171112ce0195d3302096fc19643a5ed949192950e004f8520983c40590dedeaca9fa5ce62f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101030, "uuid": "d3bbdee7-ba4d-4ecc-a27c-d53ba1fb58d5", "value": "T16A5202785429428197333AA33AF95F06EA9408FD2DE1779C36087B23DAD87490A6DD1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101030, "uuid": "c6a87922-31e0-4b1d-a24a-2043c023e710", "value": "384:E88888888888888888888888888888888888888888888888888888888888888L:E888888888888888888888888888888r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101030, "uuid": "83ba0d32-5b9e-4fc6-99c9-f07f56bee297", "value": 13977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101030, "uuid": "461ba347-e4aa-4423-bf7e-7df0afc2124b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101030, "uuid": "8cc433e8-3282-47ef-bfd8-9e55194e1667", "value": "Swift-015062026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc92e56-76f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783095096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095096, "uuid": "e9d3b24e-c80c-4085-82bd-61bd6fe12848", "comment": "Malware payload", "value": "21d7da7df67ca557739367e12f015061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095096, "uuid": "87389331-e8a7-477f-b51f-c4d8b0e13170", "comment": "Malware payload", "value": "79a2ef6dd3056588d046746120a10ef1fceec80bf05e4221598101115d9215e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095096, "uuid": "a2b2df32-c12a-4055-8e3f-0d2bba66a52d", "comment": "Malware payload", "value": "4650900dca211c00a744bf0c331e6098081b33c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095096, "uuid": "9c6143a5-641d-450e-a75a-51610c9c7320", "comment": "Malware payload", "value": "44cebce6a8180e3c762d99f9d51e06f5d19e735243a1a31a2ace1afae5ff5da5f6ba6e06d4d1cfc584e7167d876bab0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095096, "uuid": "696ad61d-0e54-48f9-bfbd-00247b517279", "value": "T129B5AD9127E542D9F8F365B47F710E5AE42BBC29CD24C26D199B31892E32B65DC30B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095096, "uuid": "b8af2ae6-c3b5-4075-a75c-7cf164ffc561", "value": "5efda4ae4b9a7df2bc1838005b6381a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095096, "uuid": "8979c7cd-696b-45a6-9a08-91e66fde64ef", "value": "49152:NsCNJw4eAIUCWl//uGcN/nNGHAF9S9oW4d:BJw4eAIUCuOjnBF9IoW4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783095096, "uuid": "194ba052-8b74-421e-bb3e-42136eeb3ab2", "value": 2398152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783095096, "uuid": "fa6e87a5-231c-4816-a2cd-65ba4eba9aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095096, "uuid": "2d5359d0-e590-4f9a-ba4f-d173d32496b9", "value": "huorong.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52f1910-76ec-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783089471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089471, "uuid": "470a755d-42af-48a4-91f4-f5a58abce6ef", "comment": "Malware payload (Mirai)", "value": "42d2d5d5a2f8230307afcae3f252cf42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089471, "uuid": "bca56624-e0b0-4447-8305-bc3386157951", "comment": "Malware payload (Mirai)", "value": "7a2a6726e3c26a67505dde920857b1f759a5b2ba6ead92604d668c167be31ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089471, "uuid": "c8e59bde-ab1f-4b8a-9db3-c42b50c8d453", "comment": "Malware payload (Mirai)", "value": "044a094b6dbe0e95072bcf2c5cc85e7a0353a647", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089471, "uuid": "43dc06ff-deb4-40d4-b8c9-cec06ecc3862", "comment": "Malware payload (Mirai)", "value": "6c4161a61a651c4edf9b253c4457dcc97e5a1b9792faf42fd502312c6ffc918d96d471a8b92664b0299bccff93d5c926", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089471, "uuid": "40ff5e7b-d491-4d7a-be2a-d20b7334a601", "value": "T1A8046B23FB1C1423C0939E701D3B07E6D37594C242BAE60965096B291B33AF55D8BBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089471, "uuid": "06fe2b11-fe3e-4e10-a65b-01a1ff84858c", "value": "3072:0OScFLyjybehsnEEacToJfUZZQdSd0FoERem:0O3L8ErnEpcToJfUZZQdCdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783089471, "uuid": "47a2e03b-e778-44ee-9ed6-3f8f9b0ac63c", "value": 174200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783089471, "uuid": "7850783e-e261-41bd-b80f-e1cd07d7ca54", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089471, "uuid": "2600f766-e6db-433d-b131-be27315f8f19", "value": "powerpc.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60781cf6-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101328, "uuid": "e298c89f-77f2-4b26-b9eb-501cd9325695", "comment": "Malware payload", "value": "6908fa3ee4d4a99633025b6829bf4ef9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101328, "uuid": "b2a13c41-0085-409c-8db0-0e35f43c3da4", "comment": "Malware payload", "value": "7a35422edcd25b51dff6cd8485c37aa3e27c7dd17627857409bd7e69360351e6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101328, "uuid": "2393a48e-13e9-4a0f-a1d4-75f27d0ba466", "comment": "Malware payload", "value": "789fa09710e10846f19c1fc94a2745bd5e9c9fd1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101328, "uuid": "4728907a-3cf2-43b7-8b6b-7e052954a4e8", "comment": "Malware payload", "value": "e549659f57cd38816b4d6eafe6c3b6134df68e64aa28315878ba3708bfa5e879d69db23d91b9070e0803fd485932dc24", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101328, "uuid": "5bb43caf-4c32-4cf5-8921-b2960769b761", "value": "T15FD3127B5DF6634B0107F0ED590928BF83B1C978888F5CE867D25FA63D194D0CA652C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101328, "uuid": "51214ecf-be62-4e2a-89bf-bb2136847710", "value": "3072:aaaIeea0uRJaf42EuyQndb3ZXtwyFOyXRV3:aaaIvazJdQn13nJfB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101328, "uuid": "9277162c-eee3-494c-81e9-e6ee9f074fa8", "value": 135071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101328, "uuid": "3c3cfb45-5b36-40d2-b4db-dd89929a5ae2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101328, "uuid": "3e366d14-e0c7-4477-9894-913d20bc1dd3", "value": "POX14075037196.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63aee839-76b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783064397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064397, "uuid": "133f6000-90cd-4c0b-ae0b-7d6ff1c48a45", "comment": "Malware payload (NetSupport)", "value": "cf82878aa225a1b11ddeadc5e6b592c3", "object_relation": "md5", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064397, "uuid": "e498bce4-cfcb-47f8-abae-39edc28f7061", "comment": "Malware payload (NetSupport)", "value": "7af9b52392570350f020c8adb29fad7d8eb61f2305feab3d63e65371c1592a24", "object_relation": "sha256", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064397, "uuid": "d3d632dd-d75a-415c-97f8-41b553967534", "comment": "Malware payload (NetSupport)", "value": "83dc0d6b561cd7fd1bdebef1781b9b5e5e793dba", "object_relation": "sha1", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064397, "uuid": "e5fa4679-aada-4b41-8514-2aae2af06b93", "comment": "Malware payload (NetSupport)", "value": "3562c70711b52b8c7118d8a93c2c358f1742a7c627e557fbdbf464a1be65af5849097c01be45cfee6eab7c2e6c78ddbd", "object_relation": "sha3-384", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064397, "uuid": "94e22452-812d-4a0f-98e0-f88711383d26", "value": "T1AEA5338C44D7C9923091320EE642BB6C09B191496B655B96820A44EFF7B8CDFFF21F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064397, "uuid": "3141b8f0-b0b0-441c-b210-8d944490f20b", "value": "49152:tZIAYKHWNg6rAVJudq6vzNwxvyC9KvzpwPI47j/YH/I8Zw:tZIAJWLn1vzKxqCsLpww47jwHgAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064397, "uuid": "5eeb577e-bc23-47fd-bbcf-84ea00883eec", "value": 2234342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064397, "uuid": "e60df4a1-a54a-4b64-af21-fa18db9c43ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064397, "uuid": "5f03c764-d79a-43e5-8ac9-11f09d0472bc", "value": "installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed11067-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101621, "uuid": "1d531c33-f1d3-4811-b4b5-decd123044e9", "comment": "Malware payload", "value": "49331bd1e5e5b490d6407cb777d09b96", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101621, "uuid": "110e6b91-8d68-4093-bf90-3ed365ed48fc", "comment": "Malware payload", "value": "7b174e4b0b2724ec48c76d8cd1470a399c245bb25ed6a829ca7552196f03d40b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101621, "uuid": "536f9c98-dedc-4ad9-b2f2-5db9774bc54c", "comment": "Malware payload", "value": "83ee2cdde9b0dfd854e6c2bf7f846637ebf1bd75", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101621, "uuid": "1e10723f-f25c-4103-9731-db4bd2ed7070", "comment": "Malware payload", "value": "f921f5b1448214471e0d82baeda615d24af43c7f3e22f8b343f0bc01dfcefd26485f0e505ad35be5f0dfb76e0d14d38a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101621, "uuid": "ee0b7275-fae3-4c86-9424-ada8789b75af", "value": "T1A2C42280B2CBEE37C29E9B7279D1C1420066FC895F11E10762547BEE1A73EA101D73AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101621, "uuid": "f087882c-032f-424c-bf5c-27a09a63b7d4", "value": "12288:c+z6Ka1OPp2nW7ocPblzhECs1YKCp13hAxydMiSpajY+Nhbx9lF6HkXRy:cHWAnW7dUCsW7p1exydMiSTWxxvFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101621, "uuid": "bfdb4dd6-d7d8-4aa0-8fca-57d08ecf894b", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101621, "uuid": "437412cd-3dad-48bc-a002-191b2dd13081", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101621, "uuid": "38c387dc-4744-43fb-90fe-ad4cc19ac8a5", "value": "MPCCXPurchaseXOrderXMPO-51720.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31779adc-76d5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783079345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079345, "uuid": "50a424e5-09f2-4825-a98d-d5846d9f980c", "comment": "Malware payload (ValleyRAT)", "value": "608646f448c0a5c26a34c79fcec2257a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079345, "uuid": "dde8fe89-fdbb-428a-9ea4-fdfdb9031144", "comment": "Malware payload (ValleyRAT)", "value": "7bb8ff1a5d1262d63167c0db64c00ae1965671c5168720fda081ca62d41d57d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079345, "uuid": "f5225f75-0454-4a11-9af6-0c2d7cd575da", "comment": "Malware payload (ValleyRAT)", "value": "3f033e89ee8e868c4ca228c45225428c9a89b6b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783079345, "uuid": "1041bf91-36ee-4959-a1b1-a51900241cbc", "comment": "Malware payload (ValleyRAT)", "value": "f25be1e6138f2051c4502fb2eba6368fbbdc784bd3739d8f0629ebf26b06ae9e520d0d414140eb21e308651c3833d678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079345, "uuid": "1f20b3aa-942b-4614-b6f0-4309f66e40e8", "value": "T10B5733B86FED12E9D03B66BEBD44F6031796A4ECBEC5C84833C0684689D6E87CC465C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079345, "uuid": "c00e91f1-b139-49bd-b03c-d6767d896625", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079345, "uuid": "83f7bcbb-572b-48d2-ab73-2e656290c34f", "value": "393216:widnRPx6mz6JixSJ4wqUsXp95IA2KzyHwKawW11JOR24LaI74H/KxpY9ZN+:wi6ivwqU88QKTag2iaIhwN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783079345, "uuid": "331d1777-5275-4742-8e56-138d7b4d01f8", "value": 28624501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783079345, "uuid": "207b0feb-cc75-4243-bbb3-8e40e0e494c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783079345, "uuid": "24c2b225-7d23-4631-9762-e992d5900c78", "value": "26422000001257905011_\u6e56\u5317\u886b\u4e3d\u670d\u9970\u6709\u9650\u516c\u53f8pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f84f78a7-76a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783060351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060351, "uuid": "e4ef652e-89ab-4ff2-bc35-4831fc87efeb", "comment": "Malware payload (RemcosRAT)", "value": "b22440ee4bc323b2b41a44638a544e8c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060351, "uuid": "490219e1-a9cc-4bfc-adcd-8f569a45d388", "comment": "Malware payload (RemcosRAT)", "value": "7c055f06c245ba0cc6afd6f7d0edf0dbc7934e53424c92e4174519726559dcec", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060351, "uuid": "be625ebd-409c-4159-a684-db1ae677c39b", "comment": "Malware payload (RemcosRAT)", "value": "d105c9f6e6853a045d29e14bfdf7103f4bbb3dd7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060351, "uuid": "49c05e2a-234f-47e9-bbb5-aeaeafb351bf", "comment": "Malware payload (RemcosRAT)", "value": "63f84939ec7c0a6f07804da545901bd4f4bd1194acdbdde0bb4d2403fdc1c4aeac0be45ca541ff33ed39966fc9ddea0e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060351, "uuid": "025ce026-b3b9-43ff-978e-8ff3413e84e2", "value": "T178943B342DFA902A71B3EF559BF479A7DA6FB7A3371A54191091038A0713942EDC233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060351, "uuid": "85d7e78d-a36a-4785-bcd3-f49511dd44a3", "value": "12288:K8HVSOa81CEANlwFSrtM8yc4kpxetQPk2KY:u8oxkS5Hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060351, "uuid": "5ac41f4f-3e2a-42e6-9783-1c6217bda4ac", "value": 420438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060351, "uuid": "5edac301-674a-4b50-a43f-02c480dbe9a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060351, "uuid": "9eae9731-c88a-49ec-847c-6d9234df2f08", "value": "Quotation Requets.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd66801c-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783077486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077486, "uuid": "f9e1c76d-4101-4c89-92ad-c5c8a74581e6", "comment": "Malware payload", "value": "1e3173f3373fa2d6d208bf8c7cb28548", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077486, "uuid": "ea5e140f-465d-4c96-b4dd-18f513d5951c", "comment": "Malware payload", "value": "7c50f337b1ef0db09ba272ef760def53dbfc1b62c6585886e5a7ddf68a440526", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077486, "uuid": "3234cffc-8f00-41b7-a435-0f722876d966", "comment": "Malware payload", "value": "b86da955d1eeecc74374e8e8fe5228091f7fa4b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077486, "uuid": "30109695-ce7c-48da-ba86-5f8f7fc4c5fd", "comment": "Malware payload", "value": "7e1586f0845a241b4700ebf802f26e73b91b012051d8d28aea4abfe952b027572fefa320e192c41e3a4d272bb5172cbf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077486, "uuid": "4f4c16f8-54c5-4730-bb30-cfacd12db155", "value": "T11331E8DD0112DB01DA1FEF98677AD958D036F8A3AEC2CF1ADEC8847DCC896593125E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077486, "uuid": "c0016790-c573-494a-96ec-55cc4c459f25", "value": "24:oq5Zlq2RPVg1NIjeD7FkgkbSe6GjJri3KDK:oq5Zlq2RPVteD7FklSfGjJri3KDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077486, "uuid": "2f8b07cb-a199-40b1-a1dd-b2a8b73bba97", "value": 1754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077486, "uuid": "ef084621-4a0c-4f09-8d6d-a2415112b380", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077486, "uuid": "93c010c7-e707-43cf-a254-e4cbe103fda5", "value": "meow.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eb6310-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082753, "uuid": "8089740e-53d0-451e-b15c-970432884515", "comment": "Malware payload (Gafgyt)", "value": "ca04d9278836321dd85be25166aba550", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082753, "uuid": "1a904883-6bc0-4510-8caf-15942ea6e001", "comment": "Malware payload (Gafgyt)", "value": "7cb67b8103522a1d89545b62b98b240dd9b08701689c87978d37fe4be081e4a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082753, "uuid": "ea8a065a-04b3-40ab-bdda-5b7c5f16e28c", "comment": "Malware payload (Gafgyt)", "value": "1757a416db4e5f381fcdd9567e2237feb0e4de11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082753, "uuid": "1fe51ddd-ffd6-4771-8685-d90ee866a5d4", "comment": "Malware payload (Gafgyt)", "value": "b14482fda71a63dc55036152705ee1bba733279fb8ff21d7b022260288fb8d08c220aa1cad4f82ce42fc4997428c8954", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082753, "uuid": "e5f3ec1a-a25a-4ff5-8e54-3a1c75006176", "value": "T1CB935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082753, "uuid": "35b5a574-f6f1-4442-a198-0eedd5cfab12", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3pyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK5ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082753, "uuid": "1b55a575-707e-4d66-bfde-d3068b9302b4", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082753, "uuid": "8f87cdd1-4046-4eb8-b3db-06dc24c18b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082753, "uuid": "52f4ee98-1bd5-4e6a-825f-4c3035b322a7", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2255641-7682-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783043993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043993, "uuid": "75bbf974-2812-4705-8fb5-d52d0411ba51", "comment": "Malware payload (Gafgyt)", "value": "9a1eade10058a6cab8a99cc93583daf7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043993, "uuid": "27d50b3c-3a0f-4b4a-a4a6-fa4a52db21e6", "comment": "Malware payload (Gafgyt)", "value": "7ccf139c5192acdec6370f391801390935df872849212349f27f388b0a39674d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043993, "uuid": "16614a1d-c5ba-4d37-9bad-08b681857fd7", "comment": "Malware payload (Gafgyt)", "value": "7cfa17e555f9826a77c47b8d910032693155d835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043993, "uuid": "52517877-e6ac-441d-9042-9829a553511e", "comment": "Malware payload (Gafgyt)", "value": "3a380738f80a44c86fc2a7c1165cc62031d17fa6d91a435ff0bc73759975dac7ca02718a683b513b7e874e88ae136a25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043993, "uuid": "ea2907cd-bc08-4062-9b15-9a350edf2f64", "value": "T143046C23FF1C1423C4939E701D3B07E6D37594C242BAA60965096B291B33AF55D8BBBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043993, "uuid": "e084ef5e-1b81-472c-9717-5a1fa1b5c5bb", "value": "3072:D0appabjyuyzvRpn9EqEtTJPsaGtQS1sFoEuo:YaWbjRsfn95EtTJPsaGtQa1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783043993, "uuid": "4d0b9b6a-6752-4e95-bac8-72cbce845be0", "value": 174200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783043993, "uuid": "c73ae226-409b-4210-a72f-d9894c710388", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043993, "uuid": "2eb2fd9f-7224-415d-9b23-666d0209b3ec", "value": "powerpc.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4f85d3-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101162, "uuid": "36d801b2-3292-48fc-b3dc-3a30db75523e", "comment": "Malware payload (AgentTesla)", "value": "c189e3cd9342923a743770f191bd70cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101162, "uuid": "3c25edb7-45e5-46be-be83-3e99623604ed", "comment": "Malware payload (AgentTesla)", "value": "7dd595347aea3817cde5da19e3a6b76adf2f0baef0ecbd67ff3d80be1d5930a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101162, "uuid": "2ee8b7e6-c680-4254-9879-78bef74434b6", "comment": "Malware payload (AgentTesla)", "value": "8b8355ebf5be22e6eeeb9053919eae7dc42af9ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101162, "uuid": "f8410de1-f4a4-497d-88fe-98c2916e35bf", "comment": "Malware payload (AgentTesla)", "value": "8b044d35d76cac686e6eefb2402548f222a8f5917139abc6b04323ba62507e06656cdd3102e3bb975233f88378b66a72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101162, "uuid": "98817bc0-1dbb-425a-9985-658ed3d62f19", "value": "T1B92501982225D602C7A14BBA0A70F2740BBE6DDA7A21C3578FD43DEF7A65F409D80357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101162, "uuid": "0e027471-6eb2-4af9-8496-23b6985e8f60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101162, "uuid": "79dcfd50-9f7d-4a6b-be35-cfd4054dbbcb", "value": "24576:900zyaxGt58cLooPM4WXkN2qADFLMgGgQz1JlWniDbX:tGa8soPOUN2qaFE/cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101162, "uuid": "5826ddb8-90b6-4385-b950-77e195a85bc7", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101162, "uuid": "5858e408-aaf1-43c3-a7ff-715b68ab0ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101162, "uuid": "430b3e51-36c3-42a2-9614-2885a3b7eef3", "value": "Outstanding_payment_INV_01290047-01288391.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39aff633-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101693, "uuid": "7d8afd63-1e02-48d2-b9d7-0f943c777a05", "comment": "Malware payload (AgentTesla)", "value": "cee7443bf9b70094aedb48e4d3f63258", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101693, "uuid": "c14c4bae-1888-424a-8f5f-e95409b40f1c", "comment": "Malware payload (AgentTesla)", "value": "7ee1824c97fbb1ba69c907d552ebce6832a62f26dd4973112fc466fa2dff01f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101693, "uuid": "95c2cb86-4d30-4178-a010-bb789e234134", "comment": "Malware payload (AgentTesla)", "value": "5d92f31072844f583b837a9560848a1c783d2aef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101693, "uuid": "6568eaf3-af1f-4117-82a7-0d1104c947fb", "comment": "Malware payload (AgentTesla)", "value": "d0ef4495a7755170db824973cfbcbea17b469ec1dddf6ad5a865f194d2d286c88327100f2d3f316f09df239946f5f7b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101693, "uuid": "d76181f0-a9f6-4236-b6ea-b93a05d64c49", "value": "T16D36094157D4A1777330E7AD523AEE78A40E900368DACF15349ED728392CD87AB18BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101693, "uuid": "7bccb6c5-4608-499d-9207-21d048660ce2", "value": "98304:yG0HYgBXqDrQ5pZkiDGtdvJEr0RlUQEdq474flJW7JQvuKJF4ijHNzdRISdPhlum:Q4gRqQ5n1GtdS86q474flJW7JQvuKJFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101693, "uuid": "43e846ef-0b9b-4a94-99a9-77bdc5aff333", "value": 4921820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101693, "uuid": "cb0d564d-81ec-4cc1-970f-191be3905a81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101693, "uuid": "ace5b008-ab8a-4b1c-880c-647973f842e0", "value": "SOA_MAY-JUNE_2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f1250f-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101503, "uuid": "5fbc9870-757c-4c78-842f-584940f2aa5f", "comment": "Malware payload", "value": "cd90ac31442bdfc6fc7f53e2370d6d23", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101503, "uuid": "83685607-d0c3-4861-acb3-2796c0d12bb2", "comment": "Malware payload", "value": "7ee1e6a26edcf903e7580b78cbdc71d4ff6d908237002e8e6940e03089a2e27d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101503, "uuid": "31453ff2-9987-4ecd-a6f4-b1b11c362180", "comment": "Malware payload", "value": "6fa29a430d7b2df68b4c78ce4de6e16a113a39e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101503, "uuid": "bef04c09-cfd4-42e1-a713-9f98eb1c2a05", "comment": "Malware payload", "value": "f1832b491c70df2e050b4877ed86d1d77c9cceabbe511146ccbecb808c83e74e998bd055937e611472df1cf054ece8c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101503, "uuid": "3aa87052-340f-4a3a-abd4-4002547e1090", "value": "T1E905E53DC968412EE972D919C49A045FF8C24A5B622CEE47A0D73B5FAE7248277D231C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101503, "uuid": "3edd8b8e-3df9-42e4-8917-5c82600dc04d", "value": "3072:JY18nxKi3KZWliGZ8dWTSKmuqFT5kbYBBdCsiendh8ADZ3g0SZsTwTAk59ROijgp:YFuqFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101503, "uuid": "6e349afe-ac4b-49c7-8305-7dd11c6e3def", "value": 822012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101503, "uuid": "d066febf-6e01-4c57-9b32-b57ef6421330", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101503, "uuid": "50d4815d-7f60-49b9-b6a3-48adacb1990d", "value": "SOA_710484359.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8068a61d-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101811, "uuid": "352a7948-d0de-4a5b-9b98-2744ff1f94da", "comment": "Malware payload (Formbook)", "value": "43faa20355f26c00e61dd84ab89a01c4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101811, "uuid": "f860513a-b08d-491d-ada7-e2e5022cd874", "comment": "Malware payload (Formbook)", "value": "7ff8cfa3044d0b95252edde70b999c0e642f260d5134f8889165db637043342a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101811, "uuid": "8af42a49-876b-4931-afc8-30be9b99a6fc", "comment": "Malware payload (Formbook)", "value": "734ab6d0c52225d6dc14365b795a3357e3c3d090", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101811, "uuid": "c292da4b-475b-46c4-ae04-9d43de7c4262", "comment": "Malware payload (Formbook)", "value": "bca67c8e8ee80481c8f3df12657380ec89cb74a8e5a3fd4a2ecdfc8fe9a1295ce12fbdbfa21a45657f0feeea0d15ee6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101811, "uuid": "10e27211-24eb-4e29-aab2-4fb86842c0a3", "value": "T157F423AB4F4264641A42F35CB600F7FE59D31CF82C0DCA63B327A15FFE6CA649A65091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101811, "uuid": "112d095d-095a-455c-9bcf-00bd9277a914", "value": "12288:cGAhTleGBoge7pDvrtzbLxp8FEmdl/roiGIClEbJgxImZTdJjzPXenENaO:cnyBvNcRl/rFGIDbixvdNzveENX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101811, "uuid": "b12719c0-16c8-4800-a2d4-4b5419ffaa8d", "value": 726146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101811, "uuid": "9e01f0ac-81e6-4575-9e84-5b5919eafc0f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101811, "uuid": "4e4fcd9a-4ec0-4c90-95cb-7a1e11ce822a", "value": "New_Quote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be0743ac-76b4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783065407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065407, "uuid": "dd189cda-f36e-4833-9007-6642d4c38a7c", "comment": "Malware payload", "value": "0d96bbe9756cdf2faa525fa6359942e9", "object_relation": "md5", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065407, "uuid": "905263fa-2956-4268-8a62-3770557265af", "comment": "Malware payload", "value": "806c1a4193780bbdfdc3db8606747edf12cdc16e8b38e318ed86928c5ce95457", "object_relation": "sha256", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065407, "uuid": "93cda17f-9943-495c-80ab-85e055066bbc", "comment": "Malware payload", "value": "7c03c97f3d52012e268fd9ccc23ff0cdb7a87dcb", "object_relation": "sha1", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065407, "uuid": "ba649f5e-cbd6-4c6f-a2e7-51c29935be21", "comment": "Malware payload", "value": "2cb03ffb53e3924a29a28502eeaa2d0e8ffb8684ff37866820cc4543bdaaa9153bf5e80a9e658f50394f43a58a112faa", "object_relation": "sha3-384", "Tag": [ { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "traffmonetizer", "colour": "#103D86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065407, "uuid": "a2f0f7d8-3d34-44ed-baed-1de535164967", "value": "T17843E7414C590DF4938BD078BE8A9055F2297E6706A93438FAECD5541F88B3942FCEBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065407, "uuid": "f488f096-149d-41d5-987a-7d1c485d20b6", "value": "768:Z5D5bcbO78sllx4NkCbuIwdUXfxLw7vCJD0i5rb1J3xL22PDrRPkNK36kbsux0gs:vDgO8sllqNTxUgNPpfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783065407, "uuid": "5ee03d4a-275e-4da9-bd00-94fbff3825a1", "value": 60321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783065407, "uuid": "94b2c4ba-db4e-4b31-9abd-02412d197b16", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065407, "uuid": "db1a47e9-0122-41cd-8585-15f27ecbf33a", "value": "806c1a4193780bbdfdc3db8606747edf12cdc16e8b38e318ed86928c5ce95457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ead24c5-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082749, "uuid": "db97d7fb-072d-48e8-bfbe-54e5ab5370f9", "comment": "Malware payload (Gafgyt)", "value": "60a7309fea7b934efbccd8615c3b1731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082749, "uuid": "9f1273a1-ea77-494a-bd34-ae8e7b930af9", "comment": "Malware payload (Gafgyt)", "value": "81515b3edf11ef17b2727f65ee6d33661fcbb7cc98625e56f442ae46128ff2ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082749, "uuid": "39e40a13-0ad2-43f4-9d88-a301b3c8b727", "comment": "Malware payload (Gafgyt)", "value": "f46a11072f3c0eb65be391428b33b538180cda7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082749, "uuid": "a4290d9f-1b1f-4b59-90b9-e106f2d0aba3", "comment": "Malware payload (Gafgyt)", "value": "5a2a7694b7e01847bb7058896276622412740cf7de13360824e19d828098c3b75f1a0558ccbe2cde7843e75f58825203", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082749, "uuid": "f7a35776-ed7e-4542-aa00-48295e8c3bff", "value": "T1CFA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082749, "uuid": "89e580cb-bee0-4e41-91bb-b638d7e5799f", "value": "3072:VSx+i6mqaObhN1nPNKV+qKmZuqQ4DPwXXtse:y6mRObn1nP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082749, "uuid": "ea0a36a0-c4ef-480e-a843-fe4bd8f660bd", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082749, "uuid": "f4388d5a-54e1-43df-a8f6-9c7f90c33742", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082749, "uuid": "37ea8095-3b50-41ef-a911-0ab4a807d5a3", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba88276e-771a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783109210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109210, "uuid": "d877e09f-7bd8-474f-9a05-b8d767908c9a", "comment": "Malware payload", "value": "1406c36bf90970e7c53eafa27b7da506", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109210, "uuid": "0b4abaf7-6c78-4ce8-9214-423ad524afbe", "comment": "Malware payload", "value": "83017185a714532b3e54cd6a86bb46e95301cfc1e2b35324a5ed8eec326b35a9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109210, "uuid": "53e0c29b-de2a-49ae-8c95-32196956cb95", "comment": "Malware payload", "value": "817579f01631b4a098a69c4c2e11a9d2f37a3f7d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109210, "uuid": "9996feaa-d9d4-4195-8065-8e5d90362e19", "comment": "Malware payload", "value": "9ad3d654a9868296d7e108917044894b06155b7d8589acc3c3e7738d67316ac21736866cc157963952f953f726857bd8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783109210, "uuid": "3aa7241e-0423-4bff-9690-0c90a6cf9e1a", "value": "T152714C426F3C613EEE43C99DC26DEB01A9939F45BA9412D47E5804CAC11F1DFDB228E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783109210, "uuid": "aaa9342b-a346-40bd-8e9d-92fe0a9f9a06", "value": "96:ZS02jAmNBHIFu5rWmMDmsZKCBps/dOXzv:wEmhr2HKus1OXzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783109210, "uuid": "43384349-26f4-435c-b3ae-bb21e01912b8", "value": 3586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783109210, "uuid": "367f25c2-a71a-4d05-8add-ffadce94255f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783109210, "uuid": "ff579e5a-7e93-497c-b645-7c9cf6e56776", "value": "3_19_8_1601_22.12.2025.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f866c6-7681-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783043389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043389, "uuid": "69fb685c-2f73-4c0f-8de6-ce725afbaf1e", "comment": "Malware payload (Mirai)", "value": "0ce5b314c8b93e952e315ff3c5e8839c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043389, "uuid": "df0cba57-81fc-4dec-b12e-f287ea11113e", "comment": "Malware payload (Mirai)", "value": "836da0de8ba87bd62b094e1b10f9fb6ffb8eee1be7bc4aedea73a40950fce2a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043389, "uuid": "d0856946-689e-4e17-afd0-63444f00be56", "comment": "Malware payload (Mirai)", "value": "0b627f2cf4c43021eab0aec7dc76e0a993eb1978", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043389, "uuid": "4bc11c03-bd06-4394-bd45-9f5a593cf116", "comment": "Malware payload (Mirai)", "value": "e58692f18bfb3f989eea260c6ddc4711671619b631a99a55f4afc16fef1be636694712d18fe809e7b0b170a812058c9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043389, "uuid": "3354509b-90b8-417f-8ca1-b177fd3abd12", "value": "T1A9A3865A3E21DFBEF56C82304BB78A20979823D626E0D685F25CD70C1E7124E585F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043389, "uuid": "33a30bc3-5236-4ffa-b7a7-4ea8ced995da", "value": "1536:oaqPQeQTOrgA3TPxpCYvuvr/7T+IiHXgeY1JNIXLXRhALb:BdeQTOriYvuz/77iHXaIthALb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783043389, "uuid": "cc060050-b4ff-43f8-8089-36bc42a823c3", "value": 101636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783043389, "uuid": "a2d8509b-b6d7-4750-9078-df581753b4b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043389, "uuid": "80ed617b-a6c3-4c1d-9622-089644d27707", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc33fc3-76b3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783064681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064681, "uuid": "7fde5ac9-36c0-4705-90f6-ba2bf9c79c76", "comment": "Malware payload (Mirai)", "value": "710588622f6b154e68d10f32def8a4cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064681, "uuid": "fc639c11-c53a-44c5-bc09-c9b04a1daf8f", "comment": "Malware payload (Mirai)", "value": "8395641e48805249d1146bb87ea1ac3af90de2edd74f6604b37a10e2bdc01fe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064681, "uuid": "7cdb419d-cec5-40ce-b48f-392a0760a92f", "comment": "Malware payload (Mirai)", "value": "1281b97618b8d4a5c587a01ef8e0fc53fbea1a8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064681, "uuid": "3adb0fc5-cf31-4a32-9e7a-2d8f1fd8c682", "comment": "Malware payload (Mirai)", "value": "f463c3aa24a8ac883b9c3c273d4cf52663f9f95624a1f5f3e1ce838e67fad1c2d42c754590bd1ed9d566e3824727f85d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064681, "uuid": "be2b38db-23e4-4c8c-af43-98313a1e60f4", "value": "T13EB3D549FD04A72BC2D372FBFB5D12CE362B1BADA7EB31129A305E9133C56915936210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064681, "uuid": "1118c01c-423e-413b-86d2-cf397e0526f8", "value": "1536:Ey/R4NcmXM0Phu3QC08dMJC9jsI7eD2IOfvStwDLv8/OgoCtv45h9p/sN6:t/w80QumjWDwf/EG645h9p/sN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064681, "uuid": "88bbd064-f95b-4451-b403-96060e3bf601", "value": 117088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064681, "uuid": "9ff78f6b-0ab5-4a69-bf1d-bafc1f0493a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064681, "uuid": "15cdbe9b-453a-42e0-a7f5-5c27c84a2062", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bc9314-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101790, "uuid": "996423cc-c7ee-4bfc-9f0d-14e476a5c5e0", "comment": "Malware payload (AgentTesla)", "value": "d1f5c8d7437eae187108c70dbbed067f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101790, "uuid": "a9a15191-4f89-42f4-9ba3-702af554ee0c", "comment": "Malware payload (AgentTesla)", "value": "839c56270979bc4138b53a8372b59e63fb27ae9522f5b0b31d279efe2416f787", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101790, "uuid": "3b8736a5-c49f-4b7a-9d76-c593fea2a152", "comment": "Malware payload (AgentTesla)", "value": "a765dad3cef2b9d725b98329f3bf0aff8164188b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101790, "uuid": "39e9b3c9-61e1-46c7-a48e-ed4692aa39d8", "comment": "Malware payload (AgentTesla)", "value": "65eb429ac1b5f14e8f4f5b7d3ae4df0c157d7b54b1ee324086c1740c3757826cab370676ce9e90c3f58ef361e165b370", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101790, "uuid": "2fb2cdc6-24a2-4382-be30-020e6f942bbb", "value": "T17815334F63D2FCD2894083671509685CD972A43BAEEC24B6BF36E4F5330D67982B5B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101790, "uuid": "9d7783ac-c35b-4329-b321-05669e140497", "value": "24576:HC25oPhZw/z70JwqWg2Mhyc2dwBv18ixN9+:HC25oPh4hqWRxcqwBNh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101790, "uuid": "025b26d4-1a94-408d-9b8c-ea70e936d5e6", "value": 921566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101790, "uuid": "9d399981-5b35-40f7-a49d-8768c9c94c82", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101790, "uuid": "31b3d307-0d2f-4ec0-b9bb-f33f70461950", "value": "Order_Inquiry_#070126.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6056e86d-768c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783048070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048070, "uuid": "45e32c1d-0976-4e9c-8e09-7ddd9afea3d1", "comment": "Malware payload", "value": "5ee0e3f5d62aa50c8fb91c59e15d71a4", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048070, "uuid": "378c3bca-dc35-4163-b0c1-176d7a4b7a3c", "comment": "Malware payload", "value": "84ddfdd7862e3c3481ae65b64d9087ab7c5c29355a29e9e7c3a4011a631f7387", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048070, "uuid": "878f7fdd-a8bb-487c-9b9e-4587292163f0", "comment": "Malware payload", "value": "2b0cf7ea9cdd7905565e02a9a35def1291bdba45", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048070, "uuid": "057bdd66-2fca-450c-9f7a-64a555da5b65", "comment": "Malware payload", "value": "04951da5ebf3a9cc48fbea3d24d4a20a444e7a0c543c075c4f5b18c15ce552dafc5766e3e48b9d8f7ed5c5789d1cfdfd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048070, "uuid": "4d7646a1-f38c-44f8-9ee8-6336833bf32d", "value": "T16776F14BE741565AC4F987B91C3732251D477C214BA3868BDB2C3E38687B5F08E97AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048070, "uuid": "801d2436-6c7b-4f31-a3c1-8d0d3605db0b", "value": "196608:IabbmIopeU96Ijli6cS9w2+A8LntlY1XLcqe:IafmIgf9nli6cGH8LrY1bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783048070, "uuid": "14dcea66-f6c1-4cd9-92e8-ffdc0c7c0673", "value": 7634561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783048070, "uuid": "5c8831b8-1e4e-4432-99cf-104aac37cbcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048070, "uuid": "4dbf9207-9c57-4325-a149-b437f2e58079", "value": "app(2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a29704a-7682-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783043631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043631, "uuid": "76c785d5-bdee-4e02-8ed3-9b04cda065fe", "comment": "Malware payload (Gafgyt)", "value": "e2e9c80fbc26a5fecb938565c91c7726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043631, "uuid": "331de869-68d6-43ea-8045-f3f4c85d730a", "comment": "Malware payload (Gafgyt)", "value": "876de7e7e43dbfacb7e37487d926eac189ddf717966e09fc439b986a20719b54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043631, "uuid": "e155e7fd-5c92-4069-afad-aeef8f305f14", "comment": "Malware payload (Gafgyt)", "value": "421f5a31b53c70188eaaf4603c1661d0461d28ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043631, "uuid": "3cd37c18-07fe-49bb-8992-519a8b53ec1e", "comment": "Malware payload (Gafgyt)", "value": "492930f2e2014a712b13d7547ebe219527fae31ef54a61159e5906a1574b817de7cde50e4a87240dc9ddc85e9cb283b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043631, "uuid": "dd7201a9-2c32-4a53-bd0e-2004514f6251", "value": "T1D3A32A17AE91C0BEC08AD2745BDBD2B2F732F8A51221361F3354AA223FB1F951B18755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043631, "uuid": "79e47a28-4ddf-4deb-bdce-7011c0ec4488", "value": "1536:WmZwg5l0gs0sqSdV080/zEi90M1gAbfvLYKlorF8AaCML:WmZtQgniHOE20zAbyF+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783043631, "uuid": "06edae3c-9708-481c-899f-8caf1d2826c8", "value": 106208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783043631, "uuid": "f6993096-83dd-4ad1-b631-9f5fd2afcba3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043631, "uuid": "357d4c3c-ff67-440b-86ee-db13675c4ab3", "value": "x86_64.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf92f22-76de-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783083228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083228, "uuid": "33bf2cad-908b-4fe6-86e8-fc09943f1c10", "comment": "Malware payload", "value": "1f2283b3990916e627fb0371609101f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083228, "uuid": "dbc71320-2c78-4d8f-9346-bd84caf48da2", "comment": "Malware payload", "value": "87e838534b50c67fdacc41a159b60c2fa12936b962f02074c6932649609c019f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083228, "uuid": "b5b2766f-4094-47b8-8d6f-07f75ef88a36", "comment": "Malware payload", "value": "c492d5241453d05c2aeccd6c636601ba54ef4621", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783083228, "uuid": "62939e71-c922-45ca-8dac-1385b0701193", "comment": "Malware payload", "value": "e8c4f32b11140ca742ebccca455d8c4fe2548c1a396ae7aba397f4ee2130ab991f24eba9d654ca980d7da7c3c23c1cfe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783083228, "uuid": "d5542978-df98-4f75-8783-b5d4ede56a8d", "value": "T146236C6516857C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C4AA9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783083228, "uuid": "d5ecd1df-68f1-4b82-9c69-50578c8a2c70", "value": "768:xr9NyXsZztCh9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:JHusZbcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783083228, "uuid": "5844a894-349d-4d5e-84aa-50c6d433321f", "value": 48364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783083228, "uuid": "009ebe16-1245-4b59-9c9a-1573f7dc02ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783083228, "uuid": "9206c3d1-311f-409c-a6da-fa1aab36a6c2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b130c97-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101776, "uuid": "76314bd7-4a2a-4dbc-813f-05adc423f7ab", "comment": "Malware payload", "value": "a1328bf3e044c79a36d5992ba3f53ba5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101776, "uuid": "14819e29-4e38-4322-ac3f-d863e359445a", "comment": "Malware payload", "value": "8834d1ae56d0eba97eeabc0103ff7ed9d52974d821afda892a45eacbb18f6128", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101776, "uuid": "e33f6295-87c2-49ce-94de-63d6a46d8783", "comment": "Malware payload", "value": "212654c4777e3f1ec7e2dfe6523971f569d42f63", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101776, "uuid": "0f4fd0d5-3933-40ef-89a6-9b8b299341b6", "comment": "Malware payload", "value": "0feb52e08e41f630053fd5ba7082b3d635896bc2642dbb13b955631ec3f2f689f5e87f04f189fca2e8ff1cbe7b5d4bb9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101776, "uuid": "fdd67e75-5453-4ff0-bc89-f1e6c0f425bd", "value": "T15B24355D39535E9E9AE1970CE2E2441F0FAEEF1DD260B7C82ED34BCEE24994076A4D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101776, "uuid": "9247c6bb-f35d-4925-815d-9695d0edb90c", "value": "6144:qhWKS4Ji/9QPaCGAYz6pZ99iD6A0B9oiq0BMczHA5MpYqGTJ+0PzdjP1EhZpv4TI:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101776, "uuid": "54c10485-e650-410d-9938-ba2d0a025948", "value": 218831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101776, "uuid": "a9d713a9-f228-4b5b-b672-fddd6660557b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101776, "uuid": "a66f395a-6103-40d8-93b6-45d80a32cb29", "value": "107.173.143.45_128_givemebesttimeforbetterplacescomingforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb08946-76d6-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783080092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783080092, "uuid": "cbeaa070-946b-44b2-8fab-fca3c554ba90", "comment": "Malware payload", "value": "77c96f339974b65ae435313a8fcc3b35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783080092, "uuid": "cad74189-3c33-4212-895b-c123bd7fcef9", "comment": "Malware payload", "value": "889cc3e793cb39889c7acc8e73a84973e9a08fcd69451f7b546509c74ffdda90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783080092, "uuid": "59a79f0c-4159-4b3e-abd7-82f9cd753dac", "comment": "Malware payload", "value": "c5ec7e2ad924e832e49fbac9d0c82719b570e080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783080092, "uuid": "2996b77e-94ea-4d27-bd9c-b81fabf2d6cf", "comment": "Malware payload", "value": "20bf10118784b5e2b2f303f41ef0a4b73beafd77693d4b09c54cad7a4d53b0ba5045236ecbd54025e1d7480992dfca40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783080092, "uuid": "819f0734-a8b1-44c9-9b77-59025b60730a", "value": "T1C4E58C47BCE148EAC4A9A33189B391927B75BC091F3263D72E90B7382E727E05D75718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783080092, "uuid": "cd6e521f-4776-4416-940d-bc7a0cea0ccc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783080092, "uuid": "38a163f0-54c5-47b6-8f7c-12d6bef9c946", "value": "49152:keYK87lG8NtitfF8nCQDCAENhTvlWG89PNojFV:keq55CM1MdMxNoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783080092, "uuid": "401aaecb-ed14-47ec-a537-aee7f82b8fbb", "value": 3159552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783080092, "uuid": "590ad8c3-386a-4db8-9c8f-8c8d74017d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783080092, "uuid": "85a2b211-ae44-469d-b7bb-27f9b486fddb", "value": "889cc3e793cb39889c7acc8e73a84973e9a08fcd69451f7b546509c74ffdda90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c3b748-76a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783056995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056995, "uuid": "a6a3f60f-9c34-4ee5-b29e-822b66997ee3", "comment": "Malware payload", "value": "f9950bdfb375b97467e924936cb96306", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056995, "uuid": "d74a784a-14eb-4020-a131-150d7c2c71f1", "comment": "Malware payload", "value": "8c8505602b6753850b7d6f85ca89e497b421f70905ac5aaf6d3023fa1c74a923", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056995, "uuid": "cd8ca2d0-915b-451c-8842-5901a7e598c8", "comment": "Malware payload", "value": "60d0290f6879f8281a9577c772f610f7390103fa", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783056995, "uuid": "99c56eea-85f1-416c-a399-d9c8d6ea5982", "comment": "Malware payload", "value": "8c1160e323449f3e1a60f2cde97da3a9952af411ba1d1e118fc9999ee0efc9f3ea3deeb70ff2184090e0d4545336b9f9", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056995, "uuid": "8f1d8387-eb36-4391-a7ef-3a2c63b59528", "value": "T1BC36BF4FBA9D07F8C93991F59424921277C1B8038F20DEBBB8563C660D7BEA84E35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056995, "uuid": "19703624-dc64-4f2c-b05c-c304480e8f36", "value": "52c0d5ce5d7923a876fda0005ddcdf27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056995, "uuid": "71a8d139-c8b5-4d4d-ad54-59abc9d33a0a", "value": "49152:E7E2RcoWcxcn2CyS/ZhVPRHFIrpDQiLzTskKVz2zWa6l63rxySL0j2nbYG22CyM6:dhPwO6SaVIc0hLSzK5Rr6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783056995, "uuid": "4570e0a9-0e38-4196-ac0d-ef99266c0fa4", "value": 4870144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783056995, "uuid": "d4c10761-cbee-472d-baf4-36297a6d19af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783056995, "uuid": "ee773154-2069-4cb5-9395-7777bc0dd0e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f32b8aa-76e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783086347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783086347, "uuid": "95b66ca0-3262-413a-929a-b56697de4840", "comment": "Malware payload (Mirai)", "value": "c944526987d33354b0a77556080111e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783086347, "uuid": "214125c9-47f4-4280-84d7-ccb79d42bf63", "comment": "Malware payload (Mirai)", "value": "8e1897382a75baf8d62f21fc5266e64d06fbc1bd5e209d0f1d35131ea5b521d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783086347, "uuid": "50ca7c59-4526-4455-944a-2d83156b7135", "comment": "Malware payload (Mirai)", "value": "0198dca2e75b3d8933dd15cf36a45cd606bb08e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783086347, "uuid": "d843cdd8-55d1-40b4-b43b-8fa81284b6c0", "comment": "Malware payload (Mirai)", "value": "4a25aaba69f52c11ad318adc4bbaf25fa07142145f45f3deacdefa881c4b14f8a7c0ec0c40853d22e678f1c95cf0d687", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783086347, "uuid": "e9bfda85-a250-4518-a104-91a243da7878", "value": "T13EA34B2BB651C47FC047E1F01BDB9963E921B97E0A717046B7D0BD912F6CCD19A183A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783086347, "uuid": "e8a76d76-718e-4a4d-aaf9-dcc539b4793f", "value": "1536:fnKb4DmQHNHUxUxKVwRLEZ0pAcMrbRy4F1rskIjLT/5z7QGL3E/phauJuBIUu:PKbktHU9whEafMBn13IjLT/tcCE/pha6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783086347, "uuid": "6524ff42-3d63-4c43-8636-67041745b681", "value": 98280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783086347, "uuid": "929f400e-577e-4b94-bcca-93a26a22383b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783086347, "uuid": "ab3c476b-1e0a-4db8-b5a8-2b2980c4b813", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07acc3c-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101087, "uuid": "2ca3c31a-106b-4c9f-94bc-12862b6b11fa", "comment": "Malware payload (AgentTesla)", "value": "49f2cd19c112cf3de6e8474be05a5bde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101087, "uuid": "2bd96aad-02c9-4be2-b0f8-635e81774134", "comment": "Malware payload (AgentTesla)", "value": "8f2734b349066f67b40ca3ddb4a6678e89cc1d0dfc5d90afb20a1dccb1073c8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101087, "uuid": "6fda2bd3-22ee-4fee-ba50-efd46c5e1668", "comment": "Malware payload (AgentTesla)", "value": "d5ead22a960682b7ee7e0e52cec3d58f14dd302c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101087, "uuid": "291d6802-4ad0-48de-bdbc-66ba953b0d0b", "comment": "Malware payload (AgentTesla)", "value": "87064b9909a9308f22d22a39d3996652caa9d3a25dc4c22ba0762b73b31b6fea362da2c18d25132cb08cfe433532ac7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101087, "uuid": "3e69ce21-777b-40f8-b16c-2e1a12f6bbac", "value": "T14045330C075CB1EAD6D8FD0EBA045F9FD6806C35E43240B2275196EFEAE11885DABBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101087, "uuid": "6db76088-0cf3-41c5-8fa2-3f28e7c75e9f", "value": "24576:FyWfXoTuGymOQVxi23IGYPHTtyIWKqWlmYZrdiXvrjk3wDgurvd358vGY:7oTwxH23EfTMcqWlm+wXvvk7uzdJ8uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101087, "uuid": "e532f239-e5b5-434f-b208-bcda1caee892", "value": 1215245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101087, "uuid": "7d4a31c3-c73f-417c-b7be-bcbaab3a2f0b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101087, "uuid": "878cdafc-3f1d-4aa5-ab21-825f94536e30", "value": "Inquiry-05201569.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26dcfda-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101519, "uuid": "02cd719d-5822-44e6-8c13-47c08eb5162c", "comment": "Malware payload (AgentTesla)", "value": "e7a6478cfa06c93a8ac7a429defcf9ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101519, "uuid": "01ad2a4c-7748-4060-a8cc-2cf142703b0d", "comment": "Malware payload (AgentTesla)", "value": "9024c83dfb4553f1c447750548be5bb722453cd546f28942781bc2ab491db976", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101519, "uuid": "b3027f1f-b7bb-4145-854b-2e732f5d7d3a", "comment": "Malware payload (AgentTesla)", "value": "344719b75b7044aab19c28cf5c382039cad2cc0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101519, "uuid": "9d990920-dada-448f-9eaa-dd08a8fe6d4a", "comment": "Malware payload (AgentTesla)", "value": "6b835d55f7c0116dfed778c91c723959e41f2ba98fabe0a72c0f49427a637df2be339b4072b3762c5466fbb7d9e45cf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101519, "uuid": "218fde17-0cca-42e6-8a48-f3e4758a639f", "value": "T1BF6533D5B1C35FE75F38C2C8C8D05E40B8BE8C9940C7E6635A901DBA81AA1E75E86D7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101519, "uuid": "6a8687b5-db43-45a3-81ad-b4194c24f708", "value": "24576:lNJG+SrX+2tCbo5LqtdqfcvZG5Wl4+Zfk9X3b8Sb+NxayxoZRCv6O9N3O7dxkYzY:4NXjtP5LqtdxvZYWxZfk9Xr8Sb+OC6Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101519, "uuid": "887e0657-6be4-481e-8b1b-6c01b5c10bc2", "value": 1485687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101519, "uuid": "43f46e56-4f00-4d6e-bbde-209aa5fb2b9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101519, "uuid": "47d77cf4-8dc6-4f7f-9272-8048b15d5f0c", "value": "SOA_MAY_2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6fa1a93-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101554, "uuid": "ef41f7c7-fb2f-46eb-b545-5bcb7028e318", "comment": "Malware payload", "value": "53a75307f2167023c36c13330b5ce9c6", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101554, "uuid": "4ace30bd-b9b0-4121-b8ac-88e6a1a20942", "comment": "Malware payload", "value": "9221a086a63673dd09ca43a6af9e7a3977f3e301e756eaefe9bfcf8680dc73b7", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101554, "uuid": "a4cf1d05-fc0b-4b0f-a25d-725dc144d1a0", "comment": "Malware payload", "value": "32aea021f247c016d7378eb98d17255fa04b8716", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101554, "uuid": "eb2f130c-e956-48b1-9b70-ea86aa94a3e8", "comment": "Malware payload", "value": "2eedeb06d7489f9d6ceb246e9a6fb7e68f8cce1d95d6e0a715312c358356c89b1b1919572ef742de3f3e87457d428965", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101554, "uuid": "e99b3cc8-c340-484b-9e27-a2db3242d899", "value": "T16E34CE1709634074E52259276FCDF9B0A4EEA3CD89B6300555CE7AC9CF8B277E230CA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101554, "uuid": "2abfcc24-ad9d-4dfe-a53a-583758ae05a7", "value": "6144:RAcicicicicicgM1PQN9aILnIoC/ZshloIwlE00Myo72zdtsZa:RAcicicicicich1PQGqnZIZscnEtMy4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101554, "uuid": "3a30c7a7-1751-48cd-891a-d6934ec2110d", "value": 252715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101554, "uuid": "5c19886f-79a9-4b8a-991c-47777921069b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101554, "uuid": "ebda8342-049f-44fe-a89e-489908c9d41a", "value": "RFQ-ISC-2026-1224-00429-IAASA.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b14d628-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106956, "uuid": "f7197302-cffe-45c8-9311-3f91c4bf64a5", "comment": "Malware payload (Mirai)", "value": "19afe61327539a53ee3366b2625d6122", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106956, "uuid": "083c327c-921c-4254-ae67-4590b969af38", "comment": "Malware payload (Mirai)", "value": "94fa960157c205a74ee1a2a783d3208dd536f25adf2f39a05b0a282ac822fcc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106956, "uuid": "b2dce59e-eb4c-4a6b-ab83-ab3ecbda6e18", "comment": "Malware payload (Mirai)", "value": "130c62c6df530e3d1df342ee32b07085e2749058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106956, "uuid": "6e0b9996-21f9-4cac-a7f7-892eee462add", "comment": "Malware payload (Mirai)", "value": "6ce248dda7683f8aa12996ce9f8bb41a5dd77442627663b4abf404b9754fe7edb1e3248db4a97516f107ff124fe107aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106956, "uuid": "13464a29-aaef-47d7-8021-651d74bbc58a", "value": "T10EA3D692BCC2562BC5E523BEA67E518D3360B7E4C2DA7117D8A34B107B8651F0E63F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106956, "uuid": "060f2609-fe0f-484c-992f-1e57c9b32cc2", "value": "1536:VnsCDhqI8UTYLbkGqnXV/EI41Le7BLGVLXe/9tmhPJHYK0vUbYO3:VnsCDhqIYLbq2ewXKGHYKCU/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106956, "uuid": "371a61b9-5c94-483d-b0e6-3bd31baa6dbe", "value": 100960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106956, "uuid": "1a1e4962-65fc-492e-a870-1fc9128164b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106956, "uuid": "e9a97b23-2519-4709-901e-d00b54e03b9d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1181cfb7-7685-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783044932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044932, "uuid": "11672f3f-ccd2-4f12-bfa9-3fca228936c5", "comment": "Malware payload (WannaCry)", "value": "094cdc3550ebb0d6a7ad470eae50b506", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044932, "uuid": "ddfff06d-d24c-4ea4-bc43-0f042828f4b4", "comment": "Malware payload (WannaCry)", "value": "94faff7500a2f959889a3fff9bed01cb30fdb6ab5dbcbe984f592a3891333f36", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044932, "uuid": "ded96d94-f14d-4ef4-a896-b7b6a726033d", "comment": "Malware payload (WannaCry)", "value": "2135c244eea8e44b66050079b144a675ffbe118f", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044932, "uuid": "e7c875db-722e-4270-a098-56c8f2198f1a", "comment": "Malware payload (WannaCry)", "value": "a2de861bdb174933249fa7901d013635ffd1af8b31ef49a8847309f09c9ca0971f77b68d96c748ede99bd4fc10053ce7", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044932, "uuid": "bab15b8e-a23f-4dd8-aa79-1e3f6402db9c", "value": "T1B336235932BC91BCD106267484B78D26E7B33C9623FD5B0F4B844AAB0D13B59BB64B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044932, "uuid": "37dced8b-1060-45d3-b091-125d750a4e30", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044932, "uuid": "2bd170bd-8d56-4a2a-b2a2-447cc3e4d242", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQgv:DXDqPoBhz1aRxcSUDkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783044932, "uuid": "76ecfd56-8309-42e1-997c-8bf4f33ef950", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783044932, "uuid": "9a18e10f-4089-48a3-a0dd-817777a05fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044932, "uuid": "9994e643-c98c-439b-aa38-7463bf4d26ce", "value": "94faff7500a2f959889a3fff9bed01cb30fdb6ab5dbcbe984f592a3891333f36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e23723b-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101297, "uuid": "f1f2e27b-0f65-45f9-a3df-bfc2a864ea5f", "comment": "Malware payload (RemcosRAT)", "value": "641155f9bca6e79d11cc25dab53c890f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101297, "uuid": "5946bb94-2f16-4e54-affb-9d2f071a40dc", "comment": "Malware payload (RemcosRAT)", "value": "956cec034e34f187af8b9b4ad497ead753b0f7ef6c26a735d7c2c35294d238c0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101297, "uuid": "944db586-6a12-4a78-89d8-f29e7f092b65", "comment": "Malware payload (RemcosRAT)", "value": "b4d0893ebce4191ed77ae12c53d2950c77b7b566", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101297, "uuid": "8d9ff914-dcf7-4d5a-aaa8-46105f08a3e3", "comment": "Malware payload (RemcosRAT)", "value": "8621f01ed8c79ec3290cf92685ceca780c6f92e4a8cb1f9b9eb65e5e3a8ec3ed0609fa5266824c54d9063daff3732000", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101297, "uuid": "8dccad0a-3480-45cb-967e-de88364f8974", "value": "T16EA5335AD4907CF641C3738ABC13D5E63A1843F91223EBD1583DA6928DB2E33E477269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101297, "uuid": "b27027b9-5f9b-4afb-bdbf-33281d72eabe", "value": "49152:nq9iqCKfvhN48e6Pv4h5KuxHCPumwYBwXFFSaMDtorvqvtlPSwjaIuDEToviTRQC:PqCKnhOW4/xHtmw7FXMS+L7uYUviThB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101297, "uuid": "b5269e14-bac6-4c98-adbc-3d8b4e46f686", "value": 2255626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101297, "uuid": "822ac970-29a5-4e88-8b9d-b8ce21f475ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101297, "uuid": "aa17bf7c-7a90-4001-b736-857fdbb6f3aa", "value": "6141.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6baee84-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101151, "uuid": "db59db0e-95ba-467a-841b-75c216e3fdba", "comment": "Malware payload", "value": "03f185d4ded54214958aff29adde2e8f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101151, "uuid": "18675a32-b1bc-4756-b72e-5567f23c218e", "comment": "Malware payload", "value": "96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101151, "uuid": "d9603a03-bdd3-4c1d-a85b-26acbecc338a", "comment": "Malware payload", "value": "e57c90518e7fd376f8a5e537c7245d69d3a7cf0c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101151, "uuid": "e08e2527-f894-4709-8602-09d0e6720b5b", "comment": "Malware payload", "value": "0e6dc3d2fdb3f817be048766434d3edac822152189eaea1206419e6a8050cc09572ff698d9bf435f25b9eedbe1e88ad5", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101151, "uuid": "7dbd983c-ea37-401c-92bc-1e40ca00de6d", "value": "T12CA31215E29D43F04FE38298B35BA40DC7BDEAF8E86AC40DD6B1E509660FB836B4D154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101151, "uuid": "061b7461-1eaf-4959-a477-6f96ea6c4c02", "value": "3072:zYdmh0usTcfGzrS2fdEtV7q92iaarcciRoCB2vH3:zYdm7tOEr7q92iaIcc8b0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101151, "uuid": "ef729b2e-767e-46d9-b4ce-096234bc038b", "value": 107241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101151, "uuid": "4cbae725-dca4-4b22-a37c-e4237a99ba3d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101151, "uuid": "9f34bc35-96fe-445e-b864-f4711dbd90f7", "value": "RFQ_For_Payment_Invoice__VER12000263330-800139_pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9970817a-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783100994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100994, "uuid": "023db492-939d-4f31-bc9a-0e41d919628c", "comment": "Malware payload (MassLogger)", "value": "cfe9be2a9ae3ee737a9ec660ebdabac9", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100994, "uuid": "e918cf71-3970-47ad-9c83-b65a8f314aee", "comment": "Malware payload (MassLogger)", "value": "976c4698f4ef65daaa15758bfa77dc9571bc57100160bebb385ad9aa549139cf", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100994, "uuid": "a1ec2152-a6d9-4921-849d-2cd75d0ae4df", "comment": "Malware payload (MassLogger)", "value": "c011312d27a33f75db15eeadc725389fec1e7978", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100994, "uuid": "bd3006aa-bbd4-405d-8230-fe4045ad9d26", "comment": "Malware payload (MassLogger)", "value": "f82573effeae1bb303e48609fd7731489cb4f1392d175c41b070453a9599148a6dbb4fa8d1cab2eebeeb179cf826a623", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100994, "uuid": "3ce034dc-d278-4f87-a74e-686d635a83e6", "value": "T19CA423800D1E9911D98F09A5ECB5E57B8CF86FE2FF36D69F0A938A0D517C6C03139698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100994, "uuid": "2eeba006-0819-4024-ba80-41ee520b98aa", "value": "12288:2b1ZDUZ3CWdcL2t9tereHyPyqCEjh4GesBpost5SjMSUZMT2K5Nz1:25NARcLCMy6yq3hsepos2AxK5Nz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783100994, "uuid": "441be9e1-a812-404a-852a-1598e5e75821", "value": 485642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783100994, "uuid": "443b5e8d-386a-42d2-bc15-0b112e8caaf6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100994, "uuid": "534cd521-14e2-413f-9da0-17a9ed4aa2da", "value": "ordenXdeXcompras.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445e9c89-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101281, "uuid": "28a30af6-476b-4d5c-b00c-59f937498af0", "comment": "Malware payload (AgentTesla)", "value": "8cedea4b700f3e469a4148485bf61533", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101281, "uuid": "8a07a35c-6151-4f85-90cb-eba583c39847", "comment": "Malware payload (AgentTesla)", "value": "992f8357342cbd40f25ec6fb8b4c4ecaeecd20e1c53fc28d925b3146075187ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101281, "uuid": "6fe202fb-0780-4418-b439-290a7dac1114", "comment": "Malware payload (AgentTesla)", "value": "6e44ad3cf6b112b5bfaa2299f8c11185c9f6fb50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101281, "uuid": "6267d59d-fe27-47d5-a8b3-c1c2b9d7ba94", "comment": "Malware payload (AgentTesla)", "value": "05b855e1bd652d4838566d2e87c2a0c53fbb784897512a3fa9b00b130dc773269e53204c0512b193d7d61d70ddc4ae6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101281, "uuid": "4d4144f6-f423-4d31-8382-29273c83bf00", "value": "T1BE45330C075CB1EAD6D8FD0EBA045F9FD5806C35E43240B2275196EFEAE11885DABBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101281, "uuid": "e6886c4a-6f00-4fad-ba2a-4975e6ae60b8", "value": "24576:GyWfXoTuGymOQVxi23IGYPHTtyIWKqWlmYZrdiXvrjk3wDgurvd358vG/:4oTwxH23EfTMcqWlm+wXvvk7uzdJ8u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101281, "uuid": "6ec52c0a-8308-476f-b746-19e56773360e", "value": 1215237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101281, "uuid": "70e825c4-152b-4f30-8458-cf49276ee200", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101281, "uuid": "cd0347f9-e569-4054-a61f-a2a238c58914", "value": "Confirmation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1c1e67-76a7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783059770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059770, "uuid": "27485485-0ce2-4a7e-b4cd-bee83c427571", "comment": "Malware payload", "value": "050e0516017eb9dadb9e6c54737bb352", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059770, "uuid": "da560cc2-2b2e-4f7e-b5cb-fea62439dccd", "comment": "Malware payload", "value": "9a6a6eea504efed17d84a12d67a857268213a8d7d6b92b9fb380b14cf3bb48c9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059770, "uuid": "5f4978e5-0312-44d9-9b1f-a4d5361b16da", "comment": "Malware payload", "value": "7e1ef452b39928eb4285a63f9c88f07cea0a769d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783059770, "uuid": "3953c996-814d-47ec-b46d-f301b5a7bf9d", "comment": "Malware payload", "value": "d39ce6ff2358cb1210992b68e40b880153ce75259bc1bc78500306a835bb4c7dbbe1ffa97ffeddb0d494622e2a99489e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "implant", "colour": "#3A798A", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Win64", "colour": "#AAE228", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059770, "uuid": "dbbb46dd-49e5-4ecd-bf2d-287c3817d525", "value": "T1AC35F9B7D7CC4318E6EE41F0F5974F8AE4B0714C5E36B5424C53678A4920FA2A2BD27A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059770, "uuid": "fc526dc0-2fca-4eca-82bc-11ecda66b713", "value": "f2367a09c19575cbaf212af1e17a5f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059770, "uuid": "3794b963-4057-47f9-aa29-27b27321f7f7", "value": "12288:uT3xQtavOt01hphjGoSyEWZWL1ltmvYydd13s4BsY0vvradUzMkLaL:uTcpt01hj3O4LL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783059770, "uuid": "e3f54e27-ffe2-40e8-81a4-0aa61d1e9053", "value": 1080384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783059770, "uuid": "97e1dd5a-9b35-460a-abc6-de88415bebfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783059770, "uuid": "779d95bc-42d9-499e-906e-018aceb6d42e", "value": "log.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80e5712-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783077477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077477, "uuid": "64508a5f-5174-4312-bd92-f36067b5cbec", "comment": "Malware payload (Mirai)", "value": "6124abed6a678e70a3b9e4bec86f639e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077477, "uuid": "069cc579-d239-416c-9326-6a2395e7d71d", "comment": "Malware payload (Mirai)", "value": "9a7ee52f3ee0eafeb1bd365c51909bd1f43010c2ab974d02a8f94455a89923c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077477, "uuid": "05d268ff-838c-4f63-95e5-722f011f6ddd", "comment": "Malware payload (Mirai)", "value": "c3c604465227ec3cb367449a442772dc3a7bb457", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077477, "uuid": "9b88f8c1-b22e-4326-ac12-9892fc83bee1", "comment": "Malware payload (Mirai)", "value": "0dbe69bd430910df4ded83aaa1d85cc65487bdd82fbf9fc83bbc7a16747e0daf80d4cb351c7e8807fcbd53b013c91ce2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077477, "uuid": "9b6033bf-40ab-48bc-b7d2-e071e1f09820", "value": "T11804881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077477, "uuid": "c854bac2-799e-4c91-812e-3dc805fba895", "value": "3072:vg57xE7LHZwbq1ESBa3VCvrCsWrFesCeX:vglxE7LHZgh6C9FHCeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077477, "uuid": "ec28bbb7-422e-469b-acaa-7a6b0708c21f", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077477, "uuid": "a4f91cbe-12cd-49f5-9f7b-39a27bb43f8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077477, "uuid": "300ccf18-5547-4f7b-8fe4-410bb9da9600", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb9f799-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101164, "uuid": "10055872-eb8e-44dd-9b10-f2224f9e28de", "comment": "Malware payload", "value": "2121fb54d012cf220273a0868fe821c7", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101164, "uuid": "323af15f-ee06-4435-9b41-6c9d287e5b57", "comment": "Malware payload", "value": "9a8b123d41ac3e0e012680caeb153adf01d9c3248175fd16df8007093012591d", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101164, "uuid": "33b00d08-2b59-4d5a-b926-d55b43aa3b07", "comment": "Malware payload", "value": "21c0c81b9433b5b485832078aeacdb0d3a4e09f1", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101164, "uuid": "471c56dc-ac0d-4faa-bc4c-5eece1417bb7", "comment": "Malware payload", "value": "411dfa48899cf957c9b12236d0c781eebbf91431b8b1922b38183a4d6f8352963c870ac511d051ed345df2c3c4a3a942", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101164, "uuid": "7ceeb783-a1df-4e80-aead-433c2f3a2555", "value": "T177230874D664CB56AD8733BDDC807A85A678CB25423310E4FED50319A00D878BFBDAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101164, "uuid": "17dd6c00-207d-4d03-8c36-21a01b205881", "value": "768:yT3wgka7nuadPTy29+5I7UmnGakJMvLM/BvfIs4noMdY8tfNB1dTxu:yT3wmlSzmnDkZ/BnIvzdFBHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101164, "uuid": "264eb0d2-4310-4f70-9ae9-d54bd2e7e0d9", "value": 47338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101164, "uuid": "c6777ebb-714f-485c-97ec-b7f9fb81e932", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101164, "uuid": "1f8a9418-28b2-4bd9-9e50-86936993e662", "value": "Bank_Details.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6d38ab-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082751, "uuid": "ef902f4b-80ee-424f-892c-a1c03b0dcac7", "comment": "Malware payload (Gafgyt)", "value": "bffea3080ad9e1a0cd28438ff9cc573d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082751, "uuid": "f11a7b38-2d0f-4a84-af69-d138c409862a", "comment": "Malware payload (Gafgyt)", "value": "9bde3bbe88824b115539416a4fbc46940a52622e81851daabea3baaf06c21a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082751, "uuid": "6ae45e7f-c404-4e6e-aa0e-ada3d17bf2c7", "comment": "Malware payload (Gafgyt)", "value": "6668bc96156e5e6ef4525e022e9ccf730a60a475", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082751, "uuid": "6cd653f9-1e0b-441a-8d5b-2242b156c60f", "comment": "Malware payload (Gafgyt)", "value": "c28bc8b371f480e88bf0b2b6add7c3beeac33ba1fa10d5d1faae3f222b78381798a40fcdfc60ab2701af82437e5b484a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082751, "uuid": "53ec3526-41c8-4976-bb37-9c4db226342a", "value": "T17D933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082751, "uuid": "01cf6a82-6294-45bc-b745-971879b8d163", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Tl4umXxVqDrstKfz9e:Q97vk51RcG7Atl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082751, "uuid": "6af61608-81f8-45cf-8be9-8fc6121c0858", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082751, "uuid": "cd7efcdf-6668-40eb-bc88-a4b412dccd7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082751, "uuid": "00322e0d-a301-4c44-8d48-3c11f49512f8", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78e4421-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101045, "uuid": "78d72110-e985-4da1-9c94-6ed485730b53", "comment": "Malware payload (AgentTesla)", "value": "e4169a0dcf71801402df6ba47bf0ec83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101045, "uuid": "9a804902-7faf-4bff-9e0a-59e3e6c62ece", "comment": "Malware payload (AgentTesla)", "value": "9c18f28b8872ad69c5dddccc432cb3eab992aff1f9d95c2c103aca16c46a3247", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101045, "uuid": "c2ebab04-7226-4b9b-8842-13a86d7c7d32", "comment": "Malware payload (AgentTesla)", "value": "b178c8f57684f1601aee318cc8661ca98fd5bc44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101045, "uuid": "22e33aef-ab7b-49ac-8d19-a01de1ed6a1e", "comment": "Malware payload (AgentTesla)", "value": "ba8d7cc2fc8b6147859f32f493303f3aaa31d07aee476649f8b46a344a10de7ed515f7486ae96b9944415728acced252", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101045, "uuid": "23ed6c5c-a8f0-44ce-b706-98a24b3feb8f", "value": "T1A245330C075CB1EAD6D8FD0EBA045F9FD6806C35E43240B2275196EFEAE11885DABBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101045, "uuid": "5f060177-1fa2-4be8-b2b2-d3313d4f659c", "value": "24576:nyWfXoTuGymOQVxi23IGYPHTtyIWKqWlmYZrdiXvrjk3wDgurvd358vGX:hoTwxH23EfTMcqWlm+wXvvk7uzdJ8uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101045, "uuid": "78eee207-1898-42d3-bbfa-21d27ced03dd", "value": 1215283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101045, "uuid": "09fc0db0-2d36-4f4c-a40e-f60b6d80de66", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101045, "uuid": "6f0c8aa2-498e-40ab-9859-dc068437ffe2", "value": "Quotatin-HKTXMarine-XBelgorod--ODME.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581db7f8-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101744, "uuid": "33c1230e-bf36-4c3d-81ec-ab1cb950fac8", "comment": "Malware payload (RemcosRAT)", "value": "8a202826b9f1eda40130eba842fec833", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101744, "uuid": "1a47b2e7-b428-46bf-9351-3997bd6912af", "comment": "Malware payload (RemcosRAT)", "value": "9c555a75b0c94ab3f2a29a3a21c7fd09c6f2893ff0c26523b773ab89fd7795b4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101744, "uuid": "10f8c487-46ea-4031-a940-34d082731eb5", "comment": "Malware payload (RemcosRAT)", "value": "93fa827d8bed058ee7f8725ce23dd3f869671f8b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101744, "uuid": "25a8e333-d19f-4337-885a-972ec1a8c4eb", "comment": "Malware payload (RemcosRAT)", "value": "cba6d8f407613566ebbeb564abcf0ea3a247f26c896db1b83e01d46a45d360673dfa84cea6d1b31fdbae0bd2a9c24b09", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101744, "uuid": "d0c48b07-5f72-41c9-843b-74efb24a12c4", "value": "T173F2F246E1C88ED5F41F6370BA2F107195E0046A59FA42A7549A2DF173C246FF4CF0AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101744, "uuid": "d7a72fcb-3f3c-4fb4-840b-a9ddc427f946", "value": "768:ZpRVhIg/rMa7+QK/QjiIHzk7ApvTNGWw9V/ZzsXVq9uBhj:ZpRPIg/rMSO/Q2IHQc8Loq9u/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101744, "uuid": "c695a837-5704-4eb3-a7c6-efb69f6f0b78", "value": 34275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101744, "uuid": "ede072ec-9f37-4b93-abf8-fd905a4e8dc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101744, "uuid": "de15bd35-e8b8-4407-8ad3-e089df8cbc7d", "value": "MayJune2026statement.arj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5523a1-7733-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783119654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119654, "uuid": "d3debfbc-3339-453d-9a4b-ba97c8364d25", "comment": "Malware payload", "value": "be1cb01a50034098af92777bafefcb75", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119654, "uuid": "7f013e9c-1230-426c-b443-0bd65cf34f8c", "comment": "Malware payload", "value": "9f42721255d8d62b4595b9040a9a7d742c8fe2a5ff17745c8e250cd04928c480", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119654, "uuid": "624beabd-a254-481e-8320-c96df56f4c5d", "comment": "Malware payload", "value": "7cddcfe3639668bf180859d6f79d498e4f61418c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119654, "uuid": "1d367b0e-eac0-4646-9687-29bf7b842bd3", "comment": "Malware payload", "value": "d81b709ee66c1dba7167560aa7f3af0c095c4890d3bb5db7a7d588358932e23bcdf94e85b47edb9590a935f66cee555d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119654, "uuid": "25576158-64a4-4875-8df7-89d949349161", "value": "T131854A46F784AA2FC837913755AB5732114B4C4A8E83DBC36958770C28BB9E41F9DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119654, "uuid": "645378cf-4adb-47b0-ab8f-ba9d8e432d3a", "value": "24576:41GcCtLm7SsoF/CaTN8NTHvj3OmywiWSp:41qx7F/CaTN8NTH01p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783119654, "uuid": "c80c8424-be4d-4cf0-857a-49d397296b5f", "value": 1812241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783119654, "uuid": "c273fa6e-5f03-40be-a54f-4ded956d08e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119654, "uuid": "db20d71e-591f-4830-bb8c-bed83b4f7853", "value": "\u06e6\u06d6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460b01d1-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106867, "uuid": "f1d54a62-1652-49fc-93bc-efbf4519049b", "comment": "Malware payload (Mirai)", "value": "9344934224cfd66e25112b774bd64b27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106867, "uuid": "f2fd3e81-dada-4a86-9421-b18640455052", "comment": "Malware payload (Mirai)", "value": "9fe304dca3df86aabe0f6df2ee36af044faddc91c6b234ece1f748ddcf0feaed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106867, "uuid": "67a8648d-3234-4225-884d-25c42fc6f3b8", "comment": "Malware payload (Mirai)", "value": "f8e638e1d5941c2de862c553ef693cbc7d943b4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106867, "uuid": "7e8699b6-b1f7-4678-b9b6-02642caa7782", "comment": "Malware payload (Mirai)", "value": "be758f9b763334df401d5be31592108dea6282da0e2ca334d70b48ffcfd79e74af0e1119256a400b8e1c500b96117fef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106867, "uuid": "c58173ac-1187-4375-a125-67659d5eb395", "value": "T11BC38E32D5A4A9D4C0624135E462EA304F63E6C902971EBF2FD68A754087D64FF09BFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106867, "uuid": "55b85441-076b-4456-9e0f-3f63d3d70aea", "value": "3072:byj5ZKoipZS9HBYHlmq1+r+BQ6BKKlz6B2E1E:bytZskhMl02Q6B5DE1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106867, "uuid": "af3ba98c-d07e-4e30-916d-c6a06312ccc2", "value": 125440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106867, "uuid": "148db2e0-97a6-4910-a4e9-54ce3ac73550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106867, "uuid": "3838341a-f2f0-45f0-9ed4-da485591db6e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135a158b-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101628, "uuid": "8aa8e2ed-9a7a-4015-af55-f960dd22158a", "comment": "Malware payload", "value": "2e2d33c266ca20d61a03678d566c6d59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101628, "uuid": "3c868cfa-4588-4e96-83d2-bf9dd1e4373e", "comment": "Malware payload", "value": "a0803d17c8ffdd1e2b206a5a88d2695f8d28d1288ca41c63d90f1b57e733a640", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101628, "uuid": "1c55262c-abc1-45e3-b299-f9c960d35115", "comment": "Malware payload", "value": "6c861d65a2e747edbe635b2a05b1d50831aac33a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101628, "uuid": "7167aa87-b541-4bf1-b124-19ec8ff71536", "comment": "Malware payload", "value": "72b1fa92f2de9751c6ef44baa31565455e707ea62d8c5e6479975db4f0ec7f89f9fbfb09429fab69260e8e1bc577750b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101628, "uuid": "40d125d2-2e66-4f91-a0fb-249f1818ca15", "value": "T156365A03F19951D8C019C079CF469232AB61BC494BF162EF3A94B7D62A76EE43B3DB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101628, "uuid": "014d7c8b-9d62-4424-8b46-e41512a99efe", "value": "648a691435f42af39b96f360c4fa9448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101628, "uuid": "9e464781-1df0-48b1-855f-925e418825a7", "value": "49152:/Cafe/nyvc2hwBuPc4TymBac7B4LAPapVJHxFT7ZCnElJi802506S+6tb2KR4IwM:8mlcXTyho50XmYymDAaC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101628, "uuid": "fcca5331-e46b-4cd2-a86a-97c854063395", "value": 5304648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101628, "uuid": "8cf46c02-2d6f-44a8-b9f6-a5884d37951a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101628, "uuid": "54f63e3c-f282-4490-8a6d-5f886ea1879a", "value": "msedge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6030b190-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101757, "uuid": "282a81ba-c3eb-4985-ae65-65b80009096c", "comment": "Malware payload (RemcosRAT)", "value": "099cb5e0b84b815002eeee8a1c0f65a0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101757, "uuid": "40ebeaef-47a3-4d1f-a850-3e351257d786", "comment": "Malware payload (RemcosRAT)", "value": "a182f5d6317bf28aefa3169bf0cb356124ebf65721874f5e0ca61e6c1e52546a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101757, "uuid": "614a4612-58f5-4100-9f28-55e2f5a5cb3f", "comment": "Malware payload (RemcosRAT)", "value": "40f32d8f8fc284b30c540b0f81b415f36e5ccb38", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101757, "uuid": "28039111-8b9e-456b-9d59-f9828365e7e1", "comment": "Malware payload (RemcosRAT)", "value": "ff6922d33ff41c7e4d444e0d36436be17d4cd6671322a9006534b87d54a914b1d433d37816c1b8096ed6d222c43bbab5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101757, "uuid": "7149a4e4-f11e-4710-ab6c-e867f2b576fd", "value": "T117A4DC34ADEA503972B3AE75CAD6B697E91FB6633B2F981D108103464723942EDC133D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101757, "uuid": "e128a51b-3c56-41e3-a2c2-a6bc1230b5bd", "value": "12288:fCo54re5E1jV8jcMHes/CkqUabNa8cJq+QR+:WS0W1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101757, "uuid": "6644dd6c-e426-45d3-897a-a405c610af65", "value": 459522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101757, "uuid": "dba53316-59bf-4786-bb64-2d84a6f3c3b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101757, "uuid": "9700d47e-56a7-4f64-ac32-c876c8175821", "value": "Requirement_document_2026010711864779153.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e1e076-7683-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783044080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044080, "uuid": "d054202c-a390-4b0e-a04c-ed9e7ebabe23", "comment": "Malware payload", "value": "e8ba7a8dc1449224d5812364c0bdf2a2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044080, "uuid": "50e95331-c38c-4f79-91dd-6f1925847b46", "comment": "Malware payload", "value": "a2b929416dba251191a074ec1a186e696d279eaff6f4dba271a4b9a0ee228c82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044080, "uuid": "4b040bfa-c6cf-4e03-b93a-b3c1a579ae6f", "comment": "Malware payload", "value": "b102b60800bf3e94ae62f28203962eb5f4013992", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044080, "uuid": "9233be85-a335-454e-8904-94cf7b5de995", "comment": "Malware payload", "value": "009fd0b72d775a6cdb11af5b2d187d3e119d34c011dc845a343705b594a224ac07f62e5fff3b364127065862be9d8617", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044080, "uuid": "2e54eced-e1be-4a0d-98f9-43e730ee8115", "value": "T10A85B1ACFA7931D45871CA535C65C101DB7BAA73192DAC0D22DA0B8C0E17E4BB96873F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044080, "uuid": "eabadf24-a580-4903-8c04-2db711f8ded7", "value": "12288:q3yVGrOuQUn4uEVTJjpV9iJRqPP/V/EXYVMeasKSpwS5BenSpdQKip:q3y8iq4FoJUGXVsJXip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783044080, "uuid": "782f5711-0019-484e-bba1-0e738e2e9e0f", "value": 1843142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783044080, "uuid": "7dd3c9d9-6a58-4f99-b514-f4f6f4b9469f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044080, "uuid": "d8ca0143-d452-4fac-af78-6fd643dfa431", "value": "output_0yditfsf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da317da3-76ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783062878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062878, "uuid": "72ee042e-6c5d-405a-9102-825f00f91888", "comment": "Malware payload (Mirai)", "value": "2790539a14656bf50b312dae09a32fd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062878, "uuid": "1bd7dd08-8074-4319-b514-8c36d3c4943d", "comment": "Malware payload (Mirai)", "value": "a34d7aa860ddd60d571be3eb9b0c0a75a00d76a7285892ae66eaf3d25a00f5df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062878, "uuid": "9d68b79c-f892-4170-afce-5971840fc352", "comment": "Malware payload (Mirai)", "value": "e7bec4bb8832bb0cafa6653cbec98408d15a29d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062878, "uuid": "ce06d92f-7f59-40cb-9f26-146e18dd4e2a", "comment": "Malware payload (Mirai)", "value": "b1faef090eb086a56eb384f08794a3789d15ddb22f107c305da1cd874ba789d674e9e7f112d39b67c1bbaad91f4c4a9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062878, "uuid": "bfb1244c-344d-466b-862f-d68c3f3a529c", "value": "T13DF38566BB61AEB7CC0ECD3302A9450220CCA65A52E92B6FB6B0C55CF34BD4F45E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062878, "uuid": "1966020e-5908-490f-b144-14ccca2e7500", "value": "1536:ztpkh2TTMyPk6v6XaWM5NyyGEd8YzrqyNOTLfZPZ6k4LgoboWRSxFzcc+P5hdpPP:EKPlWubqDTNPp4Zc/CP5hdpPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783062878, "uuid": "509b2ffe-b956-4d70-a371-70556e0be371", "value": 170436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783062878, "uuid": "59513205-a621-4e68-b713-2cdf9e193ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062878, "uuid": "2d5fd27c-7236-4f52-80cf-9c12517cc0d1", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeb972d-76b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783066243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066243, "uuid": "cef6008f-f423-4492-9b71-cf95d6ef3741", "comment": "Malware payload (Mirai)", "value": "6515086316fcf63f1f2abb42e2bf7f6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066243, "uuid": "4c7ff059-37ca-48cc-99cc-cac98e418407", "comment": "Malware payload (Mirai)", "value": "a3e695c3a15b52b59c86875a9a5c47c0f932186b8433bb70ab4aa6c72ba58e3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066243, "uuid": "e430c21c-addd-40b1-8fe1-1a86adb39493", "comment": "Malware payload (Mirai)", "value": "867601a9e4a68b702dd5b42a1ee9d0db1499f940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066243, "uuid": "d6cd79f5-8ae7-4434-9a2c-d26cb614017e", "comment": "Malware payload (Mirai)", "value": "2066d071f1f97c56be87b2b015c78aab7cb8bba9bad3cda75dccaf0c7a5e426758d900413c6ce03c088357f3163492bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066243, "uuid": "f0411b7c-f74a-4bce-aafe-5b1a0922e750", "value": "T139F3427A7E21AF7FE278823107F76FB4C75522D326E18241E16CDA085E7428D185F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066243, "uuid": "ba4239ae-7eeb-4550-8f8c-dc21c0f09e1c", "value": "3072:drdVbh290UQKUoX9l+MAp8XGy5hdpPaQVI:xbG86LvDb5hST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783066243, "uuid": "8d1287db-9459-43ff-aaf9-9f7f6f3bc079", "value": 170436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783066243, "uuid": "0868fd23-4bd1-4f1e-935f-553d86f1e9cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066243, "uuid": "716003c9-ca60-49ce-8c9e-a77e54197bb4", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faac0b66-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101587, "uuid": "e235cb3c-f28b-48f4-8383-21e2260695a3", "comment": "Malware payload", "value": "ad558751d21b845d0483c3274adacb48", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101587, "uuid": "d802fde3-e849-4588-85c0-ed85d071671f", "comment": "Malware payload", "value": "a5071686756897c34a206c735f32e14f392c0b58dc6cc03f92d3f7f31d80ed61", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101587, "uuid": "6afd8052-ef17-499d-9ffe-2b7e545a225f", "comment": "Malware payload", "value": "ea3d02b41e333a4217bf6c0786b673bb26d9c173", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101587, "uuid": "7a8cca76-3ae3-4d07-b32e-e7a484ff04c1", "comment": "Malware payload", "value": "1e710bef14681b49371dcc588e27cfaa234eb7f57f05c0b583b714ed4e71cd111d90e68c13f9d1777284ef5e61ad0e5e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101587, "uuid": "e434b6fa-4885-4edf-8b8b-5736c35c418e", "value": "T108D2E15C997090FF082850A8A0A3BFB4DE2B0565A3D9F2CF884E4A03DD7E9707201D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101587, "uuid": "5ec5ea6a-0ccb-4980-aaa3-8d78ba52b2ee", "value": "768:6P8Y+IUZS1XHpv5Q9ldkC7Sh4z6uF5Qlyo:MXTHpv5Q9ldk8SVHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101587, "uuid": "e24e0b02-4dca-4fed-b7ba-81ae75e74672", "value": 28968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101587, "uuid": "2a8d446d-340d-480e-8d56-31659c2e5e2a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101587, "uuid": "7666c338-0129-4a44-a9fb-4728136c1ef9", "value": "ShippingXNotice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fccfb6-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101715, "uuid": "1d01cbac-96da-4354-8c4f-87824f15cc7b", "comment": "Malware payload", "value": "fd431a27c8cbb7ec1c63f50e3e1a827e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101715, "uuid": "61d688d4-cc9d-429f-ad86-7d6242d92b15", "comment": "Malware payload", "value": "a5701959cb7242a7f58fa76e76274d47c6e4af12d849a70aa25708e5298e6b69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101715, "uuid": "02516d1c-3717-463f-bd82-fa021140fcb2", "comment": "Malware payload", "value": "815005d2678eea30d6728b75e66eaa64ee7b6074", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101715, "uuid": "668a37dc-d93c-4050-bb9a-e4b6049bb697", "comment": "Malware payload", "value": "0623b82033b5ecb4caed86ac24267ce8a1c6e4d3a56c90d753b6244e8ee78a012027c9e2b350f9cc2a3cf5eac2e306db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101715, "uuid": "65318e02-1650-4543-bfde-0d238b50e6d1", "value": "T1E295547ECD4F0C1614B6E987AEE9EA02D21EF372393EC4CA61C5475E1113A0A78D5B2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101715, "uuid": "705af28b-bb52-488b-86ff-ef98bb8c1b86", "value": "12288:3HmvzCvLdNNW3CjclP6R3j/wKFGtliKFnUkG0rQrkgDdTTpKqNYovTd8a6D1:35Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101715, "uuid": "e3ac0902-08b5-42e3-955e-77f1e670377b", "value": 1911512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101715, "uuid": "a22f5a9e-0f2d-4088-a907-905e7183ce29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101715, "uuid": "06318b15-89f0-489f-93c9-3b9d539232b3", "value": "POD00000917.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60602178-7685-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783045064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045064, "uuid": "74c6fcef-49e0-45e4-87e8-4050b07edeac", "comment": "Malware payload (Formbook)", "value": "0b131788c78be101415eb77a32a97866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045064, "uuid": "32da3a85-5384-43be-9dd0-4fc605514c1c", "comment": "Malware payload (Formbook)", "value": "a6264afd465d3a04bc0594251771ca50e372a8d40068707a67830be581bb2c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045064, "uuid": "78843cc9-f75e-46cb-b110-f9e84db3a478", "comment": "Malware payload (Formbook)", "value": "b8d2f8ead2d58c5ebf2d58e9fb29fa9f35f09217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783045064, "uuid": "2781dde5-41bb-412c-bffe-14d700abc3f6", "comment": "Malware payload (Formbook)", "value": "34d7c922c08e8671931fdf00eab90328b92a30b63b8f20d7f47c96edd588f2abfab2a92f11b263a3df29eb8e40905e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045064, "uuid": "4ba0895d-772c-40a4-812e-f574d423e5a7", "value": "T1AB3512541359CB06C4B34BF80A71D27487B8AEC8B926D20B9FDABDDFB97A7905414383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045064, "uuid": "ff50582a-498c-4361-8777-80f660fd1ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045064, "uuid": "ccd9c5b3-473e-45ec-a584-f5d259ac7238", "value": "24576:Ia6Uwla6M23FPhXlykEd0gMIfNmzqZk5D:Ia69YcFF2d0SfMzq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783045064, "uuid": "10204b77-5608-4ef9-b4a3-81a0bb33ac1e", "value": 1080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783045064, "uuid": "711de37a-3234-4032-949a-f353418d3a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783045064, "uuid": "f15b2061-ac25-42f5-acf9-c096124c41b2", "value": "Settlement Contract.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836eb318-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101816, "uuid": "edc3443d-5554-4f43-8e22-2995b6c8ba10", "comment": "Malware payload", "value": "eb37030436b9d18d325df07bf25b28a9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101816, "uuid": "eedc23e8-4cef-4856-b73b-6c59b0615b3d", "comment": "Malware payload", "value": "a6b79b9210ad2a32e882432e419cc207269dcffdf0de25c5188f5317c66cb309", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101816, "uuid": "49a44620-0eb5-489a-8c7e-eff53fa1ad73", "comment": "Malware payload", "value": "4325f1552569f5becd4012dfb0c548555a5d5b01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101816, "uuid": "e7000728-1c94-40df-a865-33b2f1765a3b", "comment": "Malware payload", "value": "ff8b998556973344d8e343eafededcec807658f41f408b05672f35ea7a6a60db650f25dad2e16e32c273e9c7dd6b8128", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101816, "uuid": "bbab3f77-ccec-4fb2-94b3-1fa0e241fdfe", "value": "T12A9502054EC42FB9CFAC6A1940BE150EE3A10ECE5556B58AFB33BD46FFE7A044117289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101816, "uuid": "acb4e4fc-03aa-4346-9bbb-05435db30fd1", "value": "24576:Tt5W2RDQtQLBXd/6KZOXmkWjgza6gIZX4cw4iXx7+BCI6mBQcCwcTqiV:BTR0QrtZOtag7IZ1DIbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101816, "uuid": "9e9dbc45-1a4b-41cc-a15d-837c3f3d3fc3", "value": 1972304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101816, "uuid": "310c706d-2420-4f06-a0b1-f203bf4c6bb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101816, "uuid": "f180861e-cc21-41c0-8ba5-292fc4f47b96", "value": "\uc9c0\uae09_\uc99d\ube5909889778009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7a682a-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101377, "uuid": "f8410fa1-1a89-4cb1-8327-c06559ddc7b6", "comment": "Malware payload (Formbook)", "value": "91b84b14b1e6d72dc63caf997a338c87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101377, "uuid": "c692e80e-6bdb-4a1b-9bae-0ece359216c9", "comment": "Malware payload (Formbook)", "value": "a73cd72f82f334e31d4669d43ec819a033c3f088dc96f5fc21002941ace6b61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101377, "uuid": "bb2fee46-f04f-41ce-8950-0648bc5e9424", "comment": "Malware payload (Formbook)", "value": "1c8566c440c63bff2898a25b74f3fa8debc73e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101377, "uuid": "aff62091-34a1-4ead-82f3-a42c3dd58c92", "comment": "Malware payload (Formbook)", "value": "008ef9cbe4ad98d6c8fc023e4f6580ba3c21dc3cdea2fb4e6ebe874f50b932806af0192e110ee2dabc983feddb505fde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101377, "uuid": "99403ddf-44e1-4f86-a539-169aba5c1721", "value": "T1E5250108726BE803D976273698F2D474C7B16E89E932D15F2FE57ECB39227968480743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101377, "uuid": "761886d7-e99f-4e78-9cab-74674ba8dfdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101377, "uuid": "2f8f3c63-f5b1-4293-be50-ead5dde13574", "value": "24576:uBlG9AT1as7kQMJnVscDBF95T64fAvdCQzoOwb/xHM8:CeAT1aFJae/xfAzzVwVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101377, "uuid": "1294b5b2-3020-43de-be33-1a7295837372", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101377, "uuid": "756ded3a-27fa-422c-9209-c1475eed9283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101377, "uuid": "9e7f8d9d-c9f3-4c6d-a390-554532a55765", "value": "JJCSHKRY600_NOA.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b7c44c-7711-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783105283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105283, "uuid": "1990ed7a-ebee-4a6e-9198-3662c3a3323d", "comment": "Malware payload", "value": "8f01f911ce1441d4dd0167476bfbe414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105283, "uuid": "e9e619dd-05e0-4818-95e9-39cb02c911f5", "comment": "Malware payload", "value": "a88440ce83acf3cbc70960fca0fa1b152175c5d40249dce399dfd3e2f255d46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105283, "uuid": "7f2ec231-d6fd-4579-b09a-8df142fd0ee3", "comment": "Malware payload", "value": "a264c7e9757939f1116f5d38e07704b6eec81cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105283, "uuid": "66f0ec71-a258-4583-bee9-05a7d21636b6", "comment": "Malware payload", "value": "581f573e18f1413c102cdf2ffd399c212f9782f958e12505efc0dcbe7f722afbeb7ba3a49b3ae8693932fcffe23f5808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105283, "uuid": "87b41977-1968-48c3-bfb3-6e6d785c45e5", "value": "T1D9D58D0B6CE119E9C4AA573288B642A67B34BC064F3223E72E90B7783F767D15D75384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105283, "uuid": "1d2ab767-f1e8-4cc2-8289-e49dd7062478", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105283, "uuid": "771ca974-fe1a-4641-8122-7c8c9da16959", "value": "49152:sBm9zNxAu6ImPyA2tl0hcEGkmetgaMjA9c1ffTcpFr4e:sBK9JAupp9agA9D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783105283, "uuid": "bcaf0fde-c6b0-4df2-9d62-10aa20ba3bba", "value": 3019136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783105283, "uuid": "00017965-ac2a-4661-90a1-09583b5386ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105283, "uuid": "79b2eae5-c36f-4a30-9027-f490cb6315da", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44922b15-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106865, "uuid": "4703c68a-29dc-4bc8-868e-21940a372083", "comment": "Malware payload (Mirai)", "value": "aecff1da4f66c419840a9501025ab240", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106865, "uuid": "c0fa6baa-1a87-40da-ab03-91f88bef40ca", "comment": "Malware payload (Mirai)", "value": "aa7ce81bcdc862114d7d8c192e50cd786afeab12a0d8da5593e7d48e0929d2d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106865, "uuid": "b24b3eaf-676a-4424-b98f-9054da734633", "comment": "Malware payload (Mirai)", "value": "cde75818e1893b89a01abc794cee65a3fc7f96ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106865, "uuid": "d1079390-116a-4d47-ac4a-48ad5632903f", "comment": "Malware payload (Mirai)", "value": "3f77e3656c6546d968c60d6d1f1d0e5c0f8db4d7de34761475f85d41c74a780cd4df6588807046b9dbbc90a087bd5c14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106865, "uuid": "73b0e66c-0566-42cd-bfab-9135a5d7c5af", "value": "T16FD34C07722C0F07D5A20AB1263E5BE093FE95D111F4BB89691E6B5A5732E3B1482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106865, "uuid": "7fc8d620-dd58-4adf-bf26-dc631c888ae5", "value": "3072:eiipkAST2h+SJ0I8bHFKJAhUZAs5yPZVfv3:6kDT2UE+HFyAhUZAs5yPzfv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106865, "uuid": "5cf9b4aa-badb-4bfc-9c77-6755af3c3c6b", "value": 141176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106865, "uuid": "2f627c52-9c59-435b-808f-a0fb9cd9886b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106865, "uuid": "bd65a62d-6b3c-4186-8cdc-4bba2b6db8b9", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ba561f-76b5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783065763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065763, "uuid": "e22cdb0f-9aab-4cd3-aa90-2f3f5573df62", "comment": "Malware payload", "value": "14ccbe1c366ce0ec706f7aa9417ed3a8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065763, "uuid": "3d9fff86-cfad-400e-9ec9-18c7005f1354", "comment": "Malware payload", "value": "ab08bbfa72342b7ae05dfef4a892f5a4fb9e96f5ae01aafad3542bd05226fb37", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065763, "uuid": "7e6b2c19-d361-4331-a5e3-6726da25463f", "comment": "Malware payload", "value": "552da285e677c9cca919726b4afd860010e69fb9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783065763, "uuid": "4ee92336-cbff-4230-80bd-56f3739483d6", "comment": "Malware payload", "value": "6e8a9e058c8e40687a0e37f33ae62f2c5d68a95c0de7ec71629024aa7e394a1c408b7e2fca524ea5cc20e2fdf84d4468", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065763, "uuid": "6dd2055f-d482-4010-a8a5-886f7ba66c0f", "value": "T16C236D6516817C24AA99D4371D7F2F0CBDA983E6320492DDBFCA3CF28C59A9CD11872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065763, "uuid": "c9f8abc5-e940-4682-af61-633488c80121", "value": "768:MXRWNGxVh9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:glx4cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783065763, "uuid": "92b64e46-be02-4481-b3cd-210f5a8d9a37", "value": 48360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783065763, "uuid": "a638f4b6-49b4-429a-b2bc-71ea3b428268", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783065763, "uuid": "1661999c-1981-4adf-ba7d-c1766cdfd390", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6c9208-7724-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783113398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113398, "uuid": "678e51f0-849c-42fd-a54c-9bb2aebdd3ba", "comment": "Malware payload", "value": "a1277596297b0084ad26986fc068081d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113398, "uuid": "69378687-f9ea-4098-aa69-3ca15bdb2ffe", "comment": "Malware payload", "value": "addbd8770b53a50e83c711143332c76e9160f920675e2de5591669d3b93f499b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113398, "uuid": "146a9b14-1b92-4672-ab55-57576fd5816c", "comment": "Malware payload", "value": "8774ec604ae4199cc0174240e62d666965164adc", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113398, "uuid": "456fb0f2-6488-48c0-9123-3b08f97905b4", "comment": "Malware payload", "value": "189db81a88e38cf6cc4f2a9618f0100ae49b73614fedd7b3563dc548a40c12f533dad52bdd96be0d0b968bd94b01cf3d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Goi", "colour": "#A81DA4", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113398, "uuid": "29be9ef9-69a9-4806-b7af-5b3ef9cf8050", "value": "T168C63382F35C543FC4B390360E9A4B7256599C0ACF96A34B91687B2C3C776D84E9AFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113398, "uuid": "50ce4e19-8771-47c9-97a6-d5536cf3cd06", "value": "196608:1o9EDfVzXnQ2JFBvrMcVnyn+6YPd6wuMwC1sPZoLICDjIGRJvL1c:1oKDhVbvlngXYPTPJKoLICDEeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783113398, "uuid": "8c1d0c22-bc56-4420-a57e-d941fb8b020b", "value": 12108853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783113398, "uuid": "1d30b53e-912d-4281-84e4-19bcc490f561", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113398, "uuid": "14731470-b52e-49f1-97b9-737b0e197b63", "value": "mparivahan-cefg.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99018b2-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783077480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077480, "uuid": "74be08b9-bfab-4087-b73c-e8fdc751d6b2", "comment": "Malware payload (Mirai)", "value": "e594e9b07c222a316bff6afbf2cbaed5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077480, "uuid": "b8bd192c-ae32-4f94-9a2b-23bfecdc9b4b", "comment": "Malware payload (Mirai)", "value": "adeaf4ac5afe364da59eaa9e54be99211478e0c051ae4b230986f15331b43866", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077480, "uuid": "d2b4d65a-4767-47a5-9891-0dc389d331e7", "comment": "Malware payload (Mirai)", "value": "6ebf11714211eb2eff73cd8171b9321cc5f87680", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077480, "uuid": "338fabc9-8d8c-4613-be2c-d2fbe08dfa0a", "comment": "Malware payload (Mirai)", "value": "695033ef0bb1d70b23303120fb83e6f7b499f7b5c3897ba85f9e8ac8ec733ba9714ebb66886779e43b81bf2313e51891", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077480, "uuid": "214e7d20-d9ff-47f3-82fa-b5d92cc9dd52", "value": "T173140A01B9114F53C5C32BBBB7DF42953B336A2897EB3301AA18BEB42F4769D1E29511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077480, "uuid": "46812f1d-a899-42a8-b6eb-164459ff8603", "value": "3072:rlnKe54E8MJb9PNF2BQMuVfJL8T7laE+joBuyjeAWN5IxR1kKByP:VD54E7JbxNF+QMuJJLkgoBuyjeAWN5IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077480, "uuid": "e6ab0360-ad1a-4bd0-9ca7-0ca5eca251c3", "value": 193530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077480, "uuid": "25968b0f-2025-4e61-82fc-3f5401c5d3f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077480, "uuid": "59044438-854e-4aa6-b050-49e677cdbb4d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202ef328-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082752, "uuid": "0c036fb3-dad7-4926-b00b-16a1908d79e4", "comment": "Malware payload (Gafgyt)", "value": "91978f137ddb27c36b60a71baa578f36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082752, "uuid": "e12924c2-ed0e-438d-87fc-872916479a6f", "comment": "Malware payload (Gafgyt)", "value": "afaa75e5224f201cd71ded822e1bc2e08274c77ad0ad429a538053732c75bd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082752, "uuid": "d821f056-d1ce-476c-a81e-7c0f2711614a", "comment": "Malware payload (Gafgyt)", "value": "cecde60fd1484cddca665e8506111d915c595041", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082752, "uuid": "f584ea03-efef-45cd-b20b-493ec229b316", "comment": "Malware payload (Gafgyt)", "value": "0d1121af4784e5895fd976aa8cc3a984f56996906e903512ba4aa892c860475343bc20e93ff9ef21d905d04b35f7856a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082752, "uuid": "4d152026-bc01-4663-a9ab-ad3af2a5b41f", "value": "T1DEF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082752, "uuid": "b9a87bd3-e0d7-4f93-8d96-547d20e1aa07", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvBjYnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/VYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082752, "uuid": "fdae6a83-20d0-4c82-aaae-a4a71bf6613e", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082752, "uuid": "cb343296-9099-4261-bbc4-f36aacaac6e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082752, "uuid": "dea051f1-2af5-42b0-80a7-11d3afc1fd7e", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ee3a74-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783101275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101275, "uuid": "448fcc45-423f-425d-806e-91dd2f333fb5", "comment": "Malware payload (MassLogger)", "value": "748be7b5e15f9212bf6933fa66025e10", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101275, "uuid": "3de8a99b-c5dc-4134-b182-6e8032a1d0e8", "comment": "Malware payload (MassLogger)", "value": "b033f629adb83b975dab222024e4bdaf4b43fc9298cf6784e95c8edd17090272", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101275, "uuid": "351b8aac-3bbe-4b7f-8fed-b3df64065819", "comment": "Malware payload (MassLogger)", "value": "cc34322e67674ab88a83a73f9d784f75f9386818", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101275, "uuid": "4feaa2c0-f2d2-4f31-8426-0a0f7455fea2", "comment": "Malware payload (MassLogger)", "value": "90c17afdaa37d9af533a1238041c37942a9270069855802691ecce281c14b774d6ea0f532724e8d0c2abf2434b9a89a5", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101275, "uuid": "893ce420-28d5-4dd2-8c03-e6f9726faf25", "value": "T160C423A623A335AE811473C30B5AD8A534245B4BEF9FF5A79D27C8174E40B8ECDF6910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101275, "uuid": "494d3b72-b62a-49a2-a8bf-ebc9f5361ff3", "value": "12288:eFS57Zi+2eKhFhb0RFkWsBLG80f+Np+BnUvLOneayFFzJmlFWV:f57Zb2eqFhbt5o80f+Np+Bnmqea8FzJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101275, "uuid": "79caa84c-c1e2-4938-b844-5f5a9c25e7ed", "value": 597053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101275, "uuid": "1695cc28-abc5-4779-ad63-fa750b65be1a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101275, "uuid": "8eb7149d-fa67-4c03-b82e-ee2678eb436f", "value": "RequestXForXQuotation-1100439650.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b831f1f-771c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783110017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783110017, "uuid": "ec78d854-b18c-4ba2-b01f-3576bdac4790", "comment": "Malware payload", "value": "d813dcab81bc9734cb297b6fa75355bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783110017, "uuid": "8ed429fe-992d-4bed-983f-91d9062bda29", "comment": "Malware payload", "value": "b04138725a86c8b04773f8be7c1b5550b0048f845050d0aae3c04044a5fb3e70", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783110017, "uuid": "6dea1635-769f-4825-bd1f-7620d59e7e43", "comment": "Malware payload", "value": "e16739301df6d5b4db97210fff0aa07818faa24a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783110017, "uuid": "4c06852c-2f99-49e7-ad65-bb732ef59fcc", "comment": "Malware payload", "value": "43727826c0b2efbc5bcfe427abd22c68e7b1a0c80069d5e09669e2916eb20455e7fdbbe0b277c811a95e208c35eb2e05", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783110017, "uuid": "608a9a19-2f39-4238-88a2-d812d9589ac7", "value": "T15601AFC582006800806DDA6D72E75190B410C3CE4D4A0FA87F9C6A3DFB8C810F037FA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783110017, "uuid": "39cafd19-85a7-4e7b-bbb3-66ffd74faa86", "value": "24:kXCKysE2hi0ziQvZoha4YagyjRPtMVrRYDk7:e9Qp+Ms4YbGZmYY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783110017, "uuid": "e6705219-b4e8-474c-ab54-4db15cb389be", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783110017, "uuid": "b4632ca6-a110-43bc-aac6-64d1ac53ae57", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783110017, "uuid": "6cf6115f-6f10-44d5-ad63-0c594e0beb3a", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488ce876-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101718, "uuid": "2ac7e66c-2b4e-428d-88c0-8abd8e89e011", "comment": "Malware payload", "value": "1cf6fd3e2e2831c0194301877fed9d0a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101718, "uuid": "fd220a90-e06a-4d64-b355-18686695361d", "comment": "Malware payload", "value": "b0936d282f867b4f261528ebe10b195bdcd1fc9f1090e849da846a4a8e5a6e32", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101718, "uuid": "04cafada-ba27-42a6-838f-785fe5d6237d", "comment": "Malware payload", "value": "e168e3118a1ecde87c2f8aca3d3e4dbac14e40a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101718, "uuid": "b36d2bc6-45ca-499c-b8a5-421e31c4625b", "comment": "Malware payload", "value": "a783be6deaf6d3b49077aa500d51cf2ac7bafe37424fa975e4cd7fcc2d77d0d3fad62809fae5854822377df0693babdc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101718, "uuid": "3b172c8c-f4c0-43b4-85f9-fd8b0843be41", "value": "T1D9950B8063E4017BBCA6BC96D26A93C9629E31593FF703D9FD340EDE1767406C276A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101718, "uuid": "f1b35f71-b247-46b0-8beb-2d42395178bc", "value": "12288:+NcPZeyoA7R3Z5zQIg96HFHMreDxDrqUwMvZhw:+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101718, "uuid": "a319db96-ee99-480d-b383-97ab1e62060e", "value": 1944102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101718, "uuid": "419a946d-1e99-4782-b97b-48df087083f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101718, "uuid": "8868fb07-28e3-4381-9ea2-2f8a00b59df6", "value": "PO-000143494.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180190d6-7735-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783120534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120534, "uuid": "579dcaa1-6c6b-4a48-a03b-31c911d7ed59", "comment": "Malware payload (WannaCry)", "value": "58a7e2f088cb22dba94ec1ebf9aad4ac", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120534, "uuid": "e7825ff8-252f-4121-b9c2-7fd85e2a1f2a", "comment": "Malware payload (WannaCry)", "value": "b15fabb4f73fff2dd8dbb1a58e46423e9d33d985af34880d17e410b9ecd6bc47", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120534, "uuid": "77ce0dbc-3873-41d0-b375-2a48340a1b6a", "comment": "Malware payload (WannaCry)", "value": "b145c4d4f24999d82b5fef79a79fb008791d11f8", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783120534, "uuid": "51fa69c0-fafc-41d4-86f1-fd1ec75e3b91", "comment": "Malware payload (WannaCry)", "value": "97eb4ddd8e4d7832498d6c4430cd5a0b318d87deeb6035af4c4bee9151a94daf989a1687bf4905075db275e1c0621601", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120534, "uuid": "8a955326-dc95-40bd-90bc-379fca2b2703", "value": "T14C36228932AC80FCD5065274D4B74D25F2B3BC9A22BD870F9B948B660E13791BB34B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120534, "uuid": "0cf6b11b-c759-49cb-afac-9b10bc5b9ed2", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120534, "uuid": "53bb0faf-ac6b-4d19-aed5-2a067ef98d69", "value": "12288:jbLgD1bLgmluCtgQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHe:jbLgBbLgurgQhfdmMSirYbcMNgef0Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783120534, "uuid": "c0d6fcd3-1d68-4878-9533-81d3d6df65b8", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783120534, "uuid": "1bf8f395-f87a-4965-bfc6-dd484bf1cc96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783120534, "uuid": "ce9aad7b-dd1a-4410-b1b5-2101307abe3c", "value": "b15fabb4f73fff2dd8dbb1a58e46423e9d33d985af34880d17e410b9ecd6bc47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78e47c4-76c3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1783071946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783071946, "uuid": "5d301470-eb94-4365-89b0-5b0256891581", "comment": "Malware payload (DonutLoader)", "value": "9b174bab3ba3a5f11f3551a71cbaadce", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783071946, "uuid": "58472324-e343-4aa4-896a-d914449675f6", "comment": "Malware payload (DonutLoader)", "value": "b2ba880161254c8c2b38a43a0062ac12d7d355243f59df856fd12e53150392fd", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783071946, "uuid": "8771d313-77f2-4144-b32a-32677357c243", "comment": "Malware payload (DonutLoader)", "value": "93b4fe03f6a63b8964112ddc1942046c49f90f13", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783071946, "uuid": "e6639938-831c-4c37-8aaa-03043c63546c", "comment": "Malware payload (DonutLoader)", "value": "2871bd37d1dab598217e2972a242cd028926320fa46fe5560058ee1ac4b05c994bf8862a2956c8cea095d8684bc044bb", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783071946, "uuid": "096bb9be-4860-46ad-82f4-b1e97aeaa1b2", "value": "T1FAC423A82CBDC385955BC5AB721B2127C776B8B42584A02CD37F5F96F869B0FAAC0441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783071946, "uuid": "a5a4a872-8262-4032-b911-87c333abc572", "value": "12288:ISJp0ZF3bIQ/WFlOFBUYa4AAz3v7XqG9ZyUqDBJsNM4nDXT79QTb7:jJpQbp/IGBUxQfyJDQKa7u3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783071946, "uuid": "2afa988c-5d78-4908-b718-6c83a4bb55db", "value": 566203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783071946, "uuid": "b42a2ce9-7caf-4692-abb3-e032ea868e0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783071946, "uuid": "6fed30a6-af47-4f97-8694-3aa912f8b00c", "value": "Technical_Assessment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11d2c56-7716-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783107450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107450, "uuid": "78d9d74a-8727-4086-a612-ebaa2f55084e", "comment": "Malware payload (SilentNet)", "value": "080e5a2094def756472bef0647b24c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107450, "uuid": "592fb33b-82eb-41b2-87ee-e7953b0f7f94", "comment": "Malware payload (SilentNet)", "value": "b46f58cd9bbdcfdec0908e67229b484c6f8482523092dd627e0e97fec62e53a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107450, "uuid": "45b3d3d4-8cda-4b33-821e-920fc41786b3", "comment": "Malware payload (SilentNet)", "value": "dbf6a7ae14570ea721b3dd05aa4569ddade1ffce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107450, "uuid": "ffe48862-3626-414c-b5de-97c881968488", "comment": "Malware payload (SilentNet)", "value": "aa6afda8601ea19cc901b7311b8fdf29a99d60d2f19eac2c3b28aa983d241b93734a1654077c47992cebcdd40ded64bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107450, "uuid": "d6226add-2d19-4e32-aa52-5231e8f22940", "value": "T19E357C83EBE381D8C156C8B5535BF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107450, "uuid": "70de1bfc-a4fa-497d-9b11-e6732e74a09b", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107450, "uuid": "9ee18fd1-d6cc-48bd-a9e8-7d17471a7bad", "value": "12288:fZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGbvvPqItNquB:fcb4M06WpoPrwMvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783107450, "uuid": "b3e659d9-a405-4640-870c-435b0a84f091", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783107450, "uuid": "dae31e44-f311-4b04-bffe-0a60022ba311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107450, "uuid": "adc0ced9-b6e5-4127-89ad-095412de5478", "value": "MD2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43214511-7729-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783115452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783115452, "uuid": "75e02eb7-ee89-4fa3-a7d9-08ffb2e4088c", "comment": "Malware payload (WannaCry)", "value": "7db0f7eda78daad224a3f787dedb0fae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783115452, "uuid": "760e7e6c-dcb0-4f10-80b2-29afce508aff", "comment": "Malware payload (WannaCry)", "value": "b4f0148df9332a4c3fdf19c71885867f7bff3f36641ba49dec8946ab366a64a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783115452, "uuid": "8e20a897-4ac8-4051-a616-575590442365", "comment": "Malware payload (WannaCry)", "value": "6334810a16733d1338daca7ac398c3907d441b8f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783115452, "uuid": "57f438aa-c8b1-4468-90e4-962c74900bde", "comment": "Malware payload (WannaCry)", "value": "1c62d534f2fd787baa65b5a8cbc5d9fe5a5162bc551bc71d7ec2bbf04c73b9541e1bcee508936a18ab578c4656fc43c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783115452, "uuid": "95ef7715-8266-4424-a11b-02b9945364fd", "value": "T14F3623567099C0F4C10566309C7BCEDEA6B63C69EDB9690FBBC07B6F1C33B56A600642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783115452, "uuid": "f1213fc4-4a53-429a-90ca-aac26870ca46", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783115452, "uuid": "4648e2ed-06ad-496e-98ed-cdfc8ce2c0d1", "value": "24576:RbLguriJmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqTPVX:RnZMSPbcBVQej/1INRx+TSqTdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783115452, "uuid": "8457cfc0-518b-4a62-833b-3cb427239da1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783115452, "uuid": "6199f6d9-0c45-4387-954a-6e678d9276cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783115452, "uuid": "32e4d2b4-cd9c-4c5a-99bc-23ee9c0e8da3", "value": "b4f0148df9332a4c3fdf19c71885867f7bff3f36641ba49dec8946ab366a64a8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab242c73-7718-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783108325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108325, "uuid": "c31a36f0-b779-4ef9-917f-8910e498987a", "comment": "Malware payload", "value": "d9b3d1df47a4544ecc605f60b30d6060", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108325, "uuid": "0326030b-adc3-4750-9b16-2b62798fe39c", "comment": "Malware payload", "value": "b570834a38ff9d5e085dc48700332e536635d23e7cfb9b93fe65be1ffb85e0f7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108325, "uuid": "d74dc0ae-52cd-460f-b57e-fcc60f2ff784", "comment": "Malware payload", "value": "b78861c648a71e4639071d70397ee9365414435e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108325, "uuid": "1b49dd0d-7ce4-4f7d-b476-84863e51a38c", "comment": "Malware payload", "value": "c3d2f3ced37810295b9d0d4884536e0cfbc8c545ae8141a9c4835f42a5e86224d6a8535d5f7db8a55b1281455797465f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108325, "uuid": "c45b07d3-3bcd-4710-bfae-c0ee20ca8458", "value": "T13A41298996D42068EAEB9370B93A4E81CA7332F4F636F00432482CC16AAE14D065FA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108325, "uuid": "99a7659f-f75f-4856-ae9b-22c6066b63df", "value": "48:9oxKCip9v8QkeovLchXTWARl7p5NUZv63QXHHjLuGmA3N:6xKCKZ8NXqWE/tcHH13N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783108325, "uuid": "38843f60-ca13-4611-ae48-66e4bbe76ee4", "value": 2253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783108325, "uuid": "7277dfed-7a00-4a52-9976-b3c94c076959", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108325, "uuid": "f844f14b-1d9d-4e8d-b69b-09d9505925e2", "value": "WealthGAF_CRM_API_Documentation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e7e93e7-7685-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783044953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044953, "uuid": "3f004f0e-d611-4dd5-aedf-cb40218f1cbe", "comment": "Malware payload (Gafgyt)", "value": "9dcb639debc37ac422ff510310bcbd02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044953, "uuid": "6e1b4409-fbd2-4e07-be68-6489b0625f24", "comment": "Malware payload (Gafgyt)", "value": "b60ce046f32587bc6b87df4cd530c6728af82c482df2a3fe14c88d5fd252ca30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044953, "uuid": "cfd2d2f2-4b51-4feb-86af-a00bf63468c1", "comment": "Malware payload (Gafgyt)", "value": "60c2ba144d76c92a104e213d5fb1622787505bc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783044953, "uuid": "81be8d23-2847-4b01-8ca4-0e4b2c185b2e", "comment": "Malware payload (Gafgyt)", "value": "ad8b5e4c75cc52c5ad1c1edc779817cd907da102849bafd8a9b443dddd7ef07b0a91ba5601246792e71185afdf7f68ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044953, "uuid": "1c46b2b6-a6b6-4fc1-948e-708eab2a876e", "value": "T177141742EE811ABBC44ECF31415B838A12EDD48643FB571B6178C95E7E5EA0E1CC7E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044953, "uuid": "5db64e49-6cca-4221-994e-9a2ec3c909b7", "value": "3072:TF4CBlWO6z53AVchKREMIBQLxJuW48SEqWs6ILlHVW8+2nV8ga24+BeWDIhfgENZ:TSAchKABQLxJD9VqWPIp1WJQ2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783044953, "uuid": "2efff440-4249-405a-aff2-5b2c0e0bfd46", "value": 202380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783044953, "uuid": "ecf0ff92-3444-43ca-9320-2c7525e41f4e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783044953, "uuid": "e016affe-f967-4988-93de-92b1bec0f042", "value": "mipsel.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac186a0-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101748, "uuid": "c4efc561-77ef-444e-81e6-01a978f01e53", "comment": "Malware payload (RemcosRAT)", "value": "7d279c2887ac75e06a6a5ae1ae392f18", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101748, "uuid": "a95a36ed-2ee6-4381-86a7-77c3ecd55b3b", "comment": "Malware payload (RemcosRAT)", "value": "b76d5451dd01a49fcbfb64219dfe592d392783ddb4efeb1b2a5f5dcc36ef5d30", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101748, "uuid": "6bf6459a-fd71-484a-b9b8-2340ea219756", "comment": "Malware payload (RemcosRAT)", "value": "82c1e66e48267e8a4559d6fd34e07c868001c930", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101748, "uuid": "67c20b06-b7ad-4ef4-9975-dabb695c43a8", "comment": "Malware payload (RemcosRAT)", "value": "01cfa15e8c2671f8b12f7faee825446cf5e16994bf5a4de524c78d9a00f5ccc9dd1e62d927090ccb78d381d23595651c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101748, "uuid": "ff1efc5e-5997-4f9b-b3c4-3591096b3827", "value": "T1CB0412505FA603A5DA012A8F63E5F6BD3814D41AD1CDB93C182AF0AE11B403FD762AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101748, "uuid": "32b24bc4-3415-44fe-bac4-d8ff214524d7", "value": "3072:teMtkBLfnKkakpMvDqgcx28hqefOWmDxv7LCNLJIq898j07GDOZgl:AxKNkpMvDR89fmDdeNV7898j07fZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101748, "uuid": "e1c4b0ec-ba34-4bbf-91a8-08babfc95561", "value": 181504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101748, "uuid": "c865398c-f379-4737-8c7b-360dddef1e73", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101748, "uuid": "ee352bfd-82d0-4841-9165-c37839afb8f8", "value": "Requirement_document_2026010711864779153.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e1a467-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101601, "uuid": "37a06a99-473a-4a87-a4e3-a05549341a69", "comment": "Malware payload", "value": "a5d60beb17457f2f6dd428181df3230e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101601, "uuid": "3276bd6c-dd9a-46a0-ad55-d656a32c6706", "comment": "Malware payload", "value": "b96db22d5035722780795ee7f0b5206a8703a502a66905ba8923c1ae6bf944d2", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101601, "uuid": "1ff93d43-563e-4f41-a54c-41be436f99b9", "comment": "Malware payload", "value": "843e9cede698ceae34fa73ebda3b3401de91c83c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101601, "uuid": "e0adf5ba-314a-4541-8e05-3c9488be02bb", "comment": "Malware payload", "value": "3af5f03ec354dec896e990db2418b3bb7a831915e575c14a1515e1a3804e26d7e21886623f811112451726ef7086a30a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101601, "uuid": "419c56bf-d45b-44f0-af76-4e5a3e1b3b7b", "value": "T1C9434BB2EA9902964D4727BEEC942A63CABCC509121300F5FEF9531C500E6ACB7FD65D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101601, "uuid": "d5365a05-a99f-4e7c-8325-ad9fc5cc36bb", "value": "768:qGPYvaMMniu9csGtFenClp4LhtXvLfR2nexjyQ+GXqPEilP5S5H9qQ8xuJL/vcXK:WyQWpzp2ujkGX6lPgXncX87AH3euJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101601, "uuid": "435b658e-97ac-4373-93fb-63a15fc95221", "value": 59247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101601, "uuid": "0f3f950b-9df0-4660-9631-df200d8c9a19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101601, "uuid": "c6917800-bead-4d1a-8b9e-955e7f27c657", "value": "Abbedens.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3214d836-770b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783102539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102539, "uuid": "050ae086-80a2-4456-8a1f-a8b162620f2b", "comment": "Malware payload (WannaCry)", "value": "7c766f29e987f4acf421154bb35193f2", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102539, "uuid": "02f8996e-15f1-47b5-b157-9bfb5cf1d676", "comment": "Malware payload (WannaCry)", "value": "b9783c0434065058751b59f89948498ed8d08f93f6c5780cc0ce3a6d02bdf77e", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102539, "uuid": "6bbed89a-929d-43fe-97e5-31c9877b4de0", "comment": "Malware payload (WannaCry)", "value": "3c4e3332a3c1c355884437537908b41bfc7850df", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783102539, "uuid": "6db328c6-ee3e-4ee8-8e6a-d7bdb1b67024", "comment": "Malware payload (WannaCry)", "value": "33bad4cff8879a4d75c963f9f3314964f45a49c6f5953871134b7df9886f343955f5ac8d65b8a820e6549e26269a637b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102539, "uuid": "365a738d-cdc6-411f-826b-c0819e53c8cb", "value": "T13736176897E24415D0A7C0F10112BE2DAB2F7D61A2786FC6C2D37E1FE8B36865D31A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102539, "uuid": "163533db-a479-49ba-9e4f-fca0905e6374", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102539, "uuid": "3e257af9-78e6-4942-8c01-36331c8b08bf", "value": "24576:jbLg1bLgdeQhfdmMSirYbcMNgefuF8S9r7D:jnYnjQqMSPbcBp8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783102539, "uuid": "87898755-df40-4e0c-9071-23b562fd30f9", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783102539, "uuid": "82f9a013-1029-4693-9794-d1f4310eb369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783102539, "uuid": "f28fbf38-e4b0-4d63-bbfd-8064063a7ffc", "value": "b9783c0434065058751b59f89948498ed8d08f93f6c5780cc0ce3a6d02bdf77e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcd6bbd-76ab-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783061438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783061438, "uuid": "df526f15-44e9-47cd-9af9-159f26bec21c", "comment": "Malware payload (Mirai)", "value": "a236b627bb9c4ad3ae0304d924ae559d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783061438, "uuid": "765760ee-0ae2-45cb-97a7-04856b76c1d5", "comment": "Malware payload (Mirai)", "value": "ba04702400c9a4566c89c3d32785ac2669d3c41ecfcb6950a527eb3e1e5459dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783061438, "uuid": "6559cf76-3d13-4d7b-875b-f77452362e4b", "comment": "Malware payload (Mirai)", "value": "99a05dca82e3336bc58d34d6b9ca0aa5c7e51db6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783061438, "uuid": "d6ea5d81-02be-4e42-b18e-2886ef9a85ab", "comment": "Malware payload (Mirai)", "value": "1a298694b47ace2f5c79dc5c246729e9a6a4e4825ddebcbf63d7e6e1b79285c9f6014e12179af5d463496574b8803c16", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783061438, "uuid": "ba817dde-628a-4d21-942d-f55080106d93", "value": "T1EA44C71E2E228F3DF6A9C7B547F74A24976833D622D2D5C4D2ADD1015E6028E341FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783061438, "uuid": "3be46eb6-be26-44cb-93fa-e6a86a45a56d", "value": "6144:PJ6J1cTMf+mBwGXKTAC3OBMYCOnUlsqPP02SE:vMWmkAys0nP025", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783061438, "uuid": "9414c65b-1aac-45de-bb30-c55beee848df", "value": 255712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783061438, "uuid": "5f95f97f-1a46-4a49-af0e-389724cc6ecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783061438, "uuid": "a33c1706-efa7-4a90-9957-ef1684b2387d", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f1ad38-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101819, "uuid": "13647429-0886-4d46-aec5-2c6815a90927", "comment": "Malware payload (Formbook)", "value": "0d1d9fb7cbc129aaf5dfb93869f58d40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101819, "uuid": "a7e9a3a0-ef66-417d-98de-d5fa963b70d3", "comment": "Malware payload (Formbook)", "value": "bac16a48407ea22b8905e476bbb93fc0b5ecda8bb70364094479700e33cb15d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101819, "uuid": "2f26a933-fd50-4b18-9b41-522ebe65c821", "comment": "Malware payload (Formbook)", "value": "01f5a80ad6ad4bac09728218fb610f49d55c7ad9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101819, "uuid": "fe5f421e-8bff-450b-bfc3-29c820465971", "comment": "Malware payload (Formbook)", "value": "f03569eb72a26254f2b110ac27225db09752dae4280b6541b402cd3719702b44573210c997211dd2aaa79407c07e9662", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101819, "uuid": "c9b5912d-565a-4a97-8eec-f69b98657723", "value": "T1B625DF1613E85B94F9BEE73895740100B7F6B803DB2ED76E6D8811ED5E31B81C692B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101819, "uuid": "aa11653c-0655-445d-bb77-929cfbbabbd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101819, "uuid": "5e591459-fb1d-4021-ad7d-2f4d6934f87d", "value": "12288:eOoUslm2A83T3wkTMLsu7SuGHIqAGGSZeGRpQ6s7EwOz4RH6asxTkkk:eONslA83Tge0F7UHx5QiKczyWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101819, "uuid": "7a0b68cd-32a6-44dc-9fc2-3d244805b779", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101819, "uuid": "38fbeca1-57ea-4612-b522-a1d98602829a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101819, "uuid": "c9a16a22-02d8-4c4d-b80d-409aa616e2fb", "value": "New_Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868454b8-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101822, "uuid": "7d0fba95-ebe4-4362-8655-ca6b596bf647", "comment": "Malware payload", "value": "7af9ed7817cc33c37294d6a2c4ae828e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101822, "uuid": "88577a14-8b57-4e3b-986c-f95c4f9106a6", "comment": "Malware payload", "value": "bb35a00f5da453cf95d189e88873a7cb95d168aa69b80db07ea67fa2c35895d0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101822, "uuid": "eaea5e91-0da2-4a8e-9cce-d50e7139cdb2", "comment": "Malware payload", "value": "ad275d2e94e56ae8485ae8cce44f8c602db7592c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101822, "uuid": "078cb626-a001-45a3-b422-493b08f758dd", "comment": "Malware payload", "value": "e1275ccbe85d007ff35e5783380393d175aadf4da109ebc481013bd8eac9f4833241f13190147b44ba3868f4c24d4100", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101822, "uuid": "376ac1aa-6373-4526-8c7c-bc764f5e84d5", "value": "T13FA5AF7E1FCAB46AC03757268D6A3974DC009AB739DA04423E3B3BCCA714761E151EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101822, "uuid": "347f38ee-0f81-4b5f-a6df-d2135596deb1", "value": "768:2BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBa:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101822, "uuid": "38bff4a1-d2b2-4dfa-9d3b-4f78bf92e280", "value": 2220428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101822, "uuid": "b186564c-6ea4-4fc0-aaa3-1cc5f9475662", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101822, "uuid": "60039b5e-fd66-4ed2-b6aa-323352c932e4", "value": "RFQ_EMS-PFC-2026009530.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e64355-76b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783066513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066513, "uuid": "711cfc49-4fc6-40d5-b67c-12b3f9150dd4", "comment": "Malware payload (RemcosRAT)", "value": "94e7502ee1d0fb12fa17acaa5588edb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066513, "uuid": "2b15681f-2bce-4e59-8d9a-b52023b95e94", "comment": "Malware payload (RemcosRAT)", "value": "bb9a5f5fe0d086e592ea23909cb1aa8baf792990c90691016da16908d01e83a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066513, "uuid": "49736d3b-9b05-4999-a22b-66ec0114176d", "comment": "Malware payload (RemcosRAT)", "value": "8591a11d052e3f71a45c6a35aabd51f53e3d6358", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066513, "uuid": "f24a8e6e-a9eb-4f2c-afb3-ec927f12b8a8", "comment": "Malware payload (RemcosRAT)", "value": "caf10580d091d83ef5428ec087ee7b2a4bfbae2f8ea12bde2a444bdac62163a41538610bfe159871efe359df826f5700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066513, "uuid": "854fc0be-ba8c-4942-b364-589f3140bcc8", "value": "T13675F1A87215BD4FC4B38877896AED7489685DA6C317D31744E33DEFB43D68A8E010A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066513, "uuid": "4e219f81-1b75-4dee-b086-c93c01512c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066513, "uuid": "907b0df7-db1c-437a-8a60-a009cacf6f1f", "value": "49152:6nZgFptlqOoJ6BKKTzLfiJleynlWzJBAdS0EQtfOC:Aa/N4KTKJleKIBAdSMtfOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783066513, "uuid": "42f36624-cee8-4d67-95dd-cec5d9822726", "value": 1621504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783066513, "uuid": "d2d46e16-7817-43eb-a4cb-b008f1da9ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066513, "uuid": "91ad4653-26a4-43fd-9687-442f9db34854", "value": "Scan0004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc30e86f-76a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060358, "uuid": "06088124-76a3-48ff-b5bb-67bee06bdab8", "comment": "Malware payload (Mirai)", "value": "7159be0a2f1bc4b092834896bfb4172f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060358, "uuid": "04a28124-3b9a-438e-9a1b-c8011c7c9dbe", "comment": "Malware payload (Mirai)", "value": "bbed04bd22b2b4043a2d11fb032af16428604e96be201a9b0bc68fa3ecfcc962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060358, "uuid": "009dd82f-f25c-4c73-a7d3-805bdf693ec0", "comment": "Malware payload (Mirai)", "value": "f94c20a8303d91a52ee73bcd446a356f2611ad14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060358, "uuid": "b5b30fcd-767e-4a3c-b106-29da482c7f54", "comment": "Malware payload (Mirai)", "value": "25eece82151e36e328a2765b8c2058371cf194a880ffd9e628658753739c9b5ed1e46b053af777897f796b008f99e222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060358, "uuid": "587bb1da-beb3-4f1b-b8b7-94f29a5c115f", "value": "T198244A97B904DEBDFC4BF33B44175829B13077E231630B37A3577996AC66095283AE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060358, "uuid": "f12b8d44-06be-4d9f-bc12-b9f692485345", "value": "6144:Pb4olHHhOqx1EzGhDPx+opLyky/Zhyo2K:PxlHH7PA5gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060358, "uuid": "df8e4272-7a1b-4a19-bcf3-b82c3db999a1", "value": 216608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060358, "uuid": "5c20ab2d-b5b2-49e0-9ee9-41fe8146c0ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060358, "uuid": "3c8b808e-eb0d-4dac-8c38-da8d10772317", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ec752e-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101368, "uuid": "40ba0b41-fc68-4e3f-8c64-a68c279ec871", "comment": "Malware payload (AgentTesla)", "value": "ecb33d27ccf2a1718732dc4dc0e00b53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101368, "uuid": "94806524-cac1-4cf7-89c1-fc01db9822b2", "comment": "Malware payload (AgentTesla)", "value": "bd95b4ee6290007c9804ced47042a7e8b7e4121d3fe82f7ae91e4e8baf4a4585", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101368, "uuid": "8bcab92b-f93f-46e7-8225-6e731f750973", "comment": "Malware payload (AgentTesla)", "value": "9f377c8d7a77549e315d42a2dad99224c4f50f50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101368, "uuid": "bb48bf8b-e988-4970-8f89-2b6037395b0c", "comment": "Malware payload (AgentTesla)", "value": "ec9b3f37ba90658330bf89e477fa37761ed185a8511139d192f92e16011a14dfbbd3d9612e3e2b5314dab487cb73f3e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101368, "uuid": "6cb94902-3bbc-49bc-8dd7-88b393acd20c", "value": "T17DF5C4200318D970E26D5B6DE5757918140C298B94E9FF0D3ABA07B46376933A3BE7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101368, "uuid": "cfa18da9-5774-4298-815c-d775e87051c9", "value": "98304:USRnhizuZYkIPuG3L+mnrsHpGGDr7S0X+3XF9N37K5j0PlTZ0hy:s6mcp7r7S0uHhoj09Fqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101368, "uuid": "55a0dce2-45f7-4795-be87-79c02bc8b024", "value": 3617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101368, "uuid": "9fd3dc75-3c86-491f-8bc5-6e47faa20ca7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101368, "uuid": "fb136316-8197-4e04-990b-d86bfa119e7a", "value": "Invoice901.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b39aba5-771b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783109480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109480, "uuid": "ecfd394a-b93a-4748-81ee-a05cc2676a3b", "comment": "Malware payload", "value": "42f1681771c55b34b2caa76824559b7d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109480, "uuid": "295579ef-c4c9-4afd-999c-9922e3aca46c", "comment": "Malware payload", "value": "c120ab59ac32c2bcd14e0e091629bbdbd522381594261e3452ab11f5fd02bc57", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109480, "uuid": "369f5411-44ab-48c0-8429-a8e910ba5222", "comment": "Malware payload", "value": "d2b03843809f16478aedf3eef8a2764774fbe026", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783109480, "uuid": "40e28b80-5681-4134-a7b3-fc67e6d80691", "comment": "Malware payload", "value": "69329849b569a82ecfb79a5f535b4230cca4355aea03bb684096d9e6ba509cf1e89c43f96276bcaa7c9a2e2042becc03", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783109480, "uuid": "85b3d266-1ae5-414b-97b6-dd69ffdf42e3", "value": "T1B6D09512131303B050B34447F1E6B500700007BFAC579A187103B4F05F5724CF4C0765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783109480, "uuid": "5246d7b8-1149-459c-9a93-a4909f88a903", "value": "6:hTFuRNRZDS8XqfjQAulNXYq4HvXDG+NjVsNXYrkJ:VQRdS8AsPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783109480, "uuid": "2e62e86e-2699-471b-8282-04d0d9d3018f", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783109480, "uuid": "bf98c6a1-ea82-4e13-9fb9-52438bca73ee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783109480, "uuid": "8c86b6d4-c557-4b01-ac9a-72beed41a493", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1442aa4d-7725-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783113656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113656, "uuid": "8722f758-f8e4-472d-9a5c-bde8faabd78f", "comment": "Malware payload", "value": "375c6a1a21880dfe95b5a1df10ddc2fb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113656, "uuid": "f3481a0f-447b-4cc6-8492-110f0539983d", "comment": "Malware payload", "value": "c17aff83c3fbddb86fe5a40d7a654af5591b16522fb15c222bbf3d57b0b16748", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113656, "uuid": "59cde7eb-825f-4697-9038-4b39fc915342", "comment": "Malware payload", "value": "78accb53302354bce6d6858045b1f6ad895e4938", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783113656, "uuid": "28c40fa4-9a6a-496e-9ec4-ebb2e790a6b4", "comment": "Malware payload", "value": "a857aed3a0e9d4802cad1eedb8b887b8098c750c3f2280336283bfec66e1fcb1e3d26b9ba2117026ef610d8b61ec3b4e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113656, "uuid": "9ee839f7-956c-4f9e-a958-3af2d037adba", "value": "T10696E031B7498A3BF9B6793868673271B20A6D5D4E4D82975A01F21C6DB71DC0F0BBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113656, "uuid": "bef4dd79-2742-488a-9986-cab01cb1c0b8", "value": "196608:Im55YQthqiusGP9uNw9PM4ZTqRqU2oJr3y7beN5+:l55pT4P9uy9PM4lqRqUXJby7bX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783113656, "uuid": "c363e29b-b91b-4597-af33-41ed7b50f928", "value": 8817529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783113656, "uuid": "63849461-e89e-481d-ba54-f696855dc99c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783113656, "uuid": "2a0d307a-90a8-479f-bc41-f82f38621a55", "value": "IndusindCreditCard.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b2c1b6-76b6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783066244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066244, "uuid": "3a92a01a-7f5d-480d-a3db-d177e4ba79c0", "comment": "Malware payload (Mirai)", "value": "db4e3ca7c5090e35ae394df6b46bf15d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066244, "uuid": "f64b9b83-5f0b-460c-a6b8-dbad6849ac01", "comment": "Malware payload (Mirai)", "value": "c1af9c6d656ba5b94c4a5a4f3e0bf58fa507df0a92772fa2242c67e5ba543277", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066244, "uuid": "75afefcd-836a-41a0-b83d-8f3de4edc756", "comment": "Malware payload (Mirai)", "value": "a05cd3f9807bfa4205db30f95448b18bbb196673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066244, "uuid": "77d86511-0c12-4f62-8080-a130476e1b64", "comment": "Malware payload (Mirai)", "value": "6f37aa7890a03c6b70165e7bcdb549c0de9cac5713f73a6a84d25b2833c62518d12a8e75714eb454a4081e65df47063f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066244, "uuid": "977b5062-f1e2-4672-bda0-99316d01d5ef", "value": "T1CA933C46E643C9B3C80314F212E7EA6F8A31FE3A8C62DAC6EF542D54EF164C162157B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066244, "uuid": "965ef525-88de-4762-8197-1c03208ecf74", "value": "1536:jySwIrZgtl0+YILD5YYk7+pLHnNVz40KMiGA77hcG44zgSiWPs9V9VtJkTxHLjS+:jyqrZR+DD5YYk7+pLHnNVz40KMiGA77x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783066244, "uuid": "10298697-6c7a-4916-8b16-1aa9d70e199b", "value": 91320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783066244, "uuid": "bdc38b43-80b3-499f-8995-d619b6f2f16f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066244, "uuid": "ac3c92d2-8451-4ce9-940c-d9e1b566b565", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ebb9f1-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101767, "uuid": "f1abff24-d730-4c6a-9364-aa249d9750cf", "comment": "Malware payload (RemcosRAT)", "value": "2806ba2f7552e898a2fc0efa2161c965", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101767, "uuid": "96da6af9-ddef-4dc9-b0c7-811ae468e8dd", "comment": "Malware payload (RemcosRAT)", "value": "c1bb7171e2f0316fc8f48b16387a1df989baea568b8c1632c687c6486fc2dd0d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101767, "uuid": "44d1b246-4d40-4a56-a88f-7129f7cc0fbb", "comment": "Malware payload (RemcosRAT)", "value": "e1822eff6d482eb32a8c53c274b547a0649119cd", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101767, "uuid": "c099159d-746b-4910-b2c7-c916c067b7b9", "comment": "Malware payload (RemcosRAT)", "value": "54801b57073aec89c471d3f6dab880a0e01b3e3c8a70eb2d25996536d8dbaa0b490f323a0c2425c66d0f2e61a207670b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101767, "uuid": "afb24230-f204-4cbb-94f8-8970221c0d7a", "value": "T1BEB53311D22F844B31FF66239512FA456EA99383DC3F2C77343796E85A007CAC5ABA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101767, "uuid": "891e48ff-7a0c-451a-bd35-3e84fb0beb50", "value": "49152:OoaseWrVvqr5L7CQzqwmkbEqOCIYHCD6CGBdGnx6q1UmC8Mm3llVotIb8S:OoaseCVytL/TErYHO6FBdE6q1+8T3llX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101767, "uuid": "dbe37365-c2df-48e2-a1d2-312126080eb2", "value": 2322587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101767, "uuid": "95c76676-e6e3-4df0-b6b4-c68e78ae1138", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101767, "uuid": "377cdba3-ed2e-4efc-b75c-6810796240d3", "value": "Annexure_-_Specifications.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4808ba8-76a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783057687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057687, "uuid": "9ccc866b-33f8-4d2f-bf6e-61542d5ec68a", "comment": "Malware payload", "value": "4b0390e33f5569077b67eb8d955b728f", "object_relation": "md5", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057687, "uuid": "aa6d52cc-2082-4099-9207-fefc949bbb73", "comment": "Malware payload", "value": "c2971872f2269be05bd80f2b80a6bb4520789940f4365c3176839ef635692a49", "object_relation": "sha256", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057687, "uuid": "8bfe4028-4c17-4893-8e80-6e8016f21175", "comment": "Malware payload", "value": "1bf703754f9f296749ab930911fe919f6d1ceac3", "object_relation": "sha1", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057687, "uuid": "6b117146-b948-463e-a9ad-80f8c746ed1c", "comment": "Malware payload", "value": "81c9b1f8a48a0f3b5af5a9525103823e2603543d0bafbdac9082345a5fb2c0b5d8cfd69b4c463301d3fd5582809f6e0d", "object_relation": "sha3-384", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057687, "uuid": "e5ea8607-9eb5-484b-a5d3-7eeb03a84149", "value": "T1B606338BC9EEF8AEBCB70120A3B52AC0D3179013EAC321D60CF196D4D9977819756D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057687, "uuid": "15b2dfdf-6eba-4254-90c4-2f373a4a4f9a", "value": "98304:OprVLu0ArebOOueEI3ig/jvVLOczkXrg18sb7bEU8oDB:ELu0Dru/KvROczk72lb7bEtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057687, "uuid": "955b4a1e-2b42-4091-97d6-699631f9bfde", "value": 3685767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057687, "uuid": "d82f30af-86a1-4ab8-a59c-9fbdb3f4dffa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057687, "uuid": "6c2d5f38-8beb-4737-8eec-f525dbeb1e61", "value": "manovingenieria.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef6cb93-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101648, "uuid": "3642b50d-fa7e-428b-88c8-37e3318aedc7", "comment": "Malware payload", "value": "bceb6879b98d1c4d22d800dc51e23670", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101648, "uuid": "e40c6e16-946a-41aa-b354-f641289e8f21", "comment": "Malware payload", "value": "c31a0124dbf9e5e7788db730c2253fc131026b904c9a5ccd557487297e04f15f", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101648, "uuid": "15de6fb8-453a-41de-8d79-6fbb7d11b6e2", "comment": "Malware payload", "value": "a564c821a6fe51c75001011381afa503a7ade93c", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101648, "uuid": "2653c0bb-7894-4cc2-aa61-6e36b1cb6aa8", "comment": "Malware payload", "value": "f626f3ff272f99e90daed2c48daffb61a06e72adcc27259a9430c00a4e435f738ab409662d89baddcec36ce1fc505f7a", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101648, "uuid": "d14138a3-4470-4087-b3b8-31cff5a207b3", "value": "T1634319B2DA9916558D473B69EC942B52CDBCC509162300E6FEF8030CE40B8ACF3BE65D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101648, "uuid": "8d19a362-8866-4b3c-ab32-dc55a90bc201", "value": "768:qGPYIcMPzdE9CsGCuX0W34n3tI5NQXmxJQeFVYmgEo4Msqzf+q78xuJZ2vqXV5s7:WfOFFgIQ2NVYoMr90qXgs53/yJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101648, "uuid": "b870500f-53ca-474c-ba0a-726b2ff112af", "value": 56119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101648, "uuid": "1b6f02be-81c5-4cd1-88f9-15580ef60839", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101648, "uuid": "0549d5c6-e0fa-4bcd-a26e-f2774aebc31b", "value": "Shipping_Notice.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c084ea0-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101321, "uuid": "8e39cecc-e217-4a56-a225-0ddab0783119", "comment": "Malware payload", "value": "37fa70a6e98dd9cfe8a6fc9501834bd9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101321, "uuid": "55286302-577f-404f-9bb1-1470ef73aecf", "comment": "Malware payload", "value": "c4ed041045a4c0eacd673fc5d85329cd4e082cdbed11a8ba87994b8ee2c9214d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101321, "uuid": "28413f10-6435-431e-ac38-cd195c073d7a", "comment": "Malware payload", "value": "b2e770604e3fb1f2499469e74ebdab20cd4fee40", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101321, "uuid": "3f96a6c4-911a-4d0a-a1af-3427cdbca153", "comment": "Malware payload", "value": "16afc4d87c92575a50ee7f185e1c2130f185174e1bbac21c090e9b4c639d6068ee3e3054c3c8b2dd27a29b7f96434110", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101321, "uuid": "e06d32ab-441c-4a62-bdda-75360ec0bfa9", "value": "T120B4F1A0B5948F59DB464F76CB9B8AC00325BDB35F19A60B31827B0D5EF33823947C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101321, "uuid": "5fc92cd7-ec86-46d2-8d82-2cf50feb053e", "value": "12288:h5E03Uj6WdMXMegxsEBUz9Id+qWay4nT:PE0WnK8xC9IkMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101321, "uuid": "4820b564-b198-4259-b248-d7ba930bd8bc", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101321, "uuid": "fb684170-71b2-412c-b336-bfb5853dec32", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101321, "uuid": "22fd2dbe-a302-421b-9b45-ec24d7588377", "value": "SwiftXcopyXX807FTBR261590003X.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2c3d35-76e8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783087550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087550, "uuid": "79950ebc-bda7-47d9-92d3-902bcfa9ce72", "comment": "Malware payload (Mirai)", "value": "6585adaacd90b484af5489eefc83016f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087550, "uuid": "597a42e2-b133-40dd-8e8a-96554940a163", "comment": "Malware payload (Mirai)", "value": "c62a539ef0b524d81b3379a21d52f1b1799f39be30c107abb80c91159c913cea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087550, "uuid": "e14c82f2-deed-4752-a8ca-f4fbf438f762", "comment": "Malware payload (Mirai)", "value": "97e250e16d33e3eac0d7a7dce0bb0662878fe4f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783087550, "uuid": "bd27a8b0-9379-4ec9-a216-cf177a9bda72", "comment": "Malware payload (Mirai)", "value": "178a24b1ec74d0e44ab48d750316fe23f2fb7ae5a02f3454834c052dcfe6273f21cac353244dea9af901834487ea5372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783087550, "uuid": "127d8656-1101-4410-81d7-de541c177291", "value": "T19AD3F84DE9106B29C6E271FBFB9D52CE32271FBDE3EB3012D9304B9123C5A964A36511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783087550, "uuid": "4529f9f0-ae54-48d3-a05c-4a3d70ed64ff", "value": "3072:ZemeaaNACSajE/sCbFeUj7YOPPoO8Wf5h9p/8Zy:ZMGCSajgscFeUHY9O8Wf5hEZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783087550, "uuid": "3526e7a7-701e-4a32-94ea-a4569c599a36", "value": 141628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783087550, "uuid": "110b7eb8-11fb-4f0b-b106-c1a6dc442366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783087550, "uuid": "ab05fd91-7bb8-469e-86dd-bad6a94b3d6d", "value": "ARMV7L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be278ad-76a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060599, "uuid": "5a9bacd0-2fe9-458b-9987-79cad1c66bf9", "comment": "Malware payload (Mirai)", "value": "7fa199f19af766bfe88becf0e3336706", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060599, "uuid": "71caff86-9d0a-45ff-9178-04a5b83ab978", "comment": "Malware payload (Mirai)", "value": "c71b437679db06f6f7bda909fdde306aa0080047fa6b3d63ba0cf0b66cdd062d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060599, "uuid": "f14ceefc-b2e9-4228-a87f-991b38bf8393", "comment": "Malware payload (Mirai)", "value": "397bd5c0e6f7e08f5aa044f94bcea7d85c367589", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060599, "uuid": "0b3479e1-5ba2-49b1-a17a-04550c71f200", "comment": "Malware payload (Mirai)", "value": "a6a5138d4b78e0259781a26f5d8a77880732e9234cf4e6685f3263c786fc64c0b6e08bef1df3c161f5697ec760a94e94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060599, "uuid": "8b3adcaf-a3c1-4066-b9db-60757be60e09", "value": "T154A31655BC819E2AC6C24677FF1E434C332627ECD2DE3113FA545F2D368B96A0D2A096", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060599, "uuid": "174a885b-b32e-4ef2-abc8-539a9dd9fadf", "value": "3072:qHzGP3MAcmG8If+ARJZHSmSf/X5F61qdHWv3M1rZ1lak:qTw3amGJJJtL8W1q8vc1rZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060599, "uuid": "6cef17a0-0056-4de0-ace0-8d79c9f62647", "value": 100260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060599, "uuid": "89e61c67-03bb-40e9-b5a1-944fae617e4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060599, "uuid": "a86e3119-fa96-49f6-a298-4a630ca7f638", "value": "E8mc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc23303d-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783101589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101589, "uuid": "b83e91d2-a819-4845-8fd0-6fee12316ae8", "comment": "Malware payload (PureLogsStealer)", "value": "f3c95cc59492b32ca87dc863bd6995d7", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101589, "uuid": "e7bf67f2-7e7d-4b6c-90c2-dd4e53add1a0", "comment": "Malware payload (PureLogsStealer)", "value": "c93e902e77769fd13c07b3d8efdc5a017bbc2f3a0f98b452b5439d61478b622a", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101589, "uuid": "b2bd9731-19bf-48f4-acd4-52af81c62702", "comment": "Malware payload (PureLogsStealer)", "value": "95983ac38d8e5d5b8350e4b0d1d2808f7e27b6cb", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101589, "uuid": "ca90f6f0-c13d-46ce-b350-5a85fdacc581", "comment": "Malware payload (PureLogsStealer)", "value": "e140f662d4552d3d488c9027ccc005d9f79a931b477a82a3e7f3933432005dc6ec011b3d706d9c507c64e6d77b4cf7ab", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101589, "uuid": "2f2bf453-f42e-40c3-b22c-6e471239ecca", "value": "T1C91412DF501AE0FF7714295B050E9AD9B34C8069C4AD18A402F55E792FF701BABB263D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101589, "uuid": "6f0b70d1-dda8-4a9d-aee9-a2169d78e4bb", "value": "3072:RgH8Oov6YvWPCzYFyfSv0Nm4iZF+Ta/Ho2M4FvpZf69CXvusj/ZuL5bQtuCDXWXk:RO8OoJ+aSuS74qxXzt4S/ZabQICDwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101589, "uuid": "1b0d6d12-a3b7-465f-af08-18d9e3fd0d2b", "value": 194284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101589, "uuid": "4229ffd9-32de-49a8-962b-5a88d89f35af", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101589, "uuid": "94feac7b-d84d-4e26-b7a5-ff79dea6113c", "value": "Enquiry_RFQ_MXR_TRADING_20260624.pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0040a9ad-76f8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783094295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094295, "uuid": "205e1b28-03d5-49ed-abdf-09da6c01104d", "comment": "Malware payload", "value": "2e5745943e557e48458949de27787de8", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094295, "uuid": "d7fb965c-0f0b-4bd3-8609-3613bb541906", "comment": "Malware payload", "value": "ca5e4593bb94f83c19aa74d0b5b4cbfe503fdbb0a6d2b2c5dc573c0370606db5", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094295, "uuid": "924f4eca-7116-45c1-a01d-77000ed4bc55", "comment": "Malware payload", "value": "e2d7109208cf6fd5d11fde671aebe02fd257062a", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094295, "uuid": "4f1dfeb4-67c6-4803-a652-7973dfb31249", "comment": "Malware payload", "value": "b8fd2ae4e6c5a5ac69ad53b40155c76bf73507c81381b1b9bb4e0ad5e0b3341e92bc49b682f9510d9cf3f20899cc1839", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094295, "uuid": "59930dca-953d-44f3-bf6b-beb052f72c8e", "value": "T153E58C077DC545E9D4AA933288BB01967B75BC094F3623D72E8077782E72BD08D3AB94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094295, "uuid": "344f5793-22e4-4c7c-8623-f1bb89a9e235", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094295, "uuid": "774ed6d5-01a3-442f-9026-794408202001", "value": "49152:/s73g3Y1xKqOy2JS/tLgixgB0hlGhZk8lPa3oUb3Y14gWu:/suY2iFLL60hkh7Ixu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783094295, "uuid": "83284082-bc5e-4b4a-9aba-bb00351c15c5", "value": 3021152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783094295, "uuid": "791d3a53-973b-45c4-8f68-b7a1be670e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094295, "uuid": "77d76657-f772-4c6a-a903-04f4d0c3ce11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037454b6-76d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783077979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077979, "uuid": "3e0c1a9b-9e5b-494d-9783-c429c36bb180", "comment": "Malware payload", "value": "170e07da347843b24402e7fdb04ed8dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077979, "uuid": "149c2fb0-1a5e-476f-bc58-f3926ea15356", "comment": "Malware payload", "value": "ca89436b768eb69c044b6c669bdae517fccaff8c42b31fc54d4fc70dd075f50a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077979, "uuid": "6e38ed21-cec5-43bc-91c8-8e190d8505ee", "comment": "Malware payload", "value": "1b0bb0d640bce8d6b9dadcd7bd4ec57ef7ebf29e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077979, "uuid": "52547217-e815-4e2c-a93c-a3e66db175ea", "comment": "Malware payload", "value": "e76961f12212a62fb28d5762febecc0de50a6acc2b924c237330ba36ba081b9fa58c797c8dae4c92aff95d386518c845", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077979, "uuid": "7f52d1e5-5bf2-4213-a579-69f00cbf3728", "value": "T197660797B9D24942C8E43A77A8BE80C433631EB99B8757565D04FE383EBE1D90E39314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077979, "uuid": "056c297b-f9af-4e5e-852e-44fd53b09fb5", "value": "49152:OmNFoWZ+H4NU4+pJ+SFnnpwoOGkbrJ+F+hzJK2sc5EB7:foWZ+H4N2pJ+GnUN+k5JKKEB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077979, "uuid": "b75c1351-3b76-430e-ad1a-b4ebf8bbd0ff", "value": 6750370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077979, "uuid": "6a941120-9d50-4f23-b6be-f93df2749812", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077979, "uuid": "07cbdf1e-9b54-4a01-b8d2-a4b67c6bbed0", "value": "client-linux-armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b57098-768c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783048084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048084, "uuid": "b494c5a0-fbb9-40bb-8948-722f6828a640", "comment": "Malware payload", "value": "0bf8e9415f1aeae1edb06a19f9b49a71", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048084, "uuid": "108a06de-46e6-496f-8e73-b38a6e2fbbc9", "comment": "Malware payload", "value": "ca9ae76de194548709966263c227709d5c57c8e57f07f50d1532cf52fc5f438d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048084, "uuid": "2c0d1417-a389-4a14-9c7a-0c6e48102aa4", "comment": "Malware payload", "value": "e21330f6f9b3fd20a6f29c6fbb53677c36adbc99", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048084, "uuid": "64850a1c-a347-45f3-a1a4-d6301d569425", "comment": "Malware payload", "value": "37a946b83b4962bf441b6525d1f36f7c7ca02c0199eb152b405f2069a9cb56080584dd522db394f45deec5d04f4f0391", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048084, "uuid": "fc89c138-ec93-4461-8a6c-3fe68b784e81", "value": "T13556E04BE741565AC4FA82B91C3736251D477D214BA3828BDB2C3E3C687B1F48E979C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048084, "uuid": "921b24b5-428e-4629-a30c-da492c85f68d", "value": "98304:A0dxcNxc/pOl5UcF+/A6BZTyxU+N9Hg407iqpkUoyJpThdaC9AnIeUlsm1LhJ2uU:A0jcNxc/Ul5uA6BhylAX7ZWvA+C9fdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783048084, "uuid": "fd98b541-4c75-4ea9-a42e-b4f4cb448f3b", "value": 6352157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783048084, "uuid": "13343b93-7ab2-4e09-a259-1ba0d7fc7944", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048084, "uuid": "9e1e46d3-e6cc-4872-98d4-943f4494dda0", "value": "app(3).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0705b874-76aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783060805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060805, "uuid": "a7597050-c775-4136-9f02-aee7d637eab6", "comment": "Malware payload (NanoCore)", "value": "0433de72013e991a30c62cca38146e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060805, "uuid": "98f2d40b-0f52-487c-a3aa-de4ad982570f", "comment": "Malware payload (NanoCore)", "value": "cadea6f17dbee66cfb2d7aa1ed49f168f9fc201dcdd8d5b30d4e2cfdb7e069ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060805, "uuid": "8e5b20d9-ef0c-4d56-b781-5508c14a6031", "comment": "Malware payload (NanoCore)", "value": "01f05c75fff57b225b9e8cbe749e1c41b48b2024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060805, "uuid": "eff6c286-de8a-4452-bc18-6b179afe4d7c", "comment": "Malware payload (NanoCore)", "value": "497ded84d71499a607bdced350880071186f229ab017b72dc2832475bd29883a89a29a5bf4080b827a0d9eca1285ca18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060805, "uuid": "290fc71e-5e9c-4a22-9a79-301824407d04", "value": "T1A514CF2677A84A2FE2DE86B9701212029779C2E2A8C3F3EF58D454B74F267E406471D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060805, "uuid": "692dbe16-53fa-4e28-9162-1e3e4d68ff02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060805, "uuid": "35eef0d9-fbe5-4ac3-86aa-1a8dfa2fb049", "value": "6144:MLV6Bta6dtJmakIM5YitzMM3/mpjxE7pzpTVL:MLV6BtpmkDitoxizpZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060805, "uuid": "58924342-baea-425d-a493-6d29339b470e", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060805, "uuid": "609b9593-8340-4db3-b227-9be757a14748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060805, "uuid": "04435ff0-49ce-4d03-b71a-b61bc8244065", "value": "terradactyl.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e3ef9b-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783101008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101008, "uuid": "cf3c2e23-004c-4cb8-b359-fbdfebaed1c1", "comment": "Malware payload (MassLogger)", "value": "de26872dae5abf00dbc5810b6c6f90fd", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101008, "uuid": "e64f6015-d003-481f-aa83-44c94cfdc2f4", "comment": "Malware payload (MassLogger)", "value": "caebb983223b4df407b51677235848a5cba9bb506bad2e4056793094935aa777", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101008, "uuid": "7e02eefe-3abe-4ed6-81d8-aa25f30cc05e", "comment": "Malware payload (MassLogger)", "value": "211def63876be63260697622d18147dc9ff84885", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101008, "uuid": "b7e1b92c-289a-4127-a14d-1f1aa774a094", "comment": "Malware payload (MassLogger)", "value": "43a27c082748f3f29328beb5f95cf30958a64699126a9e975e65ac3059f9f431d45708afab2efd10eea00126ce02e87a", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101008, "uuid": "c96f3076-8ed3-4822-b122-5a265031d99b", "value": "T1D8B423B462BB72BFD32324E513E1B4FF52BA9A2781EDED3710D647F6131201E8824949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101008, "uuid": "a5ead46c-56b9-4c7e-bbf5-0670302fefb1", "value": "12288:8exoau20EDyL5K973m02NPo2SVYnGVsfCGRVr3iRrron6Y:qaVtyK973A3UGV2on6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101008, "uuid": "5da0f858-e64d-4962-b17a-25570815731f", "value": 534135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101008, "uuid": "107e0dff-2ecc-43df-8e1e-b5f9d25ca6c9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101008, "uuid": "2cdf444e-d441-4229-b14a-1f6d7d052431", "value": "ORDENXDEXCOMPRAXHA339983.UU", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defcada0-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101540, "uuid": "b04d4b4d-99aa-4b71-b187-09e46fbce6bc", "comment": "Malware payload", "value": "64c33a7da8db25b508b2366e99229add", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101540, "uuid": "e07b40f4-98ae-4cda-87b6-d1abc6dac199", "comment": "Malware payload", "value": "cb52d125958088d33628988dd76d190ff179f827c8d2a2790717bf6330f8d469", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101540, "uuid": "f962d255-7fa4-49cc-a4b5-df55f96fccd1", "comment": "Malware payload", "value": "36df058030c22ad6ea76332756abc31f10c93439", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101540, "uuid": "c6889f4f-4a81-4010-adb8-bdabbef29546", "comment": "Malware payload", "value": "05ba67ec7e33ac4c344f64805499f166e942ee0092b8247181be913e1b12f79bd86f7dd3472c29e0cf262efed8e1d254", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101540, "uuid": "290ba113-5a81-48b4-8fa9-b0f8fa499ac5", "value": "T1D3B313F0B1A6162CC05EEFEC034EA9BCF8284D727D8D95D45AE41C5695223CF2312BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101540, "uuid": "8984ce2d-71d2-41f0-b5f1-ca71b4429185", "value": "3072:uARYqBgQN491eRwIscGIFzKitdnnihuQIrlJHhjd6cB:uc2f+pF37CuQwp56cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101540, "uuid": "d53a040f-3bd3-44ec-bc39-6cda6036c40b", "value": 114279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101540, "uuid": "9b9d1978-3f23-47d2-a7e4-144f493a633d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101540, "uuid": "754aff35-2651-45b0-997c-ec45e546a287", "value": "SOA_710484359.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e63d8e9-76eb-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783088869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783088869, "uuid": "ffc4fedc-ec3e-43c4-bb3a-0c1f09deded8", "comment": "Malware payload (Mirai)", "value": "67aaac3d96c862e71e045bb985ad5e8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783088869, "uuid": "47fbbe84-ad4c-423f-aaf1-77626fcec12b", "comment": "Malware payload (Mirai)", "value": "cb72cad03d2a246554438a82ff828187f06a7ee6c204f565d62f6835190f04e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783088869, "uuid": "519db3c8-0d72-4bd9-b17d-9625815f23ac", "comment": "Malware payload (Mirai)", "value": "5198c74c6c477610c054f3e3afde72c2eb0b7590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783088869, "uuid": "d7f2ce34-056e-49b3-bcd3-7d8c9d6cad67", "comment": "Malware payload (Mirai)", "value": "4504972f3f880cfa88ae793d215eb4cb8f6d027eb242fe734c6ddd3e4c70dfa2535c20a0f885ba4a169d05cd01ccbe88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783088869, "uuid": "13130794-48cf-4abd-bbee-2579f72d910e", "value": "T17AA33B17AE91C0BAC086D27457EBC2B2F731F8A51221361F3794AE223FB1F951B18765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783088869, "uuid": "c3fc6fe0-9a93-464c-b06c-3b1a139cd5ef", "value": "1536:igjSYcMcszw+6cqSfsm80/R6I7WNZgAbAvLYKlorFz0dYL:igjh0LS0u6GWUAbnFQaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783088869, "uuid": "705e6a88-0fe6-4386-af70-de6179bc4759", "value": 106208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783088869, "uuid": "41a247ac-0482-481d-a88f-e146cdc6665f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783088869, "uuid": "81eb8261-05f0-4178-82ea-9f27500ef333", "value": "x86_64.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c46742-768c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783048056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048056, "uuid": "5e1b86f5-4631-4a19-8278-2597e9d8eb72", "comment": "Malware payload", "value": "eb63a912c5765addf3d30a1db8d01252", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048056, "uuid": "842a4fa0-fcae-4f5e-91c4-d1f52f490279", "comment": "Malware payload", "value": "cb7744fe6345dd0e4f15f1acdde23ecb6d484b3c8a6ce8792628a6a1453eefa4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048056, "uuid": "5a32bd70-27e1-4743-a93d-1e382d8dd923", "comment": "Malware payload", "value": "7b52441aeb89988a642349327b66a52e541d5df6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048056, "uuid": "2b9482f4-8481-4f65-9057-fce45bfb537f", "comment": "Malware payload", "value": "651ebb663fe221e8f948e5c2e43ed6d54f1d21515577b79ea2bdd8bd73874a52d91324d7996a6316ee7c472313844354", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048056, "uuid": "5eed024d-5136-42b4-ad3f-d7628141ec4e", "value": "T1FE56E18BE745565AC4F982B90C3736251D477D214BA3828BDB2C3E3C687B1F48E979C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048056, "uuid": "f04843e5-3645-4979-820b-cfcb16d819c8", "value": "98304:AaaCVfzs5U+48Sn0QVojNjwGfDiWpm/oOLjchdYq9+cjTTRYjE08zfhSEk6n:Aa5ad4L05MqDVoAnsq99yg5Sin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783048056, "uuid": "f6d2a1ad-f773-4e83-a3bc-65da1722c0b1", "value": 6352237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783048056, "uuid": "f300d9cd-ca86-49fb-9486-8326816e597d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048056, "uuid": "e74cf1b8-b485-48b9-943b-c461a80e5eab", "value": "app(1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8094456-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101072, "uuid": "931a01d7-e664-47f1-bc87-d1775c6ac5b2", "comment": "Malware payload", "value": "bb79abac9be12bc8872ac18b2a85cd14", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101072, "uuid": "e2d83038-1910-4861-83a1-ecaafc365b7a", "comment": "Malware payload", "value": "ccd65b2ac86e64b8d87399b8875bbbb02020ae42c4fe5eb6be6e7769391f7603", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101072, "uuid": "6184a6e9-881b-4133-a867-425edc003358", "comment": "Malware payload", "value": "484ff772a526ab622faf0eca8b25c82b5d4f0581", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101072, "uuid": "2b474a2a-e835-4f14-b987-dca4579da196", "comment": "Malware payload", "value": "130a40e63925484d994e6326c189d82315f8d14fa63f9458b4489b020139da4cf3cab1ed1edebb356765f724f1793792", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101072, "uuid": "829d611c-84eb-4c91-995b-762b9a8b2e7a", "value": "T18A2302F33BD4FB5F41C5DC71716B778123E40227CA60A8AF4463249D77E12D846AD884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101072, "uuid": "5c62ad5e-5051-4d26-9dc8-c2fbe5a9c40e", "value": "768:ZaHCTn02OyA/GB3KCOFETTDup/PYCJ6M2+m4lnBr3eHV2SWC:MiT09ywG3Z/H2FJR2b4dBjkUdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101072, "uuid": "b7b286a8-176a-46f8-8a00-5c361944253b", "value": 45771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101072, "uuid": "fc675fed-94bd-4caf-a640-4c121f1ed1f9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101072, "uuid": "e32fc927-0d61-4433-89e3-427e4d222498", "value": "BIK1910486_20260615.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4551e290-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106866, "uuid": "b0f30853-76ff-40ca-9078-addc01ffc5c2", "comment": "Malware payload (Mirai)", "value": "92d59fc5a23e58c526173686545134f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106866, "uuid": "e113f0b3-5bf0-48f8-824d-39322ce45cf8", "comment": "Malware payload (Mirai)", "value": "cf256778782901b1d22145836ca1608163bf42c1c61055f455c3f4172b6c2a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106866, "uuid": "c6d7cbf0-0bb2-4cf9-9728-8c539ee5563e", "comment": "Malware payload (Mirai)", "value": "cf79f49db34b338710789382f3f64d33613f0e0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106866, "uuid": "c0816e68-21e7-4643-9d24-85b79fedd2da", "comment": "Malware payload (Mirai)", "value": "f08331a5fde00c664f33a71d59ed9c5d03610e840fa2c5dddff3f914134ac6bb93a1341a4d3a165465217f0ca7109724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106866, "uuid": "023c81bf-80be-404f-a4d1-e07220d59b30", "value": "T14A04C50EAE618F7DF79983341BB78E219758338326E1C546E1ACD7115F9428E241FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106866, "uuid": "cf5ecfa4-7e4d-44d5-93dd-2d8c55e58551", "value": "3072:x98b/DqKAuv5nPyZhFKLLj1kQnUqopYRE7X7kZYoMMRlGsvFb41LFJjKHZ/UZcpL:x98b/DqKAuv5nPyZhFKLLj1kQnUqopYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106866, "uuid": "2fe79cba-94fb-433d-9330-7be9bdd7ea6e", "value": 178108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106866, "uuid": "4332deda-1e3d-45cc-a0f5-9b797715944b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106866, "uuid": "52d48353-a80e-4e4f-9eaa-17418b28a085", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478da629-7715-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783106870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106870, "uuid": "09706a37-2f9a-4e95-af96-57a644e98539", "comment": "Malware payload (Mirai)", "value": "b26584718d5033ea6fd7176d298e602f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106870, "uuid": "1c794060-0afd-4433-a6cb-6b672c9e0d6c", "comment": "Malware payload (Mirai)", "value": "cfbd2859a855c47242fa0966147baacc11e4174ecb70910953f451711efffa92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106870, "uuid": "1885bdd3-3f56-49ff-9165-c3f712fda84e", "comment": "Malware payload (Mirai)", "value": "e71a031db3d16015b8aca12474fda6a79f454974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783106870, "uuid": "8a17b989-04ed-4ec2-b2f5-80709f3b0595", "comment": "Malware payload (Mirai)", "value": "53897606fd0e62c15da58e9a32e019d6e5175669d7c24a78446ed0d46a2df4a3a24e6c025abe3d5373c8c480af13149f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106870, "uuid": "5dc6750c-993e-447c-aaae-bc56b07766c8", "value": "T16B93F885BCC3452AC9D413BFB52E519E332173E5D2CE7212D8A30B653A8762B0E63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106870, "uuid": "87fddad4-d578-478a-aab6-045258f84a45", "value": "1536:7PPOMkP1VibKMQ4UVicyyASz8WuZbfPRjRY5VGvhIMGpbHMzWT:6VGKhMN1+MMb5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783106870, "uuid": "d1b2335d-7f01-4512-8399-4db25a7407c9", "value": 95836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783106870, "uuid": "23287fca-168d-487e-b182-5f324d9134eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783106870, "uuid": "db14e0c3-8748-4028-a570-6b401da5a235", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5186684c-7682-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783043751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043751, "uuid": "43c9bb05-74ad-4c6a-97f3-081b95de2f78", "comment": "Malware payload", "value": "93e5908865ff5e3ef981daddec661da7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043751, "uuid": "91158337-d006-414f-8d58-0ce6d776a33a", "comment": "Malware payload", "value": "cfe32ce53eb6ec90806eba86f53c778f07879ef82a898b3d45f4d43af8de2761", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043751, "uuid": "824bb07d-6a7f-4c76-a907-b4aaad86dffb", "comment": "Malware payload", "value": "6a68a7049296a2ba638d7a6e4d423e45ed35d840", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043751, "uuid": "fad1aef9-c2d5-4ce2-838c-63a5d06d0795", "comment": "Malware payload", "value": "b95ee15cee7a716215ce1ac5e835db849f31a056699192e788e679ef65250225409665a5800e9b8d439bdff5335a64e7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043751, "uuid": "9e61f493-7c16-433d-879c-06203f582d33", "value": "T1E8236C6516857C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C49A9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043751, "uuid": "7f09c338-7b26-48f8-913c-d93b3ee0a194", "value": "768:cr9NyXsZztC29GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:6HusZmcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783043751, "uuid": "2c77a737-cc18-42f3-a0f5-eb9b5af824fa", "value": 48368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783043751, "uuid": "0d0044a7-7301-498c-9068-f9855ea37222", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043751, "uuid": "f1acb717-2458-434c-af3b-5073a61e48b7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e7577f-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082866, "uuid": "ba016141-b7b3-4c3c-a758-187ce8cec3c8", "comment": "Malware payload (Gafgyt)", "value": "c75af136e53a30f776175f582495b58b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082866, "uuid": "2fef04cf-f68e-423c-8491-4c03191ae8bf", "comment": "Malware payload (Gafgyt)", "value": "d0a1a0c46eb487a7461dd86c6fb6347dc42f8d0a60d85a549ae42d2f5751f7f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082866, "uuid": "fe6e9535-9a38-48ec-87e5-96b410a6af71", "comment": "Malware payload (Gafgyt)", "value": "273fb9a12a1bd4ad53d47dd7c71b58567bcf51bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082866, "uuid": "5ff2ac2f-c203-4516-9ab6-0dd787474630", "comment": "Malware payload (Gafgyt)", "value": "70df5e01184189bb06e1085a91ab1de1b37ed2311e79a1d6193595a252dc0e62b8eb7655ec4ef940ebceac061ddfbed4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082866, "uuid": "aa74c778-24a6-43cf-bb23-17059840b56e", "value": "T147C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082866, "uuid": "a6aca527-21d7-41b9-bcff-5896808ef233", "value": "3072:ekYPUfsgnsb0J2ag/VfskDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0skDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082866, "uuid": "0a2acae7-24e9-4e76-ab7c-c1cba87f92fe", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082866, "uuid": "abb43bb9-5b24-461c-adc5-5a0a38954fbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082866, "uuid": "a9721dc4-02ae-4f7a-8dea-3ca95abb2c3d", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca352e4-7717-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783107818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107818, "uuid": "352032d7-24ae-45b1-853d-dd27ef45ee54", "comment": "Malware payload", "value": "8bca62ec55d3f0a8870fb630f58e12b8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107818, "uuid": "d324613c-4805-4938-a744-1f2eba298f00", "comment": "Malware payload", "value": "d1e6e3515ab24c3403845bb89e0cebb1fff721632735dee1fe92e7be261a8d22", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107818, "uuid": "5f4e5b5e-48c2-45fd-8769-17ab446fb6c1", "comment": "Malware payload", "value": "d45b50833624bfe7297fb93c0483fb0f38c46737", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783107818, "uuid": "2589b8e9-161b-4dbd-896b-06e6fa6232dd", "comment": "Malware payload", "value": "d4e17792ca2e20770ae4dcfd7e7e9e1249803b651689525018d194206a6ba390f6502a1b624a394a846cec8b3eb43d8e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107818, "uuid": "fea28c3e-0380-42b3-8d6d-c0246b42cd68", "value": "T12C310A22697DB84CD461E7F68B7D23BF465AA5F38C8DA1D1220AFAF21C066C006305C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107818, "uuid": "1321938c-fff5-4511-8742-61650627fcec", "value": "48:93IQ/HrVVeTWmQnohNKa19ByChioh4aQQVqlx0I72/Ho:FIQ/HClzDXyiVQgyGI72/Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783107818, "uuid": "3a03d1da-c851-42d6-af5c-bac6c578bfaa", "value": 1605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783107818, "uuid": "f5b0b0fe-53eb-489a-9a67-99f27b264a20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783107818, "uuid": "58df1f1f-e2cf-49a4-86cc-1ca88e7cb1ae", "value": "Zoom_Meeting_Notes_docx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5e4c71-7693-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783051181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051181, "uuid": "4edd51cc-cca5-4c11-ba97-e56e29736c5e", "comment": "Malware payload", "value": "d5c38c0a8c4444f9c37f4b56b6c5138e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051181, "uuid": "2463efd2-9bf9-44cf-b76d-ef2836ef8fbc", "comment": "Malware payload", "value": "d2a8fc67ee43ce1bf1af64da8cf5798a81303121fae64e2dfd1386f483ce55ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051181, "uuid": "ad75a9d0-6dd1-4212-b76d-f0117f46c63c", "comment": "Malware payload", "value": "b16e3a1c2333ecebdf35ca7afbe36bcd4938a49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783051181, "uuid": "31fac4a8-a3fb-4742-b696-3dfd405aff8f", "comment": "Malware payload", "value": "b3e67f21b01eff547b286f59a824df0451277bf4d4b4dd331325fe9ceb12b6f6c3dfdc6612b1ee03e2ada849d793d04e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051181, "uuid": "dfb1f4b2-1e72-46a9-9e57-f5b7011d18b1", "value": "T1DC76333264E08479E4EA2B7E4639CBF4693E76150720EDCB53D82879C613AC1763D7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051181, "uuid": "c512d815-623d-4616-adb6-3c0612da66e0", "value": "4ec7a9af8aea061f5934796a877e8f55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051181, "uuid": "177bbf59-5d53-4f42-813b-5cbe2fc60c37", "value": "196608:cxajcbr+7JdWs/KdmdO5XiO8ZAJqAa2+r94iOpjb4:cxycf+7JBNdYXy0VYGRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783051181, "uuid": "5ff78c7f-fae5-4233-9703-22190b36764e", "value": 7205089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783051181, "uuid": "5533e5e1-c8df-4292-8c95-e15e5a4af500", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783051181, "uuid": "2add1b4e-7c38-4e07-a6b9-f42f58015995", "value": "DiscordThemeTest#2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f99742cb-76af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783063360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063360, "uuid": "66104002-e5df-4e42-a32c-8d3850aeaa8e", "comment": "Malware payload (Mirai)", "value": "3c9402788e95dc37779ad255f80b67e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063360, "uuid": "82da4516-7df0-47b3-afa5-4cc65c2f964f", "comment": "Malware payload (Mirai)", "value": "d4a49f70b86d27a9b2f29d1874bc1407d38d98ef93267a52775948079fb96f13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063360, "uuid": "e8f6a569-5423-486f-8b31-64c6c73b4b6e", "comment": "Malware payload (Mirai)", "value": "9902ee3ea127cb97c524fdcff718db7c97c6d3b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063360, "uuid": "d2dd0df2-2b10-4c75-8dec-b46fd2e302c2", "comment": "Malware payload (Mirai)", "value": "bed1fe7fae7582a9e57dcea5c5d425169ff4ac40dfbf3f9ad32435fe3a8ff4cb57d11f20cfff901fda6135f501ef9193", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063360, "uuid": "ab0ac5ae-2bc3-44a3-938b-714eb938ccad", "value": "T120B3F60FAA2C0F87C1675AF03E3B27E0879DEA6611E453C1A41AFDC147319B66126FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063360, "uuid": "0233aba5-829f-473d-9f54-cdd85969dc82", "value": "3072:IwpEh1+Kkt4hkugNvLU/vA5D5h9p/gtK1:IhhUVt/xNveA5D5h4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783063360, "uuid": "6e32cc9f-2e8d-4f07-8c23-3a3c0f3432e6", "value": 116996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783063360, "uuid": "396cda4c-6e4d-4749-859f-18add4248fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063360, "uuid": "34944007-eec3-4798-a5e7-cc6067b4ed0e", "value": "POWERPC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d24e54-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101252, "uuid": "629e1b56-8b09-4664-9bcd-91f96179c037", "comment": "Malware payload (AgentTesla)", "value": "7a343b773abda3d4f42b88e1ef32a87e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101252, "uuid": "02622e3b-96dc-48f4-94f9-e18a62334cdf", "comment": "Malware payload (AgentTesla)", "value": "d4b8bdaf4c6f0ae2003822bc8893dc05956f12908d233ec6d0339efb373b1dda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101252, "uuid": "3a849a44-8ed8-4267-81bd-f57f1d4a1571", "comment": "Malware payload (AgentTesla)", "value": "6b7c415d448569ce80f39ffabfd00221cb52b003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101252, "uuid": "ab1b3d5c-b520-4dcc-989a-1d043fa63933", "comment": "Malware payload (AgentTesla)", "value": "62e54691362027b7eb1f17bd87dee9e24eb30349a1e72e0b3992586cbb6d0e564aed50b0336ff31de57746bb630c76c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101252, "uuid": "fb74ee0d-da4c-47b4-ade8-ca21c54ae368", "value": "T11D642371383BB8DE2666F244BEB0D75BBD29C708D51917BD89CD93AB6E1420892D0C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101252, "uuid": "44be7ed7-9629-433d-9f59-9a0ca7d61033", "value": "6144:qIrivCHVBpdFLv0ouqW4624BN5qt4qBaxdE/s8lUqQ80PbVtp0/A9:N+vC1BpH4ov624BN5PQ/s8rQHPbVtpCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101252, "uuid": "2f9983c9-365a-4d24-8e32-4f9ac6bec2e4", "value": 309455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101252, "uuid": "7bc502bc-f75f-4d8b-a670-8080ebe6777e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101252, "uuid": "964a9164-6a27-4282-b09e-6af91d2d8258", "value": "BIK1910486_20260618.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cde3f01-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101698, "uuid": "368b444c-fe82-4b36-8ae9-bc2d218a0f2b", "comment": "Malware payload", "value": "7d8884a81951500645d297e8d2514e89", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101698, "uuid": "c37c1bd9-e52e-41d0-95fe-dc49a8df4364", "comment": "Malware payload", "value": "d58d01fec56d7c5454c361de05033d35fa77090038e6204c15c4ffbbc7e7155e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101698, "uuid": "c29c1e6c-6859-4e75-9ad8-5ba252ed7918", "comment": "Malware payload", "value": "88d2d3e226e2b977e1a093bec5682f81e2398dc8", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101698, "uuid": "1fff0eb5-80a0-44be-bc6c-275a0623414d", "comment": "Malware payload", "value": "855bb60eb2e38acc616d1379dd4fdcf0807df5ae32c42f8d761111937c0287b33a88f41cb2cbaa7017414a22089373db", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101698, "uuid": "dd9026e9-1d92-44e8-be06-4720454ec6de", "value": "T122442200A907CE95FB2C45DFEF160C9C58EB6BC560967DAC4487A1BD22B38E37581A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101698, "uuid": "2e614635-87d7-4994-9a06-f2a64d50c3a2", "value": "6144:OGbI7hfEkKUkrw2vytsviDnuGJz8s3/ONbg6NbZuLbMht8:6p/CvwuKGm6J8Lwt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101698, "uuid": "f85c9fa0-046b-4b91-a708-89e71c0a12a0", "value": 278268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101698, "uuid": "6e53a0a2-f25f-4ec9-972c-92d31fab6754", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101698, "uuid": "c8a0a783-e01f-4e3a-8b1f-15a4dfe2c850", "value": "PO-000143494.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72635d9f-768c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783048101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048101, "uuid": "4f23cacd-db68-48cb-ae13-f8a1565cb12d", "comment": "Malware payload", "value": "e044aa1347523b51bd989a427851f68f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048101, "uuid": "9d0e1fed-0fd1-4cc1-ae78-bf7b65322d3c", "comment": "Malware payload", "value": "d6d1f2dd6db3177ccbde0fe17170cc4fa81078d1a9a900f1f5dd73ddce5f06e6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048101, "uuid": "da6eadcb-19b9-4b57-b503-7398273f504d", "comment": "Malware payload", "value": "ef0a818e4a43fbe061993bee655640bd230fc5d2", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048101, "uuid": "e08994f7-b116-4fed-a7e7-71e7d771bc7f", "comment": "Malware payload", "value": "69fe451ec74f69b0547488ae17b19a603cfe22a88ef9fe7827b07ed47a4a090bab54de2b136e6c5ff24fd96bcc41ace7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048101, "uuid": "4b7f50b5-fb98-4251-9488-f9dd52865964", "value": "T19D56E14BA745569AC4FA83B90C3732251D477D214BA38287DB2C3E3C687B5F48E979C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048101, "uuid": "1f428421-d1ef-4bfb-9807-e027ccd90425", "value": "98304:BahN44Rt0vyaN470sxdBYhMvkzd/HmuODiMpjIoWeB1hdao9u9+6TYkXGaytbhoq:Bab6DyFdBKMEGLDDhD5uo9QEkXYNJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783048101, "uuid": "53d7d261-11d5-47a2-9772-74ebe70ec974", "value": 6352249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783048101, "uuid": "c012fb67-2b59-44e1-b279-276e98e4d5ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048101, "uuid": "e93064a8-126c-4e97-9c69-211e89cf27c6", "value": "app(4).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a47293c9-76e2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783085121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085121, "uuid": "88359b40-7dfa-4489-b383-d7bfd67c110d", "comment": "Malware payload", "value": "2b265316ce3de69f4e53ede847e1053e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085121, "uuid": "45ff343d-7358-43b7-9b03-86427752375d", "comment": "Malware payload", "value": "d6fb04b214c8750a7ff8111b6ffb3268c97a77c32595c7e1b0633db04fa67bef", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085121, "uuid": "6988aca7-4001-4982-9ca1-250542e879ba", "comment": "Malware payload", "value": "941a220dac4935af970375ec7741de3155b17c7f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085121, "uuid": "7c6af897-4fef-4c3e-89e2-a7b8d2eade72", "comment": "Malware payload", "value": "56796cfb04adb844beb7c8fe7fd2e3d4c1363bdf7e17c992739c9105b95c1834263c8cb988a6134674f94f975a90e054", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085121, "uuid": "d012a473-32c0-4529-bd8f-53b32af3101c", "value": "T163A4233EAC8B6E2F4C5B7D94D9BE59A21451818E4FE7667BB403DD08305F8B1F07108A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085121, "uuid": "e728edd9-d6ff-41e5-a99e-4fffbcff844b", "value": "12288:tmDGansxrWPNPHDBJ3iJ3iGOOV61/D6TSL5atHQeptbp6uhxg:tmiaOr4NHDBJ3q6176k4HQeptbAuhxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783085121, "uuid": "3b984576-2264-484a-8715-bfc8b17e4808", "value": 491929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783085121, "uuid": "4019411c-caf2-4c33-abfa-59df82ac0828", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085121, "uuid": "a839e99f-b8e8-4c55-bbaf-dd5f7b559341", "value": "Protivodeistvie BPLA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4452ec7c-76a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060479, "uuid": "9ed671a9-1a42-42a0-b6d3-d0824c12ae5e", "comment": "Malware payload (Mirai)", "value": "856848f5fdb1347b9fc2147a6301173e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060479, "uuid": "931dd12c-90eb-4d3d-b62b-fdf91c3ce352", "comment": "Malware payload (Mirai)", "value": "d7c75c5258ea8467690ec1f710415e7f8234491d4873566515f15fb7e5e729a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060479, "uuid": "d929ebb1-aab2-4574-84e1-1e6107e07660", "comment": "Malware payload (Mirai)", "value": "cd14cbc370a41bb86e626e2ebe38f2bd7bc02855", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060479, "uuid": "622fdd9e-068a-4899-bb9b-be12626bea6f", "comment": "Malware payload (Mirai)", "value": "2bdfe5c507cc0c593c44c2c0177d3eec24a224e3a793187425a172d86c48e107b1c1e7b6fd8551ae57052accd047f26b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060479, "uuid": "28298622-d4fe-4f6a-96ac-8ed6453f4108", "value": "T12FA42955FC409BA5DAD22ABEFF1E824973131B78F2EE72119D151B3163CB84A0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060479, "uuid": "06dd2790-e644-4350-8039-70fced202283", "value": "12288:zqsZQ6wMHrrN70qrOPWTkZdk9gqw2/IggzDsNa+FZ+jIQ9D1kB:TZTK8CM3ZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060479, "uuid": "da782c92-b512-4ad5-b11c-7661dbf3678d", "value": 480932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060479, "uuid": "17c801ee-f894-4637-ac97-26eb987f8678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060479, "uuid": "3dbe7c30-d073-43e5-8f26-6c34cc5b8d5f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7398674-76f9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783095139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095139, "uuid": "ce7fd8ad-6a6c-4209-bd73-29d536176e66", "comment": "Malware payload", "value": "284f231d3bae3c77fd5990b332d73872", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095139, "uuid": "46ec6544-2d8a-4411-82fb-98fcff790e2f", "comment": "Malware payload", "value": "d82fb72934086f507007f70c76b608597c47c6f991cde5efde29b9371e2dfcb3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095139, "uuid": "3add88ad-c9e1-4961-af90-49705a7bcc1b", "comment": "Malware payload", "value": "e8aae19428a94a457341d40f22b515a0a48c61a2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783095139, "uuid": "9254d5de-d7ea-42bf-8319-4718892d19a8", "comment": "Malware payload", "value": "9646cbbf4ab1b738e58fa9ee1a7cff8dd60f784ba67f65fea49adf8892a031df5b8eaa90404a785bcbdcbd6b55e51607", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095139, "uuid": "250653c7-d07d-4e3e-a482-747f52d8fb9e", "value": "T100763396F98679B4C08BE3B18257627D72153FD65E685E0AB3D9B71C1F33B1408BAB00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095139, "uuid": "c8b8c88d-13af-4cc6-a98c-c76293dc67eb", "value": "196608:3i2hjUNX0bBi9D2tQ2RKuEPS9UmkLUBtCCR0TBCFbxd:3i24XKBODoQgEq9UmjtCCmTBAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783095139, "uuid": "73b9356b-c12f-4cbd-8f8b-3ecbc1184ea0", "value": 7278592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783095139, "uuid": "205ef71f-7353-4b57-8217-a0feddba9ce5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783095139, "uuid": "efcd54e2-d1ca-4eac-937e-988a5603abe0", "value": "zintall.6638250001.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da526962-76d0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783077481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077481, "uuid": "8a28801f-c306-4fb2-9de9-80df1f01757d", "comment": "Malware payload (Mirai)", "value": "a68847c782e48dd5b64c2b4860b52eff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077481, "uuid": "04e104c8-f43d-4afb-8e9a-9dea6fd50e3b", "comment": "Malware payload (Mirai)", "value": "d92cd102d82314f82f8cde90f62b344c72fab81d049079ac94b862b0143e4dcb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077481, "uuid": "dd6c4678-d5da-4da8-ad2c-d9f554879037", "comment": "Malware payload (Mirai)", "value": "910ee2073fb688f9c68b313380ffeb8e1dc72c68", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783077481, "uuid": "cd6608da-2721-4a70-93b9-638a210147d9", "comment": "Malware payload (Mirai)", "value": "59e794977adfa59877c50d5feacf07e747711f08ea1bb9d18318812efdd590df754eeebff0bac2f2e9d64811a8f79dd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077481, "uuid": "021a4058-069a-4e04-9c97-0a3f7ecc51f5", "value": "T1CE140A01B9014B53C5C32BBBB7DF43957B336A2887EB3301AA19BEB42F4769D1E29511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077481, "uuid": "c38d2da8-771f-4cfb-bbfe-f495c7d9c502", "value": "6144:o6R4GHJvKChVC2tcLmq1Sko4uy3HNWRCbJGmZT0LP:DR4yh9nko4uy3HNKCbJGmZT0LP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783077481, "uuid": "12f10de7-3443-4962-ac2b-dad8e99b590f", "value": 197433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783077481, "uuid": "a68e7d48-3e57-4278-bbed-b7d0f2a1b8a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783077481, "uuid": "eb308f49-8894-49ff-8da5-95274c2531c8", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988dea3-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101317, "uuid": "b078642e-0ba1-4587-aee0-852a30f6322b", "comment": "Malware payload", "value": "0e99176f29cf1758b1faa42da8a10a3d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101317, "uuid": "93b9a869-aa8b-43d5-8cb8-2266ef9be81b", "comment": "Malware payload", "value": "db3d1ce78482fea4862ced6dcc0a2ebc6f00632ddc6acf9edc2e18c7addc6178", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101317, "uuid": "148407a0-0b45-4703-a99e-564fd4be6624", "comment": "Malware payload", "value": "6f71067e732d10cc3e1f2c77e13bfe1157b9756a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101317, "uuid": "545581d4-4fa2-497d-a6f9-d3863293c8fb", "comment": "Malware payload", "value": "68aa636443fabd6a5e1d5dd84ed161cc30ae351851ee5b57bf380c5523c7442309837724ba144d2a33dd1642ee2cb380", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101317, "uuid": "8ea63bdf-da2a-4caf-bf25-403baaa91ca2", "value": "T1B6D3127B9DF6634B0107F0ED590928BF83F1C978888F5CE867D29FA63D194D0CA65289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101317, "uuid": "5b2ad3f3-64c7-4664-8d9e-311e58789a03", "value": "3072:qaaIeea0uRJaf42EuyQndb3ZXtwyFOyXR2:qaaIvazJdQn13nJfB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101317, "uuid": "0b6539b9-8df4-458e-9663-e2c66dcb636e", "value": 135087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101317, "uuid": "0162e7a0-158c-48fe-b6ec-f35424f1de69", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101317, "uuid": "4d0c01e4-7604-4214-b599-a7606d4b1d7f", "value": "ORDER-SUNNYX5916081940.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981d89c0-76a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783057183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057183, "uuid": "9858a81a-b6db-491a-a55e-104f2efe2bd5", "comment": "Malware payload (Mirai)", "value": "33d22017be2877db08dacc94c54c3499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057183, "uuid": "2f860021-130a-4a96-b7b6-3a8fc94bb7c4", "comment": "Malware payload (Mirai)", "value": "dbae7bc63cff2e9500a524928dc5139aff58c8c2241d9fbed43b464a3ab81ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057183, "uuid": "6cc68321-4b4e-40ba-aa2c-ed0904829000", "comment": "Malware payload (Mirai)", "value": "9b99d8f5c52197272b95830a7e12a56707584d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057183, "uuid": "fcdf7b99-dfb8-429c-ab39-b7552203d770", "comment": "Malware payload (Mirai)", "value": "4e00f62eaccd591a76bedfcf5107bae8d19b73f688ba4cc3c8d69468dc8257bdcb3feb3ef0a67bfdca9df434bbdc600c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057183, "uuid": "84410ede-6317-404a-acef-ea9216f8c4b4", "value": "T1BC44F8166F710FFBD8ABCE3742EA0B0538DC505B22A53B3576B4D414F44A58B6AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057183, "uuid": "6b8b0f10-32ba-4bf6-baf8-2fe1953fb4ef", "value": "3072:+JHVDA2hqHmV25vbcFRYsV9hJ08t5ogngckMqysvgjuWY:+BtA2hqGV25KGQ9hDMlUlsvga/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057183, "uuid": "1e1998d8-f078-467b-9f80-f5ac5d67d2a9", "value": 258080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057183, "uuid": "1efa3847-0c03-4607-9c56-063ffbc1a04e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057183, "uuid": "6484bbe2-a17c-480f-bd11-4c1fcbd4f9fa", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa9db2d-7731-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783119070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119070, "uuid": "23e9ce78-70d4-4012-9028-87783511826e", "comment": "Malware payload", "value": "ee9ccb349a01601bafe3bc010a0f97e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119070, "uuid": "13ca5728-c92b-442c-a81d-2dd1fd9944e1", "comment": "Malware payload", "value": "dceebf2ce1186b22f60b7ee064670db88347761767ea8610a35e50e568b348b3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119070, "uuid": "3a6fa4f7-b6c7-44df-8c68-94aee4b58a7f", "comment": "Malware payload", "value": "ed3e8ead24e98fbe6377ce7e672500c3a4aa1d23", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783119070, "uuid": "18180f6b-fa57-42e6-b252-f1ece1aa05f1", "comment": "Malware payload", "value": "1c4c432462b8e45c9d13b1dda91cb88c326d8c405992ae809c2eb34fbe3ab6dc5c70403fc4a5c71d381015c9b1242a10", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Indusind Credit Card", "colour": "#E15411", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119070, "uuid": "6ace27ee-f612-47fb-b9e0-a8757e2807df", "value": "T12A36CE4DB7F4DE2AC43A40362866523E625B9F478B428F43B944771D3BBB5E40E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119070, "uuid": "8057e62b-07a8-4e6b-abda-b13c4d2f328c", "value": "98304:dXO8ftRrowY3PFw0ba6Qdhb5x1vakE5FqXSh6BMUEy/:dzeFnba6cBokdMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783119070, "uuid": "72cc00df-04be-4835-9158-0093398c72ee", "value": 5226279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783119070, "uuid": "2a0fbc19-224b-4040-a591-2231c056ff50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783119070, "uuid": "a4497a6a-706b-4660-8ae9-75d595ec1500", "value": "output.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b41fb85-76da-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783081509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081509, "uuid": "b1aa2422-09a9-4cf3-bacb-6931fc0394d7", "comment": "Malware payload (Stealc)", "value": "e1b807c2d7b670f8b7ba75df1fc4dbdd", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081509, "uuid": "b5f750e2-9280-488e-876e-9ccbb7144dfb", "comment": "Malware payload (Stealc)", "value": "dd0bebc17d103b682c00e5cc6f92ae28432a357cc9f9fc49f1747d28931c6402", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081509, "uuid": "bf737418-7b86-423d-8803-7be91a9f5a10", "comment": "Malware payload (Stealc)", "value": "f1a125525920011ef6658b2ab21aeb03ef107fc3", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783081509, "uuid": "b9bf2dc4-a9e2-40df-8094-c61d96035232", "comment": "Malware payload (Stealc)", "value": "172595767a302e9ee1b539d9d4b5fe62acb2fe11b6d8262358e14c9d9beae51d507f156460f7a31bd276f677de1b082e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081509, "uuid": "c964cd37-6cce-466d-8c27-6183417ec34d", "value": "T144F47D1AF3A502FCD0BBC178CA524552EB72BC565330A69F03D15A6A1F376A06F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081509, "uuid": "264afed7-864a-4a2c-b1f6-939a076cb448", "value": "b45095de49856a47334e76102f8e7be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081509, "uuid": "cffa5bbd-7657-453c-83c1-66c7b80ce298", "value": "12288:cPgLoOm0BuwC6ewkMOayY/1XyxBlDetAqxSvvJ/:coLZgwLrk9ad/tyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783081509, "uuid": "bdbd692b-fd8e-4170-ac6a-1e6df524f840", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783081509, "uuid": "eff2a752-3f5d-455a-a9e9-239811e40c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783081509, "uuid": "72809706-e3bd-423c-996d-50dfb58c1e06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e157a9e-76b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783064441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064441, "uuid": "b63f0c09-d6bc-4e21-b4c9-8c23c807a76b", "comment": "Malware payload (Mirai)", "value": "1893625495ed25fd1bd2ad1d798c5354", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064441, "uuid": "09ec0ec7-5fe6-49d4-a846-80a4a3270b79", "comment": "Malware payload (Mirai)", "value": "de53ebcda1d083a7d3ebe4fa44d8236c785a8bc5ee816af93c43b6d9cf11c6e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064441, "uuid": "e256a560-9831-4331-b7da-8e2a9b04634d", "comment": "Malware payload (Mirai)", "value": "feab0deec319ad6c12da5a155bcabe00d0ada692", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064441, "uuid": "aae66e71-75db-4051-be15-c61e1fe12e54", "comment": "Malware payload (Mirai)", "value": "4548c34ef3ec7a4332f592fdb7572e083928c3a792e8dbe2cadf49d4874ac31190b6f610b8ba33fe4e74a22c83aa4c1d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064441, "uuid": "179f8cd8-5f15-4bb8-9ff6-6b5177b37c5d", "value": "T13104486EEE0ADE55CEC6C33E999A0FA3703234B48752C1B34F42913CB59BAD17879491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064441, "uuid": "080cbabc-a90d-4678-9c89-004fbfa9e620", "value": "3072:6rV1hx7p46gtLrWOFIadgDHmGI3YV9buMoxNTp9zYPQhcKhR1ctaysd+I2:8ofmI329bu91YPQSKxEVsd+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064441, "uuid": "29852b35-0920-4d50-8e62-8c9d06dfb965", "value": 186184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064441, "uuid": "0599759c-fd1d-4900-86c1-50ebaf609f25", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064441, "uuid": "d6cd99f7-beb0-432b-b6e8-9fa786e9788e", "value": "main_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2115c5-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082747, "uuid": "47fdb052-22ef-4122-8bfc-c6e74067aa6a", "comment": "Malware payload (Gafgyt)", "value": "f73feaa374461e7c2568c3ef72104b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082747, "uuid": "98d59707-2ecc-4543-852e-acefab76ed0d", "comment": "Malware payload (Gafgyt)", "value": "de9a0df59d81ab578f1eb1238c6caae3a718e4f35a368149656915aa15059e37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082747, "uuid": "498508f9-4c19-4238-bfdf-124ff6f4c223", "comment": "Malware payload (Gafgyt)", "value": "8661e5826c250a98d7a43d07670e7f5942040817", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082747, "uuid": "5f7653de-b7e0-4d1e-b613-b3b6ced43b36", "comment": "Malware payload (Gafgyt)", "value": "72b4e478c5c623571730fbf49fc5a390206e87c72d7fbc9a0fba3e453cba3455f35bd06b1bbcc2bb0f51f89fbd8b241a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082747, "uuid": "3544dd61-7a36-4af0-b2ff-96f554cc750a", "value": "T18B833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082747, "uuid": "b3537536-a8ff-4c6e-a413-e521ef6d6972", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCXdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JIBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082747, "uuid": "10aaff10-b3a6-470d-8812-bf1886845bf0", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082747, "uuid": "6aaddac5-5ae2-4dbb-89a6-936848464951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082747, "uuid": "f8409cea-1b20-4a8a-b309-8725f223cf39", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e079c568-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101543, "uuid": "b9d15a77-872c-4ed7-85f0-37e8b7bc64e6", "comment": "Malware payload", "value": "e1e31168cad1352f5cdb40222d9baaf8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101543, "uuid": "306854d8-35f0-4fd8-8bfe-991faed6ef9e", "comment": "Malware payload", "value": "deca7a929018cdb2cb847cfd6bba365d7babaf1219c2bc2c4a6f6cd2769e7262", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101543, "uuid": "9a564a12-07a8-4253-8b49-6436ace5bdd8", "comment": "Malware payload", "value": "6a661597089d99265b9772efa4acde634c8c38c2", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101543, "uuid": "53fce720-ff39-47c8-a261-517bdd69155e", "comment": "Malware payload", "value": "724c8488cb210ff66bbc3ba3cb54a201d028446845453bdffb4f2e110858aaf454da9e1ecacdfeca364ff10794fc47df", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101543, "uuid": "c748ba5b-3006-4084-96d4-020dd0a91a0b", "value": "T18F4423323922B92A4AC78BFFE714B65F97291696FC4972D3F0C0A4A42C1F61D6D4DD20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101543, "uuid": "f43e212b-0ceb-48f6-a913-54993968c6d8", "value": "6144:A7uZP9l+BCZtr7uvkw+nOxzS53Vmgj0W3zK8xSh7rDbKvadKy5:AaZPyB4r7uvkwiVhj3G77/bKCdKy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101543, "uuid": "4c340b85-77e1-4f4c-9933-1058f62c47f6", "value": 258101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101543, "uuid": "457f74d3-2717-4da3-80c0-2a423389efb8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101543, "uuid": "3e0744a4-6bb5-4345-8037-833c363e1239", "value": "Purchase_Order_Quote_Confirmation_November02-2025_pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368c0c37-76b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783064321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064321, "uuid": "06cc7fef-5b6c-4e4a-97e2-d4656819efef", "comment": "Malware payload", "value": "6d9e170a96deeee4cab94fff043de2c3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064321, "uuid": "ab59bbc7-5b98-4740-9b73-2695d02de672", "comment": "Malware payload", "value": "e031de762e54fe17c46c8a1936eba20787368ad79f046d762542ca487d7ec3d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064321, "uuid": "f6a5730a-5bda-46c4-b278-433971cc0ee4", "comment": "Malware payload", "value": "314aa63b9cc2e2f8454787aa1e7c7855aeb2720a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064321, "uuid": "d722a7a8-bb2b-4066-aebe-ec137b895ae5", "comment": "Malware payload", "value": "e6cb1ae8fed9e4594c002c8c7d5231127bc8c4b446b0814eed29b42473b176a7cb48ebd3727d2df1d78cb5a54d169fca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064321, "uuid": "32e2f999-4e8b-469e-b962-a90bac1102c0", "value": "T1EED0A7F36573527860966455F1DA7F00B450877E8C86863CB92720792E4434AF5C46A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064321, "uuid": "e7468426-1274-45bb-8ee5-bfca2536fc2f", "value": "6:hTGwn/7QuYPXZpAulNXYq9DG+NjVsNXYrkJ:VG0TR4Piq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064321, "uuid": "1195fd5a-66a6-4bd4-b0a2-daff690ca4a2", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064321, "uuid": "2079e5c9-e7f6-4850-a6c1-eb931da0dc34", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064321, "uuid": "2a9d926c-cbb3-4278-8191-3b0c5fc1ef62", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b5ac83-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MeshAgent)", "timestamp": 1783101572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101572, "uuid": "96665458-3ae9-472f-9ada-356d72b89755", "comment": "Malware payload (MeshAgent)", "value": "e0253c7bbc5b4e8dbc6ea231f51ea800", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101572, "uuid": "e8f76e6d-f69f-4c93-ae00-e821b6456d35", "comment": "Malware payload (MeshAgent)", "value": "e061a76a42aead05e3cf7161b65a73fb8e6f074a0a2aba1b3817eae9ef659491", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101572, "uuid": "286b65e2-3d12-4269-a630-5f500cc346d6", "comment": "Malware payload (MeshAgent)", "value": "8e94e9a609f18047c3db3df4c16dc19cd126aced", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101572, "uuid": "5189f685-4bfb-47bf-8736-300a2bccf930", "comment": "Malware payload (MeshAgent)", "value": "934e5c6818f5bfe00ba7ef2d1b146c20778a5669c932b2d00d958d9edb127abad93e62b39d1769f560a00c69a9400afb", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101572, "uuid": "55a741cf-6aaa-4965-b4c4-692c4a838f76", "value": "T1B626B389F59302ACE7FAE336490581139DF1F4028A33BEE747724D350F2AE9715296E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101572, "uuid": "ff863137-8974-4a33-bbc7-a20c73c90a10", "value": "15298c58798d9012cc4f7f1d7c4ca9d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101572, "uuid": "c5f66a17-639f-4047-922b-1ff77d67685f", "value": "49152:dMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fZbszURH1eH:2d9AddBcryO3cICgI9JHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101572, "uuid": "1ed96f0e-c6c0-4151-9fd9-0bc190d52625", "value": 4835656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101572, "uuid": "1a99e5a9-0850-4568-b146-f4acc31ff6fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101572, "uuid": "17898985-8fb8-422c-9479-37874b527f43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e64cf5-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101331, "uuid": "dc261204-a9a2-4b11-a5df-f897ff6d7fa9", "comment": "Malware payload", "value": "37808e9a75f44e0457053a7406a695ce", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101331, "uuid": "535bf35f-fa6d-4b5a-9184-2c0b59de29a9", "comment": "Malware payload", "value": "e0edbad8e28c68d4f0337170dea099d044aa54eaffe614d6e5268eeda6efd116", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101331, "uuid": "9e1ab2ca-2750-438a-bd1e-f16d4bcf1431", "comment": "Malware payload", "value": "baa8c640008770a547dec3b5424f07d0fffd9dab", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101331, "uuid": "0e117138-59bb-4c39-8ce4-0b1435f93d93", "comment": "Malware payload", "value": "5b47f346307e56c554b0d46c8bd2c55f16bdb7ccc45eecb43fc92ab00e9ea951fe48b6131c99b31ab56da2cc364b1bbf", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101331, "uuid": "697da3e9-704a-4ef0-a1bc-538e75a59610", "value": "T199D3127B5DFA634B0107F0E9590928BF83B1C978888F5CE867D29FA63D194D0CA65289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101331, "uuid": "9a55c751-7555-467c-a399-94f0fc41dce0", "value": "3072:waaIeea0uRJaf42EuyQndb3ZXtwyFOyXRv:waaIvazJdQn13nJfBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101331, "uuid": "a431e076-0696-4314-bf14-9b4cc7eb6142", "value": 135071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101331, "uuid": "70b08570-1995-424d-b44a-be6c0e69bb09", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101331, "uuid": "d257d72e-9fe3-41de-98c3-2bcd420c57b3", "value": "DocsX343910949.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b20896-76a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783058045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058045, "uuid": "fbe3c59a-4488-483d-8b05-803c5d6b0d25", "comment": "Malware payload", "value": "8e0a6e9a5c1b719a9cdab4ea4ebad4db", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058045, "uuid": "470a1c75-8875-46c9-b73b-8b83b5fe0b01", "comment": "Malware payload", "value": "e1ad265d4eceff47440bdbf53f8424081661107b43c38b5e482358678b5b8b6d", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058045, "uuid": "38e0ed80-4dc2-40d6-8fe4-744548f47af4", "comment": "Malware payload", "value": "831a285706cf546e686fef727181342e939091ae", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058045, "uuid": "5b341ac0-452b-4455-81e5-59a10eb11dfc", "comment": "Malware payload", "value": "0d5e99378aa3324ce5a9edf1349a12382eaba587c2b336a29662ed22a7253b729505f7b5842654774a45389d2cd9b252", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058045, "uuid": "aa0351a2-993a-41ee-882a-f25316481fd4", "value": "T1E5E3F1013BA0C477D77307302D33817966A5BA6A2516C7AF27509BCA3D31A919E0F77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058045, "uuid": "4058296e-1a2e-4a78-8b70-30138e2f7643", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058045, "uuid": "83aabb17-3b69-4e4b-94a0-cd7d3e02ebc6", "value": "3072:MKDxaVzwmg4CSW8JSuuE7n0oGZSxfYIA2WICvy3WLlIgDED:M0Mm4CCx78Zmfz2vymL4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783058045, "uuid": "ba5c56ec-f045-4bd0-9a2a-643ca34bc1ba", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783058045, "uuid": "08dfe09a-38fa-4521-9ce0-95b003b89902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058045, "uuid": "d4a9db4c-bbab-4213-ad00-e138760f1f47", "value": "Nomina_01_07_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4e643e-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783100974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100974, "uuid": "559435a6-96e9-4adc-bd9d-f3d6fe86ef88", "comment": "Malware payload (Formbook)", "value": "b5e339fb32668aeca30563c07b4473d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100974, "uuid": "d0275c2d-25c0-46c1-92f5-46f544b1c9db", "comment": "Malware payload (Formbook)", "value": "e2340ace8e74203f9a0e9bb72ef73964d6adcc34ff6d3d0928613bd38770cc6a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100974, "uuid": "ded5cf14-290d-4eae-aae2-fc38e2d35650", "comment": "Malware payload (Formbook)", "value": "d29e121e07558f220c03e3c702c1b492d6796e99", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100974, "uuid": "da36dd1f-7970-490a-8900-932fdc6a0dee", "comment": "Malware payload (Formbook)", "value": "a6804b4d973c38eeddd8673ad3c35ee588b225dfa50dcdcbc5678efae86df5d498af0cabfb4f750b2ad30fa3def695b4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100974, "uuid": "dcb340d9-87aa-4d60-8f65-d0a5ec36ab0c", "value": "T1B55533AB93D7120D947D766806E9194C42C5B675C23E37E2DE75292FCA3430EC02BEAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100974, "uuid": "ae2637e4-52b2-4377-aed1-dbbc66a7c8e9", "value": "24576:iZ8phx9JS8a9h4AT8AFYTh1jSh0XcpM7mlHPaUt8qL7f:NpGrXT8A41j20hmp9tf7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783100974, "uuid": "eaa1858a-e062-41d6-bc6f-e11be47c2d4d", "value": 1351526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783100974, "uuid": "34dad8ec-3509-439f-b8f3-2d021b421e56", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100974, "uuid": "3731e12b-7069-40dc-a2f4-6b00223afdf7", "value": "TAM0018.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5532c966-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101739, "uuid": "14c9679c-a5ab-4931-9bba-412b2d36a5f7", "comment": "Malware payload", "value": "895f7c818281fb92d35b234cef4d8e9b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101739, "uuid": "928ec1b5-b51e-474f-8455-30ef223518de", "comment": "Malware payload", "value": "e2aca5cae53681794c344f75e8af4f097b450b5825584d857936d5788d8d2cfe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101739, "uuid": "946c5b9b-d088-4ab6-ad8f-c753143d8998", "comment": "Malware payload", "value": "b8817626ca97a228264c074b3bfb1c25ab374b22", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101739, "uuid": "ec176b28-6d7e-4ead-8d87-11a3f8b83b0e", "comment": "Malware payload", "value": "8571d19fb055251e79912439b7fb1d3f49e46b5dfa6ff480452a158a32022354679fa01cb27ccaf96bd9371031477554", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101739, "uuid": "59beebf8-5a68-4623-b391-7e942f7b0e3d", "value": "T10FE5275303851BBDF68D0EC9C94B255B20F2D46B7D251298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101739, "uuid": "3bf75bf9-ea5b-40eb-8cac-a89429bd64b7", "value": "1536:qrQBWdwaazg/hh6yhKDCzm+BKS2vVIPkxySft8jnRRX6wp6CbEBujjhhOfA5V5x/:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101739, "uuid": "335a744b-3a12-4f15-91d5-ef0014ecc405", "value": 3189073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101739, "uuid": "805c1d60-de43-4f78-9833-7c7fea2fc084", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101739, "uuid": "21820d9a-ee4d-4e8a-a3ba-a7ccb1c85529", "value": "Remittance_copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec0e272-76b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783064577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064577, "uuid": "c514ddb3-e4e3-488a-a3e8-2bad2390077a", "comment": "Malware payload (NetSupport)", "value": "e957ec1193fad2f19873f1b65bae3445", "object_relation": "md5", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064577, "uuid": "c58a14ff-9804-485c-989b-9a24ccedbe0d", "comment": "Malware payload (NetSupport)", "value": "e30b63d095dbedefa31e6a99b25433d245fa11c9292c13439b9f410e1f9362e8", "object_relation": "sha256", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064577, "uuid": "2cdc5e5b-13ce-4fcb-aba8-39673d608702", "comment": "Malware payload (NetSupport)", "value": "6b68c72d9bffb99d26d0cc4eefb700f41d305e74", "object_relation": "sha1", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783064577, "uuid": "f284938f-b4b3-48cf-aaa6-822655cddcd1", "comment": "Malware payload (NetSupport)", "value": "3ee17d0f9f75c0695978a9608499ddd2769056468b2e35d66af4600bd2858c51f52570ba56757d8e814364bdd21a21fe", "object_relation": "sha3-384", "Tag": [ { "name": "104-21-49-68", "colour": "#777771", "exportable": true, "hide_tag": false }, { "name": "172-67-159-238", "colour": "#328D0C", "exportable": true, "hide_tag": false }, { "name": "91-92-34-113", "colour": "#ADE345", "exportable": true, "hide_tag": false }, { "name": "jameeeswt-com", "colour": "#9D0039", "exportable": true, "hide_tag": false }, { "name": "lkboasprqw-com", "colour": "#1C34F7", "exportable": true, "hide_tag": false }, { "name": "lkhpihf-com", "colour": "#C1C187", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064577, "uuid": "0ef45162-4e66-4c2f-81c1-e23943192b65", "value": "T19CA533487187CAA3E081233DE146BB6C0A71DD046B654A2A520B70DF67B5C8FBB31F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064577, "uuid": "9fbb35fb-208d-451e-a47d-d2d2c8fc3b9e", "value": "49152:f3sY0+HKN06XAlXaBquNzf8HF4U9svhjwbuE7Niv5CXp/s9n:f3sYfKDdZNzkHiUi5jwKE7NcsXpkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783064577, "uuid": "2cb3f637-28bf-4234-9da8-c2b401181365", "value": 2260992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783064577, "uuid": "58f39370-6020-4408-9353-27ac8a0cffa6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783064577, "uuid": "e8d084c5-f997-4d83-9a1c-3fd1d4c3c015", "value": "installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2f584b-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101024, "uuid": "40d48420-507d-4058-a676-4a24b26879ae", "comment": "Malware payload (Formbook)", "value": "de5e788d6dce9e9eada4cc7c87983bd4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101024, "uuid": "9a4d0844-b50d-40e1-87bb-e34f3e047e23", "comment": "Malware payload (Formbook)", "value": "e314484b3b7f5767bed58b5a6f1ecb51f8ad00825c824ec5c7f0150da05360cd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101024, "uuid": "399f8932-1b06-4cbe-8212-82eed2a84138", "comment": "Malware payload (Formbook)", "value": "691b7282ee8f827038711be97e8242fbf721efae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101024, "uuid": "c37beddd-4c3f-404d-9223-be8b275456f8", "comment": "Malware payload (Formbook)", "value": "5141d78609b7fbb1e48e45c1407a2e8c80a357466bf5220a0c1a37eb6b93e326ac63ebfea13ffaf05f91ed7db3208a54", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101024, "uuid": "9b0aa51d-f796-4f3f-8a8d-c989d4970988", "value": "T1872533A4D02F13956F0A96F09440139FBA727AF018B94DD97C38182D7A8DAA5187FFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101024, "uuid": "51f8096e-d6e6-458c-8915-f851cba19106", "value": "24576:h/oiglgo0s2FVK+7gYsZMUNlXykWUfvIBDRZWlMu5:hQiMgo92eQLsZMUNhyjUXI/ZeB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101024, "uuid": "3d4acc93-7400-491e-87fa-725968085b50", "value": 1000165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101024, "uuid": "644c47e0-4f8d-4f5c-ab63-2eb869fdf711", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101024, "uuid": "c085ac11-760c-4e8e-97e3-d08ade2624ae", "value": "ShipmentXNotificationXdocX2348703711.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ef51ce-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomGate)", "timestamp": 1783101579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101579, "uuid": "7ff45171-daf3-4de8-8120-fdb402d48d48", "comment": "Malware payload (PhantomGate)", "value": "872832a61ba05666de094242621d08e0", "object_relation": "md5", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101579, "uuid": "1af41f6b-bd6b-478c-b044-61c753577d0d", "comment": "Malware payload (PhantomGate)", "value": "e53064990eefdbadf9be49d7bc5a5f46dd60852e342010d9b13d602b27f1752d", "object_relation": "sha256", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101579, "uuid": "b57d21e5-31a7-4199-a97a-1282aa585daf", "comment": "Malware payload (PhantomGate)", "value": "6e40494b85207b41696f5d49f74599cc666c823b", "object_relation": "sha1", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101579, "uuid": "eff2f42c-eccf-4aa0-9054-1a1c51aae276", "comment": "Malware payload (PhantomGate)", "value": "9ea116beba71e7242149e5cfb5486aab46ff379ecf99513cad9e71d0a104ed6e4c0e2196e0dc81d96a7d65e57204ba57", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomGate", "colour": "#EC7047", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101579, "uuid": "e2cc85f0-3e75-47b9-8b6e-23d25324f292", "value": "T1B612BF3BDF331D428A6ACCA68FF9AC560B30B868CD5C1BDA440A711179B9C4F40D14E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101579, "uuid": "0c313e77-ba89-4ae8-8cd9-596be184b2ab", "value": "192:Oekg3F8p4ikqwnUTLua3Wn/ZdsnseZWvI7QmMYwmDQ8j8eDVnmaXQWBRlhdr:33FQ4Fqwn4P3qdsseZwI83YwmxjpD0Mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101579, "uuid": "500ebe07-7f5d-4e32-b2b1-b38543624030", "value": 9170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101579, "uuid": "767d1be2-b291-4566-b882-330e5123c790", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101579, "uuid": "118593c4-6dd0-4975-b517-24908603093e", "value": "Doc_Ref0000003_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edff008c-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101136, "uuid": "cceea24d-6aeb-448b-894b-a6c4b3987eb2", "comment": "Malware payload (AgentTesla)", "value": "15003af09f14fad3f595ac8de305c501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101136, "uuid": "c3dd0f73-2f74-435b-a134-02fbe68e178c", "comment": "Malware payload (AgentTesla)", "value": "e5b81fb1398dfa674f787ac54a6f9609c18690de81332a3f8ccfaac8a313d5ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101136, "uuid": "0d163561-9b24-42e2-bea9-1e3b1b9d73a3", "comment": "Malware payload (AgentTesla)", "value": "d382bcec6d73da394cbc7cb5fe778d0a98f2cda3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101136, "uuid": "70dd0665-61a5-4a32-9f68-1d562cccaa37", "comment": "Malware payload (AgentTesla)", "value": "a788801d69b1887543f7ea841b567d021be4b528743501bb2b6dc738ccdb316633c02b26f3d6940f67836012d7c0c640", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101136, "uuid": "689e9f03-f298-43dd-96e5-ec402e7f99c0", "value": "T1B3A423E8137507CDA18017B15B811B2DC6EBE922BD62541CDAA7C04D63A2FCE6B61FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101136, "uuid": "c1211ccc-7747-42eb-9d9e-90ef854f739d", "value": "6144:EbLWg7RHxVXSR/12Dh4/SlhEZxMrTjYHkeivH/Pu9+pDEj9nkjAQTgZZVszuj43J:cn4EDh0SAh6H/2c+nibTgZ7jBg1sj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101136, "uuid": "26e799d2-e295-40ae-99e4-0dd85c458514", "value": 452878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101136, "uuid": "f42fdfb5-de2f-4cde-9377-5266899ea60b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101136, "uuid": "6112981f-1b88-4b3b-8c69-8539af380a74", "value": "BIK1910486_20260616.tar.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1c82cf-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783101266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101266, "uuid": "cb06bb77-88d1-4f3a-9aec-4fe03d1dcbfd", "comment": "Malware payload (RemcosRAT)", "value": "3e344a746bd85356e818872c40cc2407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101266, "uuid": "a5f6db9e-ec02-4ae9-9a60-20206baf33a6", "comment": "Malware payload (RemcosRAT)", "value": "e6b15512909dad441e5da10f301d6369f333a5b51ad94f3504e9e6ef12dade3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101266, "uuid": "1c913284-3bac-4890-a563-111b823a639a", "comment": "Malware payload (RemcosRAT)", "value": "d64b237b02880d09515312c7d52769a6d2c8d813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101266, "uuid": "eff97591-99a2-4f95-ad28-10a0bc08571b", "comment": "Malware payload (RemcosRAT)", "value": "b28b952223205e3d67ad277e04032fd798ba0f2f0a116065dcc2ee91426540944c607ed1e3a8b2a2678993ab69959dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101266, "uuid": "0b9b3ad8-4f74-4a77-bbc2-060a0a6a52dd", "value": "T1AA5512982764C70BDA6113F82631F23517BD3DAA7922E6165FD0BEEF396AF800904353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101266, "uuid": "cd1d6307-1fd3-4d7c-b7df-e511d10d9836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101266, "uuid": "0984aff9-185f-4299-81ec-86bcf5d7ba34", "value": "24576:TiUsGq9nwoA45YY6KnCYyjtm4lAL00bcmhReIjDCHJ2:TUG6nZAT/KnCYyjtmk0bcmzBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101266, "uuid": "84859eab-47b6-42e3-bd77-20a3d2f45db7", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101266, "uuid": "c4f5d2c2-dc3c-48f2-be3c-39b2474dd940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101266, "uuid": "7e9b0433-59d1-43cc-962a-13819c23bb85", "value": "Swift_Copy_41,5332_HIKf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c286317e-76a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783060261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060261, "uuid": "bd553a05-f111-46fe-abaf-4bde4c2c9e64", "comment": "Malware payload", "value": "7ab91b3df034306115190e35966ea72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060261, "uuid": "95591cac-afc4-46a4-9668-60837da55126", "comment": "Malware payload", "value": "e7102c2d19f1eade3aabc2e820bba7104ea2f59d6fe91bc5dc2efcd7e835a38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060261, "uuid": "ea688586-2469-4c0e-9784-617e4fa3a489", "comment": "Malware payload", "value": "d8c19fe3c0e2f529680cb72447d7120809ad9855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060261, "uuid": "6487fe4e-7d23-4224-8043-f13e69def1a4", "comment": "Malware payload", "value": "91580fb18468ad181859ab8fd474d80bf63184d6397814a507da016ab7d506f380eb0dfbbbb79581c836b2e39cbabad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060261, "uuid": "db6f0cf1-a9ae-4595-9bd3-8b1e50751187", "value": "T1FC0833131D1AE72BFD17A8710F52E6529B43C3360679881B113D0AD2BDE3B9D68BC663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060261, "uuid": "4a5dc916-4e81-4e35-bed7-77e60e9970dd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060261, "uuid": "9484f52c-18a9-4851-b436-d6ee920724c4", "value": "1572864:wt9IKP5GjKxGYFlGmWlwPDOuUJ5UsyuRuGDzp67d0o+Wl7:wUKRG+cYull+q/FyuT6hzXl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060261, "uuid": "c12cd22d-fe09-43cf-b64a-e8908e570412", "value": 77435966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060261, "uuid": "3c8645f3-eb5d-4f87-a708-48da177c9aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060261, "uuid": "0df2ffc6-11f0-49c4-aee4-6330160b05b3", "value": "butt in the toilet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dfb48f-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101013, "uuid": "9ca954b6-6a8b-4ebe-9464-fe9ff61c43e8", "comment": "Malware payload (AgentTesla)", "value": "20263f1d70853707c191d2b53582334a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101013, "uuid": "5c86f5df-370e-4506-b53e-7ad15980c321", "comment": "Malware payload (AgentTesla)", "value": "e748047da112f7ac0ff84f1adbad5d4a83dfd857a852a7b626a5a41e54a85325", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101013, "uuid": "38814110-6bb4-4276-965f-b4d911bf756f", "comment": "Malware payload (AgentTesla)", "value": "d81bbb392c412d9b0e387196c6e299204809dff0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101013, "uuid": "65c4d994-8a88-400f-840a-3fe615382fb1", "comment": "Malware payload (AgentTesla)", "value": "29051dec884838c49c446447a7801fc5723786eabfe1f395dc29fc9767d7eade95106bdb47a5a1f370e7740052bb474a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101013, "uuid": "d5070166-b82f-40e2-b3ca-6955d0028a60", "value": "T1F845330C075CB1EAD6D8FD0EBA045F9FD6806C35E43240B2275196EFEAE11885DABBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101013, "uuid": "b8795616-a982-4f3b-a584-f01a6b5144d9", "value": "24576:5yWfXoTuGymOQVxi23IGYPHTtyIWKqWlmYZrdiXvrjk3wDgurvd358vGb:3oTwxH23EfTMcqWlm+wXvvk7uzdJ8ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101013, "uuid": "eea22e1c-aebd-41dc-a195-05c5b7514240", "value": 1215249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101013, "uuid": "e60e5729-6cd3-4800-9335-4ae4075aef2b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101013, "uuid": "ad758e07-fb08-480d-b36b-10d667a8a228", "value": "HPSXmotorXcoupling.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc8aa0e-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783100978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100978, "uuid": "8595b62d-e2d2-41d7-9a3b-36399c088c61", "comment": "Malware payload", "value": "51c09790b67094d05dca9117ce0eb8e1", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100978, "uuid": "2f502c7f-57ef-4b57-b856-4af9243c1287", "comment": "Malware payload", "value": "e751c165241e89127b19c1bbc409d83352e74f1efc3bd0c81ae36f0543d4dc2d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100978, "uuid": "8079d0e7-0821-4153-a6c0-8a6da0ce8830", "comment": "Malware payload", "value": "ef0f89bf0a6fcef7d8f73fd3ab23adec4db30955", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783100978, "uuid": "5cfe8b33-2f17-420f-b8df-bad4ae3b2a35", "comment": "Malware payload", "value": "a298d240d3ff668eb1a6b3a93851aa7fe9c1bf6a2024d300647eeab22296c31ef83ab1df6804c12a8ac6c3fee49c4b57", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100978, "uuid": "82a35acd-2afe-4e25-a923-c6e7c8a725d9", "value": "T1F573E02A32E8C409D592C6769CDCD2D75B68FC179F03A34739C4775E1CB22E0A64372A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100978, "uuid": "d33d50b2-b024-4e51-8c10-5750e39883ec", "value": "1536:3OAACUrZtsY9RNIdr7mv0ALLTJZzuTnTc9ZjE7j:3OAAJrZtsY/N63AfT3uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783100978, "uuid": "57bb8a21-61ce-42e6-ae76-4cc7af85dd5a", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783100978, "uuid": "171507ca-5e89-41b8-b426-83c0b9f3d38d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783100978, "uuid": "1a3f184f-8056-4155-b6a1-0d0d1bd31726", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ab4746f-76af-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783063120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063120, "uuid": "88d5feac-0688-4619-a7e7-c7c8805bd47c", "comment": "Malware payload", "value": "1bdf5fc366989ee9b9254997d5231faf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063120, "uuid": "64742896-1882-4646-839c-e52a81200e1c", "comment": "Malware payload", "value": "e87607d26bcc81840eaec5046b8ce7b457ce2a7802e3a8a9cf7ba657e913ffdb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063120, "uuid": "7125066b-0093-483b-a51f-b1147adad4b0", "comment": "Malware payload", "value": "6e4965681c262f7c5a1aba7297e1ef0068b01eea", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063120, "uuid": "5759cacd-4e2c-439b-a5e0-a99c368df994", "comment": "Malware payload", "value": "af833fec7067e67fe20e8abe9ef423dd6fb173e3163ed351196b08c9a62c8047db59f36bda39e6f4c04d83f8c25626ab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063120, "uuid": "4e400d70-7f7b-455f-bce7-edba094354c5", "value": "T195236C6516857C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C4AA9CE21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063120, "uuid": "d2fd7007-84bd-45e3-bda1-b4f8a001fee2", "value": "768:hr9NyXsZztCRI9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:ZHusZUVcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783063120, "uuid": "e25e0cf5-4f05-4817-8c2f-baf660a88beb", "value": 48364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783063120, "uuid": "5e032def-ae95-4244-a647-961bbf5320ed", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063120, "uuid": "d20a4cd5-53d0-4230-984f-8571843ab449", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9411d95-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101585, "uuid": "3c5d0a2d-31fb-4828-b0dd-35ef857d796b", "comment": "Malware payload", "value": "0566c645fd213ac70bf9272e52cd70ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101585, "uuid": "539928a9-a047-45d4-9f9b-36b6386b71af", "comment": "Malware payload", "value": "eb688064e919d33fb3a2bf8b5f40502f5a27d82061498bc9ab34bee6577eeed5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101585, "uuid": "8d46d587-806e-410a-85af-34b23c86da39", "comment": "Malware payload", "value": "3917716c9e89ccf0e03f6d62f3b8faae69e718bf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101585, "uuid": "496ab9e3-b86b-4613-80f2-3a3d22b7adc0", "comment": "Malware payload", "value": "018886d541188db9bbb2989980c8cb63afd8e939e1c94f7b06cb30b74dc050c0814d1a42c51c84e8a6b8594ececf4eaa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101585, "uuid": "a0a1a567-c1b0-49cd-a119-3c5358c8ab0f", "value": "T123E2F2A430F1FA658FA96773CFA88B2AEC9D9A46A1041EFB81627F4FD71381441C3075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101585, "uuid": "19317bf2-709a-4295-8b30-06c972b833b4", "value": "768:Qn7/thNE/tNHM20WgjkZKdsTuK2OChep4cJpvTVxk6cg8U6:Qn7/thes2rdKds6hCLVC6z8U6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101585, "uuid": "e6461d29-15ce-449a-99e4-eaf9064091f1", "value": 31727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101585, "uuid": "c86f7ea5-8930-4175-97f1-32ca20c90b20", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101585, "uuid": "87f0db00-7921-4900-bc91-71ccb324e2db", "value": "usdX36,000.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238fcdd3-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101226, "uuid": "dbcb582e-5605-43d3-a5ae-1892d5e649b9", "comment": "Malware payload", "value": "bd2d2f531d51d675771b3ed5eab0924c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101226, "uuid": "97aa4442-1fb2-47cb-8036-5eae7afcffee", "comment": "Malware payload", "value": "eb77ab5568d6decc6df35d5ed7b523972900cecc33d5c9e3ebc68e2c106ea596", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101226, "uuid": "24cd4d81-9423-4066-95fe-024f8f7a2d48", "comment": "Malware payload", "value": "d87e76b079e7557626b1b495157a72305e17d046", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101226, "uuid": "12226d80-6725-4b6d-9123-2e362db63b43", "comment": "Malware payload", "value": "122b48a2b37599678aff3eb264080f29b7c3c5b89e7254dd9e14f21ad9956163507e629bc42815f9689f6085225e4e7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101226, "uuid": "bd1de9b5-b74c-443c-86a3-4f9a447996ad", "value": "T16AF4F73CCC18422EF573D51A889A094FF892059B623CE94760D77B5BBE62842B7DB35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101226, "uuid": "3df7e4a6-a86f-411d-878d-ac441262513e", "value": "3072:dm6G3ajfp3Kr/t9/ufgL1+RWpjogjt2wCEUKAx0fC5TG+LRQD1L3lZtZVO6keUIo:YaQ9KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101226, "uuid": "bf69e9af-a5dc-4b04-aca5-073eae050e57", "value": 790710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101226, "uuid": "a68614af-9ea0-4554-a03b-d4b5c873af06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101226, "uuid": "045414f2-9c2d-4329-9a1c-83acb92deb3d", "value": "RFQ_For_Payment_Invoice__VER12000263330-800139_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cee7fba-7674-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783037757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037757, "uuid": "91192244-85d0-4a49-ad7a-f9c28a0ba2b8", "comment": "Malware payload (Mirai)", "value": "61c6dde79072e991be818c547f73cdb3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037757, "uuid": "58e33b05-0ee6-486c-9aab-663b05aa3bdc", "comment": "Malware payload (Mirai)", "value": "ecafb11a4c92905e8e00f586411412d8c17b3f7ed1175c07ee2464a1d88521e7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037757, "uuid": "5ae54b01-6c6b-477c-92be-014a712d8781", "comment": "Malware payload (Mirai)", "value": "9f1d912cf943d06fc932644026db88ec1f73c8f0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783037757, "uuid": "4645f1d1-755f-421d-b398-90e9fc02958d", "comment": "Malware payload (Mirai)", "value": "5eb8d7895436caa103c82764289e68d655921ad3dee3f358abf8f2f1b46e7dad13feb16b90c00cf6071c8f6c27d093d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783037757, "uuid": "ecb51c79-8279-4cd8-863d-fe518c794034", "value": "T1FE1106CE029067398CE8CD6C706FD6049C74AAC430A54F5D9E9C98B3A7A7D70AD16F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783037757, "uuid": "5364275c-eccf-4cbe-a108-5aa3815e37e6", "value": "24:Em3zBgm3Tlm3xNIIYm3dKSrm3jT1m35uqafm3pl9Rm35em3Dqgm3z/1m3rFm3hz:EwBgUlGYqxrgT1cuqafA9ReeAqgU/1g2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783037757, "uuid": "0845808b-e759-4eda-a118-b63d2464aeef", "value": 1038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783037757, "uuid": "907b2171-5b0b-4436-b831-41ce20f709ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783037757, "uuid": "be4717c4-e2da-41e0-acdd-6f84f32927f8", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f104a5-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101545, "uuid": "b08f304c-57cd-48f6-9fd5-9d00c2639bb7", "comment": "Malware payload", "value": "8c95068489d609662e7271a991844284", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101545, "uuid": "373ddd18-0d1c-4736-8a9a-d951511689a4", "comment": "Malware payload", "value": "ecc6c34225e0b6b80b20de36ca4287e0053ba491e4b5c1dc0d21d3b80e7ed128", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101545, "uuid": "00585738-b921-4972-be10-2428279ba84d", "comment": "Malware payload", "value": "9cb9a7aaf3f14167bb5c5e36434abe87609b2101", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101545, "uuid": "66c63565-53db-4d95-b1be-76052d9c0d2d", "comment": "Malware payload", "value": "49c03172881c9bb5ca8cb528cd1cc6a14cb99fa9c9705aa38719455b128ebe03e1e383913728852cdad8e2479a1b7f37", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101545, "uuid": "0f054db3-8764-4218-a375-7409c2191d04", "value": "T12785DA75A781102EB663AB38518A59C6937EE5722BEBDF4E17761FCC0B13302A531339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101545, "uuid": "7b2314fd-aa05-4fcb-8a30-73d9ef07d67b", "value": "3072:Nz10sO34vDPnzxKN6dqsobvGz4sHiALXRuhme7vwsJ4PKvNo66LpLWMi7ZHlJJCw:2KPnlRGsrLOvvC66rG7Ajo/Y9vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101545, "uuid": "b2bf11b1-ca41-4f62-b564-10d33f60d4bf", "value": 1828988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101545, "uuid": "899d7ea4-9b5b-4a25-af43-96bcf4dc30d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101545, "uuid": "5ca97e13-02b5-4ffd-8cf7-c1b1cb14fff6", "value": "Purchase_Order_Quote_Confirmation_November02-2025_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f2f8c3-76f8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783094403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094403, "uuid": "57df9f8b-44c0-484c-891e-ed6fc6f40518", "comment": "Malware payload", "value": "a9c499afa0278279acd80597cbfc1e47", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094403, "uuid": "4ee6dd6b-8b43-41b0-896d-5748f1bb59d6", "comment": "Malware payload", "value": "ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094403, "uuid": "d9a7fe3c-3963-4972-8b34-2129d9f5c308", "comment": "Malware payload", "value": "5f7f11caf5992f370ed9657ff898b96fa4fe17ba", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783094403, "uuid": "aaee786c-2e3a-4c3f-bcc7-ff6011686237", "comment": "Malware payload", "value": "2fe5ee58a43e7f548c0ce8f0fca1f830c7ff464ca788dc4ad04b700c6e8735b359c0d32cf47e7bbbfc911e28b023d4fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094403, "uuid": "3bc036f9-8cb3-4516-be65-8e87d21f5c0a", "value": "T1F725F11B729911FAE0234174C9B75A05FBB2B4760774479F339C02A56F1B381AE3EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094403, "uuid": "67a1df6a-9218-4acb-93fd-4d808f3271a7", "value": "af54c0aa6bce674ac8337f5fdf42eb94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094403, "uuid": "46f725c2-c4a9-4eeb-82b2-52ea426a1801", "value": "24576:K+1mq2hh0vPWqKHeM5eJYdYsGN2U5JIxpZ5S:d328HjK+mMsG0Uc7rS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783094403, "uuid": "17499d99-601b-4fb8-866f-642b90d0370f", "value": 973785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783094403, "uuid": "0740cdb8-cb76-4b4b-a830-bdc884f7d56f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783094403, "uuid": "fedb8a69-f66c-4394-8d4b-385f17262233", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ede0b5-76ae-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783062928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062928, "uuid": "348fd59a-cef6-4474-8ac3-b37842e89b24", "comment": "Malware payload (PureLogsStealer)", "value": "dfcc75c15d845541948899841cbf0114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062928, "uuid": "6a143bed-8d74-4153-b545-c3948f7cd7a6", "comment": "Malware payload (PureLogsStealer)", "value": "ed3171b8abf77dcc65bb6801c784a3a5adf671332fa0ad38b81c5fd87005bcf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062928, "uuid": "4809194f-cb17-4722-b5fc-48291bb05437", "comment": "Malware payload (PureLogsStealer)", "value": "4996523f783856f5f964914c65401c3e6374c6f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062928, "uuid": "490069bc-f9e1-4d81-8368-55c646d689bc", "comment": "Malware payload (PureLogsStealer)", "value": "4c15c89a2ff310995f0d8d1f1250bdf1b9b7c3b5e2577f111d143553813d4775d117a66eea8015a2adfab71c5fdb94b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062928, "uuid": "aa79032b-3541-4250-aa2a-47baca600518", "value": "T12B655A55A6A441B8E0A29578CB5EC933E7727CC60F70968F02D47DA73F33250BA297D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062928, "uuid": "43dc28d3-91e6-4336-9d86-a07519a697df", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062928, "uuid": "c7d8babc-66e6-439d-8b4e-7f4c11edf38c", "value": "24576:JRSfrAEH9XIYpj0BEHBhR6ALSTlBIXPGfjuIb1iN1Eob4k:JgTbH94YxVBSTlBB21l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783062928, "uuid": "e0baf152-0f09-4fb8-81af-56c853626424", "value": 1547827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783062928, "uuid": "25e5bf85-bb3c-4849-afe2-4e2b776f5a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062928, "uuid": "3e71d00e-f4f3-4dff-813c-06715e9dc53f", "value": "Adryhyq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c8c09d-76e4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (VENON)", "timestamp": 1783085744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085744, "uuid": "35fa1611-491f-44ec-ac0d-626bd6563567", "comment": "Malware payload (VENON)", "value": "0214ece62b99fe55834a76ea2d928583", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085744, "uuid": "681d9337-8ce7-45ae-afff-3cc40878203b", "comment": "Malware payload (VENON)", "value": "ee0e3b3489ea0dd06f2af0b969e480c4fc6f2755cf4016dcba5d1299ac74f84e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085744, "uuid": "6e6c8c16-9273-496b-9cd8-4676155f190e", "comment": "Malware payload (VENON)", "value": "75d6c6cc7d453f0a8a8dcc1ec5baf72b00d9fa90", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783085744, "uuid": "06045546-70f2-47e8-9c65-31d90be46dba", "comment": "Malware payload (VENON)", "value": "eabc93e288bc8e6f0cd69c6e7ede7a1f1553b7b7e4f5817906a8b86537ccc18d8e125534d1795795856373aa71be28ef", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085744, "uuid": "05cd9adb-b635-4975-8956-fd095d285c2c", "value": "T1F4968E02AB9644E4C5AAC470CB4B8A637F2134DA07B5F7BF61C115962F79BF07A2C349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085744, "uuid": "7e452b99-1ba1-4d43-9106-f329e46cf9dd", "value": "b9fea94ba87169e0a211d5a2c73be8c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085744, "uuid": "6c4d6665-fcdc-49b5-85b0-20855d25f065", "value": "98304:BF/A4phP214EBvc6gk6Yurb85TkAhU84+hUFn6fdS/4n+j:jBpwLj6IHU84AA6FSm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783085744, "uuid": "1b416900-bdc8-4545-81bc-c06fd6a0672c", "value": 9226752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783085744, "uuid": "e4ee895e-1e1e-4cfb-976b-05f7d4bcc05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783085744, "uuid": "0492d8e1-d38a-4063-9204-dda94b087551", "value": "ee0e3b3489ea0dd06f2af0b969e480c4fc6f2755cf4016dcba5d1299ac74f84e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77e4ea0-767a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783040513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040513, "uuid": "8848d408-accd-4feb-8bab-8798d629b096", "comment": "Malware payload", "value": "2f40814165f01097278f12054eb681d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040513, "uuid": "bd694045-ad76-43f2-b152-94f1a2292b4b", "comment": "Malware payload", "value": "eea78ce9b7a3d5e50e60db3d08218f15fd281edb79c0c175b075761858fa06e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040513, "uuid": "7fe952be-0dff-44db-910f-246aaa77fc0d", "comment": "Malware payload", "value": "02b710f8be3a3b810023c5d634cb5c66358315a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040513, "uuid": "627efe0b-57a5-487a-86f5-344df1869f57", "comment": "Malware payload", "value": "e1e5ed8aa9b3101f4126e64fe0ede9ada11359955a12485e1187ac18d31688ef0684312e6ae56ef063fd5081629856b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040513, "uuid": "8b2f0cac-9c71-445c-aeda-f2e7a56e3300", "value": "T11137CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040513, "uuid": "569a4671-427f-462c-a25e-969f425205a6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783040513, "uuid": "7c752d16-52cd-4719-93f8-a3337ce4b9cc", "value": 23560192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783040513, "uuid": "9bc406f9-05b9-4ab3-99b8-7bad08f69c24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040513, "uuid": "36496354-14d0-4d23-9455-02b77fcdc4ed", "value": "eea78ce9b7a3d5e50e60db3d08218f15fd281edb79c0c175b075761858fa06e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5805dbfb-76af-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783063089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063089, "uuid": "ad8b3c22-d555-4167-80f5-03ef4ba1af99", "comment": "Malware payload", "value": "07260334f87ea73da4bc6bf3e7703e78", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063089, "uuid": "802718f8-1348-4fd1-9e1d-c32f7a8b8ac0", "comment": "Malware payload", "value": "ef6efaa86cc34c9d4d390575c42179b5f680daa0945ac850d62fa8fdbbeaa97c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063089, "uuid": "d95028a6-e276-4f64-80ba-a8d24fe652f9", "comment": "Malware payload", "value": "9e8069045db096604dc35cf551ae8b8683f75377", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783063089, "uuid": "a410082e-c582-4dea-8283-3f03d4a3a629", "comment": "Malware payload", "value": "f030756f938fb47a7a8da56f253a56256c791bbc438c08f033c4a8f151845627507e03cdb336604f90380f3ab8cea086", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063089, "uuid": "8ea7411f-6a01-4132-967b-7303c7327adc", "value": "T180727F948918C0D0A67A7D6314B371D8F99F4B725F601918BF8F8D0C9F2AB27C0E5B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063089, "uuid": "148554ba-c08b-4724-8d71-f519ebaf2a66", "value": "192:l7e7CN+b/HQW654TJh2089jtFkfuqhW2m23+vPd+QtTVFBBIAfpQq/F///fWEU7F:l7e78II/0MzqhW2MvPxtTVDBIAQXcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783063089, "uuid": "13aa902e-5c5c-4346-ba1e-e1571d174a0b", "value": 16362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783063089, "uuid": "72541052-76e2-4ebb-94a0-93a9a7f35d83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783063089, "uuid": "eda1c22b-de12-4bfe-a3d0-0992ad9565b1", "value": "ZIP_Deploy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117a04ff-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101625, "uuid": "72d18a0d-797e-4dcd-af2d-63c3dc3d7b4b", "comment": "Malware payload (Formbook)", "value": "9621cedc2e4e90a5e990612873c89878", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101625, "uuid": "a947e55a-481d-4a05-b25e-8590eb614809", "comment": "Malware payload (Formbook)", "value": "effae3acf9a49462ddead02a7d382a899367af22271cc9b7564c7be0e3a75505", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101625, "uuid": "4aa05951-a327-4ed6-ba68-bd42a3108c34", "comment": "Malware payload (Formbook)", "value": "dc10463d07c74211fc845d05f47d8e18300a7bcc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101625, "uuid": "3166b581-ead2-428c-bf2f-60970b620845", "comment": "Malware payload (Formbook)", "value": "5916bb1807a1f13fc23bb8ca3f25c5297923126c3256530a82cbc2823a39e3f3f7f67018307d7fa0be0195dbbee770e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101625, "uuid": "18dd82b3-3e50-4ed2-815e-992416b550eb", "value": "T1092533800B9589DD33354986FBC8EDF8D39113357EE769E8728B42211E4B9E79BCC612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101625, "uuid": "98afda89-bd90-4351-a8dc-1900d640b6cc", "value": "24576:aPBW/+gBF3llUlA/Mns8NhhZqgWsAfaYOlorjtD9E7JpDmR2:aPBW2gBF3XUfzHh0R97OlorjLEv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101625, "uuid": "7346d229-7e62-4fc3-84ba-d74dc87e3e19", "value": 969100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101625, "uuid": "96c2c792-e8bd-4147-a826-35c356f0ea2d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101625, "uuid": "1b3ee28f-8916-42c3-85e4-91fa3d5c4690", "value": "TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.tgz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed481e2-76ad-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783062402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062402, "uuid": "fbb1727a-14b9-4568-b634-ef849a2ce741", "comment": "Malware payload (Mirai)", "value": "ec4748d6652afbd1ea416511a02950a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062402, "uuid": "58563dd4-481f-4a08-848a-7807190c3bd4", "comment": "Malware payload (Mirai)", "value": "f0163235356db1417f35409ec428f89392940c08bab8947acf9ccf1372f71946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062402, "uuid": "7d056fa9-c204-4a33-8aa4-4ac60f8b28d9", "comment": "Malware payload (Mirai)", "value": "d9047ce89bb17e38a92ed3619eee15a352e7ebb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783062402, "uuid": "1e02a6cb-4401-45fc-81a9-118db5bf0663", "comment": "Malware payload (Mirai)", "value": "a2cadd503af8669c9c62629fb2ea2a609e696f12abca716facb839db5a4face09f4e1daa09ac55dd0685cd44e5b0d67f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062402, "uuid": "a75b3c18-bbbf-4704-9d55-55b075319428", "value": "T123242A12BC409F21C9D112BAFA1E5389372717FCD3DF72129F156B207A878AB1E3A645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062402, "uuid": "39705e5a-5685-46a0-ad33-6e585b1a62ea", "value": "6144:kkKJn4zSAk8ZqBM7XJt4SaF/ZKFWc+f0rUlsCdH:kkKJO2e7XESaFBK4c+VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783062402, "uuid": "c5880db1-de0d-4cfc-881f-e1784733c5c7", "value": 211580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783062402, "uuid": "cf23842f-37be-4523-b740-80a56419899c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783062402, "uuid": "af0cb709-821f-494c-96ae-0d8ca8c69568", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632429f2-76aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783060960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060960, "uuid": "5a99b1c3-6e50-4b1d-934c-238830c40dc6", "comment": "Malware payload (Mirai)", "value": "87306f5c1380a6b6e277e25befcd5f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060960, "uuid": "c0507892-06e5-487e-98fc-b4b2f264d146", "comment": "Malware payload (Mirai)", "value": "f017efe36ccdbfee1fc834eb6cdbe02890edc845a2245a334a2ecaea825c6547", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060960, "uuid": "365d6026-2938-4439-ba16-344c46384e52", "comment": "Malware payload (Mirai)", "value": "0bfd5b31afc8b169d73420cf35ebc76087bdece4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783060960, "uuid": "d26233fc-3562-49ad-ad33-9d6802c27843", "comment": "Malware payload (Mirai)", "value": "aebd45693f35a28ee1f167f5a0c530eceb9fcebc3f27b585ece730b1b384c5993c7e79531b1f89cfa31590be68eb0dac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060960, "uuid": "5aa96eb6-23f9-476a-8e27-8468dc406c13", "value": "T12A140A11BC515B22C9D752BBFB5E438D372A13E8D3EB7202CE266F6036874972D3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060960, "uuid": "3d819205-3225-4a8a-b78e-07baae40e2bb", "value": "3072:Nn3FLqH6bpIPpZN5VudL4Ig6eIBc7BEmYaXckMqysujU+:NnNCPpvwL4IDeIBcCmYaXUlsug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783060960, "uuid": "6b9e415b-dc12-4aac-ad55-1c8ed0c03e2c", "value": 193312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783060960, "uuid": "ded4634b-02f6-4e11-a030-6bc00590056c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783060960, "uuid": "3ed039e6-b090-4fe9-b478-a5a1fb979f09", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a49a35c-7719-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783108539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108539, "uuid": "e13b192d-ab92-4096-96df-8f1b85bee468", "comment": "Malware payload", "value": "ca4f03ee4e5ef52ce86389ff0dca073f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108539, "uuid": "f06359e7-a567-4792-9fb3-80e44584db72", "comment": "Malware payload", "value": "f0afa9d9fb7f33961413b4827fe2a41c0cf54b7aebe0acc89c097e655b4762d7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108539, "uuid": "74e913a8-cce4-4327-9e02-a5091790ff2f", "comment": "Malware payload", "value": "bedbbbeb9a24bd71d763cab65c88d610978a1f15", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108539, "uuid": "4b438dd8-371b-4e95-82e4-4416a7c6d452", "comment": "Malware payload", "value": "4d62937caf1da0dbc225075835c9b5e89a42b3a2ef52bd9f3a898f40cf81ae5b746e2449bea613c3b99bfd5453b061cc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108539, "uuid": "085d703f-c172-4e32-943e-ebb092ab347c", "value": "T116B6F1075D6891F9D268713288E7E081B575B80A5B3227D32E04A77C3E76FD2DC38B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108539, "uuid": "fce6b44f-fbf1-4126-999a-80e3eb67f0f1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108539, "uuid": "2e89cd77-925b-485c-abea-942fb3c6bbe4", "value": "196608:DkmYDpd4iUk7ObgE4J0WQd5TkJTAcKJnc8y1WgRAWrxS:DkmypGHTG0WQXdcKm8kLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783108539, "uuid": "bee2da70-05c2-4c47-887d-8934d7a9ca5b", "value": 10650464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783108539, "uuid": "28f088a1-2c3e-438f-9056-31a31f3206a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108539, "uuid": "ecb1749d-77e5-46aa-8217-e4785ee06b57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b996a0f-76a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783058048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058048, "uuid": "81de9d37-8db1-43fa-b86f-979c71029eab", "comment": "Malware payload", "value": "d7f8be65f55b52a7c2715e73427f503a", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058048, "uuid": "9b1e916a-669d-4058-ad29-f579030402ff", "comment": "Malware payload", "value": "f12551c00b42be18bb6ffc4d046a4a87bde645cb4c457673659c8e1c879110c0", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058048, "uuid": "1ee37fb2-2b10-4be7-9855-7db8dc9e5111", "comment": "Malware payload", "value": "34ef7583212201de03136d6e83b48e6f736e52b3", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783058048, "uuid": "1a23adfb-1825-4806-a0b5-69c7ab17c711", "comment": "Malware payload", "value": "9837e8adfc1b583dcb09928a7d6f6cdb9f1c3862b3fcb59c08dd9c437d798795eebc75e34d50cb3474e12f88bf1d3c82", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058048, "uuid": "bbbde10d-bb79-4bf6-af65-59d3dcc7fc34", "value": "T1F5941A6736564F20D1880333C1EB014187F9AA8776B3F70F768513AA1D533FEEA4A696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058048, "uuid": "d6cb4df9-3cd1-41b8-9067-6041895ec9e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058048, "uuid": "b053727d-8910-482e-8b17-4065d61e46fc", "value": "6144:b+dRbwuFcTQbXBw4GcRAniXhCtyChkoIRHxzAreSNubQ:bwOMBw4GcWniuvb6xcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783058048, "uuid": "6d15ebd0-bfce-40f2-a0ba-fc2cf4b2c61e", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783058048, "uuid": "dca5091e-9336-4c6e-bdfc-8e30bf5e1c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783058048, "uuid": "5cea3adc-dcec-480a-bc03-b380dced8fe2", "value": "f12551c00b42be18bb6ffc4d046a4a87bde645cb4c457673659c8e1c879110c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da01467-7719-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783108625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108625, "uuid": "11162fd5-920a-49e3-8dcb-0f98cb113030", "comment": "Malware payload", "value": "e1d9a9df9eb2e1a7de84d8e8ac3e7b33", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108625, "uuid": "6a9941c5-aa40-49e2-ba5b-005e14aa1dac", "comment": "Malware payload", "value": "f17876b82951bc093975ee015c959f34cbbd32ef0e3e76a047b0f07eecae4916", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108625, "uuid": "46c3b9ed-e2e6-4341-944a-922035096e6b", "comment": "Malware payload", "value": "ef55c84e8a5ad330da73034aca36f652aab88dab", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783108625, "uuid": "a7a6d922-76dc-4d83-ba38-2ce6416b59c5", "comment": "Malware payload", "value": "fb03b35c588b974e71b455ac93a90c0b74794c8eba6f5a0a27d3a662d0c9f9a630e2930b2834da2cf0f97347ee7dbea8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108625, "uuid": "e8538ba7-0bca-4134-bbba-7ebaf6212053", "value": "T17F25F15736A012E7D233A37CC6561609EBB7B86657504BAF325C47B91F233C09E7AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108625, "uuid": "70d2d0a4-5eb5-43ad-b88a-5d8c61e454bd", "value": "13f79e8b30893cd8b53f6528763b9ff4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108625, "uuid": "96f9ac0f-2e30-4c6f-afbe-f926361ee8ca", "value": "12288:FcyLRwncSL2hhi36gnkjtCqbjR6oJYkCuINN6bfr9wtynFrmhFP87pLMZ2ylOniV:dVE2hh0qsQjRReIeup2yFc81LMllOn5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783108625, "uuid": "9f2f83f1-f29b-44ee-8409-d6ca2bf389e2", "value": 974763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783108625, "uuid": "2f751523-c09e-4ee9-bdd0-5fc2ca4ea0b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783108625, "uuid": "8df63d44-1e49-43ca-a8aa-0136873039de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6587ef0d-76ef-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783090599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783090599, "uuid": "1f6ac753-2b96-4784-b51c-d45110b8b05c", "comment": "Malware payload", "value": "89e0d503ed87061d78e700877c02a59b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783090599, "uuid": "48bc853c-41e6-47b9-b0cf-8e02d3bb7c6b", "comment": "Malware payload", "value": "f22a00d85ef32ea57af7e9a08f08dbc0c4b3a927e3d823945b619864c1b6e58c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783090599, "uuid": "136bc3fa-7715-4a97-a7be-c6839490d6a7", "comment": "Malware payload", "value": "eb4c1877ee343de24b4c2649976467028393a49d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783090599, "uuid": "3d8209b7-6be6-44be-89fd-01928517cb7b", "comment": "Malware payload", "value": "b2a97fa05feba14cc8db404fa140aa065795ff4382e3604881393fa1afc1faa2dbc95f233c37ba56d2960da861e6e051", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783090599, "uuid": "2da0f91c-bfb9-49a5-ae2f-adfa5698687b", "value": "T19217BD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783090599, "uuid": "9be29683-01c5-4317-a063-6cd15b9cf4e1", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783090599, "uuid": "f313ccd0-7596-4642-a372-8de35667e307", "value": 18546688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783090599, "uuid": "22cd73bc-91aa-4bc4-ab21-4d7a24f1229a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783090599, "uuid": "6079e7c8-bb26-4da7-932c-cad449cb637d", "value": "f22a00d85ef32ea57af7e9a08f08dbc0c4b3a927e3d823945b619864c1b6e58c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7949dd3-76a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783057693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057693, "uuid": "f470ed37-1101-4492-be63-742dc98dbf8b", "comment": "Malware payload", "value": "2c667ab1cdbcc0fb85f92600591c3c22", "object_relation": "md5", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057693, "uuid": "5d27911d-1731-424a-8dbf-96255922f862", "comment": "Malware payload", "value": "f3d4a674df3c8869f063fa64f8a766b8b8eadea561d18c3c2e9d7f6a9a117d78", "object_relation": "sha256", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057693, "uuid": "52a4ca6d-be5e-427f-b196-ff7b8295e277", "comment": "Malware payload", "value": "8d28e5b155788c366714d262c924f31f786c507c", "object_relation": "sha1", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783057693, "uuid": "c0c270cd-4131-4798-82a1-f4161968c83b", "comment": "Malware payload", "value": "592f6039f7397b4b0bd43211788798974bbf59805d5afaae49de36ce469a296f53494db86542bd744dc028ad4399be1b", "object_relation": "sha3-384", "Tag": [ { "name": "barlucianocassino-com", "colour": "#E75D63", "exportable": true, "hide_tag": false }, { "name": "bonuo-expo-com", "colour": "#81B0FD", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manovingenieria-com", "colour": "#783FB8", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057693, "uuid": "a821d332-373e-4c13-81d1-d97fe6564699", "value": "T111B67C05E38806A9D25ACE7C861BAE22C3B1BC160735BD9B55D237CD1D73F7E1B2A601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057693, "uuid": "f9198ddc-2ea8-4e8a-a46f-391c51d61b65", "value": "9a6abff380ed67806f1007a3bbd1c698", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057693, "uuid": "267abc90-fee7-4c8e-9187-ed5eb9590d34", "value": "98304:4b1ckV7w0fS769nEF1xTyknvLFRUXJTh3/:YcEKu9n0xTzTFRU7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783057693, "uuid": "aad6a02e-6285-4033-a300-116748b7989b", "value": 11061248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783057693, "uuid": "09152851-bfa2-4bca-a11d-ec8259a98d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783057693, "uuid": "3a354714-9514-4579-bf32-d0337b7b30aa", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0debcac-7711-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783105436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105436, "uuid": "3844fa36-57be-4352-b1c5-c9d290ac7eac", "comment": "Malware payload", "value": "cae1448008c11d810dd0fc8bde721db6", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105436, "uuid": "cb493a88-a4cd-4625-8eb9-1d1bdb0c1083", "comment": "Malware payload", "value": "f3e1e3c4397686ae17308f1f5376a76eaacfe018b834a7d3f5512739be7d19b3", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105436, "uuid": "2ecadc1b-9e1e-4b62-85a6-0fb576b39eaa", "comment": "Malware payload", "value": "cc5fe809d81b9b599d3ffb964c2544f28c53e430", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783105436, "uuid": "3e00a001-4dc2-4a05-9ae3-556e3d53a62e", "comment": "Malware payload", "value": "32902aa46289435a1114beab35c3189b7a05c3536b682e07c39873f33318cf612f543e118dc4aad2e65d64fe9aaf41f1", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105436, "uuid": "26881bcc-ad7a-4455-9db2-85778fe4d465", "value": "T1A8564A07ECA545E9C0AEE230896B9253BB717C485F2123D32BA0F7286F76BD06E75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105436, "uuid": "7774c527-4783-4a8f-a6c4-6b7e0143c8d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105436, "uuid": "a482bc55-c5a9-4aec-9abc-a8416b549766", "value": "49152:mO3INVQGTfyPlc1Fqg8xVNXTYDnFqR6LKJSLwDNA6oOJlPV5T5Rzc/XnTfKiK9KE:mIVl9Y8R6OLFzTH4bbfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783105436, "uuid": "76ec60dc-8fb9-476c-a88f-881ccf950cc6", "value": 6366720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783105436, "uuid": "ba0880d0-9de1-4498-a5a5-6bfa45099050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783105436, "uuid": "05586ea0-e684-415f-8ef9-7f7502ac73c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35aba16-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1783101011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101011, "uuid": "dcbdef63-35ce-40f1-9891-12503c11040d", "comment": "Malware payload (MassLogger)", "value": "bb609758df454abc0cdedd88b26c2810", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101011, "uuid": "a2024f0f-c2ea-4dc2-8b65-6d46812fa727", "comment": "Malware payload (MassLogger)", "value": "f490827a714eff3614b4bfd4f8d196f427d1fc841c3038554d2c48ca9415b40d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101011, "uuid": "53f7e6f4-2a01-4ac8-93ac-c79d55290e1e", "comment": "Malware payload (MassLogger)", "value": "7181dc2ba8ebf01c78d66a9b47c531708904bd13", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101011, "uuid": "e9f963ff-4534-4d4a-ba92-e70334b0f08f", "comment": "Malware payload (MassLogger)", "value": "e90e89ad85b7ca3868d3d7df0536d8a2cd1aa8c4106fcd6edc3a9b672635deeddf6895eddada0ddd8f77da27451f4935", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101011, "uuid": "31358cfc-e6d6-4746-9240-d06dc900acd6", "value": "T199B423254F64059B49475B1EC06B916FADF87522EF604F83D32BE2A9EB50F4E49AB003", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101011, "uuid": "0dce518a-4549-40ff-9720-c1365311b57f", "value": "12288:T8nS1mMTK3xojHVOau2S5ZgelU63oxjhOnJDdD0uiuAR:InMu2jHVOayLbDJiuAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101011, "uuid": "45db099d-93f5-425c-8bac-94dbfe1926f2", "value": 525927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101011, "uuid": "9640c9f2-8744-4f00-9627-e835005483cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101011, "uuid": "1d5799a8-f305-4f98-bda4-82f0de32053a", "value": "RFQ-3L50051061.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6ab348-770e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783104170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104170, "uuid": "31556468-1d91-4574-8ca0-d4a649a1e36b", "comment": "Malware payload", "value": "6bf777f66683a71d31775b61f088b94f", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104170, "uuid": "dade236a-f957-48a7-bc28-03600dd764b7", "comment": "Malware payload", "value": "f558a4bf6ef4b5fb6773016bbb5d3ac32a619ce040f18c1cd27d2e3dded3dd89", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104170, "uuid": "b6d189cc-4296-45db-99cd-ddbc7b6acc4d", "comment": "Malware payload", "value": "9a2a564f44c82aebe1393208aa1c8bbc38923e7e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783104170, "uuid": "c2666ce6-22d7-487b-893c-76436b6cd09e", "comment": "Malware payload", "value": "978f905c9d029a86ddd29c989955753b83d86a9c8789786666a6c52f85191496593a2e31d220cb2597cb4e3e2310b314", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104170, "uuid": "a8e03456-e116-4132-bb39-6efe4627807b", "value": "T169967D43ECA159E9C19AA2308AA39253BB717C444F3263D36B50F7382F76BD46EB5314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104170, "uuid": "b6083cd1-1b6c-4329-91bf-072a3b692af0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104170, "uuid": "fceb3410-43f6-44e0-853f-cc2c1b00c9ad", "value": "98304:eIfOOyCCTXhlpgseSGAD6EJhUfmEa+wz9ZwYAMCa7mHA665G:e1Zhlp9eShD6cmDaRz9CYcAcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783104170, "uuid": "9ff710b4-26cf-4748-8a1d-50f53fb04a28", "value": 8756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783104170, "uuid": "9793c397-a4a8-4f39-a71e-056c6ceeda44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783104170, "uuid": "9788be27-4f17-4693-ab89-56a82c1fd03f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f00e62-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101141, "uuid": "32146035-391f-44f6-8321-f6d36c5e0d4c", "comment": "Malware payload (AgentTesla)", "value": "f6cd81b5b189dcf08dca8035d4195824", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101141, "uuid": "f88084d6-32a5-4dfe-9f1a-c2ceb8ebd82c", "comment": "Malware payload (AgentTesla)", "value": "f583571ccb563a05415d5fe9dd67b369d9e5e01ce71f113633552a869720867b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101141, "uuid": "b471cfc9-91d8-4a77-802c-8dda85050b71", "comment": "Malware payload (AgentTesla)", "value": "b51cd4fadf685f926dc3faa788840640a660394f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101141, "uuid": "bbf638a0-f38d-4297-b5f5-0a363ceb466c", "comment": "Malware payload (AgentTesla)", "value": "b859a3384626e24cf608109a1602cf8dd8b8009a0f08f21425e7b1c4a895e7e5f917e91d1c3c12f636999aab4d5f8e22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101141, "uuid": "a82e3ed2-237d-4fcf-86fa-823980c23a0f", "value": "T1281533AC82B8E27C7C29FC8539C0D75839F202A64A122DE5AD25DEB49F1467CD0D7B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101141, "uuid": "0d10be5f-a240-4555-af58-2864786b6831", "value": "12288:RDIQgVdefVEVjJSQrtbEOqTmSYkQCJHwO4wG7bsR+aQItgZt7hHLmVIraMQesG/6:12refAJzrtdO+a6mkHy6n6sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101141, "uuid": "5217c04c-751c-4652-b565-ba622c918768", "value": 941108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101141, "uuid": "cf4c6c52-8b84-42b5-bdb9-22a097c33e9d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101141, "uuid": "22aaa871-0b03-4c51-b1a4-081e45518cf0", "value": "Outstanding_payment_INV_01290047-01288391.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8ace3e-772c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783116945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783116945, "uuid": "cdcb29da-449c-4636-984b-675768046f59", "comment": "Malware payload (WannaCry)", "value": "1ec808d23dc8b2775c37db0dabe09573", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783116945, "uuid": "b6e19032-691b-41bd-a213-f92c568b601e", "comment": "Malware payload (WannaCry)", "value": "f5b43a3803a8149dda677d208ba7ef5e0aa33640bcd3dd58924355f4fc54be99", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783116945, "uuid": "8c15e92b-a7ff-449b-9d7d-2912c5bbb60d", "comment": "Malware payload (WannaCry)", "value": "b59e3977a75660c858475e89536b7920ab1f1a10", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783116945, "uuid": "32dc73bb-7661-4341-b688-204abfffd10b", "comment": "Malware payload (WannaCry)", "value": "86da11c1487481314c9eaac8ac3e277db76d8549323790b036a985c1f52bf64477d0b85568b54d69c97d6088300434c0", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783116945, "uuid": "ec465616-6523-42dd-9367-d22598e79e26", "value": "T17636235932B885FCC006257984B78D57E7B37C9A13FE9B0F8B4086AA1E13755BF64B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783116945, "uuid": "4b4b2c51-f5c6-4c12-aa7b-7107255ff925", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783116945, "uuid": "3526c184-5c70-477e-9d37-0821533cc62d", "value": "49152:jnsnNQqMSPbcBVQej01INRx+TSqTdX1HkQo6SAA:DMWqPoBho1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783116945, "uuid": "c2c222ec-e8b5-42d9-b9a8-b2b9a8d87362", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783116945, "uuid": "4fc45899-a59a-43fd-9a6a-284457e6ad50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783116945, "uuid": "62b3dcda-86e6-444e-8df2-a4138c86b748", "value": "f5b43a3803a8149dda677d208ba7ef5e0aa33640bcd3dd58924355f4fc54be99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3505902e-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101685, "uuid": "125a6c39-a22a-4684-b018-29e609c8ad8d", "comment": "Malware payload", "value": "a0f4ec11acdab29ab0b90e28b8d77c14", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101685, "uuid": "5e9d62ec-f3ea-4875-bed3-5d058d3e1ffb", "comment": "Malware payload", "value": "f67949219e9c1e550c67f14877e01b8b0ba6072249e45c2abb1ccef67bc91fb7", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101685, "uuid": "141786f1-94bd-420c-abd2-b3535fa72219", "comment": "Malware payload", "value": "4085674d2d0df42bcaa86b36e8c8f4e268af4405", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101685, "uuid": "0f308e0c-c60d-470f-a7ec-b8aeee461433", "comment": "Malware payload", "value": "369696851d72dcfde3253f0257e203b139b2cfe496015da42c119e9ab54260d178d057aef359738c856d474db41eb511", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101685, "uuid": "4e14176a-00ba-4568-9578-2d87678868a9", "value": "T11BA422AE72C6C92BE23395704AC6C6C3A209FC43AF49F60FB1A4B38D54793B1591D45B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101685, "uuid": "398a0842-1f56-437f-9a22-e376e38a37f8", "value": "12288:/APXRC/+79QG0WW7zovnWyru/LLgh1Yjd:/A/EravWvTLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101685, "uuid": "ceae2fd1-d485-498c-9fb4-19472b718373", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101685, "uuid": "bbd757b4-7686-4f19-8849-78e0c7dd4c57", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101685, "uuid": "26992052-33ba-42c8-b3a8-67a3dfc3905f", "value": "PO00226.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d857deb-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101323, "uuid": "cd46361a-49f0-4ec6-bce8-805a40c16fc6", "comment": "Malware payload", "value": "970c3a2840e9c3b742b2a2ad16ba5f37", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101323, "uuid": "2f450fc5-31cd-491f-bcc4-b99898c37f33", "comment": "Malware payload", "value": "f7a574b37d0c380932f8c0a200d7976226f72de44c8490d007ab96734a7d87d6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101323, "uuid": "af385b30-2dc5-411b-a810-ec0eb6134877", "comment": "Malware payload", "value": "8c1173f63bc0031d61328cab298ae3a66403cf17", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101323, "uuid": "c89eb736-6ead-47b1-a26a-fb47f0264cef", "comment": "Malware payload", "value": "91d8f42a69651e80de7dc14f15f99c300ecd22d8f04b52ef4724e6dba31be4cba5ef1a0c739fb9dce6cb6de6e3705017", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101323, "uuid": "d268a532-a754-4e64-9ba5-9837fd2fff33", "value": "T1917423146FBB45DE5C8C7A6743C85A6C82549116B01277A3B3A632EB7E43819CFFE21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101323, "uuid": "dc3cb894-ad6f-460c-a735-4b8de9699e83", "value": "6144:E0NAilzGZd4znoTS5onRsJ7F1YBkKngilJvnGL61k0J2/vuxd4wjwqGRB3iq43zN:E0flyd4znkbyykCfvGL6q0J23xKwjwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101323, "uuid": "49e76206-b456-4737-a9b5-09233dbd528e", "value": 367988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101323, "uuid": "091b260f-5208-491c-a44f-b6940064ec8a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101323, "uuid": "0c95b5ec-7950-40cd-806b-d367ec6b4daf", "value": "AdvanceXpaymentXreceipt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096a9ee4-7682-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783043630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043630, "uuid": "43c231cb-7682-4585-b464-189ada0d4d01", "comment": "Malware payload (Mirai)", "value": "ab28916ee26d2982841b582fb7fd888d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043630, "uuid": "630109ba-19c9-47be-b102-6a0a9896ea6d", "comment": "Malware payload (Mirai)", "value": "f8183b625153b4b06f974c697d52a2d273a4e7d981f4f33e8ff27c203653f600", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043630, "uuid": "42240597-7d27-4359-88a8-c3107d29d026", "comment": "Malware payload (Mirai)", "value": "f56d49ece59f99523a875668390fc35067f0ab80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783043630, "uuid": "f967f561-df11-4edb-a0c6-f7b77253d32a", "comment": "Malware payload (Mirai)", "value": "cc5dcbf73d6e7c674d19146131ac707bc208ee8979791688bc2c97975bd2f6bf4811575dcd3f342317f44d3de0120b9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043630, "uuid": "200e5d52-42ea-48a0-b2a7-f8da436d8bbf", "value": "T10EB3D81E2E219F7EF36DC2354BB74E25939823C627E1D685D25CEA005E7038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043630, "uuid": "1c001e2b-d26d-4bcf-a729-63e4d4b61d69", "value": "3072:uKY6AV7RBY0Rhj81E3Do8cErFQ+QsninsQg:uKY6AV7/Y0RhjU8cEKpoQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783043630, "uuid": "b62986de-4622-43fb-86c5-a4e6f4ed5c43", "value": 114040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783043630, "uuid": "d25a3bca-6bd4-4212-ba58-16b6583c74db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783043630, "uuid": "4bafcc2a-e897-4fc2-9e7d-70b1e6b8fb0d", "value": "tmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34362c97-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101254, "uuid": "7136609f-6550-47de-8c14-8b64f916d497", "comment": "Malware payload", "value": "fe5f2ad65eae1c3a92d23a53cb52a433", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101254, "uuid": "5ebdd2cd-3ae8-4672-a9e4-99312c545332", "comment": "Malware payload", "value": "f9742c96a3b0f96c4bead1c1ce3a327d541f88c840e802ae61045958d2f5927d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101254, "uuid": "7d7e3539-d1b0-4fd0-9331-794fb74fe539", "comment": "Malware payload", "value": "d99734931fc75b3b987610a9c3b3df361e3eb300", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101254, "uuid": "8d45c41b-02c0-4562-8714-b3a2392baf7e", "comment": "Malware payload", "value": "898a74a910a33f8f2a52337aa40c08f8362ff2a2bdcec6a6f169e65f49c403c45514698d325dfd3e87176e1f6690925f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101254, "uuid": "c77169d3-cb71-406a-8507-ba853eb8a370", "value": "T162C3121B8DA04F78B2F90B885AE9057FE95FCC896BFD2BA22544365CD1113033ED5917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101254, "uuid": "8cdf2b4f-6df5-4ad6-abfd-fe99f7409dd1", "value": "3072:pAhjpNzgUzxXJu/2TUm5R69CaVCpD8K4zzKl0XOxkv:pqbvXw/2TUc8VPxzlOxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101254, "uuid": "4fee4b4d-b677-48a0-8f61-d1b1d5a85d4c", "value": 125054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101254, "uuid": "9de10617-92f5-4c95-a004-c54ed5723518", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101254, "uuid": "51740b1d-79cf-4640-936b-6a392a57f47d", "value": "SOAX916081940.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42170b1e-76b7-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783066488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066488, "uuid": "64dd139d-c354-447a-8e3a-22933e391ed0", "comment": "Malware payload (Mirai)", "value": "19ced1d7327f0765143624b000a507fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066488, "uuid": "cd6e6928-acae-4722-8753-2911d7cf1bbc", "comment": "Malware payload (Mirai)", "value": "f9e91a2fcffaeae978fa7abf8bdcb7ee79270f97385e22d70e7182a969af1fac", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066488, "uuid": "0d3f0709-56b3-4ec3-8c34-b7de52c4f372", "comment": "Malware payload (Mirai)", "value": "8fb80d087a8c9e32c81f840c6ddc2e9534696a60", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783066488, "uuid": "03b33ef9-936d-4164-9808-c577b53c078a", "comment": "Malware payload (Mirai)", "value": "049e9800c51aeb0c2d32d86b458778efd079a3125202b3a1bd1b40ee8b28c7a039706bc9a5a82308476b4d9998437a16", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066488, "uuid": "3c36bffd-7a5f-48fb-982f-586d7c802f5c", "value": "T11531A6C721924DB03EE1E96B36AD494135C5F5C751DBEF996CED38E950CED08B804A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066488, "uuid": "b172125b-74b9-4c44-8f59-c4b0abe9fb5e", "value": "48:vtgtRutQtnYtMrt/dratX/st0totcttutctAtb:vmbuOuyr1laRU6uiuy2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783066488, "uuid": "5ca063b6-4bb7-417f-8f87-ce12cc1111cb", "value": 1790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783066488, "uuid": "b7f76d72-df24-4f83-becd-4802e408ccc1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783066488, "uuid": "44b1e47b-de45-4526-9591-fc2e2215d930", "value": "Ciabins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df0f030-76dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783082748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082748, "uuid": "64717b5e-21fa-4d75-84c4-75eaafc5170c", "comment": "Malware payload (Gafgyt)", "value": "dbeae86f4f56cc570d1826c9b8ae17f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082748, "uuid": "55475acf-5473-489c-99a9-81ce1fd939fe", "comment": "Malware payload (Gafgyt)", "value": "fb913ba0ad2ee1d28ed55ac637d770a196ec0fac8d865f106a45338f95757557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082748, "uuid": "a3c8e99d-53cc-448d-8a62-159e6353eba8", "comment": "Malware payload (Gafgyt)", "value": "334c4444606eb6ebbdc8cfcf36423a2c6ddf7dfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783082748, "uuid": "2715487b-0946-463b-b536-4ff0d31bbb0f", "comment": "Malware payload (Gafgyt)", "value": "45d4062b6cf0653a64769629ddaceadaa83c832d943b72b8e1cbf2b94a5474cd1265f2e450380d586668d428dacc33ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082748, "uuid": "76b42d5f-0156-4bfb-b902-14a317ef31f9", "value": "T1CFC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082748, "uuid": "03e9f75d-04b9-4bd1-8005-3bbc2fde2588", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBeYEdWfRZrmW+IFj:Ted0W0MZQHqd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783082748, "uuid": "de5a7750-da41-4a47-bb47-24b6e2754160", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783082748, "uuid": "262bc206-99f1-47cc-b0bd-6305b1a17334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783082748, "uuid": "556c85d6-15d9-4af1-b0b6-7f0e0a26fa43", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ef4ef7-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101634, "uuid": "dac2b4a7-44d9-4f2a-9d14-1d54013c6e04", "comment": "Malware payload (Formbook)", "value": "f4b19ddac26cc4add956fb01856469d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101634, "uuid": "afeb0b97-6530-4b8a-8199-77a5ec616a5c", "comment": "Malware payload (Formbook)", "value": "fbbb5b74e9d1d24d79f9ca7f8dc44dac9ea7663d666ee829bc5e2d2cbcec3174", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101634, "uuid": "042389ad-9359-4147-89f2-9ad6ff577de0", "comment": "Malware payload (Formbook)", "value": "275dc4dc7584d05ccd76d90f992af8c66dab34dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101634, "uuid": "7e1ecea4-ffcb-410c-b061-ea7b25aa6047", "comment": "Malware payload (Formbook)", "value": "79d44ce29d694a98f004378b277c5d1cf25eb6604e845a2bc040171d6e4da723c30d9c694073b195898750e09458722a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101634, "uuid": "2b57ca4d-5007-46a1-973d-4adbc9734aca", "value": "T1D635F119A1A7C802E57A0F728CF5E1B01331AD96F232D61F1FD11EEB76633516D8272A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101634, "uuid": "70b0aded-4d2f-4a54-9a71-413187358dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101634, "uuid": "e444c96c-2ec3-4a28-9ab8-bd5569af060d", "value": "24576:62VM/c9vJGQXIUEaTR7HEzZrGJxi4Y14:zM/WEQXIUEaToIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101634, "uuid": "684ef499-dd54-4e01-8dc6-155ffa23989a", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101634, "uuid": "62fd4f3c-147e-40a5-a083-644c271ddb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101634, "uuid": "b47b47d9-2427-471a-bbd1-3030d7893c6a", "value": "TENDER_33AAACL1880A1Z4___PAN_No.AAACL1880A.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63f1107-7700-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783098090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098090, "uuid": "18ada39c-2203-4266-b842-5c33ea9f962b", "comment": "Malware payload", "value": "6b208bde3883f416371ff21daef8a42e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098090, "uuid": "6605044e-8fe0-442c-ae9e-c824735b1a02", "comment": "Malware payload", "value": "fc0185a577b10f2f7533d396bf424be83bb5ab5716a4403f721cd688bb82b9db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098090, "uuid": "cc978c8c-8960-4d98-aa1f-e1efd87ef33b", "comment": "Malware payload", "value": "f5b7064756c8a8aba04ee107b0c15000ff68e875", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783098090, "uuid": "2767898c-b0d5-487e-a442-e7f8768b5e37", "comment": "Malware payload", "value": "1118b5fc29e0f2acfe597a9390856ff142e60f010e2cad3854ab429ac63fe0f380eb4fd2e3e02663246797257ff3a40e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098090, "uuid": "3bd7ab30-0e81-4747-bb8a-b60892c4f6f8", "value": "T14017BE77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098090, "uuid": "969c5e2b-66d1-4ff7-a860-2cc7b27e2aab", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQp:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783098090, "uuid": "9887fda1-85d8-46aa-bd33-586daf1d5281", "value": 20217856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783098090, "uuid": "53c8f2b1-d1dc-4ff8-9704-0e5d92cc46fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783098090, "uuid": "c74161c0-cf76-4a6e-b076-c305dad37c1e", "value": "fc0185a577b10f2f7533d396bf424be83bb5ab5716a4403f721cd688bb82b9db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4ac9eb-768c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (GhostBat)", "timestamp": 1783048042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048042, "uuid": "47a7c30c-43ac-491f-bc0b-39437e162180", "comment": "Malware payload (GhostBat)", "value": "986bc4bf920d7f572cca6715d3f31e93", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostBat", "colour": "#ED22E3", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048042, "uuid": "d6041ae9-00a1-4d4b-9490-b539e4ca566c", "comment": "Malware payload (GhostBat)", "value": "fca210ed8b28a9544d0db5a8387fe75c26091003041220a9d28cb445e8169aad", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostBat", "colour": "#ED22E3", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048042, "uuid": "0ee0b1c5-7429-45d6-87aa-908a97b7c2de", "comment": "Malware payload (GhostBat)", "value": "ea31131371f2307d03b5453c94aa333fcfd6b182", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostBat", "colour": "#ED22E3", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783048042, "uuid": "2868a3f1-e571-42b1-bc3c-05983efc8784", "comment": "Malware payload (GhostBat)", "value": "1abd0fe101e4a2574ada9f100e7427b967a0e976440bbeec64608b23444f82d1cde2f810ab88c80ab67aa0bc894f3c45", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "GhostBat", "colour": "#ED22E3", "exportable": true, "hide_tag": false }, { "name": "mparivahan", "colour": "#29C0BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048042, "uuid": "ada8c111-3725-49bb-a6a5-76ab557006fd", "value": "T139760148F7485A1AC8FB53361D7626211D8BBD168B83C6435B543E3C69BB5E00F9BACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048042, "uuid": "1d5ccff3-7412-43fa-8968-5306374aedfe", "value": "196608:pRgUrwLubPZt54iHq6jwgBulJZmuhiy3NrCc8BvLlzA:vgnyzZnZmtJky3NOc8BjlzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783048042, "uuid": "81de43cf-cb9f-445a-811c-6aff52f86df8", "value": 7332471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783048042, "uuid": "8e6aa891-6668-475c-a696-60a8300a95c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783048042, "uuid": "897da388-3eb7-41cf-804e-2b57d76ce3df", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8761256-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101556, "uuid": "8f990f19-777d-49c7-a72d-6eff93313a39", "comment": "Malware payload", "value": "642a624ab83cb519901e0839f3858c99", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101556, "uuid": "39287f10-78a4-4cb4-ade6-e49032d9aadc", "comment": "Malware payload", "value": "fcc0ce34342df35b5e89c77c5c5101aeab1c54b428998c64685018db15999083", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101556, "uuid": "44d7f638-fbbf-4d7a-b507-c0e93f3b9526", "comment": "Malware payload", "value": "5cd07562e2a296f3ad4ffbb8955bea9495e734b6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101556, "uuid": "4a0d7fe6-a759-4f91-aa89-9c55d4466638", "comment": "Malware payload", "value": "1c129e8fcfc90540bb87296464ff1935fc4e3a848fee239d1dec14430640e20dfa08ae5653057052916dd8d5a68fffe4", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101556, "uuid": "ce6573c9-d427-465f-b4e9-d2c3dc844b0f", "value": "T183D41256F381E93FC28AAB7901834693143DAD75FE85C2433B637B4D66783E1B01662E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101556, "uuid": "af98b8c5-6c2f-4b1f-a9f4-940af425e0e3", "value": "12288:meqAy4TtuP/5ZJ9Z7TvtzX5lhk479backMAShvmLE/+iPKeTFharY:JRZEX7TvpzpahdFLYb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101556, "uuid": "c5125b3f-6649-47b3-b6ff-3f906268f174", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101556, "uuid": "e133af06-752f-4962-b4df-b90539e270fb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101556, "uuid": "56d3d7a9-3592-40bb-aa98-d3297d8ef6af", "value": "Business-Database-SaudiA-Kuwait-UAE-Oman-WOJK2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8f6cb7-7709-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101753, "uuid": "81f0a810-fd38-48b8-9fe1-146bd78a6ea4", "comment": "Malware payload", "value": "13b3081c68b1241ac4416af0e126a0e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101753, "uuid": "aeb4d9dd-de3d-44a0-9b24-39110063d148", "comment": "Malware payload", "value": "fd1ffcb01924aef12019f1ca9294a2fe6a2b1b82a03fc9b935a5f8664a77cbca", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101753, "uuid": "445d8a19-5c1d-433c-94f9-462d42058edd", "comment": "Malware payload", "value": "8957f3c4184967d215e25fc45cdf5a244cae906a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101753, "uuid": "81a5e8c2-0751-439e-8ce2-fec7dd632aeb", "comment": "Malware payload", "value": "70e0f8bac6cbac0af0899f1666f4f942f3465a24b34fea0f041e5605f05688300393c25f0f954773aa331bc2972421ce", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101753, "uuid": "40f0f5f8-4960-4cb4-8380-b634654ad362", "value": "T15312BF3D105A03AB0591263225A9355A09A8F4FF80DDC626660472BD1F9FC73E7E7D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101753, "uuid": "1378e262-79ac-46d7-8efb-8365f47d6ffc", "value": "192:UCKCtoQ24eif/nnT02VCE9/5Lswce9uH2psMyJFN5yvtIryMG2:eCt5tz02Vvx5gEEH22/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101753, "uuid": "3db269a6-9c15-437b-9937-35a1386627a4", "value": 9642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101753, "uuid": "b5dcd0e3-3a26-41d0-8a1d-913517604893", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101753, "uuid": "2978686f-ed2a-4452-9c02-10a5b1d7790a", "value": "Purchase_order_4000373697pdf.z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd7db63-76ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783089919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089919, "uuid": "e4c509eb-b18d-43a2-8909-2fa163e1bd0b", "comment": "Malware payload (Stealc)", "value": "7751792eebb0d401d0a580f5e142756a", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089919, "uuid": "f11aabed-00ef-4666-ad1e-c33cc0294ef8", "comment": "Malware payload (Stealc)", "value": "fd2d5ada1da9e1088e3ad645543dcdf407a1996be32041c4fd64e15591962577", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089919, "uuid": "d2b1a610-dbc4-45c0-a09a-dc5fa1e6350b", "comment": "Malware payload (Stealc)", "value": "e6c76b55c330ab9f6a9012c3b84a0a953387c2d1", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783089919, "uuid": "02539104-e4e6-4ebc-80c7-31c1d3ccef8f", "comment": "Malware payload (Stealc)", "value": "b47f0e52292b8bfded91de189278b7888bc4635134fb9165c69090f4269fe3c2fef0900a208c0288a2eaa05c93da4916", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089919, "uuid": "a8d714e3-d56b-4f76-b33a-698eafecb386", "value": "T189A5232513C825A9D836177598A4416A2730FC23AB1A1BDF47D0EFBA1E73BD0E13275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089919, "uuid": "d3b25cf4-6167-4442-9813-7567132fbd17", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089919, "uuid": "352fd6e9-2907-418b-bbda-e339611c2680", "value": "49152:Yut4zM3lI7E8sgKdaLjaWwjigA2nxrNfGKUAN6us2ISwMi:iz37E8xZupSsfDYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783089919, "uuid": "cba3a797-2a6d-42d4-ade7-7747832f9fbf", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783089919, "uuid": "5164238c-e665-4bf8-8a3f-32c9b4183d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783089919, "uuid": "b953f0f1-a4c4-417f-9647-ee6c6ab5d86d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efbd05a-7708-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783101326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101326, "uuid": "b4b314d2-da63-4d86-a18e-b2e7f2034d72", "comment": "Malware payload (Formbook)", "value": "fa91d3f6d8fe745d6a776b6e815c5ea4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101326, "uuid": "20e09e56-8d78-4e8b-b9d0-7fd625c3d5a8", "comment": "Malware payload (Formbook)", "value": "fe433b106b81aca0f29123d68602b575f954813e86ada3db97eedb71209e8180", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101326, "uuid": "47e1f3e3-792a-46ea-a093-36928c974e23", "comment": "Malware payload (Formbook)", "value": "b3a955f75102108bfa81dbb69cc3867472e7175e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101326, "uuid": "a8c524ac-0fc4-4626-94cd-68dd1291f61e", "comment": "Malware payload (Formbook)", "value": "82e1910c01bc6b7c6d20cd2d51f50c669b00d763365209cc962bcacb9632f30e3cbfbb7c0b4d9d2f2d43d19ddd6b0d82", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101326, "uuid": "5ba78b4d-c1ed-43e0-8aee-417c5d3cda52", "value": "T1FE1533BC59159B7A68329CABC6FC57B78702E8DC0637E56C793458D30860E370BADE48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101326, "uuid": "7930e409-014f-4766-b504-34950d1202d0", "value": "24576:XM99g3hZDqfjTULfTTWWPgGsIpPNOch8DF8cWQBfZibN9lBVxCJcMt:vqbonxnpPNOch8DKcWQBYbN9HBMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101326, "uuid": "8b21179d-dbb9-489e-afb0-bb22238adaa4", "value": 952048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101326, "uuid": "6c6abf6e-cd0c-4707-a651-f88ed86348d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101326, "uuid": "25ba7220-58b7-4531-9f47-2d34b7f45789", "value": "ROT-20.06.2026X-XOOCU6741260.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e699f3ed-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783101124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101124, "uuid": "003945e6-d458-44b0-a45b-baa8cce1180e", "comment": "Malware payload", "value": "7860bd0f38f38b3b9484c7b8e9043ce2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101124, "uuid": "3aca8ca3-ec55-449a-8952-2b1c5f9fb42a", "comment": "Malware payload", "value": "fe4feae078353bf7b2fc20dc3b9f3e6ca9a3176d31dc331d715277d1bbb855cf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101124, "uuid": "252bd2a0-a9cd-4d6f-a356-b096c9d3ab7f", "comment": "Malware payload", "value": "e42e59609e30548ec5d82bb7ad7edcac82daffd9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101124, "uuid": "7a8703ee-b0fd-4171-ac5d-b1ba09f2bf44", "comment": "Malware payload", "value": "64a43f30452a399cab29fd3383f750e89dbdd9d2bb18c9624bc2c40e78d64b5e035731ad9c8c064a4f19433b165306a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101124, "uuid": "0c1dd812-7594-493d-ae77-265f1391281b", "value": "T1BF52039680A51AFD40314CF9B62F136147A6A93D21CBE23290F846D992F73A633F51C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101124, "uuid": "3a5a0404-fc79-4ed2-9247-7af6abb26af2", "value": "48:9tS+s2N9YTM6E3INfw6/mEYQfGMgsiyFW6+rl48i8DK7GGfmwerOIvMQ/x2Okyxn:k2KEYe65YWGuiLrD0Yw9mMKx2OLxbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101124, "uuid": "ea22486f-65c4-46f7-a312-122805c55377", "value": 14181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101124, "uuid": "6919ee37-9cd8-4f6f-8276-6dab66c2dfc8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101124, "uuid": "3fe4c62a-ddd4-4515-835f-7709d834ee8f", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2a7502-767a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783040519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040519, "uuid": "4b05cb39-746a-4adf-a664-5505f940a585", "comment": "Malware payload", "value": "7a70515c2375dacdf5182382fdc4d580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040519, "uuid": "585d8c79-ddff-42f7-9bcf-22f27d15ab2e", "comment": "Malware payload", "value": "fe5cfaef3ae8218abb6074de7886b83b420451ecb0088591d96b44a7426f9a41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040519, "uuid": "3de6f650-3ea4-4e4a-9f2b-d91d33c8ce07", "comment": "Malware payload", "value": "ae8d37dd27b372d18de229dd34409eba7da15adf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783040519, "uuid": "eb7f90e9-0342-4e4e-b757-65299ab77f9f", "comment": "Malware payload", "value": "ba2d122abc38014d957832293e5781c7e08e31cd9f86866c8f873a30a50f50854f7ff5fa50df231b8535e16de306ff5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040519, "uuid": "617b4026-c4e9-4abf-94dc-53ff96258eac", "value": "T157F5F857E59550E4C0EED174C726A223BAA13899073433E36FA1A7B11F36FE46ABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040519, "uuid": "1b8fa9a2-4464-4340-a173-47bb7f445ffc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783040519, "uuid": "133d1004-4662-4599-b177-bdd6d74f7a08", "value": 3375104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783040519, "uuid": "3d4fdb3d-5aee-492e-8f63-1c6264e0fb7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783040519, "uuid": "5080359d-1f00-487d-adf4-e96c2fe58a7e", "value": "fe5cfaef3ae8218abb6074de7886b83b420451ecb0088591d96b44a7426f9a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a070432d-7707-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783101006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101006, "uuid": "28dc5078-f447-4063-ad99-d29e7b3f1c88", "comment": "Malware payload (AgentTesla)", "value": "c9a9a09fbaaec949085e5e155af23628", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101006, "uuid": "d8613ca8-1ad0-4028-bd39-422805ded69b", "comment": "Malware payload (AgentTesla)", "value": "ff5e55cdf68dcf74022d806dfa3a4e5f55780cabd255b63cde7cf00d78d7f96f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101006, "uuid": "39ee9d17-9ced-476a-81cf-c6a721cc91b7", "comment": "Malware payload (AgentTesla)", "value": "2d068222c120fd19748332732d329b4b228450b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783101006, "uuid": "8fd36be8-3a96-4fae-9c92-0c1bebe9da64", "comment": "Malware payload (AgentTesla)", "value": "ce47b53c07440b610af53a35b79eddb7ff3a3c1429a5d0be17c16d817d3fd1df1b067b13e44b38b4259954f74bf4d918", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101006, "uuid": "7c7736bb-31b0-422c-86d0-aa8fd8c0b2c8", "value": "T1F76533A38C1962FDB174C00B2BEAD1667CA516843EE2D5B25CE91C0F72D63785A7DA0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101006, "uuid": "abcef7b5-3afa-4615-a435-eeb3af5adcb3", "value": "24576:eqjkf8yYyz67+kXJrrxRdd9xtm/DrQy27/pfrKaDeeOr2zEOvQ9XkIoWN5KpimCx:FkmyO+OTtm/DER3tOizEOIKI5N4p4azA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783101006, "uuid": "7e9658b3-7089-499c-9cc8-0335c8ec6b95", "value": 1540709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783101006, "uuid": "686fd90c-cf68-429b-9450-52046feb7d08", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783101006, "uuid": "456f2fe1-b807-480a-b7fe-03156425db7e", "value": "OrderXNo.XMP.S.006025-08524.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b321086-76f2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783091978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091978, "uuid": "c3560c90-7efe-4f70-a8ec-5f5061351871", "comment": "Malware payload", "value": "82db12c13a8c6695c43ae207fa358ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091978, "uuid": "fba6694e-2a41-416e-9ed2-9567cd53f45f", "comment": "Malware payload", "value": "ffa6334625c7613e5a3b8817c742e43a2e9447fcaae7305e3eeaf0be5eb4ea70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091978, "uuid": "47dae253-cd06-402c-b816-250a605cb64a", "comment": "Malware payload", "value": "8b686bac3a44ead6dee49ce4b5a1e5af4a2749d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783091978, "uuid": "3116bf84-bd49-4fb1-8923-cda281233703", "comment": "Malware payload", "value": "e4ea97ad89ab29a21ba21e5f90fa8a0f08698e3cc06191f57310037b89b7600c6ab8caea1f5564143b121a38fbcf3959", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091978, "uuid": "573bbfb0-8910-4bf9-9011-927be04cf349", "value": "T1E515014023E9DD06D0FA1BB42EB0D27017B86E99E972D34B4FE2ACDB787A7154815383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091978, "uuid": "c258e724-9414-4364-8c60-e4b920f102d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091978, "uuid": "b293e06f-c0ec-4f26-a0d9-2a71de135f17", "value": "24576:qyZkYeJaPrQMGF7+rY5s7fVnMWMsTTijsfnx72+:pZgrZF2Y5spnMW56Gnx72+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783091978, "uuid": "f22f0961-d563-409c-9fb2-762d4e5a13f0", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783091978, "uuid": "cc3e1a8d-12d7-4c53-89d7-bb819673424c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783091978, "uuid": "24f1a3d9-68b0-4657-b898-8f60f91a3ef1", "value": "Scan_doc202607024800921134667554300000014_ALZ-LTD.PDF(741KB).LHA.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }