{ "Event": { "published": true, "date": "2025-06-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-06-03", "timestamp": 1748995382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "5a6761d7-d8ea-4ad9-8a46-6d0c9d8f3b6e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3619f987-408b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748962710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962710, "uuid": "01778b04-c181-4fd2-a3ff-73464171adf0", "comment": "Malware payload (RemcosRAT)", "value": "ce5fdf8a7c410e1bbef4d77772d6bb56", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962710, "uuid": "cebb2318-630f-42f4-a19f-e7fc687b488b", "comment": "Malware payload (RemcosRAT)", "value": "001710ceda74d60a689f76c21e9be152597fc7c621b60cf2a1c50737bb35d6fc", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962710, "uuid": "534f1092-2b79-410e-baba-5d4dbd71795b", "comment": "Malware payload (RemcosRAT)", "value": "a2bbd207a0e2d5af4f57051fecf25c6b9639d2a4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962710, "uuid": "5c7fc82a-15d7-404f-9aa2-dbea9a15c3a8", "comment": "Malware payload (RemcosRAT)", "value": "1a32ebf986d583bab49a6d771bfa3c7b662bfe1f532835e4d3be75b2dec4ca55f94b5135bf78313903f6c6b0a834ee65", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962710, "uuid": "fd348ea9-d388-4c41-8193-86d2167bc24c", "value": "T10D5247585C91BE1457E74795C7CF6CF91ECD0B0C5410720678AD28BB4394A796CEC1A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962710, "uuid": "23afe0e7-17a9-426e-b70a-bc555ba4f52f", "value": "48:3a0WKgwT0fFKgwBsuDRnVmCsX99DdCP0ifHARJFM50+0ElXKgw+0WPG:K3w+nFuDR0CsXf+vfmWfxr5H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962710, "uuid": "43037038-c0ba-4ea8-a4f8-e34ef9a26ad4", "value": 13378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962710, "uuid": "88cf4cda-f35a-451b-b356-a50718a65ad4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962710, "uuid": "bacab141-3996-496f-8ea7-65bce9fc21cd", "value": "evaadanflowwithgreathappinessforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edefc8db-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963877, "uuid": "de10287c-a794-4fc2-bb0c-99d96296e977", "comment": "Malware payload (Grandoreiro)", "value": "6575ecf307a1d46837406a02258cfce5", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963877, "uuid": "9e23b13a-cc8e-4a0f-bb0c-0dae8872ea84", "comment": "Malware payload (Grandoreiro)", "value": "00243b8f8e1a6b292785cd251460bcfc194491deed6c4844863dce3a05572309", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963877, "uuid": "615f5594-e643-46d1-b00f-ea0544550700", "comment": "Malware payload (Grandoreiro)", "value": "b14e93c549a2e3f559775c18454047593d014ffa", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963877, "uuid": "25666c7d-affe-4ec7-979d-48a6eb6e947b", "comment": "Malware payload (Grandoreiro)", "value": "abdb66d1efb44f79e3c37168b50b88d857408b74e212545241dcc28c1e1ecf227e4812a6e04c6a0ed0d321150bebc7dd", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963877, "uuid": "782b40e5-37bb-4270-9d45-5beccc12fe02", "value": "T1AFF523B214657DBB43A60E09304E3BAA9EBC69EF8C64F1CD75CC15CB71EAB418C158B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963877, "uuid": "828df972-f89e-4a95-9ce1-04e4a5f80ee2", "value": "49152:WUGd8dCJ4J8RnWjeHSnZf8Kte8RqhYRkptpRsw:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963877, "uuid": "017592d9-dc27-4a0a-9bab-b2bbdccc1d57", "value": 3331492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963877, "uuid": "38504777-f0dd-4cec-adc3-2e2466fdd1fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963877, "uuid": "6e6b93ff-06db-4111-8813-9af5dec0cfb8", "value": "DP68420Y9AO2YK6VUC#NTUNlbvimSEMS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733eb063-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929311, "uuid": "d57605f8-91e8-4836-86ce-4e063fb2522d", "comment": "Malware payload (Mirai)", "value": "1a3315f60d200af1ee30879d06053086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929311, "uuid": "cf38462e-b0fd-419b-a7ef-9790d5492f25", "comment": "Malware payload (Mirai)", "value": "00a82b0a1c09c8fd20447cd460e9ab59259c374a2b68648fa41c824ad7947413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929311, "uuid": "12d71229-f910-4e8a-aee4-470942c6c760", "comment": "Malware payload (Mirai)", "value": "f71dbba1e09deb4def3e17d68c1e3f33b310b6ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929311, "uuid": "f230c86e-d4d9-420d-97ef-e505b8dfa44c", "comment": "Malware payload (Mirai)", "value": "aa58d3e5ea714417981608562934be757a69a605db33ce312d83681f1c65aca8d566c0d02c8cea7823bd53fe9172d4ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929311, "uuid": "b133781d-4721-4937-8c55-9f4fc28ee835", "value": "T1A3F2E0A6E9EA6BB2CB7041307BB511839E444FF5C1EE607B109B460437E58862BFC4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929311, "uuid": "851af457-f798-4911-aabf-65de85f3b0b5", "value": "768:gZxIT6ei50wr/idUQPnSfDHwxAjO9q3UELqB:gTy6ei5pr/6yL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929311, "uuid": "64412907-4d7a-4289-8c12-5381fc4ecdd5", "value": 36552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929311, "uuid": "5f5f0f11-640e-4b33-8440-1bb9908a7f52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929311, "uuid": "47b757db-e804-474f-8ad0-e66bcbb51dbf", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9569f6a9-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963728, "uuid": "330d2fb2-871f-4330-b053-bcd41340b604", "comment": "Malware payload (Grandoreiro)", "value": "1a07b74bde74a2f464a28465e24e68c2", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963728, "uuid": "6ce0e987-8378-4f8b-a7c7-dcf209bf393d", "comment": "Malware payload (Grandoreiro)", "value": "00d086fa4b6d613420645b17d4dc643ebd24a761559c7ff22254b96e322aea96", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963728, "uuid": "9a78bcbc-52bb-4fd3-890b-78abca0c32a2", "comment": "Malware payload (Grandoreiro)", "value": "0c5327cbba8a033005642d1957f6d02a8e577ada", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963728, "uuid": "7c6b5e05-8106-43b0-a2fd-6d9a3525972f", "comment": "Malware payload (Grandoreiro)", "value": "e7fb7bae93464e3d3bb39bb3775b17cc2f01ba7b62e1495976fe1bde525f6f96dd35d1690f1889a19863de823708d55e", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963728, "uuid": "e9d7d864-a260-4f73-8356-027fd1cedacd", "value": "T17FB5331105DFE72FDED365B2A5BE666E2C95800B720183CBE7906BF4080E55FE249F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963728, "uuid": "524603b0-91ce-4d15-ba2a-0422d4b8cf7e", "value": "49152:Wu7pX8r5QrRFgC75+bVEYnWyu+AJUX7iq7RKnBwAVZcwqoIDS85:WEU5ZWOEYnBnOUGWRmwAVZc7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963728, "uuid": "353263cb-c9f5-4853-b990-bea6884fb060", "value": 2425232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963728, "uuid": "01a86fc6-a440-4b1a-bc2e-854e3b674784", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963728, "uuid": "86e60d93-e086-4bfb-8ce5-d2e236be2a19", "value": "00d086fa4b6d613420645b17d4dc643ebd24a761559c7ff22254b96e322aea96.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd62660-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963746, "uuid": "0bb42b1d-704c-4a18-8ebc-eb9524448274", "comment": "Malware payload (Grandoreiro)", "value": "f0df51f2031da7c05975d581051cff05", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963746, "uuid": "5e6463b4-af9d-4169-bd4c-1c6882df891f", "comment": "Malware payload (Grandoreiro)", "value": "0119c56ed6ddbef9d949ab89e11d88177d180d92658577254db5419c7f6cae27", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963746, "uuid": "0b4739cc-1c21-4021-bacf-c79874ed5591", "comment": "Malware payload (Grandoreiro)", "value": "d5afc9ac8ba2831decd2f070a565a7f2c91b5d4a", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963746, "uuid": "7eeba25f-9ade-4102-a73c-7c289f769d5e", "comment": "Malware payload (Grandoreiro)", "value": "ef587844ab47d5cbf280152d85c9e6adc90ab16d12803566a48f68f978fed9f1d23cd17fe059fd41490c89c8fac401f9", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963746, "uuid": "e3dfbeda-571a-403c-9aee-be4e289fb759", "value": "T1CAD533FA3CDC252EA666977AC9DB58F4D6F73D020A5D98CA37E0804C161E3604274BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963746, "uuid": "b22acabc-806c-4549-a1c3-fbf330846985", "value": "49152:r8ur0PN6v0GjA6pDBTJwBlAeFRv10r03YOQdxnuxxkQ7dGU/Si8bj5StVas8xkfc:r8uoYTA6p5iBlXRvCrIYO0k7kSbqi8RD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963746, "uuid": "f3a313e8-c211-4dbb-9100-fd5b06c44f9b", "value": 2868210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963746, "uuid": "9d383c41-919c-4f95-b9a3-2e21bbefad97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963746, "uuid": "9932bbb7-4fd0-49c7-a8c9-143188e2fcd9", "value": "0119c56ed6ddbef9d949ab89e11d88177d180d92658577254db5419c7f6cae27.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79cb0bb-4012-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748911011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911011, "uuid": "7b934de4-9f4c-4f78-99fe-37c62b563fd3", "comment": "Malware payload", "value": "0b77299f18041ac91933d7ce37cf5459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911011, "uuid": "f940bc5c-5dad-4658-aa53-b85691af1e93", "comment": "Malware payload", "value": "0181bfcb168876a346dc8694eb82fbeb76a19c7cef159980ee1353fbd159f0a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911011, "uuid": "78a575a4-c894-4aae-a30e-f922dcd81e5d", "comment": "Malware payload", "value": "c21b3912943d07c2d1b83a14cb21685949d30028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911011, "uuid": "d7a32d99-ab0a-40c3-83b9-1d7b2cf9dc89", "comment": "Malware payload", "value": "112f85796e9a4d13841ee5bb4bdb27920c9d6ad235cbbdb2098b69192c05860fe01685e305613fc8ea2c398e201cfb65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911011, "uuid": "fcceec12-007f-4ed7-9570-0e7785b9605c", "value": "T115A41212E290D8FEC4DAC170429FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911011, "uuid": "fc6f26b6-0048-45b6-8c31-8feb1051e387", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748911011, "uuid": "7d38a989-c8b2-4ecd-b80a-c860652bb900", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748911011, "uuid": "6472cb6c-aa50-4ccb-876f-cfe492ca8f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911011, "uuid": "38d9919e-e172-46a3-bb2e-4b2ab82d92bf", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31af695-404c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DBatLoader)", "timestamp": 1748935834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935834, "uuid": "898688e1-cbb6-47cd-a169-c87a96e4dd8c", "comment": "Malware payload (DBatLoader)", "value": "e69e2fab184f5f0676d926029a41a32d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935834, "uuid": "90f821bd-eed5-4ac4-b9e7-05e04023a731", "comment": "Malware payload (DBatLoader)", "value": "0212c454235c02e5e53de949d7f493f08e4de6ecd378fd1b8390121749667284", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935834, "uuid": "4e679f4e-a51c-4709-b329-208794a0a36b", "comment": "Malware payload (DBatLoader)", "value": "5b507727a6744673304f41a513e806babeee682e", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935834, "uuid": "b1a59526-bb17-4d26-a639-33f78b2ca51f", "comment": "Malware payload (DBatLoader)", "value": "bc8b1276433618eb8b883db88caf9c4a614d9bff1540504f7661bddae80f6b69a69da5cd29f7f32d1e4418fe2f606569", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935834, "uuid": "fac80a17-eee6-4247-90c0-743d097f6a93", "value": "T12D5533FDFFA92AC36519E6402E3AC875EFE81D1C748CE8671F71846857868A34A87D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935834, "uuid": "12f807a3-9396-4065-a904-defc35a32a0f", "value": "24576:xIn4f0Z1On65UqpXiPZFx1AjKIxz2cfAce//pkEjLW9xeSPNLO5OX+h:xI481NpXih1AeIxyc4cenpRjaxeSlt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935834, "uuid": "a452415b-3029-49cb-80dd-ae99a7ae8407", "value": 1284052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935834, "uuid": "fafba1c2-1a15-4734-ad29-65c0a9f41c89", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935834, "uuid": "b7fa2258-78a9-4541-83dd-9925e67ef8df", "value": "nPO.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3cc2b4-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929622, "uuid": "8fe20110-6341-424c-bbb3-93be3bedc2c2", "comment": "Malware payload (Mirai)", "value": "ef4412593c2e4c488f2770a0b16e5fe7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929622, "uuid": "d6161c51-52f3-4abc-a471-7ec726047493", "comment": "Malware payload (Mirai)", "value": "0267bf04769657779fe05fb348a171599f891337cf7de94bf9d989af7b0094f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929622, "uuid": "6b8e8f76-cd0a-48b7-80c7-e388a66292b7", "comment": "Malware payload (Mirai)", "value": "9d0a5598d6b93c6942a8a8338365a8f8d4f88d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929622, "uuid": "3fa1c604-681a-4c3f-bf91-5bc03fc3786c", "comment": "Malware payload (Mirai)", "value": "3312c86776dc92e9039960f3f7ec24c4ac0c0a2610ea1d65b5e4992d43cf81fff3424b0a7e2d7e294a0aa941d5ad9fda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929622, "uuid": "e72b33b6-7afb-4e50-bb6b-6dafaba6a4b3", "value": "T154A31856F881AF11D5D526BEFE4E018933135BACE3EE7212DD205B2527CAA6B0F7B401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929622, "uuid": "a78453ce-018b-4f52-992e-db814742a6d8", "value": "3072:9xN3ZweUO2jNFLs2TSyaJIqaJVsFQH11RgnA:9PpmjjNFLs2TsJIqaJVOifJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929622, "uuid": "45244094-4db0-489f-87f0-40dc8041037c", "value": 99716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929622, "uuid": "d98b749e-279b-4edf-9c56-96eec7ea89e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929622, "uuid": "dd54b867-2da3-444d-bf31-e9d561049a40", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffb3234-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748935077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935077, "uuid": "8d394ea0-0d42-4c83-aa51-ff4c201cbc37", "comment": "Malware payload", "value": "271bc83a2f26e21ea935c9ed4e6a4e8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935077, "uuid": "712175f3-ca40-4394-b8a6-19f451620174", "comment": "Malware payload", "value": "027f579195069df5858662f0891c257cd212ffb3129a6c2cd6eaa276967e28b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935077, "uuid": "67d41946-3694-4bb0-b141-568f589c6c4a", "comment": "Malware payload", "value": "b48b79a7c77f9c8aafd8c8ed30766b2199f34274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935077, "uuid": "090c9409-0798-4059-b4f9-0b94c4aa59c1", "comment": "Malware payload", "value": "b309b2d92f923997d22eb3e5c629a56836f66ea5bdeb815bf7f479366a74a4825a5e6f92f012b37acde6869974a42ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935077, "uuid": "5a17ca1b-498a-4760-93e1-acf9bb4f4ebc", "value": "T1B3D45B34B596C0E7C302673C4F1CE6651229E8565BB827CB33D52AAB0FE62E39717907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935077, "uuid": "4fc4bdc4-b94a-44ef-a389-a4a3afa98081", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935077, "uuid": "b7c29979-8167-453e-898f-19226a844394", "value": "6144:bWh9RAEdtwXm+3HYhQJan7r4NGoyqPGRf9dxojJ+T:yhMEUXm5hQJe7r0kfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935077, "uuid": "9f203f17-8181-4130-9a9f-c54a2b8ced49", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935077, "uuid": "d2c89abf-a321-4632-8e1f-3e62afb1f267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935077, "uuid": "9dc6f683-13d6-4c54-a178-85778332d837", "value": "madksss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3460fdf1-40b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748982464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982464, "uuid": "b66b4133-1f77-48f5-9518-dbe33a42df43", "comment": "Malware payload", "value": "42ad7a4aaa04f10ba629c3116e05407c", "object_relation": "md5", "Tag": [ { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982464, "uuid": "67666558-ad43-4fa9-a143-fda046dde816", "comment": "Malware payload", "value": "029d327010d944dd61ad3a06c36752ccb6f94c24f3994cfdd20c581f0bec3b44", "object_relation": "sha256", "Tag": [ { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982464, "uuid": "72482138-2014-4746-abb5-3547c204d7fb", "comment": "Malware payload", "value": "df14946dc0a2a1773da399f26ee6904e62808204", "object_relation": "sha1", "Tag": [ { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982464, "uuid": "af922abb-73e8-4155-b983-cdb794562b22", "comment": "Malware payload", "value": "2173bc6f9869f3c82fe97781aeb99003d194e18fb197c0286d5ed169246ebdc3b087ba86edb3d5591ded556b431ed921", "object_relation": "sha3-384", "Tag": [ { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982464, "uuid": "d64c8c17-695f-4a55-a71b-9f2beea82448", "value": "T1DBD312756135CADCBF033B71E508271553DBDDAD2A08F4E827E2C189268E678E4A0F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982464, "uuid": "bc42f0f0-2650-4beb-97f2-205e8897c542", "value": "3072:USEyZgMp8VGb2Ipn+IuBDPy78jRe0X9eD/wjhPd6ugNUdGk7:VEyqC8sb2Ipn3GqwjRei+gd4NKl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982464, "uuid": "47e04fe7-5f55-46e1-a946-2b427b8a4c3d", "value": 136869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982464, "uuid": "a55ea138-ecab-441f-a27f-7812ebba2c7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982464, "uuid": "a74147a9-a3a5-4ffc-8823-154221bc4085", "value": "ok.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e30337-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1748989175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989175, "uuid": "c93bb487-a2e2-46d3-892c-2249d72764c5", "comment": "Malware payload (ErbiumStealer)", "value": "1ba9cbbd92b6b222c63d0ea4b8337027", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989175, "uuid": "7457ff2c-757d-4c91-8be5-aef6be9f4817", "comment": "Malware payload (ErbiumStealer)", "value": "038bebec6ac0cd5c5ffb890ebeccd2982bb8b3c9ed84fa30f8408e26a6322cc2", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989175, "uuid": "00a95d25-7e13-4ec1-87fa-04d0ae113584", "comment": "Malware payload (ErbiumStealer)", "value": "0b2e8b4275b6928b2c8c8145b9b2b21d2ad18328", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989175, "uuid": "7e9576ee-d8ec-4f3b-9cbb-b53a2f95b687", "comment": "Malware payload (ErbiumStealer)", "value": "958bb5922839b3301f7cd2c8b10362bccf92f4b83961cbfddf6d1bad469b738d130df87fa386941d7c8e55f5ca5001ad", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989175, "uuid": "d4bea008-593a-408b-a54b-5d8a13ee7729", "value": "T15B22C701A742572AD9EA48F081354B8EF56D9B312B205AF7B0FE6C5DCFA47D07828623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989175, "uuid": "b263f47e-eb77-455c-862c-a6fb4d2a3aad", "value": "e2cf7e9b7ea276e49dd6f9224087577b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989175, "uuid": "2b3420ba-da80-45e5-a4a9-d5a4820e6416", "value": "96:3m2unjKp7Y5DkYoCYNiESNfWNsn8WEmO8qQuD1oCbyRTq8QEtFS32hWN3QU:3Kup7iDkYDxNeNejEmO8q7xlbuTXn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989175, "uuid": "ebc8cbb7-2817-490b-9696-6d676b5c7a48", "value": 10374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989175, "uuid": "73de83e0-63e2-489c-b560-6c4e8a514481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989175, "uuid": "ab81be25-7f12-4949-aadd-3b3c5679e5ed", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.34463.13166.2246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec176f35-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748961297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961297, "uuid": "92b9947a-2efa-4026-b142-5597859beaf1", "comment": "Malware payload", "value": "9e861ebc7840a99422c0e44020c74419", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961297, "uuid": "9d6b0cc8-2fde-4bf6-aa15-e91912fa70f8", "comment": "Malware payload", "value": "04f700665eb5d72a1090cd48cffc8882f84ad2e3905d2fa4ff7287f0cab3f558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961297, "uuid": "243ab940-347d-4b21-a918-2470f35c3d93", "comment": "Malware payload", "value": "677dc73d3b9a10b8e08c1a78b5d6d56aedf51d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961297, "uuid": "3ede3964-baf3-4265-8bc1-0a55ad9f15db", "comment": "Malware payload", "value": "9aba6e8086a6ea651fadee36cd29c14179c99cea491a35d6106b3f9d77d2738bc32b7af94bbf4b9d654558986c094576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961297, "uuid": "127381dd-0ca2-44c3-8756-4704519eccb9", "value": "T1AB37332D26A054F1D4731730E8A8CA58560BBB6A207835C513D6EF748769F122F93FEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961297, "uuid": "d0a4e6c6-feb2-4a5b-942f-a90d0e2a95f3", "value": "4d65eb009a5bed7efce0091931f34eb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961297, "uuid": "60f61835-933f-4ab4-bbc0-571bd14f72bf", "value": "393216:ceh+Gj4LtTQIdTr2V91kasRfo2rqPMG/51M/Tto9/HJG2NhvBgM:XY+OCFkPt7r/Um/K9PlNpSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961297, "uuid": "73101066-126d-4938-a6b1-9b23c5564b5b", "value": 22530184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961297, "uuid": "869f7ab5-6bf8-4d6b-b834-82d6d36e3aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961297, "uuid": "0bc95e2a-7f84-4a3c-ab33-cf51ab7a5ddc", "value": "SecuriteInfo.com.Program.Unwanted.5457.12772.3130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4ec808-4062-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748945250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945250, "uuid": "f8c37f45-a5e0-48da-9478-db1852685e81", "comment": "Malware payload (MassLogger)", "value": "a760fc0c66fc00980b105c7815bdb769", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945250, "uuid": "c174b4da-d07a-45de-8e28-d16aa67f4c6f", "comment": "Malware payload (MassLogger)", "value": "051b6d93ecab1b11d8bd45b823f6d20aff316f81c8661a8544b007cd494ca20f", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945250, "uuid": "5e6dbb92-a2be-43bd-be6d-6f47f7196458", "comment": "Malware payload (MassLogger)", "value": "5b5f2107ec556347a0c2d0ee794fa0510d75a540", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945250, "uuid": "7bb52190-e9c6-4006-92d4-a0096cffd3c4", "comment": "Malware payload (MassLogger)", "value": "f5ae8298a4e280128ea0e9d5d8f597fe2e2a284a3382289ed528ff6c0aa7c6de2128ba73c60ceeb78187cc7210794a70", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945250, "uuid": "8d3d2c94-fbd4-4908-9909-d49831c1dc31", "value": "T139035E115E43CEF1D932A270AFDDB4B1EE590003A5A4D191B4DFFB311B25BA15CA2ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945250, "uuid": "2168bf5b-acbe-45fe-a7da-7de42a8cd9c6", "value": "768:8K5dlE1nLHa4gcSzrrQNllyqOWf4LDM/jRkw+qG:8K5rE1nLHa4dy4NBOWI8k9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748945250, "uuid": "f3e5fa5c-1043-463e-a195-a1b649b8b24e", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748945250, "uuid": "50adea1a-20c0-44f8-9b24-6c66facecfba", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945250, "uuid": "3668188c-2887-4de8-9529-a84efbb937db", "value": "553e2cef202d920a827bce0d1efd7831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b505714-40ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748982851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982851, "uuid": "0484246c-44e0-4aef-a66f-7198bb932f1e", "comment": "Malware payload", "value": "b2479455f3c31861f9683abb2a1d50ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982851, "uuid": "fffd2b5d-6b65-4a1c-bd10-16e7e5cb80ca", "comment": "Malware payload", "value": "053430f7b5b154bcf35526579cd21e63c356360b22856e12a7cde9fa6865b9d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982851, "uuid": "3300183c-74d0-422f-b64a-5d4c618171dc", "comment": "Malware payload", "value": "7760330e630715b5220ea794b0b7e6ec1430699a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982851, "uuid": "61ac89c1-379f-4dcd-9134-2ca4f4354440", "comment": "Malware payload", "value": "b1b853420970c823894a9a5ae758bb38a17412bb86b6847cc83be51dfa286833dc0a5663ab51915005746b53f752bcea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982851, "uuid": "17b188b2-d4be-4e33-b19a-b3ece3e240c5", "value": "T1CD458D299252E1D6FC6A04B640B1A1A834627733C63D2FFF8290E333AD17BD54B2975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982851, "uuid": "0536a9b2-e714-4b29-8dbc-111670b2f83c", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982851, "uuid": "fa5b06fe-d7fb-4ab1-833b-88dc0257f7a5", "value": "24576:XSxGdss5tPmW4JSjfJBxYDBGd7EZVgL9UBN2E8Rac5XmrT:AGdRyWiSdvsBGhEZVGWN2BYcE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982851, "uuid": "e3145e9c-5357-491a-83f7-c2c6b372d572", "value": 1231360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982851, "uuid": "ad396c67-ae8c-4547-a422-aeae17c9bec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982851, "uuid": "5731f713-7dcb-452b-91f4-44df9e2a526f", "value": "Elexum.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db7a508-405d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943100, "uuid": "c8b34d2a-efea-42e1-ae78-f9ba3f9606e7", "comment": "Malware payload", "value": "adc471dd88534bec4b49f2115d426716", "object_relation": "md5", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943100, "uuid": "2079ef13-7c26-4f8f-9fc6-b97fac96f8a8", "comment": "Malware payload", "value": "0559f003151aaf2bbc115fae13802d098f0c4b2401b1c40cf2b81f7807ea889a", "object_relation": "sha256", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943100, "uuid": "ae82bd61-785b-4c7a-9b5a-a935d88f58aa", "comment": "Malware payload", "value": "04c1489363343a8766453ff9358d400de487df4e", "object_relation": "sha1", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943100, "uuid": "15971724-bbc0-4b1e-81aa-640169726635", "comment": "Malware payload", "value": "060d46e69f47c903e13482fa626627844daaffdfc901afbbca0f0159335541dca30cb31f775b5ef54f3975141b805fd2", "object_relation": "sha3-384", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943100, "uuid": "e3f80aed-91cf-4671-a422-3ce00257b980", "value": "T132768D03FC9555E9C1ED92358A628252BA71BC494B3423D37F60F7382F72BD4AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943100, "uuid": "0fa72065-b208-4aee-9c9a-70b0e2ee2297", "value": "98304:fXj3JAtIZ51pIEU4a0FX4k1gv/Vr9FaL0NgqWcFh/QFN8D:itIXtnok1M9o0NIc3QFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943100, "uuid": "b85b5939-5901-4420-a5a8-1b50153b538f", "value": 7808205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943100, "uuid": "48c1d77c-4362-4640-ac23-a6680e9ff7f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943100, "uuid": "6b1bf8b5-f737-4911-ad79-fc3341b84514", "value": "0559f003151aaf2bbc115fae13802d098f0c4b2401b1c40cf2b81f7807ea889a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f005af52-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748932098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932098, "uuid": "f64b09d8-ccb0-4ee8-ac4e-d89b99763083", "comment": "Malware payload (Amadey)", "value": "fe217f0277d3aba89f6ad6db491b31f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932098, "uuid": "70e12872-fc19-4c99-b4d2-cce88cce60b8", "comment": "Malware payload (Amadey)", "value": "0696b3990b6527b9cac3fbe2901f65110055284b26c3e0a8c549670cbc3bb844", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932098, "uuid": "3a2612ac-e57f-4a84-ba06-44cf9d846a0c", "comment": "Malware payload (Amadey)", "value": "eb66cf41cc43ced7840731e6f693310c357d4e82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932098, "uuid": "1aff6b9f-5773-4d1a-9a78-3c407a96babd", "comment": "Malware payload (Amadey)", "value": "24307b415c6586c80ea1561dae368da59b2847246e3d09d42d2bc6dd47165cee73de1b5e80cb3410bf50fdf5f5473f54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932098, "uuid": "fdf79ae8-ddf2-4125-8ad0-fd26cbad1271", "value": "T1A1D54BA1B505B1CBD8CE67749427CFC2995C07B8872869C3D81DA47EBDA3EC13AB5C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932098, "uuid": "2f4351e4-6f5f-4e68-a4d5-93bcc2ded5c1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932098, "uuid": "476f3d74-01e2-4d2d-a43e-d9d433543189", "value": "49152:SHOL5G9vJJhzMDJpMy3cQcNU+u/SzG+lkqp+j/ICU9g9Xq1p:fyvJJJMDJCy3cQcW+u6zGRqpKUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932098, "uuid": "854ff784-89a1-4f84-921b-2de4af5e07fd", "value": 2969600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932098, "uuid": "db25fb32-1dc6-47ac-a54e-bc2500c17a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932098, "uuid": "a2fb7723-6ea8-4b99-8158-c522a7fba69c", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038abe7b-404d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748935996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935996, "uuid": "69978660-0316-4b80-8c8b-854d378305f7", "comment": "Malware payload (LummaStealer)", "value": "186b9aaca7f786d85502276cfbd1d593", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935996, "uuid": "32f14ec4-bee7-41ff-9c15-f2368b0ff926", "comment": "Malware payload (LummaStealer)", "value": "0706072643eb149890c0a839b37664923328022f053e9eab500472b162efd54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935996, "uuid": "e73502e7-126a-4eeb-8ca6-7e33a1de6922", "comment": "Malware payload (LummaStealer)", "value": "9beb40ee7c8f463ea1d90c768ef5277bebc3cce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935996, "uuid": "164320fa-e1ef-4610-9c40-f0fd03352268", "comment": "Malware payload (LummaStealer)", "value": "0bd640999ede40541deaf041b04a78014fa7187744262c0447f82c07abfc2c5a6a8151ebf6957b0765ff8da397ab98ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935996, "uuid": "1f7d85df-c89b-468e-abc5-83b94ad84f5a", "value": "T111359E9A63947E80D1BE9B7695306490D3B2A8D7DD64868C9884D5FD2FF33407EB02E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935996, "uuid": "e7deffb7-b78f-4927-a85c-c0485b4fccff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935996, "uuid": "c8e3e42b-56a9-4c2a-b542-313797e7b31d", "value": "12288:BaWHeSEyol2yJyKjgL0F2caMmyFQr3R+VYvAcF0:HHeSELBpjgM2chWrh+rcF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935996, "uuid": "3156e4db-4083-4364-a85c-0cc73c08c608", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935996, "uuid": "a55bd393-9f9b-4347-932f-74323fdf3a7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935996, "uuid": "4ae952a4-a7b2-4d6e-a95b-a1e2ae25c903", "value": "SecuriteInfo.com.Win32.MalwareX-gen.11623.11277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f66b6b-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955807, "uuid": "04d7615d-6b86-41b3-abea-e62805c8d7fc", "comment": "Malware payload (Mirai)", "value": "260317b83a2ef826e5b5d742501e3877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955807, "uuid": "53f43f9b-5547-4963-a990-af261dd7d64a", "comment": "Malware payload (Mirai)", "value": "071f0b9b05b44049a3f83b6eaa53f2ef44ed315b1117c2fdd554f090a9601968", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955807, "uuid": "65c1c8f6-f032-48bc-b70c-77671759589d", "comment": "Malware payload (Mirai)", "value": "c5ccd551f3fcc88f1906f6f157ef013defdfac21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955807, "uuid": "b496e702-8c0c-4257-8896-f4f73c8ebefd", "comment": "Malware payload (Mirai)", "value": "091cfd5bcb209016fe2853729711b07dbdac5e8fd310035ec1d359a74fe1f723d28d3bc51a124d0d128debc5678fcebc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955807, "uuid": "2ffc8bfc-c222-4743-91fa-7a50d60bb13b", "value": "T1ECF2E16A56C8E504D8668374CDFC2ACFA515D33E1BACCD23539875F69AD0BAC37A01A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955807, "uuid": "09e6d249-3dbf-473f-aa18-655bbecb4d00", "value": "768:XFuZjYuLqM1RLxh97qXitqnBVTvi2/uWo1scmYSOpZu4ntnbcuyD7UHQRjw:hsqM1RLxhKi4VTviccbS8rtnouy8Hyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955807, "uuid": "80df7fa8-2c01-4c17-aa73-b06dd91a5d97", "value": 35104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955807, "uuid": "ce101a3c-0d5d-4ddb-b8d8-d081dd8237df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955807, "uuid": "4cdf2e03-2182-47a2-9393-59d264c92416", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9069ec27-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Adware.Generic)", "timestamp": 1748995073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995073, "uuid": "9dfbc5ca-009d-40b0-8f9e-27182f6c9320", "comment": "Malware payload (Adware.Generic)", "value": "b4b432e4206ef432efbf9bcfabbba83d", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995073, "uuid": "fd86c928-23b8-4df6-a7d7-7fdf3100cbfe", "comment": "Malware payload (Adware.Generic)", "value": "08e5ac045972aec949a0c0616e152aa17ea0f668a3844711a87ce315fd50a6b9", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995073, "uuid": "a8c0ddc6-fd1b-44c9-be50-82944ef515b9", "comment": "Malware payload (Adware.Generic)", "value": "f86830cd6e0b6ffba324251be3dce69853ecd64e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995073, "uuid": "bc47c416-72ec-4124-a621-eb20297eaffc", "comment": "Malware payload (Adware.Generic)", "value": "1a9cee64c4315f878b905da44119581b3a05644a8a10e3b052725b230ed53c5d351e460751c9449a8b8d0e5bd397e50b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995073, "uuid": "639f4df5-0ab1-4eee-8045-932be501d2c1", "value": "T1AA75BF3FB268653EC5AE0B3245B39360997BBA61B81B8C1E47F0094DCF265701E3FA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995073, "uuid": "7595dce1-7103-4978-aacf-8d8e2b58d79b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995073, "uuid": "4daed968-e07f-4d55-bf2b-55c70b75a796", "value": "24576:67FUDowAyrTVE3U5FLLmTRecMAGBSHoG+trP9YeuPBByl2C61:6BuZrEU6TCTBSHlmuLyr61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995073, "uuid": "c0151663-dc68-468d-8e88-5ddc2c607d96", "value": 1607798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995073, "uuid": "39b8c360-a4e5-4e1c-9016-076f0d12e338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995073, "uuid": "bf45ef34-401f-446c-9179-2c3449a39d0f", "value": "SecuriteInfo.com.FileRepMalware.21825.9389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83f01e3-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MetaStealer)", "timestamp": 1748931118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931118, "uuid": "c2adf829-3c3f-45bd-b3cf-af37e884bed5", "comment": "Malware payload (MetaStealer)", "value": "dfe375e0f62dacfc9fe97eb8b6abd324", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931118, "uuid": "315e5eec-0d4a-4ab7-9566-9bfde6579a1b", "comment": "Malware payload (MetaStealer)", "value": "092bf52aa8665708edda64ba3a4c84629727868ba7adee56b3c6ab170bb92028", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931118, "uuid": "6f52bdc8-b03f-4195-b738-9b63d0a5a488", "comment": "Malware payload (MetaStealer)", "value": "545c29dd86a5307a010469fc2b503bb4e3ce8934", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931118, "uuid": "1b7fd32d-72df-4246-b70a-7075fe089e15", "comment": "Malware payload (MetaStealer)", "value": "ddd3a63dbb856c5f4d43eab7d787772dddd0385b8714dd9e6695d36b73f37c66de8903c78eaaa39a1b4c3a14b37deb81", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931118, "uuid": "92b8132b-6dc0-477d-86fa-d9a1604aca16", "value": "T17F5103112BFD4716F3F38D7A54B7991665377986EE61CA4C01A0410D4892B00EC35F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931118, "uuid": "2b5791b0-8e59-4272-b025-b6da17379378", "value": "48:8EzlRW1aEy1N3ZGnfYMK2dyRiXuH8mWjPGL:8QcoEwTGfCCuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931118, "uuid": "5abdee24-245a-4554-82ca-51ffba1e5dc6", "value": 3123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931118, "uuid": "6cdf280c-8b05-421b-ad8a-6ed03d0d0a8c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931118, "uuid": "b4228c48-241c-41fa-9468-dae8f3f019c4", "value": "\u0421oupon40TrendFinders.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41230f8-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956962, "uuid": "db25931f-ee44-4cbb-8784-b7171fc963b1", "comment": "Malware payload (Mirai)", "value": "846b98e61f0a4ecc0a4fdf08ad16aaff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956962, "uuid": "5ada5acc-e5b9-43ac-9767-32734f2be912", "comment": "Malware payload (Mirai)", "value": "094b51ee02c7b276be834bf6ca9e23cc63273f1e14133bab318ece342a9d2ba8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956962, "uuid": "58d01694-575f-4809-90e0-57ae4993b3c7", "comment": "Malware payload (Mirai)", "value": "15d096a7962b2a3803ec76f4a0836922094b2027", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956962, "uuid": "bd995fd8-36cc-4b5b-a891-0b7d99d268ac", "comment": "Malware payload (Mirai)", "value": "45f066eb110167aa14b3b3af49b0b8d5c928762fcbd5d16a15c3905a30557130639b1a73bf56c12a956c6c95c91801c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956962, "uuid": "396d3b70-33d0-4570-830a-ab5beeea243c", "value": "T1A5E012ED7332226704980CD8E01594844018ABE0897C97C8A7CC44FFD15CF18A315AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956962, "uuid": "b6d51cd1-93cd-47db-ac4e-a74082e12dd7", "value": "6:dDQqb7jZdDQq1aGNI3ta+fBPdDQqc4ZKjSdDQqmrVREU:ZvZrNNI9vfVCMKjS8REU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956962, "uuid": "a23bae5d-ed80-41ac-9346-30c14ba686f1", "value": 368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956962, "uuid": "1c616021-b7df-4c67-99cc-94409f8df2b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956962, "uuid": "cd4bd073-135a-40ac-8ce1-04f51c1275b2", "value": "lawl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089b9a5c-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748931280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931280, "uuid": "5e84657b-ec0c-4943-8ec9-d08af2f8444d", "comment": "Malware payload (RemcosRAT)", "value": "38a61994411add041e935803e3bed3af", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931280, "uuid": "9c33759a-9a70-4f4f-9e1a-8e10b36a8f35", "comment": "Malware payload (RemcosRAT)", "value": "09b86e5a0124cc1b2149915dab878a2cd0a7359dca941927a9c9394d45d1c55c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931280, "uuid": "d1b94aa2-755b-4f6d-b5cb-9de5e9d224c1", "comment": "Malware payload (RemcosRAT)", "value": "7d1cb854e527a08b21d84c229e4b3485f1d6ecbf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931280, "uuid": "7af205b2-6ece-4946-8a48-3f7f3f6f506b", "comment": "Malware payload (RemcosRAT)", "value": "a12b5cfa2b312ceb5ce26e48115217654f373aed6bff0d2dd950ace92f3889897bb1e6824c6eefdb3ccaa884cd9967a2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931280, "uuid": "b0235a22-eb1f-4d8a-a686-8cc382a59e35", "value": "T1A4E23C67FF2700930D8F2275AE685F2A85A8C75540223C71BFED7B4E8005A6C7B7D929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931280, "uuid": "fc561de2-3a1e-4637-9eb1-7e42d072297d", "value": "768:qkruzxEh4d4WXk8xIcV08w/4uFVpl95sNtWR+lSvTFpUaaAQaxWZjdACVUiCzpiW:sxu4aWXkSI0Dw/4mVplQnS+lETHzatab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931280, "uuid": "57440dd2-e48a-48a3-ad19-c1426ef88a72", "value": 33821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931280, "uuid": "b9aeae9a-3884-4fdf-be58-5c271d004dde", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931280, "uuid": "22da7755-bbad-4fd3-a123-89e93bcd27ec", "value": "1000015394.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db820693-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932063, "uuid": "895d6528-873d-40a1-8c08-17c09081ce94", "comment": "Malware payload (LummaStealer)", "value": "c8eb2d44b177c838b1b381d7480f8f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932063, "uuid": "f222b589-5c1a-4d80-9e65-ca9a1807fbdb", "comment": "Malware payload (LummaStealer)", "value": "09c17e71a2bdb6aec337f54c48b4e5121fdc753127f8f3ea425b11ce4e2a2dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932063, "uuid": "86123fbc-fc78-4597-a1c3-ffda039599f0", "comment": "Malware payload (LummaStealer)", "value": "85b6649e313449bec768c5f41980d15d106bd278", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932063, "uuid": "19194f36-7a8e-4e6a-99de-f9f7a1101d6e", "comment": "Malware payload (LummaStealer)", "value": "c078a9f03253632ef34d023993e55c29ca94b69049eb520cc7c06a391e9e2977077fd54189cda977a492aff95937f19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932063, "uuid": "7742e7ea-10f1-46a4-96c1-bf50db8e27a9", "value": "T17D95332F7796B71ECC306BB26AD3D4513BBDE48A04916A564FCFA93809C35CC16142BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932063, "uuid": "cdda6f01-ff0b-4cd7-9a20-2538524fcbc1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932063, "uuid": "310c655e-53c1-4c5f-9034-77febc66d245", "value": "49152:c++2FOreOlkrS47dMJFCuaX+lc0yZcnsRL:Dp86Ekm4JjZ+l9ekSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932063, "uuid": "113c3b0d-cb5e-404d-ac52-7bc78e0dbcf8", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932063, "uuid": "f03abc9e-485a-4ed3-a014-abb7f8d5b878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932063, "uuid": "b65be475-ccfd-4b85-9e0a-ef073a327aba", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb973d3-4044-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748932473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932473, "uuid": "0a49d9c3-c908-4f5b-915a-d10dd20b9b2c", "comment": "Malware payload", "value": "03d58176b11fb95994978f54ce6d0b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932473, "uuid": "2b916c18-2419-4ab2-8b33-6af76c69622f", "comment": "Malware payload", "value": "09c778062957fd9c4cd0e21a8a2c384265fff6e10431316b6a72231727be5aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932473, "uuid": "76770e69-4137-47e2-8f3b-239b828603a3", "comment": "Malware payload", "value": "c3f406211878f496a529f57d23678243739aca8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932473, "uuid": "6ff84099-e86f-4aac-a4a0-21d7c8d835e1", "comment": "Malware payload", "value": "531da90b7442439c297d8d4f065d2d7b99668ea1cb3d8068908c2289fc30ca6c29f3cca0700adf7a2402ab84298b1225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932473, "uuid": "29227e32-2d24-45e1-aa00-cbb592b1d52a", "value": "T151873341F38208A8F55A25B368D0DA6A47F7AD408738D7CA93E555441EEB1E0FF3CB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932473, "uuid": "0e269bb7-f2f8-47d1-badb-eb10952d5e5d", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932473, "uuid": "01fbbfe4-a6df-4bd3-9da4-c600cb9c5b7f", "value": "786432:VeQcKm8W8ci1QtI++nUU0sc6yhclOpJQuyFRbgMSk+:MQ88WXeiI+sOX6yvUbgS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932473, "uuid": "eb12e9a1-791d-4ef2-8652-ad51b53cd230", "value": 37940396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932473, "uuid": "cac11985-011e-4b7b-bdc6-429fc7372114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932473, "uuid": "e8ec0a88-5fa0-4948-b3de-4b3df36dae4c", "value": "bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cc0953-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748931138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931138, "uuid": "0fd1eec0-0e97-4e52-b3d2-9e7a8953fa85", "comment": "Malware payload (Vidar)", "value": "e441e48965a3c875ce923306e20e430b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931138, "uuid": "52d102b4-fa94-4a31-aa4f-d00e09ae350f", "comment": "Malware payload (Vidar)", "value": "0a15114cec5c5ba2fca6b39c372f5b9740dda0d028a70cced50a0c93ef04b9b6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931138, "uuid": "cfb0cc08-9311-43c2-8e19-4f723b4cd645", "comment": "Malware payload (Vidar)", "value": "0cd128c10e6a98b9a0beed599d7a715db69b47e5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931138, "uuid": "0f46d8ff-75a9-4a08-b545-9960a3803112", "comment": "Malware payload (Vidar)", "value": "9703dcf29751988ca9c0c6a50ee233e32aa19779c9446bf4959adda69ac47e505bc839db9dfe532c4345ddd7e4bbdb5c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931138, "uuid": "1d5fac2b-b7f9-4b36-853a-5b2fe777b9c7", "value": "T12C31D6380EE202EAE6738779ABF973B38425FB92DD6556BD114063415722110F867E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931138, "uuid": "9f86a1ff-5aef-4171-8730-f901520a74fe", "value": "24:8y/BHYVKVWO+/CWuOskcxaAcaUzQTP7zJm0sHCEJZarab/BiT:8+5aSpkDmXTPvJUiuZ4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931138, "uuid": "ab50b11c-6e61-40dc-9977-9c013d1ae7af", "value": 1606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931138, "uuid": "2d282cd8-943e-4945-955f-1ad14c099b2b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931138, "uuid": "b734e2b9-bb6b-40f1-a668-eb9683e684f6", "value": "SharenVpn_Setup.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59efac17-40a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975655, "uuid": "31deafd8-8240-4578-ac80-7e21ff111dae", "comment": "Malware payload", "value": "0b99de4b4af0c4907d5a944d8924e434", "object_relation": "md5", "Tag": [ { "name": "213-209-150-143", "colour": "#340105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975655, "uuid": "139aafba-ae1b-4fe2-9e30-9600328cf4e0", "comment": "Malware payload", "value": "0a34339d1f82bcef40ed241b4dd8d3f3a69c34d158c059a26c45bbc6b24ebb59", "object_relation": "sha256", "Tag": [ { "name": "213-209-150-143", "colour": "#340105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975655, "uuid": "d919b765-8516-40c0-8525-2c16410dfd9c", "comment": "Malware payload", "value": "377e1f877fc4892b126fd762867fa8456b559f23", "object_relation": "sha1", "Tag": [ { "name": "213-209-150-143", "colour": "#340105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975655, "uuid": "e02cbaa5-24f0-4ff6-b304-2c6a73d6e3ff", "comment": "Malware payload", "value": "5e635b47e11345d34a4289deef5543169b9f1495256c0d0e4473bf6f06ac9b0b6c04bba5a96de8cd28dc368b3445d011", "object_relation": "sha3-384", "Tag": [ { "name": "213-209-150-143", "colour": "#340105", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975655, "uuid": "e0c394e2-c592-4a45-b2f0-e78c04a423b1", "value": "T1023633805DC5217CE39B667C2912FD6F70FA19F9DA108C7B846A2BC74A53A1D7E32213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975655, "uuid": "3087ab43-656b-48f3-9ccc-043eadcca059", "value": "7d746b91e1e57b358f148ed3374f0079", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975655, "uuid": "d4131b97-ace5-4915-9fe0-583d02b1706e", "value": "98304:1/ohfyCBO8ieDg3eHdIQlFg19GVZv+Lyf2hJagyhsLJnXjIXL7jajFo:y1yAO7OUXGV5uhjqsNXjxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975655, "uuid": "6a16f984-c58e-4813-8eca-b39e646aee81", "value": 5094400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975655, "uuid": "acd33887-86ab-4e63-a11c-ddd857432659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975655, "uuid": "4aa09b6f-44bb-402c-a4ed-7a693539e4fa", "value": "v5.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c62e129-408b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748962720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962720, "uuid": "bb84a0af-4def-4f5b-bc88-11b000db711c", "comment": "Malware payload (MassLogger)", "value": "bfebfa38ed9b453150c475eb18de2e07", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962720, "uuid": "26ebd6b3-5f23-46c0-81c7-41fdaf5cb870", "comment": "Malware payload (MassLogger)", "value": "0af487f2593b0de4f0a394b4c440ff04e08674f42c77f9cd922a819fca5b7ed8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962720, "uuid": "ab110b03-8fda-4715-b45d-25ffc29e2c74", "comment": "Malware payload (MassLogger)", "value": "d535153ca720218a05a22d5446e7e121640fcd67", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962720, "uuid": "a8d219c2-b9fb-45bf-922c-7e16f803eca2", "comment": "Malware payload (MassLogger)", "value": "180a6b58a7aec8402243e82841b807b2fab2dc27c0ae4ce43cab62d19f6b99e001efbcb4e5ad28bc101c40365f5f5807", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962720, "uuid": "65ecacc5-fb47-454d-a2ea-a3e56c4fbccd", "value": "T108425381BD22DC90A3C1C134AEDF84C5EE6C9F1E48523929305C96C837673A469DA9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962720, "uuid": "87cf0b12-5998-41d5-840f-dad66acb066b", "value": "48:3vTkveZSZwveoSZa4T7Wn6nt/AwlcdIxyeUAl66t6JcveMvex4KSZ3veyPG:fTg+1DYTqn6tIw6dIYeU4tyI5Spm1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962720, "uuid": "09731caa-8c68-4e76-9406-a7d5f64e5134", "value": 12158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962720, "uuid": "bf4caab5-bcad-482f-b48f-9f66459150c7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962720, "uuid": "e204a668-5c4e-4e1c-b6a8-32eb80faf822", "value": "egivemebestdaytodaywithgreatness.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fab94a5-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944633, "uuid": "cd62a1c0-7e7e-45cf-a63f-57a1c5c340f0", "comment": "Malware payload", "value": "5bdee85cb7a384c2af8d07be1fbb92c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944633, "uuid": "f64847fd-a02f-4849-a6e2-204a88d5d078", "comment": "Malware payload", "value": "0b726a26684dff36b5fdb907f0bdb37cb30e29aad3da564b40b462baef977d4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944633, "uuid": "9ec46b87-6867-4491-87d0-7f05b6a8fb86", "comment": "Malware payload", "value": "ba99b37661bed7d545cabba129e8c70d4d4b2079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944633, "uuid": "933a8773-0964-4e49-9909-1069bc62e8bf", "comment": "Malware payload", "value": "b7dfdb93c7cf3b685703b08983bd39972f8a25c641e9cd8ddb46d560192acbff45d4f6f7093d0f98c9210e8eaa18f4d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944633, "uuid": "dcbf3710-67e7-4593-9327-5f1d98a8b7c2", "value": "T1EA2633FF69072D3BFA4054B899C14313EF4257184EEAAFD9324D026C7BA726342657B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944633, "uuid": "c0eddc0c-1bde-4447-99ae-c611be77c2d4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944633, "uuid": "745985a0-84eb-4b38-a7c7-2f7ad6f172e6", "value": "98304:+BX3xYkUSirfK9ANfdKUxC1amBBa7ZVND29am9v+0I:aX3xWBfKIKU41Hq7ZbU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944633, "uuid": "f056e71f-87e1-4c97-b314-cd4825f52de3", "value": 4756992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944633, "uuid": "8d71cb43-c529-4541-ad69-19fbacadbc56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944633, "uuid": "44f564e0-3f99-46c0-944b-1bf34c11da8a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22458061-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748944637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944637, "uuid": "45eb929b-285b-4a28-9ca7-9216dc6bb4b7", "comment": "Malware payload (LummaStealer)", "value": "db00b77ce551aabd508f1f236c2c9bdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944637, "uuid": "d10583de-da80-4cb3-ac55-d1bb0a3b16e0", "comment": "Malware payload (LummaStealer)", "value": "0c6d0f3c3386fe733614834cacfb1f3964658d8eeb1d752934f52305ed42cde2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944637, "uuid": "5273940e-764c-4037-8583-49132be29b26", "comment": "Malware payload (LummaStealer)", "value": "c3edbb2489d84bdc7e6373287c9d0258d3f0c232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944637, "uuid": "fb92335e-e66c-47e6-ab36-a589a1f7a064", "comment": "Malware payload (LummaStealer)", "value": "489eb21cd64d0435681da54842d2cde81708f9ae1441e5e59dc38640599789944576d9883c61a1ff0aef12b07c2ce122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944637, "uuid": "3d8aae77-3fb3-4a8f-9c68-2ee0101ad181", "value": "T1979533BB70D5AC4AE3BCDBB27B846D744A6BB01A52FDA6DDC42761D8E09C420277C05C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944637, "uuid": "043cd70a-3e21-4cb9-adc6-cf951dbea84f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944637, "uuid": "d1ecd491-a6dd-443a-b24b-eebca7597272", "value": "24576:fRuuJIXl8BZTYpUeR5Dt47sy65EYVi0uIPQGiAsr0zlVajgzCq3LqeUEUk63DHIV:1rB+aLp6aDAYGKIJYjgzCq3IEBGHv5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944637, "uuid": "0200c3ca-f05b-45bd-93e4-6757809e53e0", "value": 1908736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944637, "uuid": "7f51a026-7549-4297-a6ca-376099c73037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944637, "uuid": "8cd65329-6e04-4147-b9dd-e1cdf044db2a", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f63015-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963805, "uuid": "00275a28-56ab-4406-ba10-ba9a589f0379", "comment": "Malware payload (Grandoreiro)", "value": "bfd6b269e5079a1b7f4db3abda97d1cf", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963805, "uuid": "2a671901-645f-4e64-83fd-0cea20135c2c", "comment": "Malware payload (Grandoreiro)", "value": "0d6fee38edf224e4e76dfeb242f91ca07a02317faefc6aa8f4b28c8eb958dfcd", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963805, "uuid": "081431d9-e4b7-49e0-970e-e3ae9ce9cf7e", "comment": "Malware payload (Grandoreiro)", "value": "7706127133147a651c8fe7ec2d9c2c46e7e55f19", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963805, "uuid": "9d625b0c-09a0-4016-9768-7c8530a79eaf", "comment": "Malware payload (Grandoreiro)", "value": "e06d7ab1831dfed338c6e6f94bc93911903592abc29779d1dc2b0ebc78626c094e551affcfe9be2b97d813bed2aa09bc", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963805, "uuid": "4a909c27-52a3-4009-86b2-9c33e15c9253", "value": "T1AAD533E75CA14713DE858F27A27621610278E51CA37ED8DEBA2D232C5ADB57FFE00844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963805, "uuid": "e424a7e8-e9b4-4666-a96b-776d21233ff5", "value": "49152:kSl3ARLdpu8iq8rNk1wgsnSUdnNZrNg7QwaK32koiq5o0G44qA7XNtrXba:Oppu8iq91wXhJNFe7wgq5o0G9quS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963805, "uuid": "a569f411-4489-4a3d-9a8c-fe02d920bee1", "value": 2873331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963805, "uuid": "93ebaff1-255d-4003-8de4-1174ae28aba9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963805, "uuid": "e9117e5a-38fc-4aa0-97dd-e606074965c2", "value": "0d6fee38edf224e4e76dfeb242f91ca07a02317faefc6aa8f4b28c8eb958dfcd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef5cb06-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748931317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931317, "uuid": "9b4fd24c-f5a8-4a92-8c34-2b829fd0caaa", "comment": "Malware payload (MassLogger)", "value": "29dbd06402d208e5ebae1fb7ba78ad7a", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931317, "uuid": "9eaf8d5f-91a0-4a5d-ba7b-8584abf48023", "comment": "Malware payload (MassLogger)", "value": "0e34c369fc2ab097534feac7983c24c9082ce7e88f600b2f30d377145224cc1d", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931317, "uuid": "38fdbad4-4b0e-4640-b9ac-e7a171ada9b2", "comment": "Malware payload (MassLogger)", "value": "91099f3f8ed538a491d084c47f470ba7a3aca9a3", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931317, "uuid": "9d2a786e-cf86-4885-b5ed-14949641445f", "comment": "Malware payload (MassLogger)", "value": "f6e24fa407d4e3feab5b15f229175165c21906e8d987a22ea0d0bbde974326939ade2a32ae21a5ffda40cd6b9da65d5e", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931317, "uuid": "442eee94-8843-4460-b10f-97e92e90897a", "value": "T1F235B35D9060A9D3A054FDF0F551AF97CCDB239416278A021FD5A1AD23268C3FFAE2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931317, "uuid": "e002de3a-1c26-4019-b6b6-a7ecea47597c", "value": "6144:2kwBoUnODZ6UzGTRat31wPsSM1ccs1RS83Jyg2oTorS57JhGb2JyZu+Bkzutgdex:2kwBoUnCabS83Jyg/dSsFztFXeZkrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931317, "uuid": "8a1f870f-ff21-477a-b454-6b4db59da704", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931317, "uuid": "b327d998-22d1-4059-9c1e-74022f2d018b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931317, "uuid": "d7b0fa07-ea00-41ac-a772-72998a18f914", "value": "mmm9908321.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b0e567-40a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748972505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972505, "uuid": "0afe5930-9a24-4713-9411-e9429b21f997", "comment": "Malware payload (Mirai)", "value": "3bc74133f37ce52b85e89929a96dfa92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972505, "uuid": "3ed91309-0488-4d2c-b479-383fe2f8b080", "comment": "Malware payload (Mirai)", "value": "0eeed171f3296b32e0ac132b1c4ad51e038152a0e58c3796c979ccabe24cd038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972505, "uuid": "7947bc70-1765-4424-b75e-d6a2b7400e0d", "comment": "Malware payload (Mirai)", "value": "a0868c751faba45c64bc868e3b0fda7c143d750d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972505, "uuid": "740b9c1e-5acf-4704-9106-6657b2af9cca", "comment": "Malware payload (Mirai)", "value": "2d537cf4ac66ef1b01e886ef1ef6b159f58286aebfe25c0477e7503c2342d1b02f2bf3090a3a957e372838f6f88740a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972505, "uuid": "edb2ea47-23d0-4e0f-a820-72b72dea5af5", "value": "T139A3C61ABF614FB7D89BDC3709AD1B0528CC655B25A97B35BA30C818B64B34F1AD3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972505, "uuid": "cc7e794e-6c4c-4880-8a88-0af93ba71461", "value": "1536:wyhsQOfbrBVvaa7JwPNAd9PyLBKWZ2ecOy/xZhPX0hkg:wyhsQOfbrbvqtFry/xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972505, "uuid": "9ebbdf7a-cd35-4aca-9b95-acce1824333e", "value": 101044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972505, "uuid": "6f5e6344-3705-44b4-b042-792df49930e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972505, "uuid": "cda77f77-cee3-42f9-9f0a-3815af3ab477", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a556f9-4075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748953439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953439, "uuid": "e1a20f77-cadc-4c55-b1e1-74c18deed774", "comment": "Malware payload (ResolverRAT)", "value": "91cd6d7e97c57957b7551b0ed5a27239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953439, "uuid": "d657ae4c-1ede-4c08-9b33-2f2edfdc881f", "comment": "Malware payload (ResolverRAT)", "value": "0f0b1a17f7beeb26799ba061501774182332bd66a650ba167ec7dbfba93cb3d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953439, "uuid": "00c45d65-42ee-449f-94aa-9679ad2f6464", "comment": "Malware payload (ResolverRAT)", "value": "4fde3e757ae92180297299d28b1f8f8f69351f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953439, "uuid": "0a4455ba-6bbe-40f9-93f1-f8b39260a6d0", "comment": "Malware payload (ResolverRAT)", "value": "94a372f3b94d87fa8cf7cab29c839aa86ee9858945cb00d02d4f724ae58d329cdbcacae4f7c400739bae88236e289401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953439, "uuid": "36fb9581-9e2c-4fd9-bb31-919fba772943", "value": "T141A7AD0372E60095E8B7D2388AA75103D773B8635731DADF326D06152FBBAD49A7B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953439, "uuid": "c1c1f6b8-320d-4809-a21e-fd4b51317a69", "value": "66b10d8b5718b0fd6fb4865843d44280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953439, "uuid": "cde75ea3-a20f-4a6a-b92f-8ebf0116e24c", "value": "393216:C76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yf9nVQx4urYsANulL7Ns:C0LoCOn+29s4urYDNulLBiug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748953439, "uuid": "fb959386-2d01-4069-a971-8c11edf9397a", "value": 46279232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748953439, "uuid": "1d1aafb8-0b91-4613-aebc-c793f788f177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953439, "uuid": "4b8fa327-7cdc-4e71-bf90-598313edb861", "value": "91cd6d7e97c57957b7551b0ed5a27239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb67c612-409d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748970691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970691, "uuid": "044b4c07-f678-4bbf-9784-dcacd646a118", "comment": "Malware payload (LummaStealer)", "value": "22778b08c971f5b46bb36e0cef2f3c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970691, "uuid": "e47b9543-c797-46d0-a469-0ccf7eae838b", "comment": "Malware payload (LummaStealer)", "value": "0f942dc50d4e0b11973eafc57365e6e71a1830b88d3db7d3077604b383c8386c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970691, "uuid": "eeaca70f-cedb-4f9c-919e-4fb1f5272c41", "comment": "Malware payload (LummaStealer)", "value": "2ae3bc11f6910026a7bbeae36b4a4a2105976102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970691, "uuid": "6b4949da-b2af-42fa-8acf-9abedca5c7cd", "comment": "Malware payload (LummaStealer)", "value": "233aa0619f291bebf8f5ef05a544a1090abe33311d1af5518122eda39d066f724c388e376b02c7119408c166f4fe3f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970691, "uuid": "f0d11cc1-545d-48cd-9e24-0df40e01ab47", "value": "T10AA64C316B1043F5DF8315BA9E1BE7DAE92CD111231114DBA28E0A4BDA438ED5337E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970691, "uuid": "511c5bcb-7777-4335-9419-4a0ef35c918f", "value": "e28c63ec2b67f22960e72d10513cfad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970691, "uuid": "e83dabc1-f8ae-4bda-a3ba-95a2243928b8", "value": "98304:XZTPxkaWWbhw+Vbvf9e9rooIBRsLOwMAHVJ9Hj9M:tJW0KoTZo2RsLOujC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970691, "uuid": "d44e2468-497f-4595-a96a-7ffb985ccd5a", "value": 9938498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970691, "uuid": "3c344e07-4412-4b8a-a406-73b5cb3fc0aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970691, "uuid": "075fee97-8657-42ed-892a-f02e64cb6f1b", "value": "SetUp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6869d52-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Arechclient2)", "timestamp": 1748931142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931142, "uuid": "22cc7ece-baf0-498b-8e74-855d82d27d47", "comment": "Malware payload (Arechclient2)", "value": "518f2dcee12563c9ba54932d4d4cfe63", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931142, "uuid": "37e53b52-b2c9-4660-88b8-9621291de477", "comment": "Malware payload (Arechclient2)", "value": "10a18ee810b5a4708369adb73b635d861ac394c545d0f14d8db3cbebd506835e", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931142, "uuid": "9fb17a50-fa04-456b-848c-a397bc6d7616", "comment": "Malware payload (Arechclient2)", "value": "0df32463f581329015568cf10ea7dadc8197d2d7", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931142, "uuid": "14d3b9cc-3013-47d9-b01a-493ba0f2a6f1", "comment": "Malware payload (Arechclient2)", "value": "e28e18c8b182f2e2898f3a3552662ceaf9dca4df346327d790afaef4d1a0135a802391e4e578d56dc42c6c89f1c0924a", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931142, "uuid": "0fef23e6-0db7-496e-8122-eca1b4c482f2", "value": "T10F511F6227F50B29E3B78B74157BA250973BFD14AD04D71E10605B0C58A1A2CD83DF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931142, "uuid": "426e7927-c345-4d09-878b-0136223c5513", "value": "24:8JgtCkP2WyZ0K4KWO2WAlWucbQqEUwoSGddNXuHY8ddGRgGbvq+3Ym:8JyC62WyM/N+bQnGdLXuHJdGR/bvfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931142, "uuid": "f50c0d0f-f40a-4776-b95d-a653c0b8aad8", "value": 2463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931142, "uuid": "3a30f4dc-c765-4835-850d-223fdcd4fd45", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931142, "uuid": "33807908-40b1-49cb-8503-c8199c07f706", "value": "IRS_report_2025.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9117aa4-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748994256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994256, "uuid": "40e0d194-4b29-4746-8140-585bde0f0163", "comment": "Malware payload (Gafgyt)", "value": "387dc0672462cbb025543c1e12eb92c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994256, "uuid": "f122c845-a0ce-407c-af60-53cc05f223c8", "comment": "Malware payload (Gafgyt)", "value": "10ccc249d2f1eace96ce8047286875cebd357c2a7ecf6efaca0d061708a39b6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994256, "uuid": "ef237b60-dd83-411c-8d44-e3865114c5b5", "comment": "Malware payload (Gafgyt)", "value": "97175eb99770d49276817cadb0754502286a0604", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994256, "uuid": "b9f6f9f3-3b7c-4f39-99a1-325b5c882431", "comment": "Malware payload (Gafgyt)", "value": "65e110cc7d56001183f9fb98786081facf8fbe2e577c85d4abe27000810afabef8531ea5eefda1da8451daa168409c0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994256, "uuid": "61861829-7f83-4aca-b9ca-14e6124a117c", "value": "T1F5C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994256, "uuid": "ddd99827-172a-4f0a-b89e-e368af3be2bd", "value": "3072:hQrFRNfuLrGhEPOD0jg3gNlmBoHQuQekQnYW:IFzuaEGQjg3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994256, "uuid": "df9062b3-fcad-491e-a8a0-a3dcfda2a489", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994256, "uuid": "c841a902-7617-4851-985a-7ad44f8eb004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994256, "uuid": "510180fa-7b99-4abc-a195-94c3c8d83c14", "value": "co", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b082e0-40aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975961, "uuid": "ae476a89-bc77-49f7-ac41-b1b0c57d15a4", "comment": "Malware payload", "value": "f1cf69d668876d1d39d6e95eb7204484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975961, "uuid": "a81932a6-49a8-4887-a610-d762ed92edb5", "comment": "Malware payload", "value": "112b7b52f42a0e2f37815ae6ce877eb5ed43b51463a08cd131bb4b2a7c16db6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975961, "uuid": "75f1d55e-00b0-4166-a04b-6601d8d1ff0e", "comment": "Malware payload", "value": "16263a2acd2e7ea93b1333d7bec94041e2c30084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975961, "uuid": "c01ff624-7f7b-43af-9bd5-7745fe87725f", "comment": "Malware payload", "value": "1cc65c61ac0b1a683991d4dd28ed547c4d32874aa5d17960ba93ce4728cac620cc8af350af298447631c3b56d6822b09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975961, "uuid": "c7a4488d-238a-4cea-8d31-d89e8c93cc33", "value": "T175D7494666EA0481FDF7EA348AF65513C633BC166F3185CF620C1B2A1F776E08976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975961, "uuid": "f1f3ed6c-5211-4209-b2d1-3d1babb0d0e7", "value": "be4fab12f4723443ba169a0e35943ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975961, "uuid": "494672b1-4e47-4139-8df4-d835a7e338e6", "value": "393216:SsqGxqsktO5GG02US1P+/U7q7K0mAb5ZUjcDUND3usyBvaRRMV+o33irYVI31BL9:S4lmOIUMFCrYVKAGmjvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975961, "uuid": "e7621ace-af5d-4289-b9c6-5a082387669e", "value": 63425508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975961, "uuid": "82655864-41b0-4ead-b3d9-a63c484505d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975961, "uuid": "84a3493d-eea6-4ddb-aed2-4cb3f8234279", "value": "LaunchMe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4865d3b4-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748930528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930528, "uuid": "e4463e02-cec6-4e30-b622-b5b8214b4bd4", "comment": "Malware payload", "value": "4864a63b449bdde0acd99a9a01a73c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930528, "uuid": "4de5903a-fce0-4791-9936-b156cbc6d1a5", "comment": "Malware payload", "value": "115230b6a6df985f38684694c169b18251559414197c1e681d880dcafa23cb98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930528, "uuid": "aa954f5b-809b-4cd8-a0c5-29eaaef05e6a", "comment": "Malware payload", "value": "aa87fa06a4aecb1e910dd677e0e5ba268e8ebbdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930528, "uuid": "422a907d-28c7-4462-afe0-c61e15ff6b87", "comment": "Malware payload", "value": "53c680b6568994ae0f4c51655d758b295bc2873d198b02c4e80bb42bd2223d30db6b4484a33ef7622d68bc8cecf78dfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930528, "uuid": "cf58c3fb-7ad8-4096-a93f-147f4589a440", "value": "T173A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930528, "uuid": "b64fd49c-c993-4212-b867-b77ccdb66a40", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930528, "uuid": "0003b320-cc6a-41b7-9d32-f1975fbfe9b8", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930528, "uuid": "81315858-f67d-4d52-96f5-1c0bfa2227e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930528, "uuid": "2031c59d-7e41-4c5e-9cac-b4cc515a2ad0", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8f4144-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748944713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944713, "uuid": "dc4edccf-d915-4145-b949-bdeb7e9c956f", "comment": "Malware payload (Formbook)", "value": "fd41b4201f0511d85957b94bc64e2790", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944713, "uuid": "0ac8b184-2dae-438a-a79d-1a2cf04ba491", "comment": "Malware payload (Formbook)", "value": "11aa8ade534f35f3f88dde4fd4ca4182c7f4725f884b12812378f4608cc976bf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944713, "uuid": "c2152491-0631-4a7b-8e2d-dfdafcd7e4b3", "comment": "Malware payload (Formbook)", "value": "951ca75a8509bdf29e994520725b3e60ad8f4411", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944713, "uuid": "65b2d641-834f-425d-84cb-dc20e4b4dc6b", "comment": "Malware payload (Formbook)", "value": "964c796aed8425aa3e23916ae7f490361d8d7d220021fa4807fa0efba0dcd022ba360a72220d50071a1544c27e946702", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944713, "uuid": "6a4c7773-3664-4708-9524-5b2a1b59a5a5", "value": "T11B5244098F54ED1E8B14F224B6EC28D2645C97B821924491B09D43E71BDD65D28F99CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944713, "uuid": "7179d40c-fa8f-4b49-b903-575e5f0e5a84", "value": "96:U6wtH6HO6wtH6HlAvQf1QX+Pkckt6u6KtH6HB6/:UltH6HObtH6HlAYSXhRt9dtH6HB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944713, "uuid": "812043b0-a0e8-4b05-b450-306868b7873b", "value": 13420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944713, "uuid": "8444eb03-2870-44a0-91ab-70d21e9851fb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944713, "uuid": "3097bb9e-3925-43c2-94fb-c1cb37851b39", "value": "restartedentireprocessfromthestartingwithnewgen.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182c3cdd-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748930877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930877, "uuid": "f6ad0fbb-b44c-4b0a-a5bd-c32791650464", "comment": "Malware payload (Formbook)", "value": "426df8644cfbe2312ab47d0d57345d52", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930877, "uuid": "ae270639-9bea-4de7-87c1-96ee7719a359", "comment": "Malware payload (Formbook)", "value": "12016a108e323f3ea577aac06d4fbf5e9d60af5ce4c09ef7c7a5fc55fb7d5983", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930877, "uuid": "d2bfccee-4489-4f82-a307-b1208dc96436", "comment": "Malware payload (Formbook)", "value": "63dfd0d6ac6cc89db24eb3c2c55788acae4bb7e2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930877, "uuid": "81f553bd-13b4-4697-99d7-8b16475b2516", "comment": "Malware payload (Formbook)", "value": "47e87de5621abf747ca202aa897414c696d0a50be42709b280c44f2a093cea72a142889ff6d0115b4f6107cd527060e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930877, "uuid": "cf285806-257a-4f85-b48d-3eb58d3a70c2", "value": "T17F858D06BFE1FE5BC954133A89E707692371DC81AB13070B2744B31A6CE5BD85B9B2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930877, "uuid": "bc44991f-362b-440a-b508-57e63dd80dc1", "value": "24576:9G2COCZicZdUvl9/+HUttxVrAZGXGpS6JdAdNH1ROpOuNL8TFmvMjnk87Hz:9XcZdUN9/M01sA56dAdFFTFmEjnkMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930877, "uuid": "c7397ea3-e9b8-4529-9271-e037ca16d9fe", "value": 1713152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930877, "uuid": "1ad39da5-ec87-4959-b6d8-99c71a00c2f3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930877, "uuid": "c3ebc7da-fa75-461e-a4eb-2eaaa975b9bb", "value": "RFOPC7992974472652980098CONTRAC.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94305e73-405d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748943111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943111, "uuid": "1df0f8f2-fa4e-4096-845d-0df11d2350ba", "comment": "Malware payload (Mirai)", "value": "5b304b749b7bdf83590c3f645c1e68fe", "object_relation": "md5", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943111, "uuid": "99fe3919-d283-4a0a-9727-0ebc68d308f4", "comment": "Malware payload (Mirai)", "value": "12ccaa0b9eb15a5e0d4e7d9d370a31fb90442d82af6c53c0ec7ec68baf89e212", "object_relation": "sha256", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943111, "uuid": "e509067a-5827-4b67-8871-c549f61256cc", "comment": "Malware payload (Mirai)", "value": "0fecde696724934755f00497ef625edc1fdf01c2", "object_relation": "sha1", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943111, "uuid": "277993c0-7f94-4d02-993c-75e03b6cafc4", "comment": "Malware payload (Mirai)", "value": "ce0f3301deb9b7995901037fac69be75e23b181a8d0f26236dad49a7ce1098cbc066bff196b41be5fb192974cd5c439d", "object_relation": "sha3-384", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943111, "uuid": "cf60cbe6-1bf1-4a91-99a0-e0f5b9b8a481", "value": "T142864947ECA108E8C1ED853486669657BB717C894B3073D72B60F7682F73BD06ABA350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943111, "uuid": "ac373342-1566-4d0f-99e9-091f77c35296", "value": "98304:d9IDh2F9GysQANgGOWb1xTW7UrgeDaO5YlUbf1hun6QV6acXbp7X99ilAxKiNV09:fpF9GysTeLh0s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943111, "uuid": "3747cf48-a305-4e31-b97f-a6c0666338c1", "value": 8581272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943111, "uuid": "31f5cd00-c3ee-4afa-bc0f-47988878db1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943111, "uuid": "4e751960-79f1-414f-9c7e-302c31f11ed8", "value": "12ccaa0b9eb15a5e0d4e7d9d370a31fb90442d82af6c53c0ec7ec68baf89e212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a54e1c1-4084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748959737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959737, "uuid": "a906d372-9367-47e4-8f53-58a5692aa3ca", "comment": "Malware payload (Mirai)", "value": "e5351e58068e798c92ec0898191d8819", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959737, "uuid": "d532f91e-be11-4680-8843-010c9ef981cb", "comment": "Malware payload (Mirai)", "value": "131e7abf8631d1c23bb93a1de9348a7ff692e8d1720c7bfc4a18213efde31461", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959737, "uuid": "6058ebf9-9d1b-4067-84b2-edd3821fb260", "comment": "Malware payload (Mirai)", "value": "2a2c5b5c7f48a86d4c0222083b9f712213a7cf08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959737, "uuid": "a6679acf-5fda-4eb5-ab0d-edd550dfe28f", "comment": "Malware payload (Mirai)", "value": "81d58fa516bd41795cd6a161e4e6dbbcfc41c2744b8f3492d7b0ea2f7bd05d492a196e3f99a5de6e7be551d6b76df7f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959737, "uuid": "411c9fd3-1184-4293-8585-0bd8f01a177d", "value": "T1E13319DAB801AD3CF85FEABE8017090AB63137505193272763B7FD936C321A49E57E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959737, "uuid": "e70aeec0-061f-42c8-9512-8fd1180d2e59", "value": "1536:JdX2LrnTSXiXFYUAj9GqV6NqqDLJAYnL7QsQ9p5AczJwayM87:JQYPouZvhwXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748959737, "uuid": "28552d77-b7a2-4dff-a95c-dcb34d6a90b7", "value": 50260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748959737, "uuid": "e38c4780-4228-4c0c-82e1-82cebcd18186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959737, "uuid": "75d96fe3-d926-40bc-b639-07fafd57796d", "value": "hoho.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a55ccc-407e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ParadoxRAT)", "timestamp": 1748957077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957077, "uuid": "6c6ff137-afcb-4d92-9840-bc0eb37d2716", "comment": "Malware payload (ParadoxRAT)", "value": "1578b14e72e801ce2a91bcc0dc6f7b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParadoxRAT", "colour": "#8716DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957077, "uuid": "31c85979-3f77-4b7e-a060-9dea3e63954d", "comment": "Malware payload (ParadoxRAT)", "value": "13e9042f6fa0c525b1cbe97d3273b1c0ae0b63e426ffaeec7caa3e11786141f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParadoxRAT", "colour": "#8716DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957077, "uuid": "2ca9b290-6342-460a-a6c4-33812244fdd1", "comment": "Malware payload (ParadoxRAT)", "value": "88e2a4418a80a80128f03b47ffdadd0848979e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParadoxRAT", "colour": "#8716DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957077, "uuid": "b92db95a-5f77-4008-9ede-5b06612e0022", "comment": "Malware payload (ParadoxRAT)", "value": "7608f7dac555f95724773b9d2071c150c3a44093c8a3ec11f9e89e29b95c69526e481049c9ae3fccc0b51fe2d9296272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParadoxRAT", "colour": "#8716DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957077, "uuid": "3232ca50-e552-4342-b414-416dbd39d6b1", "value": "T1EBC3A30C33807B16EDBD5AB90565E2215AFEEC33D622EF0D2DDA70DC067B3918A51B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957077, "uuid": "84c78030-27cc-483f-ab4a-1aba88c8b8db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957077, "uuid": "4468a482-9cde-411b-9ac3-fd82c303e90f", "value": "3072:01ENY7DQQ+iduqU/uQGDR5Sp4Wd0wUmmTQpCIb+:Mf/+Dt/uQr41wUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957077, "uuid": "e3250f2f-13c6-4513-92fe-ca799e9fd819", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957077, "uuid": "0390a9ea-708f-4be6-b44b-8101fc19ebcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957077, "uuid": "fc08ec73-5786-4caf-b2cc-6f26c8ae9308", "value": "FUPPGP Discord tool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1306251f-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748929150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929150, "uuid": "2e789e7a-3453-488f-ba7b-d39a97967368", "comment": "Malware payload", "value": "fdc36de62917345f78cf5873833e309c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929150, "uuid": "0f8c05dc-147a-4a2c-97e6-0bd040e764f4", "comment": "Malware payload", "value": "13f789f8a222a84ba892cd88ef1485d7b6a166c58a2177a93feb85a545f61566", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929150, "uuid": "c4afc1ec-ce9c-418c-a78e-0f63f4c677fa", "comment": "Malware payload", "value": "9b49476ba3a2da41df9420979f2a0187ba7eb761", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929150, "uuid": "a0164b03-c086-4d8b-9d20-e40627059ebe", "comment": "Malware payload", "value": "a34579d288f1c9f60d0f92de7963917ebd015b180c5bfafe920e226ebf364d8d2619e4e24b21a809c6a255bb6c0860d6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929150, "uuid": "89566e32-2248-47c5-b53a-615b1a3b253b", "value": "T1772141636588681DAD1E02BC80BCBCB55DB8E249272282DA32F0948B10176BCF3765CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929150, "uuid": "57fa2d24-9882-4be1-9562-88e67f4acaa3", "value": "24:6qKA8Ljsj9tkoQCLoQUBq25C7X4ON12inH/e8VQFqQtY/:NwkL2q25CAiHm8Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929150, "uuid": "afa73c1f-03d4-4c8b-a6af-24a7f7e6d8a5", "value": 1361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929150, "uuid": "67bbb80b-2682-4070-8f54-f4d657934fbb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929150, "uuid": "d880ed4e-8d06-4df1-a45a-e88558d97abe", "value": "final.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4610f0d2-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748930524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930524, "uuid": "1721cb3e-076a-4d69-b21b-78d2555d66d4", "comment": "Malware payload", "value": "a4e1524893c9935fd2927051a50311bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930524, "uuid": "411e666a-7a91-4a6f-bb00-1e18fb07ae37", "comment": "Malware payload", "value": "13fe7fd93ba8fe36e073a80eb3ba45ae4d44d633b96b65c27a08cd6bf33053b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930524, "uuid": "6096257b-def3-4a3a-96eb-eeabdf4f8bbf", "comment": "Malware payload", "value": "4c2b1492bee128a06d55fccf78120b2ad211e016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930524, "uuid": "a69b6b4e-b5cf-4d3c-ad33-a9dd29af57ac", "comment": "Malware payload", "value": "a54197a5ffde5bb049fea6bd65ca5703038ecaab3918c8b5f47734dd563f92c9de21b6a833bf044a401aa50884ad3965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930524, "uuid": "413efe93-6031-4155-9810-8883cef30e8b", "value": "T109E36186BFA13FFFD81ECD334295DB0912AD8A095295AF771B38D518B64A10A4DD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930524, "uuid": "e8661118-f0de-4ca9-a03d-ddc36aa1bdec", "value": "1536:NidRDxl1rFq+GBX9UvXEH2gmn3bDr85kWExDTlfn2sEl5Wn:No1bXq2gmnQyWE5lfndn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930524, "uuid": "3ae4ed4f-0eef-4c56-8ade-da233126fd3d", "value": 149188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930524, "uuid": "687ccae6-25e7-4c20-93a1-1a3fb3524dc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930524, "uuid": "b220a000-8074-4913-bc33-483ced51896b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3d33ce-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1748931447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931447, "uuid": "d2533218-270f-498c-beac-4a65e2945e7b", "comment": "Malware payload (AgentTesla)", "value": "38603813388713af923098e822cd56ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931447, "uuid": "0e8e34f4-3453-498f-b990-3eb6bc851616", "comment": "Malware payload (AgentTesla)", "value": "15819dc93c187e6498d014ef7c1df5a2c63be6e77772a10d9aa214c5f23ee2ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931447, "uuid": "816afbd0-6ba3-4a60-b89c-baca8ee1cf7d", "comment": "Malware payload (AgentTesla)", "value": "d3aeb4b6f3c31dae5abf61dfb8207959e67865ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931447, "uuid": "544ffbef-8773-41c1-95f5-7d60d4ffd37f", "comment": "Malware payload (AgentTesla)", "value": "e271c33145d9fe5ee885ba5ee3945d5d4eb7e3d4c98cb0d5ea3b1d04ab1e097422d7f0ac8c4100b6bdde001f8274a177", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931447, "uuid": "a15d809c-c131-40ad-8994-cbf44cbc21b8", "value": "T10FF4028F3BA1C213E0BB0B7456A2E1B8577BADCE8852E75B5FC82D9F79127481171384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931447, "uuid": "b013473d-c7d5-4a3b-8424-6c723da832f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931447, "uuid": "1f7292f4-232d-428c-bb43-f50155434c78", "value": "12288:W2DmFtHQWbjd+L70ecrCH5YaMXJSsUWyd0qnbQOG8jjgn8Y1VinI:9SFdQWbQL70eqCZYu7WFqb+Kkn8Cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931447, "uuid": "aec60d85-ce0b-43e1-9fda-73ea03ba37a6", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931447, "uuid": "9a6ad580-ba6f-4b0a-a358-205f161f0519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931447, "uuid": "4e6a6c9b-fcc6-43b2-b815-808acdaba952", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b997f1-4017-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748912810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912810, "uuid": "067e70c6-ed4a-407a-a9be-74d6a91d5b57", "comment": "Malware payload (Mirai)", "value": "08416a1ef9a5bfcc77131c34af46204f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912810, "uuid": "d2b2d9a0-0c3d-49f2-b33a-e52400874abc", "comment": "Malware payload (Mirai)", "value": "15b63c1681574153b1da9bb4a969c9f76efc65583a0833ee9c3bf72d2d2f79c0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912810, "uuid": "9c80c8ca-2576-46fd-a0ce-e3d594fda095", "comment": "Malware payload (Mirai)", "value": "a937aae1f87e2d8c6399c3a7ae875a229a796491", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912810, "uuid": "04a5aa7f-d2d0-4329-8e6b-b4c412d470a0", "comment": "Malware payload (Mirai)", "value": "4d23b1890ce92fffa5d7f2dbd90f387f95d6bad161f8f877ae71b60f6be798257c9713fc30780732b8e61a3e504721a9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748912810, "uuid": "b466573f-04d1-4a46-b7ce-7a6c80f375d1", "value": "T1F921399960B0E02E447FCD497CE8A0E014A1B2E698A0BD44E87E0CA34EC157876DEBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748912810, "uuid": "9ec7bb7c-f464-4cfb-816f-54fb9a46254a", "value": "12:qc85MQ85+8VsJHGYJHYJKDjuExwKJxZ5a6xGeDVArSuTY/tcLcxwLMx38YQO/NxF:ykgpZpYEXUo9scUyFy8x9XEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748912810, "uuid": "c584f59a-28a0-4ac0-927c-eda65c843076", "value": 1274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748912810, "uuid": "8c67a8f7-9a8f-49c6-914d-f2685678b0d5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748912810, "uuid": "60385eee-0ceb-40b3-919f-967e2139646f", "value": "Tcp1000gbps.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38edd802-408b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748962714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962714, "uuid": "6ebffcd9-b7d6-4a65-8395-c3cc1045ea18", "comment": "Malware payload", "value": "1d10d1e54adb019ea5bb763d88d10384", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962714, "uuid": "8343d9a4-3545-42d9-ba3e-d2903c5717e3", "comment": "Malware payload", "value": "165a30046843f08790dcd1fcaa6922d1adee712003f737aee617b37c3d8aafe4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962714, "uuid": "3a0e94a9-08c1-4bd3-bb82-ebaa15d08c44", "comment": "Malware payload", "value": "91cdcb8385f18b7b0bce442c369f9293dedf7792", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962714, "uuid": "376187a5-de47-471c-96f0-246990e02796", "comment": "Malware payload", "value": "395a6c09e5fee7f55daaabe1e13d162f34736a7a5129d23edf1f7af09b09433031c6a87483aa9004ee6ee9b52e68a1cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962714, "uuid": "5a547ab8-3d2a-4441-8974-9187a7eb1293", "value": "T1A93301D00762278C8265D9753CAD301E8524252F32EA2D102DAB918FF55B723A8B6EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962714, "uuid": "555085b3-b3b1-454a-933f-eae0879d2eca", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSL:8D+CAXFYQChaAUk5ljnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962714, "uuid": "6d1a360f-ce30-40e0-9b4d-0c4220661c34", "value": 51012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962714, "uuid": "1dfd00e6-c9c2-496a-8cce-0f1316ecb3db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962714, "uuid": "b1064984-5e95-489b-a1bc-873836ea8fec", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd83bbe2-4075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748953488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953488, "uuid": "6208554c-2e64-477c-951d-e5ef64f6b16f", "comment": "Malware payload (LummaStealer)", "value": "a1db0b17ff356f4dd3c1673f43d7fe40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953488, "uuid": "ebdbc078-dd1d-4cb7-af71-f4a10aba2d8f", "comment": "Malware payload (LummaStealer)", "value": "1665a5576a0cd571925860e8adf2aa4131792090cbc7cd1c953960312ca0044d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953488, "uuid": "5aea4d73-5ce9-438a-8fc0-c17ba76a41fb", "comment": "Malware payload (LummaStealer)", "value": "e773d9a80a93ad1188fc0b5bfc32810710ee1242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953488, "uuid": "b8b6f4ea-64c2-482f-885f-cecb3a18dcee", "comment": "Malware payload (LummaStealer)", "value": "4c6a14637bb8a7f415a74f312d6eba01d2adf5103c9263278a80a2f58d21b7749d0bd538a9d2d41a5e372a690545fa86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953488, "uuid": "dbecab06-f454-4afb-9d77-a9bdcad189f3", "value": "T16695330FEEA4147CC5C7873126931746EB379E85B869F10AF49AE72C6439F8831DE198", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953488, "uuid": "b9f8e610-533c-4483-add1-6e5d447b68da", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953488, "uuid": "33320cac-6edd-45db-8c91-0016dded55be", "value": "49152:tnqGV0CzriOcRCEJfF4tKt/ti2/Lwl5t:bVPi7LfLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748953488, "uuid": "675d2961-58a3-4f02-8bfd-87ff129f7511", "value": 1916928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748953488, "uuid": "68137872-d743-4b89-bc3a-ddd77cf090ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953488, "uuid": "3147adf8-d7a8-4631-9437-ea271557ced0", "value": "a1db0b17ff356f4dd3c1673f43d7fe40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c26483-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748934704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934704, "uuid": "5df9e425-dd8b-4a72-9b1f-9532dd960175", "comment": "Malware payload (XWorm)", "value": "953c6a8acc80511c4d805084e6c9ed5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934704, "uuid": "4289acbd-76ac-457a-858d-87b1794d49c2", "comment": "Malware payload (XWorm)", "value": "169483831e84d1a6e6d81e4273f327affbe038b99c2b2ba85c182184f9fe0cc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934704, "uuid": "8f323940-ebc0-420c-a145-d72d1e29a007", "comment": "Malware payload (XWorm)", "value": "197ed620f067c4de4daf08a56e913f94f2b576ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934704, "uuid": "97d6f7a0-d371-4e5f-8b89-1877c69ac9a7", "comment": "Malware payload (XWorm)", "value": "c61f9fa4840140a5e5712b0ed9cf8811e6a8773e4fe4abe26fb5143c321aae02e622ce1f3d9d214f9340389f7c48beef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934704, "uuid": "f9887e3b-f331-4b7a-9897-25354fe4f534", "value": "T100D44B34B597C0E7C302673C4F1CE6651229A8665BB427CB33C52A6A0FE62E79717D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934704, "uuid": "e2aa7504-05ca-4a69-a530-bc7d6cb0529e", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934704, "uuid": "2cc398bb-3b74-46f8-b259-e9d222a5e89b", "value": "6144:NsVyC0+9eQ8h81ntJZXHXqkNsomZzGvotZr1+aur9lb:WVq+9eQ8YtJZ3XqTGB9lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934704, "uuid": "c5bd3f6d-3905-4cd4-ac69-38c9bedc4f7d", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934704, "uuid": "f623dadd-4cf0-484f-8e7d-efdd485e62e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934704, "uuid": "fde8490c-3577-4444-aa65-ab874bf2ff7b", "value": "fdiulidcdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d02143-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973020, "uuid": "ddddfdbd-9bc0-4322-9425-10b7ad367cdc", "comment": "Malware payload", "value": "cf69907b012cba61f6f19b24dbb7bfe5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973020, "uuid": "1e02e757-b2be-48cb-a5d0-d2faad913d54", "comment": "Malware payload", "value": "1806ca0e907fb6b954d25d8cf4ead1ab0b1135b07c21cbe913281e3d5175c80c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973020, "uuid": "97245ceb-66e9-4fa0-bca3-564a5c5f5cd2", "comment": "Malware payload", "value": "95ab511ef18b29e0b2690582385f5940be486d50", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973020, "uuid": "8711115c-3811-44cd-8316-fde93f11d0a0", "comment": "Malware payload", "value": "0513016d6766c1f8edc3b7655d44bbd901b2e388813a18ce550110cb2a519de3192ea2ae7adf6039a6342dcd6bc91580", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973020, "uuid": "f6362cee-5832-4892-ba1d-242c925a77cd", "value": "T140A30219533C4D97EC54897F4D87BE4B963BE39A087213DA898E0E598FD63494F27C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973020, "uuid": "2fec8d3f-44ff-4077-9cba-bd9d9ee52281", "value": "3072:MLaM+tLxiCxLHIKFCcmSr/FyM+96rKGhFv:9MqQCFHIYCMrNyM+sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973020, "uuid": "b3868a5f-2c37-4b37-be97-887e9a7c47da", "value": 105646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973020, "uuid": "60de1791-7afc-427c-b0bd-bcf6eb327caf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973020, "uuid": "5cde3e2f-3bae-43e8-ac55-3c108c8166c3", "value": "bloodyv2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471e3437-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748930526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930526, "uuid": "a457f0da-4034-48e5-9a1f-10d3de7f5248", "comment": "Malware payload (Mirai)", "value": "d3e118c6abee5548fa6e759b92f5ad60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930526, "uuid": "ddb1ccdf-1fcd-465d-b7c0-4045b7d12d01", "comment": "Malware payload (Mirai)", "value": "18a220efc7b45f587f3b3b641d2018a4cd7afeb42b2f10ab0c71bef872f72889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930526, "uuid": "78c7d32d-4c8f-4d4c-a479-d8cc76a8f13c", "comment": "Malware payload (Mirai)", "value": "685558f587b3be7591da348a9933cc429aef4d71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930526, "uuid": "caa17bc1-efd5-4d69-962f-409ae1c8bf71", "comment": "Malware payload (Mirai)", "value": "f60da5c693bd274c308ab1c7e0bb1f3d953f9656966d05436b2d940a67e6be9dd3b662357dc523a844fb0901a62405de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930526, "uuid": "9a37b052-b44e-4630-9f93-7e57218e50a0", "value": "T17772D034095A6455C7707073AD7986DAF9AF0BB8D1B23233114817F8BAC690643F8AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930526, "uuid": "91b1077e-02eb-48a9-a948-15c0243a6bfd", "value": "384:pscHGDS17kin1Tt0Cl7DJ4YDiUtd1SG6KjBoshymdGUop5h40:CMMS17R1J0APeYTSBABds3Uoz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930526, "uuid": "e9525cac-9d71-4d5f-8715-b7f870f13df8", "value": 17232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930526, "uuid": "f254c0b2-598b-4f33-bd03-09f128af08b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930526, "uuid": "0ebaaff2-95aa-43e6-93fa-5965b8da91f4", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b25ecf1-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748929620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929620, "uuid": "44ebd350-3e80-4884-8d4f-03f90faf97aa", "comment": "Malware payload (Prometei)", "value": "cbeb4096937e6248105a4dad45415d3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929620, "uuid": "614ae7b7-ec73-474d-9161-ac623779af4a", "comment": "Malware payload (Prometei)", "value": "18afb0a9971692e55980a4472b103210a6f3d00f8475103019aec13db3eee3b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929620, "uuid": "fdf6b2df-3cfc-471c-809f-d45264f1fbbf", "comment": "Malware payload (Prometei)", "value": "b170fcd3ab4a202537ae607986577e10891a9377", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929620, "uuid": "166c6d76-99a5-4db2-a3e1-c3979ec8e4ef", "comment": "Malware payload (Prometei)", "value": "b5fd3d605a3ebf5bdb4b59ecfbfc7a3a18691acd48bfba1c7aed77356b2e014b25b8eed3d62e0c6ace2986579600ea4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929620, "uuid": "6bf86e74-e04f-4e95-a3d4-c10798487b6b", "value": "T11A9423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929620, "uuid": "c161f0ce-bb01-4e4c-b132-ff73f48dd9a3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgo:25WOSACZSV6eKRH5EPiamb4DsDwwc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929620, "uuid": "cacc4ad3-7f59-4162-a310-bf1e1f5d477b", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929620, "uuid": "3847b8df-2932-49a9-a243-2b1f5343bde7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929620, "uuid": "d72d605a-05a6-4e54-bd97-5ecd03e32826", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195eb0f6-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748960943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960943, "uuid": "e02aaf08-7443-49eb-8107-be589ab0564c", "comment": "Malware payload (LummaStealer)", "value": "f590d01d9a734fb46c76de11b8f5a258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960943, "uuid": "cd470bee-db0c-4b18-b45d-986e46acc425", "comment": "Malware payload (LummaStealer)", "value": "1938e5a61e8b1a015d383bdbd6aff3b15fc2d057a808f400f781dbe98b01ad4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960943, "uuid": "10d7ff4a-c821-4f53-aad3-b5958fd1fa34", "comment": "Malware payload (LummaStealer)", "value": "f4869146fb4e2f7cc5b354ef622885cf04a1215b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960943, "uuid": "8e59d3e3-3b3b-49ea-90e8-00ae6869b6b4", "comment": "Malware payload (LummaStealer)", "value": "d852cf76eb33e0c0130be7931721be4c7a78d4757ca0476610e2ed1c7dc60f756ccf07f5888249d3f1fd72b08a7eb80b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960943, "uuid": "f5df5a09-a9d0-4dc3-ac5a-213b4de20277", "value": "T19985AE399152A2C6FC2A40B601A1A5D93462B733C63D2FFF4290F333AD07AD15E6A75D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960943, "uuid": "73bfba43-0fe4-4e90-99f5-ef82d1249db1", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960943, "uuid": "9c1c9b21-df68-4434-8dcd-58cdc756d505", "value": "24576:B9LATjgcql9XDP81Xbe6A5kS/FHBpzJ+PczY8TZ+Q7U6Ycegrlu+Q7U6Ycegrl2:XLA3ibXDk1re61S7pGczY8tHMHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960943, "uuid": "4ac381e1-55c1-4565-a666-6b8126a96c91", "value": 1790464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960943, "uuid": "21580593-c118-4202-8b04-0c67e7ed91c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960943, "uuid": "30f32dd2-c72d-42ca-acb9-648ae83a6f04", "value": "6whDrpz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6030bfe6-4047-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748933574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933574, "uuid": "e6154374-e986-4772-a224-061d4f1c4253", "comment": "Malware payload", "value": "4659a5f9433ccb2f25a3243745669bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933574, "uuid": "29c9c669-e82b-4829-953a-cfa7655ecd04", "comment": "Malware payload", "value": "199f5902ffd9a513a0c3f0d8c4179621c27efefd16bf85508c76d367e5e75cf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933574, "uuid": "c1074a5f-1cd7-4594-ab5b-10c757bde1f1", "comment": "Malware payload", "value": "0da911bdcfdaeedc2c3811b6ef7ace671fad6312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933574, "uuid": "93fa9950-15cb-4feb-b4c5-ad31a65861bb", "comment": "Malware payload", "value": "cb6e9a35aab5bb389e3c91f7577aa8b1aea29e2509f077db6d745699567103f19db80beced0b5532c61690cf691f4445", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933574, "uuid": "07a685b5-bc42-40c6-a45a-1aa8ca38bd9d", "value": "T1ADA41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933574, "uuid": "bd637606-2ff4-4abb-b810-32f4c754a395", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933574, "uuid": "0a77e7bc-3ce2-4102-a6df-081cf2ee0e80", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933574, "uuid": "3b35762f-9b7f-4735-ad52-056e0116d196", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933574, "uuid": "833c2564-8499-4eb1-add6-4f1574450d94", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e230396-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748956683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956683, "uuid": "26532420-56ab-450a-9c99-a43dc38165e1", "comment": "Malware payload (Prometei)", "value": "56670deb9eead82af901f5e6506186ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956683, "uuid": "a3f70409-5167-469b-bd6d-f4e8d96a212a", "comment": "Malware payload (Prometei)", "value": "19b8f09fcf1ff192cbf93359d97f97f025e528dae4f6fa4b2c783c268a72430a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956683, "uuid": "81cae697-ac8a-4670-af7c-f539e854a18a", "comment": "Malware payload (Prometei)", "value": "5ba9d881db0ec4dd62ffb63a7911477fea935103", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956683, "uuid": "1317688e-6174-41b3-a7c5-becb244911ab", "comment": "Malware payload (Prometei)", "value": "5fa1e69a5a337cb3acd046840a54ba103144e82d40053e085a94f5d9fc317cb1e6c506718c6f179de9d3c7d7c3148486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956683, "uuid": "3e16b480-f6c0-4c35-b4e5-e682e62a36d1", "value": "T19E9423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956683, "uuid": "facaa1fd-c0af-4121-9ca8-1a64d68235c5", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgr:25WOSACZSV6eKRH5EPiamb4DsDwwcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956683, "uuid": "3bd5f277-095a-4b06-aace-592b3b5757af", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956683, "uuid": "99373a17-216f-44e7-a982-85717458b22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956683, "uuid": "d4bfd40c-37b7-495c-94e1-cd9eab74415a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d59166af-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944509, "uuid": "dd83f5b3-4f35-4241-8814-3fa278edff31", "comment": "Malware payload", "value": "013cf008d024e83183c8ddc7ecefb266", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944509, "uuid": "feabb677-c0ef-4721-bac0-3e8d9a25add0", "comment": "Malware payload", "value": "1a15c4d654d88dc3f1943361cb69bb5dea90c758a6fe4e8b72e683ba9354c480", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944509, "uuid": "ffdf22eb-091f-4c69-8f70-961cbc52f895", "comment": "Malware payload", "value": "ae271809c8f2bd86db95199dcf7081b42e7f61f5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944509, "uuid": "8f384fdd-25e4-4de1-89b7-021e559f2c2f", "comment": "Malware payload", "value": "15a94dfde5c89333510b65f7d0540175855daf4b8609e5bf793ebe14bc374fa02ff385b7e7764c0210a60f2002b1f5e4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944509, "uuid": "d74602c4-1ea7-4d02-92ba-a463cd4005d3", "value": "T17731DD127BFD4B60F3F24A7218F666354A3BF801E675CB6D0055524C18B1E10AD28F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944509, "uuid": "d4e916a2-8de2-4aca-a69e-dbb1d8ab24ac", "value": "24:8aJ+Jjl3vGYEAU2++/cdHKr3arP0IVYqVRtyncm:8pJ53vNOdHNrMCBbIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944509, "uuid": "9c7c4153-c4ef-4e5e-9339-bf95cf9c3c36", "value": 1513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944509, "uuid": "518694a3-bff7-4111-8a36-7a5020c81055", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944509, "uuid": "3107d758-dce6-4e51-9ab7-2b8d48586d83", "value": "RE_02K503756K0S.pdf.lnk.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b4c57-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1748970840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970840, "uuid": "5d146d25-5ed2-4122-898f-4281d513076f", "comment": "Malware payload (ACRStealer)", "value": "aa64fc1129b24cde6a7ba24ff78cf05d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970840, "uuid": "d79fda4a-1c82-4a2c-a1bf-ba103659f7d2", "comment": "Malware payload (ACRStealer)", "value": "1a246782167b5121312a943b9e682cd2a032b053147bcacb4732434b945b0b44", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970840, "uuid": "7ba0ecfc-e68b-4088-bf98-0cdfbf9c4d85", "comment": "Malware payload (ACRStealer)", "value": "031819c16e59bf49c73ce2844bf1955b1905581e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970840, "uuid": "4d655b01-1743-46dd-8f32-86790a38960e", "comment": "Malware payload (ACRStealer)", "value": "66ab4774ad07cab2417362dc33d0b84344f915533866276b22c32b63dbcd2f506b70c94136c0f039b9d3b27824322808", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970840, "uuid": "db71798d-3f86-41df-9c0a-c4a13b471e31", "value": "T1A9C58E23B745667AC06A1F3A6D27A350983FBE2139625C5BABE43C4D8F360402E7F547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970840, "uuid": "59735236-5cb3-4c42-9d35-1ed25aea8330", "value": "5a830e9855cf76b228072694c3b0e2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970840, "uuid": "ef0424eb-827c-44eb-bdf6-8edcbb1f56be", "value": "49152:ramj2IRUiMWR+bukkfqSk9K5Vm17XZhak5dhEtLF:GnyyH17XZhawEFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970840, "uuid": "b1f56384-0d8c-4705-a4fc-c1a3ccf6308e", "value": 2551472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970840, "uuid": "1f77b9ef-1cc6-45e1-981f-efb27237ed81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970840, "uuid": "7ac9148e-064d-4b21-926e-44799d6775c5", "value": "SETUP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8497db4d-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942655, "uuid": "319a2526-90b1-40a9-99d3-5d78284710f9", "comment": "Malware payload", "value": "e329be9f69ac44c388831184de54df7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942655, "uuid": "719707cf-9c0a-401c-9249-fec3fd494c31", "comment": "Malware payload", "value": "1a80f721ab125b88e5baf77dd2bf01be92ff5299665356621b21306a71c86672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942655, "uuid": "ed0cc2aa-02b9-4eec-9cb2-bb5209c87058", "comment": "Malware payload", "value": "da410379906d769d1d4be47b3b351f8e93f761f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942655, "uuid": "3526ce8b-9a39-445a-a2e0-33a7dda28b6e", "comment": "Malware payload", "value": "38079159b80d064d46c16a8336687839ef2ee36d29816e5ee6c35981a2bf1be3e97462da6d496cf55b572aed9613595a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942655, "uuid": "e6665fc6-5d0a-4448-96ac-354a848784be", "value": "T136037E592B2C4533CB4C0E7CA4D22A534A72B337B553E38FACECA5A418473CA56417EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942655, "uuid": "835f4ca2-0157-4c87-b922-6c0f06d75ba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942655, "uuid": "d3eee01a-a928-491e-9883-8d11de0fe301", "value": "768:5mzUaxahaOeYsYiwupFRIcYAzq0pXIXGxMwAmbLo:5mzDgLhTXEFRIcYAzJpXUGxMwVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942655, "uuid": "9022d206-11ee-49c4-ae36-55efdeaae343", "value": 38704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942655, "uuid": "65c7c95c-dde8-4d5d-a595-05d77544ce2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942655, "uuid": "6fc3e1b9-2e01-4294-b45f-81968111a0af", "value": "1a80f721ab125b88e5baf77dd2bf01be92ff5299665356621b21306a71c86672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a8556-4074-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748952923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952923, "uuid": "ae4a4c8a-b593-4a8d-827b-bfcbd8a4930b", "comment": "Malware payload (Metasploit)", "value": "6c36e1b7dcb6e7015ef0202ba43e59b6", "object_relation": "md5", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952923, "uuid": "788b4e9f-11fc-482e-be81-c60e48be289a", "comment": "Malware payload (Metasploit)", "value": "1a82ce2ddf4c6390a9ac7b2f70b2cbb659374034b4f1ab15e3526c385290a254", "object_relation": "sha256", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952923, "uuid": "46e29b88-720f-4590-ae05-1623ffb7811f", "comment": "Malware payload (Metasploit)", "value": "6739af30f4bea6701c0c9b7e06fd29094d3a6412", "object_relation": "sha1", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952923, "uuid": "b69a29f3-4112-40f0-8919-3bfccbbe0271", "comment": "Malware payload (Metasploit)", "value": "7e2a547d79097a6fb695831c60e1e815c06d5cb68b1ac4981d3a357beca1f2a93343845dedd08076fe7cc4084967c89b", "object_relation": "sha3-384", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952923, "uuid": "7045047b-25a2-4174-82df-bfdeae0c541d", "value": "T1C3714C25125DEB39874A149FA824611ADFA8439EB7F09420F3D9E7EC8D17C5C19FC16C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952923, "uuid": "978b8176-f025-4e99-97e6-4792567c5eee", "value": "96:x9xlfCoGSImpFjnOfok1A+7zLlDCzUMKwA13LFP:fxlx/PnOAkr7zRDCzUMKwA1BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748952923, "uuid": "189be1e7-87bb-4a2e-bd9d-d0e644f8c9b5", "value": 3763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748952923, "uuid": "84fd0ef4-eb3c-4b84-9535-b6765c062e4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952923, "uuid": "2b1807c5-0c69-4fc4-9cbe-eacfb51a2737", "value": "!!.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433a00ff-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973040, "uuid": "c0fddc41-bb29-45c1-87e9-9e23967c2705", "comment": "Malware payload", "value": "f3a583cc5aea0f94e08810abaefe2fc8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973040, "uuid": "9905ba0c-2816-4315-9938-8e35aabfa6b8", "comment": "Malware payload", "value": "1b19724e633f88b7a5b32950693ecf3bea99eca30f50ab2679d6a80ddcd33206", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973040, "uuid": "ddb3bac5-3871-4cd4-8565-0dd307f477fb", "comment": "Malware payload", "value": "5e63ad5d6fb6933cd06f8adabb51cc8fa48b511e", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973040, "uuid": "27a8cdfc-f9ce-4cfc-baec-1672495bbae7", "comment": "Malware payload", "value": "1d23ed6b33548e3cb4b184f4787e97744ed015913ca180aa980ecaa0f9ef2eec386c0b553fe4fa8bbaa658aae70effd2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973040, "uuid": "1a2e7715-b884-4a1f-8a1c-e8a3098449a2", "value": "T1764302F2E84887BFEA14EF7D314B5243C6259D130FB5F2AA281566F461ABC9C26C7143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973040, "uuid": "b847f8ed-750d-4ea1-94bb-6032507228f4", "value": "1536:bPwwKCysGW2lAaBuTgtdQCbACzEatOE2s:bxQ1hLtqCAKHN2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973040, "uuid": "13740b35-490c-4947-b711-b0d1a8a48318", "value": 59294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973040, "uuid": "6a3b2468-0915-4b23-af69-36e7f922b0d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973040, "uuid": "5b77162f-326e-4800-8974-69da69ba66a3", "value": "lunagrabber.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49470a5c-401a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748914209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914209, "uuid": "05f90a16-88f2-4d39-8a8b-bfc25b7d6793", "comment": "Malware payload (Formbook)", "value": "a04f856d00a1239ef689aa397d17f156", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914209, "uuid": "ac9e55e4-0a65-4787-b942-57d00ddc5eb5", "comment": "Malware payload (Formbook)", "value": "1b3673958e3b8dfefa8bddf7b83fb241b3ce22681eb5cbccd7f74650ed7a4279", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914209, "uuid": "3a5aea05-c14f-4e98-8f47-85283f568830", "comment": "Malware payload (Formbook)", "value": "2af520b6a98c0e2e1a4b7764288bf0f955f5e3d4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914209, "uuid": "8f38de75-8634-4cb8-8d37-90daeeb37c9f", "comment": "Malware payload (Formbook)", "value": "646f86ebcf32ee31362f99e45440b9187df84051c3fdc81830f9ed63a04fbff625a1bcde13491ab6227f64df3f92e380", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914209, "uuid": "2cef9eba-d75a-4fe7-ad0d-2ae30a16927f", "value": "T12C15331B950A9147F583AB323A1EC9DC047DB909127ABA074D9F4AD5C0FEE69063C8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914209, "uuid": "66ecd192-d9be-411b-993b-5bbf08f6119e", "value": "24576:2Uu+nSDoDRmtIVo+bTsVJBzwptbaJDfDLwUHC:M+SIRmtIVoWsVgDboHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748914209, "uuid": "193a3d51-d1bf-4563-901f-3910469f2b3c", "value": 900019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748914209, "uuid": "de13bcbc-cdd9-4809-af44-d4537f58467c", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914209, "uuid": "d380eacf-d043-43c8-82af-e01a8e5aa17b", "value": "nquotation.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409a27ce-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956714, "uuid": "1786fff6-ebe6-49a8-8f80-e4df9c637231", "comment": "Malware payload (Mirai)", "value": "476f6708167f6ffb5d756b57d5fc61e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956714, "uuid": "fe5c60c9-a526-416f-babb-8126b261d54c", "comment": "Malware payload (Mirai)", "value": "1b7c01e9ae28adf8e64bc5b47c69f698baebd805138870023b99df7f59971c85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956714, "uuid": "80f52020-2041-427e-a8e2-28067da16840", "comment": "Malware payload (Mirai)", "value": "c6ac20fc8b64a8258d2d6f8a6267171073585fb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956714, "uuid": "74022745-9b6c-4b2b-91da-9d9886302456", "comment": "Malware payload (Mirai)", "value": "f65baa4c71b389b214bfba00dc657692a66b9a088ce9abf34fcd794c0a0fd25eda32ae88cbe7db9a57680295dd357312", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956714, "uuid": "2762a885-9115-4c61-a329-b5c66ba3d79d", "value": "T1DF93D71E7E219FBDF7A9823047B78F21979923D227D1D586D2ACD6001E7024E681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956714, "uuid": "dcfe5730-aeaf-4f5c-8b33-ad2e87da1f88", "value": "1536:MIZZrDVCJ6YhLyDAVhL43wQEpyif5XnQzJStQenFDGmJY1:MITPtY1yayaXeJStRJY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956714, "uuid": "76398530-61e6-446c-a35b-2cea62925732", "value": 93208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956714, "uuid": "3089e3dc-5cca-4186-b4b6-e50594d1d5b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956714, "uuid": "51b74756-9369-4b75-b509-a5140afea499", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85b416d-409d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748970632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970632, "uuid": "d6cfc78d-a3c9-4c64-8a73-c5b78388d378", "comment": "Malware payload (Rhadamanthys)", "value": "c9662a27a67a84ba695c63a259fa61ce", "object_relation": "md5", "Tag": [ { "name": "45-153-34-242", "colour": "#3AC74E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970632, "uuid": "3f1af27d-0bd6-44e5-80e2-936f7283e93b", "comment": "Malware payload (Rhadamanthys)", "value": "1d4f4c044361d7333ba51518fe443cef631f7a9d8ab1bdbea142f74e04ac8ff9", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-242", "colour": "#3AC74E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970632, "uuid": "522e4ff0-e673-413d-97f4-529893f03c04", "comment": "Malware payload (Rhadamanthys)", "value": "be21e0820245e03618a6223164dc45c02706794e", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-242", "colour": "#3AC74E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970632, "uuid": "db2352f6-7d7d-42a2-b74b-a5d2798754cf", "comment": "Malware payload (Rhadamanthys)", "value": "3ee51bd6e664f3bdf81972c9c2ef102ddbfa011554299b0a9a30c2f9dab8c2ba19177d5050e19f57e0661a582cab4e93", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-242", "colour": "#3AC74E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970632, "uuid": "bf978bfa-4567-43fc-ba18-14883a2e04b5", "value": "T15F6533DB073FD867FE230CF612F120B9FDB26216F175051BA390550E9979BB42986217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970632, "uuid": "ee1435f2-868a-4e30-8153-2c6b076caff0", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970632, "uuid": "b9bd4145-b969-4167-9e24-588d3650f87c", "value": "24576:N0a6DRYALoTQ+jr16qxPJVLgTbiaSWbLS35uvlnOfE2lCM6FELtyp7sI45g5:Ng5D+97PLobiaSWbLSJuD2R6SLteqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970632, "uuid": "79b1e4e5-fe40-4031-86b5-8195725272cb", "value": 1465759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970632, "uuid": "45593081-d959-43bd-a47b-096665d7b5aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970632, "uuid": "a5e35633-f314-4fd9-b9dc-78510e86cbcc", "value": "v-latest-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdb01be-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973056, "uuid": "b8b94061-ade7-4694-b2e7-a9376eac077f", "comment": "Malware payload", "value": "7372fc8020f300cbd7e4859181d6fb7d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973056, "uuid": "6c7d8dba-b363-4301-9bee-ae665b8aeda6", "comment": "Malware payload", "value": "1eb96b973a5cc9a6d24d8468a4e25d72b93dcaaa3298c66705564a5b996102df", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973056, "uuid": "5a2b2cd2-56da-4e74-a7e9-bcf41c9eb5f7", "comment": "Malware payload", "value": "81e9336850cb9db2f77031dc7d2b1d5729739656", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973056, "uuid": "34f115d1-15bd-447a-b53f-4d09c19f9c9d", "comment": "Malware payload", "value": "ffe8085b982bb242979db4a37d73c10e49ddb32424c82d854375e4bc5952b749a90fb768e6c4be82964d37cc779b6eda", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973056, "uuid": "3a4be653-949d-469e-a04a-388f197aab8f", "value": "T1FCF17DA896DE0419F4B99378EB119501CF0C9F18B8184BADFBA36477CD9214E898F27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973056, "uuid": "46ebcc21-fff2-49c0-b51f-fdb0734787d0", "value": "192:sOzoSTLcYTH2MSTO3JZoGjRH1rlNVacpAJH8DKIHCbk0:X0OdTHVF/hjRHtlNIBjbk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973056, "uuid": "d6e1f482-30ff-4f8a-87d9-f21186635a00", "value": 8145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973056, "uuid": "18679854-6011-457e-9541-6cb3a6c15bf5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973056, "uuid": "986879eb-784a-4a21-88e5-d2dd131a016a", "value": "net-nuker.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df81731b-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748944525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944525, "uuid": "fb475096-5352-4de7-802c-0df38b3d3207", "comment": "Malware payload (AsyncRAT)", "value": "80384876fb1f42bd852703caf7a7c491", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944525, "uuid": "ddce7b1a-91e8-461f-bf0c-65550ba72e0d", "comment": "Malware payload (AsyncRAT)", "value": "1f29dc280ee7223b751c80043254c35f6b8d8f89fa6d1f6780c939f2b6c99073", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944525, "uuid": "78425997-f198-4b84-b995-e0d5cb646d86", "comment": "Malware payload (AsyncRAT)", "value": "f51af5ce0ec802710be78ad9e5e21132835e91d3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944525, "uuid": "fd87288d-85db-4fac-a371-96a85dbea968", "comment": "Malware payload (AsyncRAT)", "value": "640cd4f4b94973fac2be3cc0a47757432429099281bd08df3c32c2f85f65570671017e993ae6904e18504599a9414b90", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944525, "uuid": "992a0f3a-cba1-47e0-b7a5-e17859d08ede", "value": "T13A13F9307EB68B0B608847DA918285965466E4FF50E7F49AF4D73B780BD2F4FD02E05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944525, "uuid": "6aab2f39-fcf0-4881-9c0c-69d1c62ca002", "value": "192:v0PDiKXvJxxvIvBFoWPfWnG9VyfIv7R6OQSrAIsW/qGjKIG8Y/OrGJIyE5IgaAuv:mZdXEn2cHDnNLnun5dw6n9QQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944525, "uuid": "21066adf-a124-4a89-b799-1365a1627ba6", "value": 44922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944525, "uuid": "82846b26-d16a-488a-a640-d7452f7b211e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944525, "uuid": "af81ac77-40d2-4997-ad89-bba1307f6f57", "value": "kano.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a349e6b0-4079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748955162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955162, "uuid": "2640e4a7-3d97-4d98-86c3-2a50839389ef", "comment": "Malware payload (Prometei)", "value": "f99e1a33acc813ef4b0b8be53c4dde52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955162, "uuid": "d77963ac-01e1-4df8-9fc0-5e04f633491b", "comment": "Malware payload (Prometei)", "value": "1f7a70f25a3fc57b6e4d2f4a1dff49528ca337c86140ca668aec2c0272c01663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955162, "uuid": "ce719131-4735-4aaa-ba1e-38711ddc867c", "comment": "Malware payload (Prometei)", "value": "1a4b0b42f5633c57cd4f380a3164aad7f2b64ba9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955162, "uuid": "05cba52a-1147-4592-a0e4-65a651aafd8b", "comment": "Malware payload (Prometei)", "value": "d279dce29eba05d2c9abb52c3dbb871e663f4e551b2c8cd48cb3ee0927a0b47046351650cf6cde1fa974616d71d1be8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955162, "uuid": "2cc58389-4704-4388-8cc7-e82777261dad", "value": "T1D89423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955162, "uuid": "8c9ab115-5c42-4307-9624-4c267ebacb94", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgX:25WOSACZSV6eKRH5EPiamb4DsDwwcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955162, "uuid": "213ce67f-72c4-4562-82b1-0b37b5aa738c", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955162, "uuid": "c5ed1fa0-9355-4573-bb5c-05a2e3697e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955162, "uuid": "5ac088c0-ac90-497f-8d36-6e764cc0ae89", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d711b8-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957879, "uuid": "c42371f8-9175-4821-b4ac-5219928d621b", "comment": "Malware payload (Mirai)", "value": "c13a6d337e6c65b5b0c0ed10620644a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957879, "uuid": "8f79e488-1b90-409b-811d-796c0671860c", "comment": "Malware payload (Mirai)", "value": "1fa8b96e1a4a734109eba587a924f48df79e41affa228f1b0f120632a2187f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957879, "uuid": "5baa5bd0-0b26-402a-b7d7-6563db2af2a7", "comment": "Malware payload (Mirai)", "value": "7710f187d9594a924c3d917f3edd8b1f97aef92e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957879, "uuid": "1fca7653-e12d-421c-915f-eaa4dd100059", "comment": "Malware payload (Mirai)", "value": "b64586ff94f6dce040aeea6d06e9ad63e012a5e4505cf8e38c2063ad9e3166af8b34b83e0ef8829e218916a45e4638a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957879, "uuid": "04a659f6-ba02-4756-9875-a249b92e5d7f", "value": "T1F363830ABF654FB7EC6FCC3749A91746258C641A21A93B397E34D828F24B24F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957879, "uuid": "8c42a9da-d22c-4dcb-9ac3-48c2f6cbc9c3", "value": "768:c+xGiJEEYlDIR990vjNLifkUKqBN55geRegEeFNboNRpkEA5TXirmMMHDNM/:c+xGiJxYlkUAksBNY49ESNd75HO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957879, "uuid": "edd8ba4a-78ac-42eb-9046-6be770aa184d", "value": 67484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957879, "uuid": "6095910f-55ad-41a0-a384-d844e6dcbfa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957879, "uuid": "4300a402-3595-4482-a8ba-051bb8305c27", "value": "hoho.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f53dcb-404c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748935681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935681, "uuid": "b15cc852-13a3-40f2-bb0e-3088a6fbcbd8", "comment": "Malware payload (Mirai)", "value": "afcd14226615a199c3cd494520a1be54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935681, "uuid": "1602a467-43aa-4370-b0bd-a11c103c9f8f", "comment": "Malware payload (Mirai)", "value": "1fc6811ffbd0aa76d6a17eae4d089d06e64fcf1deb7b872b7b312b220064b8a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935681, "uuid": "bdc49817-0684-4775-8231-9d1e0bf1fb08", "comment": "Malware payload (Mirai)", "value": "e94bddd1b0d8bafee70a1f0efbe8ed8904af3cef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935681, "uuid": "1a0027ea-a91e-4101-8aff-9adbcaf5117d", "comment": "Malware payload (Mirai)", "value": "4e32ab0d66ae5a98c26555d3f8fc5686e77f0b1ee7fe6a4122eed320cb80956bca13ca1bd699eb325959e03219c4819c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935681, "uuid": "9b05184a-77fc-4c37-b621-deb6ddb0329e", "value": "T116233B02B30D0E03C15329F066BF2BE15766EEA51AB2E184B52DFBCD4275EF35145EA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935681, "uuid": "8c2beaa9-0bd5-4886-a211-339a56e13fd8", "value": "768:FGNWo79D5zvxezD6EehjYkJp55BvbXfkYkSVq7No926YdSYBQZidI:FGNEfehjhp5XbXfqybYwYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935681, "uuid": "9ccad924-6668-427f-9e09-5a270272eda6", "value": 49208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935681, "uuid": "6fc247a6-5d43-4ebc-935a-ca11d7fa5487", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935681, "uuid": "2a63d68b-9005-491b-a4ff-4e324612c366", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8e5b46-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748934484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934484, "uuid": "06cb8bd8-6595-42ce-b6e2-a6b4c7119ea9", "comment": "Malware payload (ResolverRAT)", "value": "7ceac2c9d12d9ae332f3b5a7ed583183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934484, "uuid": "b105af23-c23b-425a-b1a8-0b421f95afe1", "comment": "Malware payload (ResolverRAT)", "value": "1fe5d31bc57a80fd57ca615d2e0f8c25cbe5f3c1020f33b487856e54a740d550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934484, "uuid": "7922b805-b34b-4cc2-a285-768f72e633df", "comment": "Malware payload (ResolverRAT)", "value": "7ebce8af69f2fefb6ec0b3f8a3d41e4ca0880284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934484, "uuid": "4ba5f114-f86f-47df-89b5-aa4840f296ec", "comment": "Malware payload (ResolverRAT)", "value": "4d9346c40138cb6a4b3042ed15f6bb4e654491499650958547c75583401f0d0e131a9acb20c988c4f96143524d52e871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934484, "uuid": "5b52e59b-7249-44f0-a548-6ef79c4d06c4", "value": "T1A0D45C34B49BC0E7C312673C4F1CE6552229E8665BB427CB33D52A5A0FE62E39B17907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934484, "uuid": "56345395-6f3d-435b-8e99-73563f41a59f", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934484, "uuid": "204ffb4a-1aac-450a-a418-0a557953ecc0", "value": "6144:sUAAwk61ioJZrYSNhfimwE3PjMXrMVN3o+jrGLtpxbf/mH863Nqt7:sXAkio/Yyhfi63PjkrM1wtpxLmldK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934484, "uuid": "ce2bc8c3-583b-4bcd-b66b-28dc7734e004", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934484, "uuid": "4b69d52b-155d-4351-a51e-fed1451492d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934484, "uuid": "7fa168ae-c5f6-4470-b36f-b5b93029706d", "value": "canclee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009ba462-404d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748935991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935991, "uuid": "18d5d555-ac32-4145-9d3b-cb0556baa288", "comment": "Malware payload", "value": "c2e91aadcea7699008bf11cbff61c8e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935991, "uuid": "96c1ed14-a8af-4cd4-89f5-32a017ec3607", "comment": "Malware payload", "value": "2134984a11f96f077d0e0764650905133e993723bdeba5a5d0d6e293b6496867", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935991, "uuid": "46812b51-1cfa-4b79-aa91-a8e9fff8ee15", "comment": "Malware payload", "value": "a90b6aff341952451e0a38b0ecf830fbec8ec85b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935991, "uuid": "c5b18563-883b-43ba-a0af-0565df473a5c", "comment": "Malware payload", "value": "d1a633fa787f29d959defb917435ae4d79ff6428400e8a1dfdf018a7ac90f2335db5ba2438720b911ccb404fdef16763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935991, "uuid": "5de87a1c-33b5-4a9b-bf14-cbbb4859b67d", "value": "T198D53379E1F0C8A2FD574E3ABD579A760142FD2702D62C3B0342275EB62304ED697AD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935991, "uuid": "a474d6e8-fb73-40d7-bd2c-0c4f4b8651ee", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935991, "uuid": "8c02c6cc-9ade-4763-b882-a6e80c10723b", "value": "49152:M6PHaZezTQ2Ht8NE5qYkrPnvMEuW0eT6/i65Yk/DdzDFpK+Bwz5OgBLW70qN:Mklw2HWNoqpr3/uWaV5p3FpFBkkgBLID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935991, "uuid": "d1c5c3b0-4c41-444d-b49c-430fd818bfc6", "value": 2884815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935991, "uuid": "596d58d5-7f2a-4a07-a496-f5bb38ce77ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935991, "uuid": "60ce4d74-0bb5-4b6f-b61e-8c3348d1bb08", "value": "SecuriteInfo.com.Trojan.PackedNET.3332.26434.22724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98618182-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748995087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995087, "uuid": "c127e232-c518-421b-a82a-33f4728f297b", "comment": "Malware payload (RustyStealer)", "value": "a03ffd21ce3baeca856f0ff5fe02e4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995087, "uuid": "ad19390b-cb6a-4d2b-9010-437405f24492", "comment": "Malware payload (RustyStealer)", "value": "2149149b8855f779ca5e58feac15fcbc4a6670feb517fb6a3ce362366f94c255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995087, "uuid": "9b3ad3f0-6bb1-4ae1-9951-3273b9b93770", "comment": "Malware payload (RustyStealer)", "value": "94e4b833cfb8c507816791c853bae2ef83fcba9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995087, "uuid": "2917f6a5-5142-433b-bedb-814eec755dbb", "comment": "Malware payload (RustyStealer)", "value": "bb88617b7eba9eaddb4e188ba0a2da47e179882f93ec59c7572034c484cf2f68242301bbe30a3b9fb98049e5f3a961c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995087, "uuid": "424cd5e2-4b75-4d74-a885-606122b50fc5", "value": "T132855A16F6A299EEC419C1B482576332FA31B88D0725BBEB17C486313E56BD02F3D794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995087, "uuid": "c3c14bb3-5528-4471-b6be-089d171f5729", "value": "c91a90511ff035e8e792782d01cabe46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995087, "uuid": "f9399ede-728f-481b-8e59-8697fafc9b64", "value": "24576:QX/dFzeJcHE0/dVVB8qDHsdayVvfCO+TPYElrrWhRplQn652FOOh:QX/dFzeJKE0/dVKdgOwYEVYgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995087, "uuid": "e47e49ef-868b-4f71-8131-ab3529bbafae", "value": 1737216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995087, "uuid": "e1fa04b6-9384-482c-b5c0-1669525d547f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995087, "uuid": "8e394cff-759d-4ce7-b0bf-ae423d733ed2", "value": "SecuriteInfo.com.Win64.MalwareX-gen.5745.1869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02aeb1b0-40a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Kinsing)", "timestamp": 1748972502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972502, "uuid": "aed07954-5cb9-46cd-a951-6350024293a1", "comment": "Malware payload (Kinsing)", "value": "c773668c3c92a3f63f53683a2f7706f1", "object_relation": "md5", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972502, "uuid": "05e598b8-6d56-448b-a116-6a5ee82a7316", "comment": "Malware payload (Kinsing)", "value": "21c20cf2f55e0f7010bc0e051889aee75cf94ae69f1e6a206104a213500f4b5c", "object_relation": "sha256", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972502, "uuid": "164a161b-7c75-4fe0-9628-a529ddcad483", "comment": "Malware payload (Kinsing)", "value": "3a04aba38a3c2284fe6a70a156e25adda28c95df", "object_relation": "sha1", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972502, "uuid": "91a8b6b2-211e-4ebe-af72-2d9c32844bea", "comment": "Malware payload (Kinsing)", "value": "0bd72d667af9273a1d786d1157fb62546fc4c82cb7319c327ed7cb2b460043d0dbc260bac663a508ebbd028e3253385c", "object_relation": "sha3-384", "Tag": [ { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972502, "uuid": "e4993f97-3a2a-427b-80ca-2699c53179f3", "value": "T1CF72118EB011ED74265DC4B59CE2287D602B900A8D623F10B4587E78779DA05F7B9BFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972502, "uuid": "c790b8ae-dc89-4c9a-a146-0080530f282e", "value": "384:r5TLwlH2wx2vUaQa5/eN86704s80ooJQYgykWT4yCtvUsDjdWOoJwFb:tP7YJDj8OoJwFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972502, "uuid": "aa3a34bc-8591-4545-b888-63480859e72b", "value": 16363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972502, "uuid": "1356edcf-4eb0-4527-9229-8a42ddec40c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972502, "uuid": "f6ba3d0f-1ebb-4103-a015-336d769b2016", "value": "pg2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938ac098-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994220, "uuid": "99133801-3804-41d0-b82f-64220d34b603", "comment": "Malware payload (Mirai)", "value": "79d882970f8dd4ed5de4d8fce7d8e532", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994220, "uuid": "38952439-21a2-4b85-88ac-c0f1bc54908d", "comment": "Malware payload (Mirai)", "value": "21d68b2f77532ed051a724dd8594ba237609189e9297ab03a9634f63c0bae768", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994220, "uuid": "a13ebfd5-791e-4c82-b50a-ea54c55625d9", "comment": "Malware payload (Mirai)", "value": "7cb64a213a6d98b8bf35412a03043241d002f0a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994220, "uuid": "540bbc18-efcd-443f-8c36-95f8af50571e", "comment": "Malware payload (Mirai)", "value": "f2c583984b656544a40cde3d84cf64a2bf940c37300977441bf8e796c80e6c96ed70a488fc3f0b3be2ea234c91c075e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994220, "uuid": "9d62d5f8-b697-45c1-b303-e0d745e51453", "value": "T1D0B33A37B551C67AC08752B02BDB96519D23BCBF1B32214B33E87EA52F368D85D19B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994220, "uuid": "b71e963f-c075-4b6e-a5bb-0d4de5cecca7", "value": "3072:GZQMf63hq7S3OHKUayixONJFKLmNonVqfHXF/4Nb:jmMOq5uILmNonVqfHXF/4Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994220, "uuid": "33550581-30e2-499b-9657-fbd266e29012", "value": 117204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994220, "uuid": "320be121-8a4a-4a29-a274-18f03f06c8eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994220, "uuid": "73ff8419-0119-47c7-b8aa-70817bbd98a0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2baf99ad-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956679, "uuid": "63f7d0bf-2d7c-4e1b-8c6a-9f50141f2236", "comment": "Malware payload (Mirai)", "value": "a11f98d59f998ee84d9f19c68726e5d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956679, "uuid": "ccbcdf91-832a-4049-9a9d-54754ecffa96", "comment": "Malware payload (Mirai)", "value": "2211e82ed0a2c4041b1cd2c865e1637e84c7249004bd20fafe8c99a84f1cbb34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956679, "uuid": "6d8401bc-f93d-4231-bfd6-1cad776cf570", "comment": "Malware payload (Mirai)", "value": "92c745b2769e4e835854c444073fd0e0d62431aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956679, "uuid": "64511f3c-35b4-4932-b412-376bcb7c4759", "comment": "Malware payload (Mirai)", "value": "4329655ef71e995c81c40c56564213e7f3215743c132bd27e42b4165112e518a19511315f50c7cfa0d74fccdcfcfa1c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956679, "uuid": "ac1242d8-0b18-41ae-9c35-1e6f6fa2439e", "value": "T1F2F2D17CA70615AEC75ACAFB1BA007997EE00FBC6584DC0F80225D93D6464E8F5D25CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956679, "uuid": "1ab9f368-ad73-4213-bbb4-9794c94e5f59", "value": "768:RGmfKrF3bSnW///LX3qONdgMsqZyOsG1EBOYABGJgGlzDpbuR1J6:RtUTXNdIqPNByVJuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956679, "uuid": "65c3c227-ca1d-4b29-8e47-cee29218ed67", "value": 36676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956679, "uuid": "fa7a3bda-fc89-4981-b699-8e0fb15c5055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956679, "uuid": "2b82d32a-75cb-4342-be4b-6b213d2df91d", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9894d466-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748994228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994228, "uuid": "241a6fea-88e8-4ba8-a926-e3776776dfe7", "comment": "Malware payload (Gafgyt)", "value": "1c020c476b8ddb347092902e6771beec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994228, "uuid": "9a1e2cd4-a543-4f79-bf71-acc415818b87", "comment": "Malware payload (Gafgyt)", "value": "247c23fd71027c7c132383b6f618ea167757e9c6e4ba518a8ae853460c696106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994228, "uuid": "402eadf2-7a48-495c-bdcd-8a8d1761bddb", "comment": "Malware payload (Gafgyt)", "value": "bd23481d962a3575d4052217230c8122c9f66252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994228, "uuid": "0fddaaee-7710-4d4e-a966-8fe40d41e1d9", "comment": "Malware payload (Gafgyt)", "value": "4f9d7d3e7735c933e86281ad5942884bb15b098eaf05f7d1a503e13629cf0aea0ff781117e10e9b5a9df71dc94490c12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994228, "uuid": "7c5fd6f6-0b3a-497b-9dec-5fd96376cb18", "value": "T126B328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994228, "uuid": "106a59ce-a923-4191-8e11-42a64be82331", "value": "3072:WD3l+XQzPeV91310pWudNKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCNypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994228, "uuid": "911b724d-4719-40e8-b1ad-4e37c4f0e247", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994228, "uuid": "5cd7fce8-1bbf-415e-af35-38f4df72de49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994228, "uuid": "95470067-96fb-46e8-83bc-6506e278c263", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b87796b-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748933030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933030, "uuid": "9d89e9e9-e995-42aa-bf33-bff7670bc628", "comment": "Malware payload (LummaStealer)", "value": "5e123659ab84508d456abaaa792fedbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933030, "uuid": "fb47a0fd-ad29-4656-b41e-87090f9d6966", "comment": "Malware payload (LummaStealer)", "value": "24878067e22c0d4e13840a252d630ae4624cf6b8120cc59745261de8460744d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933030, "uuid": "b73992f7-8981-46c5-8e73-5ce69a4c0611", "comment": "Malware payload (LummaStealer)", "value": "1a48f367dd8a813ab214bdf10e8f2666d8d299c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933030, "uuid": "16952abf-8289-434b-9d68-8f28550b7a68", "comment": "Malware payload (LummaStealer)", "value": "fc8356bdc213a48898d277695f55c4e77315c1ec2b1160423d4cae718414363f5921d8857c4e6536dc00984eb0b14c27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933030, "uuid": "f063055e-d730-4114-8387-9ab7b254cef2", "value": "T1A785AE399152A2C6FC2A00B641A1A5D93462B733C63D2FFF4290F233AE07BD15E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933030, "uuid": "d27deb43-b9b6-404f-a4e1-518149c31227", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933030, "uuid": "42b9f941-3643-4c7e-b5bb-d894c7bd8475", "value": "24576:59LATjgcql9XDP81Xbe6A5kS/FHBpzJ+PczY8T4IfzgJPAZU4RdIfzgJPAZU4R4:vLA3ibXDk1re61S7pGczY8iWffWfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933030, "uuid": "d5af8fe6-ff62-4358-aad8-24883b9d42a0", "value": 1769984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933030, "uuid": "5ec8e67f-d922-4ae7-9d59-200608ee4d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933030, "uuid": "1d038b11-e55c-4565-b510-6024ed7df0c6", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45512185-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748931382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931382, "uuid": "f9433a1a-84c7-4107-9602-2ecc01c9cdb5", "comment": "Malware payload (RemcosRAT)", "value": "4150610a5a015f95c988834bd35cccef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931382, "uuid": "e0bf82b2-cc2f-49fa-9583-0afc83c9e89b", "comment": "Malware payload (RemcosRAT)", "value": "24d845c266dc1d2fdd1af6df8cc3c206d2b570ac6df249147664310b13a28371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931382, "uuid": "81623563-e0fb-4831-9ae3-8e7e023cb7df", "comment": "Malware payload (RemcosRAT)", "value": "206c0ae057c9fb37a7b2916a3840b8c3d5954a34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931382, "uuid": "6bb34314-8e1f-4b0e-9f6c-64c7df7a5bb4", "comment": "Malware payload (RemcosRAT)", "value": "8d62cfca160c2748d080856a830dd63ec2d51ee8019e91f285879d1a81a11452409148f6361ee30788191cfc8a44e805", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931382, "uuid": "02e94f43-dd7b-403d-9248-81ec0824beb8", "value": "T19625F1153A26AF02D6BA47F80925D1342BF85FDDA41EE22A4EF1BCDF70B5F110980A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931382, "uuid": "b64893ea-f644-44d1-bd3f-ce8937c8a1d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931382, "uuid": "587bc557-a2b3-47fa-ae7f-759f0bda3439", "value": "24576:tsZa0tQHhAglgGO2sZCu0taZEGpKFVH5Lyq:tka0tQHCLg5EyGpKxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931382, "uuid": "de752c98-81c4-4eb2-a65b-101166e0c459", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931382, "uuid": "9f801914-3ba8-448e-bbd9-7bc5208cab76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931382, "uuid": "9154deaf-e0bc-49b6-b9f4-8541e1f47466", "value": "Teklif 09052022-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "938fa4ed-4088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748961578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961578, "uuid": "891c0682-fd81-4844-908b-74446069c8f1", "comment": "Malware payload (Mirai)", "value": "50716f275539794044095da2be5bf35c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961578, "uuid": "9f8831c2-5c0f-4f32-a791-3cf505fae9fd", "comment": "Malware payload (Mirai)", "value": "268dfe88b6c4d5a1b86d12f77b2a4fc3a9d7ffab0b871ea4a3cd56fd37f9117e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961578, "uuid": "bd10f8a5-a96d-4b32-ab8a-ad62c2783966", "comment": "Malware payload (Mirai)", "value": "4bd006cd6db22b73e7c3f7b6fd68f190fbf15355", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961578, "uuid": "39ca866f-6667-449b-8264-ca082bf2e14d", "comment": "Malware payload (Mirai)", "value": "010be31ca69bb39ecfbcb70afe8c5f5c0a51c1a51263919f3ec9fccc9845cde2e1b78361ccae498282a493dd964887ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961578, "uuid": "fbe8a634-edcf-4f66-b39f-d803ed3bb502", "value": "T1F382D0A0525FACA2C7E0EC798E298947BF074EF8F2CB606B15195F1CF65908A1267583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961578, "uuid": "bf90b7d4-d391-4ac3-8ee8-ed1af3c71183", "value": "384:yXO9eHb6Cr9NfFzH5evsWOde26UtJdaUgPiibtMNAhymdGUop5hSUG:Vk6sNfavsXd3aUgNLs3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961578, "uuid": "e74d6d0d-0a6a-4052-8ad0-f3ecc9ef96b5", "value": 18828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961578, "uuid": "99cdf136-a338-4a76-ba47-cc6fe2841acd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961578, "uuid": "b7a24183-d2f1-4e3a-af56-e6ee7a0d1737", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00730a60-40a2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748972498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972498, "uuid": "dc9bfb75-08ca-41dc-ba0b-e0431fdcbdb9", "comment": "Malware payload (Mirai)", "value": "ab6d2277d75fee36ef3ec379832ad086", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972498, "uuid": "662b52a4-4044-48c6-a6ec-ea259ca86328", "comment": "Malware payload (Mirai)", "value": "26bae109244f85a91e2f1f17c50911a705c204e6c6408b426ddaa00ad2380216", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972498, "uuid": "82069fbc-d93a-43b2-9e35-6429da36a1b9", "comment": "Malware payload (Mirai)", "value": "09a694bfb3dcdd016e9ac40dc407394064c6ec34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972498, "uuid": "f55e2962-3f44-4e30-a2eb-1e59add7f957", "comment": "Malware payload (Mirai)", "value": "39df9cb84018165074d306e0e15127ce06474703452c3ecd52e58a92343122c29a5325729b29fffe78555ba7304c7d02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972498, "uuid": "ca93c46a-bced-4fd2-99a2-bf44dc4fa2fa", "value": "T15393A50D6E219F7DFB9D823887B78E225A5933E626E1C585D16CDE011E7034E340BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972498, "uuid": "b29273e8-080b-4d5b-b11a-802faa02b7a3", "value": "1536:AYiSusyCdaHPwPa78JGJ72z0vA0Osnr5vs9T2L7O6lgS6TgQ:MaU40Y7sJs9T2L7hlgvTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972498, "uuid": "8e37b5f0-dcbf-49bb-8d22-1e3bc35e996c", "value": 96948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972498, "uuid": "78e9479c-9917-4068-b341-1f83354a23ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972498, "uuid": "b2b6e2ef-56ee-4916-b1cb-52226a377c9e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566fa969-403b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928404, "uuid": "8da5b481-4395-40d2-b7cd-e17b6de96826", "comment": "Malware payload (Mirai)", "value": "4b723a1ebcfb92df51135e49cc517f97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928404, "uuid": "9ebd536e-74ef-4ada-b963-fcc79bbd42a7", "comment": "Malware payload (Mirai)", "value": "26d66a27ff095991032d853b0d568a3eece34aafc54ab71e9fd6f8820be6442b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928404, "uuid": "7bed32c7-823f-4362-81d3-d345b78ea964", "comment": "Malware payload (Mirai)", "value": "9c6d282b244d5c78f86b0fe4675f28baa0971b00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928404, "uuid": "63638571-6392-4df3-9661-ac4741f16522", "comment": "Malware payload (Mirai)", "value": "35b530783597d110e8299e18a98d476cc5ad38bab6a0af7fa8b9edfe843bc22b44c3aebcd26e82ce8d0a9d807229404d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928404, "uuid": "d84b4433-3951-46b9-b71e-03c19ed484ea", "value": "T179F2D0AD72510444E5A8C6B70FC2E74029620BA66C43FDD17E49FAA2FBC383979C3994", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928404, "uuid": "dc82a1e2-4223-4942-99d5-d69d50279ade", "value": "768:hXu2g4QuUm/lPr2naDbyrzqMpj3cjekztEA6OrJgGlzDpbuR1J+:hXu2g1Ir2naDyWMpjsj1p6EVJuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928404, "uuid": "a3b75b77-5d3f-43be-8612-0f8a98ba9f1c", "value": 35064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928404, "uuid": "1afa8bb9-7e0f-47e2-b1af-a76df35d1992", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928404, "uuid": "2f14366f-2969-4ab0-8b92-05359278b955", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf597e93-405e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943612, "uuid": "08392acc-e533-4a13-b131-6556c4871905", "comment": "Malware payload", "value": "8ac61092c0256cc28ee17597c34e90bb", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943612, "uuid": "286e7b09-b184-4aa6-aa8e-dc6a22ae363c", "comment": "Malware payload", "value": "27456b5f03f437ce6f4d42f8b7018fa95d0394136de55a64002e597c95396bb7", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943612, "uuid": "d32d5de7-76b5-4fdd-a9fd-b102f9a12e64", "comment": "Malware payload", "value": "d8dcbd8bbb2eba96fcfea6837913ecb18fb8c23b", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943612, "uuid": "ba8ad6bb-3e28-4460-9d6e-c85a024dd5c6", "comment": "Malware payload", "value": "49990940db4c806c5a2e880ebb536413d37d07dc8ebe649ee835ffce0f448a9cbcc6a9af7c604d93e25e95022893e3b7", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943612, "uuid": "ffa43791-0531-49f5-8964-6adae4a911f6", "value": "T19372E13CDAF1FDD0436F70D09A5E3B46108D5B63BAB51B6CF9C205AA5818689DB3A24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943612, "uuid": "278366e0-13cf-41d5-b38c-333ad4f4384a", "value": "384:BvK+SWpijmhiihwuBZ28j0F48VhoEh4rirCZ2n7Ehzh9qKrh9Xw4t5vymAOUdeP:fJi4wwglwiuLlkKduD+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943612, "uuid": "8abcf321-77f0-4a40-8ed3-10e701ce8c80", "value": 16983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943612, "uuid": "9e952252-6539-4fe0-8b09-a2dc8f2afc7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943612, "uuid": "8212084c-8e9a-4b7d-9b12-90216ae16d8a", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2522c1c-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928102, "uuid": "e443013c-6291-4029-9e55-f5ba987a0ce5", "comment": "Malware payload (Mirai)", "value": "d072896b1d9d877dc978c5fe9f41fb0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928102, "uuid": "43fc300f-e2e3-4024-b1c9-a115495de2cd", "comment": "Malware payload (Mirai)", "value": "27a471f58dab8c76900976c61b33cd7ac0ee482c6fef428930593e50264dc1e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928102, "uuid": "ae4d8378-29de-4f6d-8107-1bcce702afdf", "comment": "Malware payload (Mirai)", "value": "3ddca6d77390c0e9a75befca4756df71f4ec9425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928102, "uuid": "95577d94-c1fd-413c-8126-65b4c56a1794", "comment": "Malware payload (Mirai)", "value": "a056c79563323639fb63e7e8b79342a79d39da374c9742164d575df4855168bad85ec0a33c9839641ef029ee63f0be2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928102, "uuid": "9b34e249-c3fe-44c6-9709-e5dd142d9761", "value": "T1BF633932F9350927C4D5587621F74B36F5F643DA20A88A2F3DB10E8DBF646403647EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928102, "uuid": "7adbb56b-5a09-476e-ae5a-5cbd2dd8fad4", "value": "768:XGowzVdpqwxdRvLe3n929i0qtICwpMO+YDG5FXWDT3qpwR/9da3t0f4L/ApIp3:XGhBqwxdRvLe3IZqtVnYa5JpwV9Mt0T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928102, "uuid": "fe438f2d-ca25-4734-acf6-4fc7012788dc", "value": 71816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928102, "uuid": "7bd16000-a328-4512-b9e7-fa69d72e85eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928102, "uuid": "9f99fd37-0f72-4981-8595-e2a258473094", "value": "neon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae9d894-408e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963979, "uuid": "4c8f0c70-d32d-461f-a8fe-0e32f84066f0", "comment": "Malware payload (Grandoreiro)", "value": "4d27bd45bc942a44cf6c07ee60542b7b", "object_relation": "md5", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963979, "uuid": "fe3e79b3-2887-443d-9410-2af9a41fc5c0", "comment": "Malware payload (Grandoreiro)", "value": "27d250e652da19458174086b36156743c8b5ed6d73ec0150ae3c2e6ca91392f2", "object_relation": "sha256", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963979, "uuid": "33fc1198-8a96-4892-b0c7-067b39969e87", "comment": "Malware payload (Grandoreiro)", "value": "3dc1ca51c81d5b85224a99752630b586f7743378", "object_relation": "sha1", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963979, "uuid": "825bf628-40e5-4fcb-ae49-1e7a83e74acc", "comment": "Malware payload (Grandoreiro)", "value": "865d9b58d165a7c3986204a29e3749261ee2c61eb4d0fe8d9f380518e1688095216a1f0fcc724c6ee35610c62b575b83", "object_relation": "sha3-384", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963979, "uuid": "e93fe898-6651-4f0f-a077-bc8605f5c1f3", "value": "T1EFC523E0FC959E58FD0095B396480F84E1AE007463559BCA8BA0B77B7F27A921F53C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963979, "uuid": "2ed17b11-8ae2-49f9-a2b9-0c095c5a5ae1", "value": "49152:uJiKuzLyHTL7SEPrtODobDJpMeQ2uaghumCuIEulUeWsw+Kz+JDeO:uJtuKHnBE0DJp9uakauQdw+KiwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963979, "uuid": "aa89773a-803d-4c49-97ec-34720dbdef52", "value": 2735949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963979, "uuid": "9f208d9a-460d-4e3e-a8b5-8a20e3d162ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963979, "uuid": "b49f75b9-1b2d-40c4-afe2-db67fb7c7b47", "value": "grandoreiro2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d138f1d9-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944501, "uuid": "abc57b86-adab-48a0-8fea-075208c26dfc", "comment": "Malware payload", "value": "1d4bec356f65badba54b998f2457d917", "object_relation": "md5", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944501, "uuid": "91571b8f-6604-4ae1-bee4-79e8918b2ce7", "comment": "Malware payload", "value": "280b0f478cdafbdf58db090c9162a44fdcf9f642e12cdbcad2539eb1b24bde28", "object_relation": "sha256", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944501, "uuid": "8529fa28-c09b-4279-ad3d-5d46337229e3", "comment": "Malware payload", "value": "4953113af8c048349f9a4f6de926332a9367ef0c", "object_relation": "sha1", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944501, "uuid": "383162b8-12cc-4770-9cd0-0bc9d0c5c200", "comment": "Malware payload", "value": "0773b64f312304fa577c63a4cf3210b026a1c7eb52ce4d7f39b6f7d77af50442c42dfec919929f89235f3ccd0d4755aa", "object_relation": "sha3-384", "Tag": [ { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944501, "uuid": "daa8bf99-83ef-4357-b1da-ce5910c70a2a", "value": "T11BF0AC42AB67DA261530034328B994BDE749D07F3174845A394C581ABFF0AF28B6E3D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944501, "uuid": "db1fd3a1-a042-4aca-a6f2-021d1cc33098", "value": "12:HhjOCYhGP58cSAk2XuyGkGd0AGQEgsg9TSlw8OQEkYJr0UMeq:BGb29G/JGEvTqw8OQoVMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944501, "uuid": "179dbe4c-c520-4905-a70a-0d2fe93a0cdc", "value": 593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944501, "uuid": "37db7111-0d88-4107-9c20-9d43cd24133b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944501, "uuid": "ee939034-9751-4c2d-b8c5-230665603d07", "value": "loop.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482f5a90-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748934823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934823, "uuid": "9892da7b-e0bc-41ca-8ea1-29d7ae627afd", "comment": "Malware payload (Mirai)", "value": "e71a01bd41863f3563e9ab3305a53757", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934823, "uuid": "785c0763-9e0b-44e4-bba9-d1e865c6ae95", "comment": "Malware payload (Mirai)", "value": "28589833211a3653884d854d2c9127b32ff13c436fdffde6bcea076be6314262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934823, "uuid": "d4c9b09b-5728-4e41-a4bf-74c41a089263", "comment": "Malware payload (Mirai)", "value": "0ca9e1a1268e6a59098954b031051f7a72568e6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934823, "uuid": "8568adee-a1c0-49d4-b885-1f4dbab7e32f", "comment": "Malware payload (Mirai)", "value": "86e23d2deb62056b58d529e1a28bf844697a0ee5fe86afb5135b0b7e28ce87ef4d9101db29b2633d86a714fab4bf7c68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934823, "uuid": "c1b50988-bf77-455a-bf25-1ff27c556bc4", "value": "T1CF3319077E4285BEC096C1F04AF76436C963BD7E1B333545B3A8FEE16B966903A2D604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934823, "uuid": "18fea838-ab11-4a4c-8949-793f3a011815", "value": "768:EXHsvVzuDzUZfaoHF+m98aJuCpQo9h+G81LTXEWDFyMrEw6kT:tvhuPUUmF+J+bQo520j8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934823, "uuid": "8bb97447-c902-4d7e-90e5-6bbd7271fe34", "value": 52248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934823, "uuid": "d5c60aca-4eca-471c-a5eb-d39c2af265e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934823, "uuid": "d6b9bf2d-3bcb-4e75-885e-688d2cebf997", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d3bee6-4017-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748912809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912809, "uuid": "92ad0180-4a39-43ab-8fef-444cfb679b64", "comment": "Malware payload (Mirai)", "value": "e2192836df0c372df11692310eff6dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912809, "uuid": "3b63ea5f-0618-4766-adc1-62ad141986de", "comment": "Malware payload (Mirai)", "value": "28b1c558b3a134103bfad4658a0f8b5a7add9b9e19c65b399ba65558e93a51f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912809, "uuid": "bcc99e8d-d519-4419-a096-a409c7c641fe", "comment": "Malware payload (Mirai)", "value": "4662cd2c949401d80ddb0023616cee13c538dcef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748912809, "uuid": "5d0466c4-aad7-4e46-819c-c42f11b433f5", "comment": "Malware payload (Mirai)", "value": "0ca622dcdb65912500d14736370eb866cc3dd2bb2da63a8d9c8d256829763617fb36b960e41daf0b2461e28a14375e2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748912809, "uuid": "f4e8ee17-a86c-4117-94b0-517357c6d1d1", "value": "T14FA2D014F2D8D542CC9173F589EDF1C9A526A504425E47CA934CD32FE8BB82AB190F4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748912809, "uuid": "db53411d-8882-42f1-8eea-ced16275980a", "value": "384:MOgagW7L5avOVYcSdUWTqOixGXqkNKL4PLutvyvF7ThQTHH+9v096:kXcSuC8UXqJ4P0Mt1QL+9896", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748912809, "uuid": "4e08d6c1-3e1e-4626-bc44-d041a1d7c32b", "value": 21696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748912809, "uuid": "f49f07f5-c8ff-4d25-bfed-a862201a3111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748912809, "uuid": "7825c904-a039-4847-8eda-0c7461e16ed8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4ee5f3-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748934457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934457, "uuid": "b39b2939-2f83-4535-950e-0caad6293181", "comment": "Malware payload (AsyncRAT)", "value": "82f0386ba39197fc3c46416e961d2331", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-accesscam-org", "colour": "#FC8A99", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934457, "uuid": "672e2a88-637f-46f9-b664-c911b8892b4d", "comment": "Malware payload (AsyncRAT)", "value": "28c3e1c268d0912dc5d9c261852d672bcb7f2810aa6b28057577f59e2476f053", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-accesscam-org", "colour": "#FC8A99", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934457, "uuid": "c61a8507-5e35-42fc-a9ff-4288def72e75", "comment": "Malware payload (AsyncRAT)", "value": "34be10aa4df02bf46902bd7ace48fa5e97bfd132", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-accesscam-org", "colour": "#FC8A99", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934457, "uuid": "bcfcad67-aaa0-4057-9247-f9e1eaf92370", "comment": "Malware payload (AsyncRAT)", "value": "aaad503be3397be3705da50c9bef038374407211eddcbdc6870e9a1557e260932d5ea575564e56fd493bf969a7dc5edd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-accesscam-org", "colour": "#FC8A99", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934457, "uuid": "b8ac5ec1-69d3-4903-adcd-336f1468e948", "value": "T1A251CA6387954327ABBD03C38912144FC98F495A950D1AFD728F3CCE72816286FD36E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934457, "uuid": "9c886f57-bc13-4fb3-bcc1-539b15bbee22", "value": "48:18OjQsOjQOlCjQ6OjQOOjQ0OjQ+ZOjQszPOjQmjOjQfyzOjQgujQj9js+UMjct0T:F01l++6EnwiSuy+HCgZTUYct6aVIIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934457, "uuid": "ab0ac52b-e00f-4935-9f13-5ceafdee82b4", "value": 2916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934457, "uuid": "30c849b0-c8ec-4885-bc6a-ee8ff4ed870a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934457, "uuid": "e97c1ca4-3789-4e32-bc87-be8b3f3024d0", "value": "28c3e1c268d0912dc5d9c261852d672bcb7f2810aa6b28057577f59e2476f053.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eb3c45-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929308, "uuid": "bd69188f-e053-4606-8d7b-af32a7dd6b93", "comment": "Malware payload (Mirai)", "value": "4538d9e6d08f357a1ff446d0539f8aeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929308, "uuid": "6610fafa-a99b-4878-9b0f-3950a58cc1e1", "comment": "Malware payload (Mirai)", "value": "290f39f112b18dad5e4704cc06e6978fc9c3ad0ba58402734f8b3adbb4758ffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929308, "uuid": "d577e7ed-a1bd-4e85-871f-56dc542756ea", "comment": "Malware payload (Mirai)", "value": "cf123026126330588ec1fdab59450b1a97a1f192", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929308, "uuid": "53da6510-1ce2-4f51-9e86-eb8689193d48", "comment": "Malware payload (Mirai)", "value": "d6bde8aadb7abde4b2ed0154b230ed42fb00659967f1f73837b2e90b085dc0dcab155537983b13c8e3a7fa322f962951", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929308, "uuid": "d0f5fdad-be9e-4bc7-a782-e4b3397a866d", "value": "T1EFB39C9FF2075691C8A347F007CB8B9E3E6323819F57D4E32C5D2A7A18762CB5902B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929308, "uuid": "d8a162f1-f484-4eaf-a1af-afc215309ca4", "value": "1536:IXQxm0hAAfthevSyCPUhEqlyinfCVNxV/3Ngl/LW+:IXPoRthevxSUhEqRfCvNglq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929308, "uuid": "38247848-3050-4aa8-b961-1c6613125f6f", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929308, "uuid": "a407f364-6d76-420f-9538-dfa2d47ffd0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929308, "uuid": "f2997bdd-a0cd-49ac-8070-59a914a63efc", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af48bd1f-4092-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748965919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965919, "uuid": "8949141d-911f-4106-b43d-f22abcde2440", "comment": "Malware payload", "value": "b0837598e8bd55a96f60bfdb63d6f80c", "object_relation": "md5", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965919, "uuid": "cd7221e3-7de1-439a-ba1f-b0376d537be0", "comment": "Malware payload", "value": "293741bf548c932d27256e3465dbf1ecceb9706c9a42caef86da97df7d7bac8c", "object_relation": "sha256", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965919, "uuid": "7133328b-469d-407c-9721-7799630902cc", "comment": "Malware payload", "value": "e816ddbd06dbbdcecea6cbc8abe37d783f6a9c42", "object_relation": "sha1", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965919, "uuid": "7b0748ab-8e51-4890-9347-1ceb7efbe8cb", "comment": "Malware payload", "value": "2a9d90dbc8941ccf6af2c02a11623323b0a636bd84bc5ae307fcd8eae88a0888227179d0dfdfebf90717ca2be4afae15", "object_relation": "sha3-384", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965919, "uuid": "4b7f2b37-069e-4e67-bb1d-e7f7a7ad885b", "value": "T19934FBB443D0AAF6D11883D5D7B5B47D1E7FA1F174442EAA17D23EEE8C08D831AA484B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965919, "uuid": "6b242202-afae-46a5-8670-3b192dcf5beb", "value": "1536:T3UXaIqg+3h7/GokYnoYOkV/S917kTpI7q6KtSzqPtYeLKj443wtsHQiK43YXH9E:E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748965919, "uuid": "88c96c7a-3e8b-43c4-a1d3-220485becd07", "value": 250780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748965919, "uuid": "08950034-7920-46da-90c1-4bc3c34bb9e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965919, "uuid": "e205468a-72f6-4e5e-a73c-a7ed6767c6b8", "value": "293741bf548c932d27256e3465dbf1ecceb9706c9a42caef86da97df7d7bac8c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72320503-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748929310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929310, "uuid": "5499889c-d5e5-4584-92d0-fe33f6234756", "comment": "Malware payload", "value": "d2763792f153d10ec087d5740da176f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929310, "uuid": "c703a8bf-8996-44f1-a875-3794d7453546", "comment": "Malware payload", "value": "29a8c50a2b8b7f4fd40a043206dca3994df84d92424a12aa2089f8fab622a011", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929310, "uuid": "1b0f8492-3bd5-4e87-a3f2-e5ea38fc4e71", "comment": "Malware payload", "value": "9df642b8e038505c06a27019917d4a89661bf7e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929310, "uuid": "577f6c36-3a46-4fb1-afed-e5e47cfd8271", "comment": "Malware payload", "value": "c043967793e7ce20e2645c1638268967b007701887096d9b2dfa1fdf8d24521b4404577210826aa0918e7067a55fe353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929310, "uuid": "fedc13b6-416b-4f2e-8ac8-dfeb10dc539c", "value": "T146A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929310, "uuid": "90114bfa-6ca8-4641-bda9-e1725326b49d", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929310, "uuid": "6b8fbff9-1891-4d04-bd51-fc2f798425d7", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929310, "uuid": "051d472b-3726-4efa-9692-95cd4d862f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929310, "uuid": "9f33efc0-517c-41e6-87cf-bd1f38130fc8", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f30798-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748960931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960931, "uuid": "57c41083-91b3-4636-9617-8bce5c4b12ff", "comment": "Malware payload (QuasarRAT)", "value": "ef697ec946d1c7425f81f82b3461751c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960931, "uuid": "66555c29-33bc-4d35-a8e2-053c75c111ce", "comment": "Malware payload (QuasarRAT)", "value": "2a6add589b534632a04d3c6eaec0c4a7d6b072bffbb84c0b800bb24ef2ad1ab0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960931, "uuid": "d8dbeefe-9556-4a05-be9c-d4194f138e19", "comment": "Malware payload (QuasarRAT)", "value": "22f68e5ffe6b79dd0f3d6f7d9aaf3a1acb2883f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960931, "uuid": "c76b6b20-5b12-4227-b260-4d8536c2a1b0", "comment": "Malware payload (QuasarRAT)", "value": "79b3460815956f1a2f80f0347e2d73a642bc5b089915c8f12a73c1b2891b199cd6d7543a3f515bbd4cdbad8a085fac71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960931, "uuid": "a8bba0a8-b626-40fd-b201-278889f6ab09", "value": "T13095AF2439EA401AF1B7AF75D7D0B5DA8B7EF223760A965D249103460E23B41EDC723B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960931, "uuid": "8c786498-1fe1-4136-9ac5-962fdc4c43f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960931, "uuid": "201ae33e-6624-4b37-9615-89e10faf1f1a", "value": "24576:eEgSWeWBRYRR1qJvHIPbcNE0KKSb7yviUSQaBaOwIRxl2S62/9+TNd3T8eO8:q7YReEwKKSb7L3wip6fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960931, "uuid": "e914d813-c4c6-4940-ab11-d8512776d6fa", "value": 2001920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960931, "uuid": "e4d80b92-e925-4bb5-8b64-5019f5089cfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960931, "uuid": "55a1d085-2c5e-4e29-9ac6-358d9b658ef8", "value": "rE2WYP3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0e19e1-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748932088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932088, "uuid": "2b8d31bc-b172-4c80-b969-4857c123b5a5", "comment": "Malware payload", "value": "a2314957037240cdf4abb44546d22112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932088, "uuid": "3e1582fb-6916-423d-a8c7-f328e85e0c81", "comment": "Malware payload", "value": "2a992d16360a55b6e99de3952daf7e4480ad565211d8f0e95978134393f2d4f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932088, "uuid": "62c82753-68db-4244-902b-391f5e646811", "comment": "Malware payload", "value": "6c6e915bb83de92381ca2ccb7180fbcd64130cd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932088, "uuid": "bd6c2ad2-bfbd-4a3f-b6c4-57188ae92061", "comment": "Malware payload", "value": "5c0397ef4218c9bf885f3140062d6bf4db054764a9c0223d5eabb8bc2b6b3f708b1c559cfa9e088d74d4e34d566cb915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932088, "uuid": "721ed6b3-0f14-4bda-ab34-84a866e9e6c9", "value": "T10E4633AB78EB175DCBDA4B36D30B73A4851073F47A41D8A04E6EDBED1C236589316B20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932088, "uuid": "df66dc61-8cda-4ea7-803c-40807e79a9eb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932088, "uuid": "69a1ec10-75b2-4a45-a91e-f37f2752c891", "value": "98304:FIsjcYBoO9Z2oc3/CS1XqI79BTlztX0hIvCf713BLXj+NimhVoeGSn4FkbHvsg/G:vjc0oO9Z2oc3H1XqIZn2iIRLzKh4F0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932088, "uuid": "3e319c94-82c4-4a09-ac80-197e7e2e746a", "value": 5662208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932088, "uuid": "b9460905-3b50-4e43-86ee-11c29fb85a75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932088, "uuid": "011b7f3d-5174-4e2a-b6e1-70bae4739b12", "value": "addon2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9193637b-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748995075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995075, "uuid": "3f8c466e-4f8f-44d3-bc57-f44be1c5000c", "comment": "Malware payload", "value": "46b4829b7797fbd992e9f9084f0ffa6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995075, "uuid": "c563081c-ca71-4dee-8e02-f7685bf0df12", "comment": "Malware payload", "value": "2c03d9c969ff7ed8daf6b00c1c37ba98af7e0c9182d2c96b584b58513e10c491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995075, "uuid": "0c01ec44-4ddd-4180-a38a-385a7ba00c4c", "comment": "Malware payload", "value": "60261a1be6cab273d1dea79112072fcc4bcabf7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995075, "uuid": "495a777b-9e3e-487a-ac91-7a4185210b05", "comment": "Malware payload", "value": "c08a222f9e0bd59a5860389edee50a0dcc5760a29aa80a281d082946e26be0bef21ebc07483ee587485851727939b85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995075, "uuid": "9970efc1-8fcc-426c-b595-b8a83b1c7580", "value": "T16D9307017BFA1B65D6BE83FA5A62111007B2AD1B1523DA187DCD31DD1FB2B044BA0F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995075, "uuid": "e5fa6153-67bb-4b64-9a4e-2598a19414e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995075, "uuid": "8e73bfe4-e0b2-4bf0-9364-81727d1758fe", "value": "1536:j9tdX+9Ma+KuaGFEz+uD5SRSuamwKLNMao:xtdXFa+ZFEzvD5SRSuamwKLNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995075, "uuid": "518875e6-f481-4161-a059-6418d9f717c3", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995075, "uuid": "a12c436c-1e71-4f5c-a156-350663085022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995075, "uuid": "ae9b4b94-0fd1-4c0b-9861-41101f69a0df", "value": "SecuriteInfo.com.Win32.MalwareX-gen.26227.24105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6c2265-402b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748921571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921571, "uuid": "d0ec4680-5db4-4853-ada7-745e8086ceb6", "comment": "Malware payload", "value": "4ccd0046fa957194ca20c00f3f30bd83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921571, "uuid": "f1ed8680-8b6a-4a04-8ffd-8bef0e31bb4c", "comment": "Malware payload", "value": "2d214d9558415c2290977fe0476771f6be71e6031aee876d358e087d936339e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921571, "uuid": "8334835f-914a-4066-a3e3-2c8ac78ca4f9", "comment": "Malware payload", "value": "bf7af8da5a95a1a85bceef73309b2158aa25b2d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921571, "uuid": "66a4ec8f-e677-4656-b790-cde991795097", "comment": "Malware payload", "value": "531b0d10fde5eaa5767b5763f7e9ae87b1a96b044117a7d055f9c1a484a262de434ffe1be37fb5832ec4d8348876af9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921571, "uuid": "5e687c3a-f979-499a-87fa-a73ce96c8768", "value": "T1A2A633C8C14259F2C5179F7ABB6EE724A458C6E25E7A4CC743D3BA1D36B0250B80EB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921571, "uuid": "b4130fac-a6be-4c0a-b1f0-1cf81b6b3750", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921571, "uuid": "eccdeab8-414b-49cf-a642-f3f711687479", "value": "196608:R4mdjpOqhwn5tM5ipTGFjL3tmfCD/1KNHKISToPkoghl/l3d/PULZ0:R40pqCipu3tm65KpKISTMkHfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748921571, "uuid": "1acb4cd1-05d5-4a78-8dd9-d59bd4a890ae", "value": 10268944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748921571, "uuid": "9ce93e38-51cb-4beb-af37-0bc8f6ac47c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921571, "uuid": "eeddeb6f-944a-49f1-9f1a-b652541b38bb", "value": "2d214d9558415c2290977fe0476771f6be71e6031aee876d358e087d936339e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5a7752-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928713, "uuid": "989f93a0-3d70-4f0a-8bb6-e37f89dbe52d", "comment": "Malware payload (Mirai)", "value": "f7004ba9183029effbb424548487ebfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928713, "uuid": "51cfb307-1a5f-4b82-9e43-ed0fa3e85a0d", "comment": "Malware payload (Mirai)", "value": "2d9f3d45a629583d70f0646371f5351c0d12429d104222d34e592865daefc4bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928713, "uuid": "6afab537-59b5-4b1a-bda1-0b607d04a3a2", "comment": "Malware payload (Mirai)", "value": "44382fae76bd031624f98d55fd91dd9434630d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928713, "uuid": "49168527-b3d3-4af0-b4d3-d7a7e25e31ea", "comment": "Malware payload (Mirai)", "value": "cc42ee778c0c4aec6fb9ab00d5e33e18d0fdc004f65d0506eac1108db0d71ce8b9be867ad9bda4d79b6cf72431e28dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928713, "uuid": "fcc60898-cba4-4a52-ac9f-26482cba8c65", "value": "T1C6A3D90A6E21CFADF369C63147F74E21A79933D627E1C685D26CE9001F6438D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928713, "uuid": "2e3b8c73-826c-4924-9378-a2b893f1f799", "value": "1536:pgm5L7w3HPTVMQi22iJ1XCrbuygVASjeanmF:T7sbVMS2iJ1XCrbIAanmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928713, "uuid": "ffc16aa9-0474-44e5-8747-c023ea1785ec", "value": 97704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928713, "uuid": "2669a94e-c8fa-44cc-b926-0accdc4d3eba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928713, "uuid": "c2348dc7-f31f-4943-aaa9-008d0347ad6c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a52ee60-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929350, "uuid": "a25dee08-add9-4808-8932-9960ecceb125", "comment": "Malware payload (Mirai)", "value": "8bb7fafb52726df7226d01b4a6898d16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929350, "uuid": "d2e2ee41-2018-48bb-9320-74f238116840", "comment": "Malware payload (Mirai)", "value": "2e4db9e473296d8353a350dc3bad0eb0ce3ed014ebdb5ca7a29166b8c9b04b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929350, "uuid": "fa8592dc-4554-4310-af53-7a98e65c5c97", "comment": "Malware payload (Mirai)", "value": "7b7e809e033d5dcf59e05b47697c43e67f5f13eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929350, "uuid": "a9702837-80ea-4691-b361-318b3b1c0bfb", "comment": "Malware payload (Mirai)", "value": "6e806093f58eddf14216a826628b3ca48e419a086321307763d37d46e6a2d98f37f5eb6e3fd77b42c9b00dfe703262d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929350, "uuid": "8a826396-02df-4fa7-9af4-7b49bb5fe2ed", "value": "T17D73185AF8818B21D5D212BAFA1E114E331317E8E3DE72129E24AF74778752B0E7BC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929350, "uuid": "79ac1681-f5b4-49b3-886c-6d44e56fd507", "value": "1536:yUn9gV53uq6X8e0CEDKWD7ma9xBSQdM1i/XIBg86N71151Yz:QRVD7ma9P4Bg86Nx1vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929350, "uuid": "63358cfa-6f23-4167-835d-86a2cb837358", "value": 79192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929350, "uuid": "41e44cb8-8f79-48ee-ade2-b769e5f78d48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929350, "uuid": "a269e452-a1dc-4165-a4f3-8e37e1a80c9d", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084c7ca8-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748960915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960915, "uuid": "94b116ee-300c-47ec-b7ab-8372138c4f5d", "comment": "Malware payload (RemcosRAT)", "value": "e3d62b19060b5b4bf881d48684012376", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960915, "uuid": "06bd5fdd-156a-4a42-abc7-b7673d4f2c80", "comment": "Malware payload (RemcosRAT)", "value": "2e5c05efb82ba3925cb2da3bd03e017901ca118e4f6aea2f6c99b76abb671721", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960915, "uuid": "a2990d41-4c98-4c23-abea-6adee09aa31f", "comment": "Malware payload (RemcosRAT)", "value": "4204c2f2e41059c6c8b6031d4229b66b3d0c6756", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960915, "uuid": "d6a449c1-3981-433b-bded-086b3899b8ab", "comment": "Malware payload (RemcosRAT)", "value": "ea02e7f2532469abc5f3c045c56fca63b08198b681361f3585e17c846b5bbae5898e1055b45457d9c273580d08df1270", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960915, "uuid": "ac784fcb-ec1e-4ed9-80bc-a66241516407", "value": "T12E07974B3EB155DA265918E0AF334DF81E31FA75CCAF6C4CFAD4928C681C67190879AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960915, "uuid": "79341129-693a-46b2-a2c5-3e99a98041d0", "value": "768:/R4i5pbMKiZd+JbtzJCpQ2KJjH7p2Oz4MzGMxEwnOHqquzHxPN27tEJKnzUngnbe:AWbt1N9H7AOz4MzvHOHqq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960915, "uuid": "67fe7541-d404-4b2e-88cb-1a51fe4f2f44", "value": 17860182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960915, "uuid": "8371ec67-0f56-4bea-b173-e5d3a189063a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960915, "uuid": "6e37c5e5-9ff5-42a2-8b18-170a1d274206", "value": "MV Vitaspirit Survey and Sparelist XLS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df6b4f6-4078-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748954616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954616, "uuid": "784d0647-7157-43e6-baca-92fdd89f6694", "comment": "Malware payload", "value": "98c94fc8723c9f0b5b9b986a4cff0bf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954616, "uuid": "49b64795-f81a-4d10-9531-ad42bd2d1bec", "comment": "Malware payload", "value": "2e9c5492ebe89e7171482cc4d933c8910f806880edc163c412075ed786c19332", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954616, "uuid": "702b0fad-b723-4edf-84ed-f8a79c692040", "comment": "Malware payload", "value": "b0271a1435caa00ca3eb9a6f6a6862023c1e36a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954616, "uuid": "bec4bace-b526-4b44-8fbd-b552835ed8b9", "comment": "Malware payload", "value": "35183672fd9b9aa1364f01022cee9098266034f00383efa4a9be9e44a472b11cee91fd5fda1c030ae84bfe98bde99af3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954616, "uuid": "af647e11-065e-40da-8a52-5a298d587e06", "value": "T112A41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954616, "uuid": "1a187926-7bdc-49b1-92a4-35874627ef58", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748954616, "uuid": "9fe02978-8d7c-48dc-b522-9e255789bc21", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748954616, "uuid": "c2429613-cb35-4376-9986-9c7d3f4aad75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954616, "uuid": "8cb20bc8-1373-4a61-be9c-7e00161b2913", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf5cd42-40a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975500, "uuid": "42ea9455-b119-4e9e-a259-5b06f3c8cd9d", "comment": "Malware payload", "value": "ac03317a2c6c059d802eb9e08f08c14d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975500, "uuid": "d1db0df2-1a6f-4322-8052-44022ed3a3f7", "comment": "Malware payload", "value": "3016c8668a7b4f884179d49c9501fcc7a52e6835bcd84fe922919a33d8fad5bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975500, "uuid": "7c7ca215-5eba-4f8b-b4b0-0722d2d6c1dd", "comment": "Malware payload", "value": "10abc3b8540951e4c09c43879b28b5081dfe1ace", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975500, "uuid": "7ffd8ae8-5d6f-4491-a998-969fff6534f5", "comment": "Malware payload", "value": "a8d295f0e78a9cfe26079b9b20619970e90cf4a40da49678b7ea0dd3a3b5f8887e997ddc0a1aa52d36945f510b3899d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975500, "uuid": "6311142d-876e-422d-9cd6-cfc74da10436", "value": "T18095BF399152A2C6FC2A40B60161A6E93462B733C63D2FFF4290F333AD17AD15E6974D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975500, "uuid": "f65680a9-59c0-4bef-858f-bdebcd271423", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975500, "uuid": "7755a7d7-4bf2-4d14-b54e-e5d8267e2b87", "value": "49152:/LA3ibXDk1re61S7pGczY8kbtl/Fpa5bt/btl/Fpa5btS:/LA3ibXgTS7sthl/Fw5bthl/Fw5bY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975500, "uuid": "58ec3a82-ff33-4c7f-abd6-d3580ba48153", "value": 2023936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975500, "uuid": "b97d5489-257d-4e94-90b4-901a784581b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975500, "uuid": "cc9d725e-d098-4d6f-ab0b-267c6ce64876", "value": "Roblox Executor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b3f95c-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748973175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973175, "uuid": "ccf8ef66-bcf3-48c4-b1bc-62fc9b2a8004", "comment": "Malware payload (Mirai)", "value": "eef3167968dab57c73914030939755ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973175, "uuid": "efc14527-ef9b-4244-99fc-a550e61babbe", "comment": "Malware payload (Mirai)", "value": "302036b63ba6eed09ec673b7287dd869f8277d6a8a4abda66b6b554ff8f422ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973175, "uuid": "e26e8515-90d0-4deb-8226-344834ffd3db", "comment": "Malware payload (Mirai)", "value": "1398e7020c7086199b8409ee2d48dff4e8bd893d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973175, "uuid": "300e9a59-f2ae-40dd-8392-4f879bf79db3", "comment": "Malware payload (Mirai)", "value": "9e08839a10c20d5a6f1cc352eb38dd75255aa7b0438ad79ad4f289b304a4be896e82461e60f229a1739c2669f51e863a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973175, "uuid": "9e600e33-b23e-4b4d-8baf-d2c6d71a54c8", "value": "T1E7633BC8F883D8F6EC160538202BEF725E73F177623ADA5BD3A64577AC45602A501A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973175, "uuid": "c097595f-78e1-45c3-ac56-3e9d318798d3", "value": "1536:1s/lgTMtJe0ztj83FrPlDa2TWdrPZMhhPxuwFFlmAvy:1AgTMtJe0ztj8htDRTWdzZ4h5vXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973175, "uuid": "9a7385be-c8c4-44fe-8afc-29dfa1fea790", "value": 66768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973175, "uuid": "b88978aa-b5c5-492e-8b08-d51a92320762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973175, "uuid": "86d7c30a-4f06-4661-a25f-a12b106533e9", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e431dde0-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748957848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957848, "uuid": "28bea693-6473-40b5-8930-e97324e19e94", "comment": "Malware payload", "value": "ec65e09c7fc4d0cdea5fe530ce8afd7e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957848, "uuid": "74d055b1-79bb-40bc-a319-d5cbd1bda03a", "comment": "Malware payload", "value": "30c6e902418f24fc0a69334128b6f128856f7afd72d0b9f3a5d262f28a291452", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957848, "uuid": "bf137fd8-3ea1-4f9f-821c-e51f0e19f902", "comment": "Malware payload", "value": "fc81340370ae9352c24a770c91a6ba3fa585d3e0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957848, "uuid": "c419e026-810b-4422-bcd1-ca9a7d55fe0e", "comment": "Malware payload", "value": "b198b8844c7c9ab1fdf0c9e0c57ceda90c346c3c66af6d607fd5831cb260a19c99669e8c0a7035a892638d6f4a9062e0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957848, "uuid": "96e963cf-0d61-4b24-9bc5-f393b236577a", "value": "T11311DDCEB66131729E60CF21B466D418916DAAC032802B5F9DCD08F5D5E9E10BB26EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957848, "uuid": "f88ed2bb-868f-4a61-82dc-a07e32541688", "value": "12:fJ4SpYF6jjuNIl5kYLz0LKYCj+ODBsj0cTwJSW8tKf2SKWG6yn:uMYUmNI7khK7+Y2jJTKitlEyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957848, "uuid": "ff5b0a38-4627-4700-af1b-64dca0fdff92", "value": 966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957848, "uuid": "ee2c7754-4cec-4674-b4c9-4944b722f087", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957848, "uuid": "6c367d3e-f321-4211-b137-e74db4edef19", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d5d49e-4022-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748917906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748917906, "uuid": "c328cc60-1d5a-422c-9d1e-ac562bb93fd9", "comment": "Malware payload (Prometei)", "value": "a438068d1ef9335ad6b874e410f33554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748917906, "uuid": "0e8efa12-cbb1-445a-a372-5c34dfa2ed5c", "comment": "Malware payload (Prometei)", "value": "322750630c528d8ad3aac493568172724a3f7550ff633bee7c4312d9b1e3635a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748917906, "uuid": "4318dc7d-7230-4413-9c04-b2bf105eb3c8", "comment": "Malware payload (Prometei)", "value": "ba0c870e3284a53753031ac26cbf4a84b89297ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748917906, "uuid": "d418c1c0-94c3-4a56-9897-ba9906ce8d99", "comment": "Malware payload (Prometei)", "value": "947981e70117bc3b5b628ab1a592cb63a15c8f0b716b261eb735d1991b8b6ccb2acc64aac79678baf9663289f9f71728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748917906, "uuid": "cd8f49d7-16d7-4dc5-b933-55cf11207d0b", "value": "T1879423F8C83D2E3098169B3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748917906, "uuid": "e81b6419-eb94-4a04-a0c7-c516f161a0ff", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgj:25WOSACZSV6eKRH5EPiamb4DsDwwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748917906, "uuid": "a35c79d1-4e38-4fe7-abb0-0cd3e245f287", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748917906, "uuid": "6b6e4013-ad8f-4020-aa58-7e08c536b2df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748917906, "uuid": "47cb7dbc-a9e7-47c7-8671-4d7763f776b9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cfbb16-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748956956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956956, "uuid": "7b4b2b77-34ef-48cb-b0fe-f210b210deba", "comment": "Malware payload", "value": "549eca5df91fde1c81505a3762b0dbad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956956, "uuid": "13a8f77d-812f-4aa2-9332-7fd2035b303b", "comment": "Malware payload", "value": "326396981113f32dce0cbc008403e893d3eefcce22067b57f9bcd26b020e14f9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956956, "uuid": "795dc322-3091-4fc0-834c-69e5a78109ce", "comment": "Malware payload", "value": "2b645d8b42e942950d89545c3f6a80643f2afd8d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956956, "uuid": "ff539002-8806-4dbb-a4e9-266e22b4db5c", "comment": "Malware payload", "value": "1ee25b149714f6dadb65cc7c86da8832ec02ba627c0091c7bc78e7a7ef5c7d27f255a81e6a53650b99f9f2737f34212a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956956, "uuid": "166f0e2f-73a5-425d-bed9-7cfbd5448980", "value": "T1324110CD726232316D62DD3776AAD408B2E8A08522C63F5798D838F5C4DDD042A51EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956956, "uuid": "ea6bd508-5c09-458f-a9b2-de49daaeacd0", "value": "24:UNX/duc4IQudZTmTw370kKW9cKZ/6NIjC5mYMx:UNX/V4IQGdKw37FNc8/7C59Mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956956, "uuid": "0b57dfde-60f8-4c46-ac25-0df6d5482412", "value": 2290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956956, "uuid": "9ff6600a-47e7-444e-a3bb-e46e77b1c1b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956956, "uuid": "73d48d39-9760-45eb-a461-a846f413a6e1", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426a0a14-409f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1748971320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971320, "uuid": "c03b43b8-a6f2-43db-9c97-2b5f941dd685", "comment": "Malware payload (ACRStealer)", "value": "cd0bf267c4a66a45f422c0a678ee2cfc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971320, "uuid": "520a4fd6-fd06-4230-a77d-efefb7e0617d", "comment": "Malware payload (ACRStealer)", "value": "33c7d97ac786c33d45cca6f97e466dbb44566728b2eb59fc5041b108ee50461e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971320, "uuid": "d4cd89f9-f498-444f-aff9-ef7340ed93de", "comment": "Malware payload (ACRStealer)", "value": "2715f6d81def9b753f0daa012d673c2c97ee9152", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971320, "uuid": "17eafab2-08ad-4466-bf6b-31b3358c9efe", "comment": "Malware payload (ACRStealer)", "value": "f995ac9a244ec55820613e954fdcdfe8107bf9332b56b32f7426423ade1664cc7ddd3c5d3e6885f0aad4246c410c2950", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971320, "uuid": "bc0ad40c-ab66-450f-9bea-a71de2950247", "value": "T106E5F8E0A8E4B7E6E3770570F94AB3B810DAFDD1E70C921730517AA96A71B412C1C69F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971320, "uuid": "7cdb6e66-2921-48b4-9041-c9dc8b4e5a48", "value": "1f6357097b48479279ee373f2525236b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971320, "uuid": "2047662a-6ca0-4a0a-9f1e-5c05fe048c82", "value": "49152:DNPFbjYYFBkPYMhJVh/Bx7PlkiIlMDjSFmb7iwzeZLNh:vjYYFYDhJVh/BxDGiIlMDjSFmb7iwzeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971320, "uuid": "a3ec2e60-4af3-4369-b479-d985e4b8f880", "value": 3075504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971320, "uuid": "cd12d1bc-a640-4025-9e99-105610db1441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971320, "uuid": "85cd3fdf-234d-4e8b-9a77-1c6239a0eacb", "value": "\ud835\udc7a\ud835\udc86\ud835\udc95\ud835\udc96\ud835\udc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c0627a4-403f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748930212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930212, "uuid": "9b63418d-bbeb-45c6-8d41-cf8330a621a8", "comment": "Malware payload (Mirai)", "value": "720e66b2deebae4004283cdce5eed1ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930212, "uuid": "b070a7b1-3e18-4202-9b5e-0a9a466a6d1e", "comment": "Malware payload (Mirai)", "value": "34d8a4d4d2515edcf42b0fcfbe97373d16c7e171b006ebaecabd63c1aa5d341b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930212, "uuid": "c2a1a51f-c0a2-4d12-8dd6-e9b05020ba47", "comment": "Malware payload (Mirai)", "value": "01a97dd88b5f09c73186c8abcad29ba05d546022", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930212, "uuid": "3a4fa4cf-b379-4f67-adb5-a4b1e6782112", "comment": "Malware payload (Mirai)", "value": "c82bbe1e19dd118447072499c6a3d6743e865994b764ee5724ddaef902b52503ccff085153e33740a99ffce11e45fad8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930212, "uuid": "a90f5cb3-e5e6-4fd7-af20-070e6d7cf346", "value": "T15E832845B8819E12C6C5167BFB0E028D772757ACE2EB72139E249F6237C796B0E7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930212, "uuid": "6db4e484-9ca4-48a8-968e-2d171590894c", "value": "1536:sVQ9g/xJ05mBkwwmjXWvGLd4iuSZBLqxu0pPUF4ZipvVBQAtM8rNrKnKvKn9:REWvGLSF0tqvpPUF4ZipvVBdLrNrKYK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930212, "uuid": "b4234d10-8188-4513-ac67-72328b8fdd1f", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930212, "uuid": "699febea-cbde-449c-a323-2e606580c8e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930212, "uuid": "9beead46-4dd8-4927-90b2-9c769044d87b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de784a62-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1748933357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933357, "uuid": "ecf94876-824d-4607-a04b-013edab01485", "comment": "Malware payload (SSHdKit)", "value": "3587b4c9b21d1fc96b492094f2119e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933357, "uuid": "6de3329b-6549-475a-9875-8e0b8f565b4c", "comment": "Malware payload (SSHdKit)", "value": "353a25258864c63a73aa0bd372031fb9f502bf992b2e3ee2d16b12aa5f48d896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933357, "uuid": "7a46750f-656c-425c-999c-03d89fdefb1d", "comment": "Malware payload (SSHdKit)", "value": "53831c1258b5b4e8011ea1262de046e163553f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933357, "uuid": "656e9254-2f52-444c-b833-88e1dc0b5ac6", "comment": "Malware payload (SSHdKit)", "value": "ebdf1b23590b81a2d9043dd978b67cc65429c141532462d9f21337cd858677229fadf9040bb162107beef113a6eadef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933357, "uuid": "3bcf142e-836c-4db6-af58-66f1101b1c36", "value": "T153356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933357, "uuid": "e563d9ab-7b6e-48ee-8e56-a0704996958d", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSjlcaUxQ5TVdQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO30+TXgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933357, "uuid": "c043fd24-ec85-49ee-b594-ac7d2311f63a", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933357, "uuid": "929be04f-c90d-40cf-9e0e-135dce3f7659", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933357, "uuid": "0bacefab-c489-454c-967f-f045caa95845", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c7d3f8-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (HijackLoader)", "timestamp": 1748944590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944590, "uuid": "d046ff42-f941-4b5d-951e-80f4838d562b", "comment": "Malware payload (HijackLoader)", "value": "3f237c9059bd310235423948c9b9beaa", "object_relation": "md5", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944590, "uuid": "a08d38d7-f530-42c4-83f8-3832f3140463", "comment": "Malware payload (HijackLoader)", "value": "36389a37b4203e6237a31669f64ef2a315774914f4947a41bc5d0774a2535f9f", "object_relation": "sha256", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944590, "uuid": "04f227d6-12b8-4bf6-97c8-a926929dcf4a", "comment": "Malware payload (HijackLoader)", "value": "348e813f2062d93d1c2dc6ce3019b70d7344a46d", "object_relation": "sha1", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944590, "uuid": "446a7930-67e9-4778-bba0-503b561c4b91", "comment": "Malware payload (HijackLoader)", "value": "a170002aeb73a964315f6d8b5010bc748041e9ebe0f70aa1c1ca99498423688ecbaefca7fa807ebb623e11c8a641555c", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944590, "uuid": "7472d783-9d6f-4e0c-bf03-af84d13856bb", "value": "T1FF1633967F44ACF4CBF8CC328F5CCB5165B2DBBA96981E0B824E1E051D831B592079DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944590, "uuid": "d6f30faa-c439-4cb9-8812-e4f3456a13d6", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944590, "uuid": "91f9c70b-82d9-43f0-b019-21f69f78951c", "value": "98304:DpBZC4Gvgp5NqCV8Sxzw9tW/zC1SO9b4u2p7s8:DpBZCExqCVrGtWbC1Tb4u2ph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944590, "uuid": "2888e387-6997-4445-a2c6-d646fe5877c4", "value": 4232728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944590, "uuid": "c65ab582-c835-4705-9e63-334131f14329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944590, "uuid": "3319ab91-e8f1-4ee3-9c6d-4b82586bf552", "value": "36389a37b4203e6237a31669f64ef2a315774914f4947a41bc5d0774a2535f9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c77551-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748944731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944731, "uuid": "0f30b2f6-05e8-4257-b18d-be0a045e80b0", "comment": "Malware payload (RemcosRAT)", "value": "88327be25c08015a11ad1fb9dea6a579", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944731, "uuid": "55dadd2d-2a48-4d3f-a65c-f986fc9753e9", "comment": "Malware payload (RemcosRAT)", "value": "36a6d04b9c423d11a4f5489f775f63b3b8b09b55b280e2cdeb6cf938325c434e", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944731, "uuid": "a95dba26-12dd-4cb9-af9a-d1a732430aee", "comment": "Malware payload (RemcosRAT)", "value": "8fdc551e774d93ba8e997f1c870ef0e7d1c9fb48", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944731, "uuid": "dece7454-6444-4637-bfd4-9092fc22b686", "comment": "Malware payload (RemcosRAT)", "value": "20ca0a778f7d4f976e5d2e04e7eaa685c7486db2bb439beff460df9b423d6811092c3f59258482bd899e9b1ac64b0809", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944731, "uuid": "4e25abd8-b136-4c78-af48-705fa4577b8c", "value": "T19CC3D54F4782FCB99F51EDBCEB70B6A56F95173BCC20B0866CC0B00C09AE7595990EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944731, "uuid": "fcbfcd17-bbe8-47a1-bded-419447806aa4", "value": "384:vm5fxVm4Id9cZb0grSonMr9cZbrPgrSonMCSkFr2z4+dXS2kGK6ovmdADvVBD09E:CnrXror2CKz4u5UvnEyrac7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944731, "uuid": "ae8b06ee-bcb9-4881-80a6-bd3b4e4dd455", "value": 127025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944731, "uuid": "835ce0cb-85bc-4a94-8bce-1acfc550aa35", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944731, "uuid": "1752b726-5248-4e2e-9ecc-261fcd4721c8", "value": "ficepeoplesgettingspendingtimeforbestbasketofthbestthigns.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dac6708-4096-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1748967447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967447, "uuid": "425fdcdd-e646-4351-9f73-6fb521b31124", "comment": "Malware payload (AgentTesla)", "value": "34083be490504b543146801734ab4033", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967447, "uuid": "fbfc229b-81fb-4ec2-9187-84ff38838f25", "comment": "Malware payload (AgentTesla)", "value": "36d73dad1a1d20a3555e2206290f750426a6447cf2afd9163ac4764f7fe33af3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967447, "uuid": "8e02c027-ac96-4ca7-9955-ecceac588f26", "comment": "Malware payload (AgentTesla)", "value": "1250ceaea50420a3cdb405fd03b217c56d83c6ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967447, "uuid": "0d121ad1-a16f-44b7-b027-a9eb39742522", "comment": "Malware payload (AgentTesla)", "value": "4d403e844c159010990297ded9486650728c3ba47264848dce60545e7b605fa4bc640ae182a472a6102a122b5baed674", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967447, "uuid": "dfc538f2-9285-4315-b095-82680dc1dc8f", "value": "T13925BF2373EE8364C3B25273BA557701BEBF782506B5F86B2FD4093DA920121525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967447, "uuid": "f0e552dc-8611-4c40-94af-bf1b12b373d7", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967447, "uuid": "2bfbc14c-7f5c-4b25-8b15-7f47059ff94e", "value": "24576:jtb20pkaCqT5TBWgNQ7arIIYtIFXHlr6A:gVg5tQ7arIIYta3p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748967447, "uuid": "237a3883-c86c-4cb8-a3cd-01b65973f364", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748967447, "uuid": "e5e9a804-b3e5-4460-aae6-c1668bae4ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967447, "uuid": "15f2edf7-0b88-42ad-8ae3-280c6138b1c5", "value": "RFQ Mei 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951010fe-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (NanoCore)", "timestamp": 1748995081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995081, "uuid": "c383efc0-e450-486c-a52d-b1479e6a4e6f", "comment": "Malware payload (NanoCore)", "value": "49ccea66638295eecf389e37b8f50124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995081, "uuid": "4549d17e-6713-4b8d-958d-b91264ca279d", "comment": "Malware payload (NanoCore)", "value": "3707a5c7dcf9dfea8ad9be2246868744ba902bc163e94ffd00b2e56a8ac2e1ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995081, "uuid": "817fe8e8-a122-4b78-90a7-242b3167fbf4", "comment": "Malware payload (NanoCore)", "value": "07fab944e2b814d72e6b5128b45e76c508acf03f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995081, "uuid": "5d6cfd05-d035-4e83-80c3-b97bee103f6e", "comment": "Malware payload (NanoCore)", "value": "9719526f5ebc707b54f2bcf2ce9e06485030f91412e13d8f375a92cd8003ca97f41e4a3cd89fa92376c82ecc9c7416e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995081, "uuid": "33955562-dcbd-4c54-941d-c1f1f568f5d2", "value": "T117521A4ABBE5C695E2BF0F7E48B357405276F90B6E22CB0F08D51C9D5C377008AA1B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995081, "uuid": "e0669534-d1a2-4d7f-939b-0d595ea3a9bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995081, "uuid": "04da2820-a1a2-4c01-9f79-ab124bae1be8", "value": "192:Abn6/mUnyWplHpytK4GLj7osVD1Fpr+9Dh9LsaXNsQ8kQvFMu9gY6:ADxUnyWTJO+IODzpr+9zLsaXNzu9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995081, "uuid": "a25fcff9-c78d-4e63-ae43-853ffa74f865", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995081, "uuid": "6f033213-7f97-4b5a-92e6-28fa932c3996", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995081, "uuid": "c11efe97-23e4-43ae-a74e-6d54ffc27ebc", "value": "SecuriteInfo.com.Trojan.PWS.GrowtopiaNET.13.11764.13971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f1f110-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748930891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930891, "uuid": "9b06dd4d-f84a-4a7d-87d8-1617933e9bb5", "comment": "Malware payload (RemcosRAT)", "value": "4783e082333afd556ca519adbb22e914", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930891, "uuid": "a8df064f-3921-40c2-9e0a-6de3d65859b6", "comment": "Malware payload (RemcosRAT)", "value": "3711c6a688bd3e54ca72f465e3538f84c1bd68247a2ba6f2f8a9809482f1a4d2", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930891, "uuid": "24490fe1-3c68-44be-afa5-28eb870ac3b2", "comment": "Malware payload (RemcosRAT)", "value": "0a5d6c2c3212e976894f107d1f4bc43962513d7d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930891, "uuid": "99f4f00c-41c6-4d1f-b988-075c1e64ab31", "comment": "Malware payload (RemcosRAT)", "value": "d7f7d6d25f8599c835766225189646affefb93dba4329a93ed4f740bf11406b8b67e2b1b791ebbaaa5e9a4202f20c40c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930891, "uuid": "e43cc00d-0064-4a20-aa2a-a6dd72a6f8ee", "value": "T1A1558C01BFE0FE13D524037A89FB57653671EC82AB13470B1694B71A2D727D81B8B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930891, "uuid": "7c733d72-fedf-43ec-936c-db44edfd37af", "value": "24576:P1j7sxqAiAR2eU7uMiAQ6K/1jdUCiXzid:9j73AiAMZKVdjiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930891, "uuid": "023afc43-ea62-4d0e-96a7-8b6cf376d1fa", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930891, "uuid": "cbcd4a74-d0d0-4bdb-87f6-73546871297a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930891, "uuid": "d53c54d5-6d67-41a6-9b1a-fe29e9d063b6", "value": "Purchase Inquiry.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f560d0dd-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748961313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961313, "uuid": "84426cdb-96d0-4ac4-ada1-88473c03fa2b", "comment": "Malware payload (Vidar)", "value": "dd06655302265c1e0c82717c0df1c02c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961313, "uuid": "f2e92005-610e-4412-ac95-b00e4ae3cc3c", "comment": "Malware payload (Vidar)", "value": "376ab51f457c02b5f62e5db07bf6dac178aed99bb339fa58c1ad6dd405b6ab52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961313, "uuid": "60431a92-3c97-44ab-85ee-03dfc64f6d52", "comment": "Malware payload (Vidar)", "value": "14826df64fbdc3e7523e0e7f8c9e47b184f67349", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961313, "uuid": "3a358889-e2ee-49a7-97bb-8eaaf86f5ce9", "comment": "Malware payload (Vidar)", "value": "49145576c0ee13b3610c3c920e4a0bb76a78479f5c5605dc811ca213ef97cb02b8f32e75a729c73b914485f81ae32d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961313, "uuid": "09c8d0f2-1d29-4c41-847b-149bcc7114ad", "value": "T1A8563310CAC0E4BBE048E77285B696276C7C7B21DE745EFF0151E81858269E7E877F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961313, "uuid": "8ce3029e-ec6f-4ffb-b7f9-f56de7096dc2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961313, "uuid": "dabedc24-9655-4117-bdae-c61245455484", "value": "98304:eaaVnuYdEh1jU3NM3A99spbDDWHzSgqS0LrbrwvVHRV+fz72wlBLijwygOkPbE:/aVnuy+btDDWHzPqS0L3IL+bKyBL5yxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961313, "uuid": "9010c4c4-8534-4637-98fb-d05120c119e4", "value": 6279168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961313, "uuid": "a82e73ea-6beb-4376-b892-0b38fe6ffa57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961313, "uuid": "a228ddbf-7cc4-4aea-bc57-b2fe0c2b4ddc", "value": "SecuriteInfo.com.W64.Agent.KHK.gen.Eldorado.25308.13156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb121d9b-40a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748972489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972489, "uuid": "462ad8bb-04dc-4139-a7f7-f509ddce9488", "comment": "Malware payload", "value": "692b14cf67b70a5b9c019f8c170b2609", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972489, "uuid": "4f5ba527-6c8a-44f5-8ff3-8ddcac015572", "comment": "Malware payload", "value": "3779594dc43a31f6488ca1752ca38f109e40b335ad1969e0d75c1e3ef2698076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972489, "uuid": "6d08aed5-cccc-4999-aced-0c660a9b88d4", "comment": "Malware payload", "value": "8f007be24f9c8a0e1b1bcfb26f1f5de6f0d9fc14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972489, "uuid": "b5736aa2-5ecf-4859-a4b9-dc770d1e5424", "comment": "Malware payload", "value": "48d97b432841e20d7554bcbe5085c0fc10a4d49953cbd7b79dab366d06bd06129e8d3a0f055ceeadd53064cd01d96ea2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972489, "uuid": "fa1eff53-08ce-4182-b6ad-e58b16183b73", "value": "T132A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972489, "uuid": "22d7264f-bea1-4331-93a5-164536589d55", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972489, "uuid": "06915b41-7743-4dfd-b401-98f60ed05fba", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972489, "uuid": "cd9f33ad-6e45-4794-904d-ca724e4e8124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972489, "uuid": "d1438761-493f-4fb9-88d8-831736498440", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecba6f6f-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RecordBreaker)", "timestamp": 1748989215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989215, "uuid": "4946d986-f838-493a-913d-7fd46420b8ca", "comment": "Malware payload (RecordBreaker)", "value": "f6aa80c3abb2293aab1466ddb188ac7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989215, "uuid": "00aed25c-abf8-4b67-8a9a-693fe919d0f0", "comment": "Malware payload (RecordBreaker)", "value": "37f05ced32f6b42088b752747c4a4ad57e35de200f1ddbdddc4519b85604e81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989215, "uuid": "58b8d786-38fd-45c7-9192-631b63a30571", "comment": "Malware payload (RecordBreaker)", "value": "47a3b65f4ad52c3bf0ee9aa403b274b309a9e1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989215, "uuid": "8dbabcd7-d9cf-4427-8d76-b70de202fa37", "comment": "Malware payload (RecordBreaker)", "value": "2f2f38cac766794a0dbb32c097b052fea054fe9256f621f93a9a95e93b4541912dbf2f527de23eb31251fe60a6f4bdc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989215, "uuid": "12dd12d7-d159-4770-96c5-7994a0ffcfc8", "value": "T1F4432811E5C3D4A7E59208F127C63A38EB0FFF35395D3D9363098B54AAA05F21B176A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989215, "uuid": "464d58d1-0275-45ff-82c2-88bcbc24e810", "value": "f15c46dd0ebd22938b2ec56664ea6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989215, "uuid": "c46627ab-80b7-45ac-a58b-14e75d54ad65", "value": "1536:IVp01Eca2z/LvhbUDZUN1T04K3rJJOFOE:j1EcfBUDZi03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989215, "uuid": "ccca40e0-e743-490d-8830-c08039352c6b", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989215, "uuid": "97f31ada-ec82-4267-8a55-ee3f5530476b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989215, "uuid": "71e7906f-b171-4964-b896-3e49bc37b427", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.36396.2030.26152", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3efbb3-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973033, "uuid": "15a3d588-86fc-4111-9f02-19441632c31d", "comment": "Malware payload", "value": "45513ccdd2307e208240af7bd3faf3f9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973033, "uuid": "8ef10342-3c11-499e-90c8-1b5db16258fe", "comment": "Malware payload", "value": "389e123912373420f7659c8a6e4d621b678c327944d141c7758d120909c95246", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973033, "uuid": "bd403084-8fe6-443d-bd25-8aa5f0856086", "comment": "Malware payload", "value": "753cb923f0ad7583a3f6ed4f11825c216c1615db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973033, "uuid": "e0f6eaeb-492d-4c0b-9bb2-e462c5aaba0b", "comment": "Malware payload", "value": "67ebca139b4e7360cffdee87ad5dd054a1e942fbc006ea5af3346fdbe3213fa35b5521deac2b96f4c9efa8a6e3dbff4c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973033, "uuid": "7042293c-533b-4a6c-855d-079a5e8a836f", "value": "T144963347B54E93DDB8964F0A8C84BE1087CABE11379E806D2DD00DFD44A6DAE8D9E53C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973033, "uuid": "127ed090-6760-40b8-abec-9caf91cfb046", "value": "196608:q0GmJAhvrpa0hS9fyWzh7LuQZoVfeakmjmz6Hmln8CpA:7PJABr9hcy81qVfjmeHmphe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973033, "uuid": "c7cbb2c3-7a0d-456b-80fa-e6148c06b369", "value": 8672629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973033, "uuid": "68071fb2-9aa5-43d7-a9ac-3378932494d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973033, "uuid": "ad0fcdcb-61b9-479f-bce0-7fdca40e4e77", "value": "gloomv2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdb7ea0-4062-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748945353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945353, "uuid": "c55b29f9-3330-4949-87ac-9d1ed877c60c", "comment": "Malware payload", "value": "39231b77fb60d8c01b2641976e231cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945353, "uuid": "117829b7-26cb-46a3-a311-eb2c3c90fd49", "comment": "Malware payload", "value": "38fcc4d974238562284162dbb684ebbe6249ab4ee2f508ff16d4893b287a27f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945353, "uuid": "c31ca4ff-16d7-47a3-9759-de8a571cae2a", "comment": "Malware payload", "value": "4594f0463377a7521d5acf09e3868b07c29a49c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945353, "uuid": "51409262-52d9-4723-9c84-59da25174792", "comment": "Malware payload", "value": "e07687becd555acd35bcd5799403b5e6231b457ccf2602973e92108ce8b6d1040b0655f9a67409b15f9e910389e6f3d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945353, "uuid": "fb997524-6ff9-4774-86db-6a3353319883", "value": "T181453B41DEE201FADF472672116B67198635D35913392AF3A6642FB1EB312D3B83E318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945353, "uuid": "48cf0e92-0075-43ef-8a4f-abbf4e650d1e", "value": "24576:mo7Hp3yVWSQ6Q2YiE2IqH27yPtHq48srzm5vDkwoACsh6fGRj:FwWgQ2l5dw3Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748945353, "uuid": "b9083a36-2ec9-482b-bcfd-64b604f19b1a", "value": 1168233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748945353, "uuid": "ff9f217e-f061-4dca-98da-c18fa614c27e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945353, "uuid": "36239390-8f67-4414-9efc-96f2e5dbe278", "value": "39231b77fb60d8c01b2641976e231cbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e62f7a4-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748995097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995097, "uuid": "e1450d9f-c272-4b75-bc66-e4c0a7035569", "comment": "Malware payload", "value": "b705acb47849998dadf47101c73a0032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995097, "uuid": "4d905c1e-9c42-4ec0-8838-6ffc56cbfaf4", "comment": "Malware payload", "value": "395644e12dda250c754520285e24eab46a7f29e2207c5d30c272b49812caf8ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995097, "uuid": "14c1a6bd-ba34-40f9-98b0-730f58f06d79", "comment": "Malware payload", "value": "1ca2fba68ed213840c2c8dc85431fcd33fa0bece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995097, "uuid": "4e597ee4-c3cb-43d6-b9a6-c7623e306138", "comment": "Malware payload", "value": "8998d336fae1c5334842dd10072aa47270535664034dce1798a3f8c6cdb1d8c2eb2ed1756d54937453a7a9251b19e44e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995097, "uuid": "3226bfd9-7af5-4fc4-8153-f953fa3fd77f", "value": "T1A4725B03FB4589EAC5BAC13589532D2AE3B5F714131293CF63D0065E2E773D1AA37A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995097, "uuid": "643b72e1-e902-4cd1-be58-8edc1d0dc289", "value": "8cb5a84d1fa015b346be9a2a215b1e45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995097, "uuid": "41bdb118-9555-460c-a770-43aaee1ecde2", "value": "192:DsEJkxbxm4eT7OzCMAgpklDRLM9agV7YHGHqWeSwt5GH73c8J6f4U:DsEqxHe/OkjeBYHWqWeSsW7/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995097, "uuid": "f2964bfd-defd-436c-bc9e-c262331a2bcb", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995097, "uuid": "0f2fd4a5-07a8-4fa6-aeb5-733bfdbcfaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995097, "uuid": "52fb48de-1974-465f-9b55-04be2d70126d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.15961.22175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc98be32-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748933354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933354, "uuid": "c17eea60-f6d8-47a8-b5f5-daeeb47ac289", "comment": "Malware payload (Prometei)", "value": "5682d962de65f114ec54ac7941ee7751", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933354, "uuid": "3a1958c2-b23e-4806-b9ad-7a17a7fd39b4", "comment": "Malware payload (Prometei)", "value": "399f8d603090cf119ad908603fd0db4d3aa7690d6e66e77c374b3300561b21ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933354, "uuid": "ce77c2d7-f433-42f2-b45b-3154d0a56e5a", "comment": "Malware payload (Prometei)", "value": "022b2c0887df2b1ca5c54150929f0c49ddcde82d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933354, "uuid": "c895b5b5-31e4-4f5e-9561-06ed2cb24de1", "comment": "Malware payload (Prometei)", "value": "bf27edad7f743c2077392924ef0093a4647a647496fa00a2e4ff422d0ff093f3570f3bcaf0602ab56226abfd54e78f4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933354, "uuid": "a5266939-0ac3-4501-9ef1-6fddb752dacd", "value": "T1269423F8C83D2E3098169B3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933354, "uuid": "fb0e3651-8a7d-4f67-af4b-0c1bdc8d9c85", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgI:25WOSACZSV6eKRH5EPiamb4DsDwwcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933354, "uuid": "50232177-9ec8-4bb4-b19e-49907b9ec036", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933354, "uuid": "681b5c3d-ca77-4588-8766-e358c1d2ed76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933354, "uuid": "d10e1a69-cc82-4ffb-b3df-86d02bb0429f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8246965-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932111, "uuid": "71961004-c5a8-4acd-9d37-c8ab66bede5f", "comment": "Malware payload (LummaStealer)", "value": "2672065f95ab6c96c0bd4a37970f7035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932111, "uuid": "7b505a29-7f84-442d-97c6-020f471679d6", "comment": "Malware payload (LummaStealer)", "value": "39bd3ba338c11754cb8955e7ca6f4149068e4a1a029ade01e466bd01f450cee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932111, "uuid": "70b4ec3a-db59-4012-8b1d-e341cc5be60d", "comment": "Malware payload (LummaStealer)", "value": "ce71811041933342602a130e53984ded222496ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932111, "uuid": "9c82314b-9068-4bc4-b61c-13fca59abade", "comment": "Malware payload (LummaStealer)", "value": "fae6ee6677cae6a27c7963853c1e12bb3622975d899e35ea5d052784cb9acd7569bb50c18edf0133e622b91193657644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932111, "uuid": "722924e7-79c2-4c09-931b-c904ea6f1431", "value": "T1A685AE399152A2C6FC2A40B60161A5D93462B733C63D2FFF8290F333AE17AD11E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932111, "uuid": "62331ebd-471d-492d-8ba7-84dd28bd6c47", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932111, "uuid": "5cd40843-a900-4b9b-aa85-8a4427e03061", "value": "49152:TLA3ibXDk1re61S7pGczY8/f+5D/BF+LWEvTPf+5D/BF+LWEvT3:TLA3ibXgTS7safEBF+LZjfEBF+LZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932111, "uuid": "f06a5db4-c83b-4921-87bb-42239fcda925", "value": 1772032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932111, "uuid": "4c0f6545-1e64-411f-8026-8fd7b675a9fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932111, "uuid": "58184dd2-595d-43ac-9b7d-2715db04b3d1", "value": "Bwwn8Qr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11cd4c8-4057-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748940609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748940609, "uuid": "c4c72327-7ddf-485c-bd77-fc56cc75f67b", "comment": "Malware payload", "value": "be83a1388c5734b16d5ff7a586906ab8", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "link-storjshare-io", "colour": "#27ED7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748940609, "uuid": "c131f9f5-8b3c-42cf-a760-39fde403bcad", "comment": "Malware payload", "value": "39e318435e1edfced6fd3cdc7e40352310f19ae3e7e1ed7c55cea8e8c18b96f1", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "link-storjshare-io", "colour": "#27ED7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748940609, "uuid": "d5d02004-8108-4102-a15a-70668069414b", "comment": "Malware payload", "value": "74037687cb2e3d1dccb5480ec4661b080f0407d0", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "link-storjshare-io", "colour": "#27ED7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748940609, "uuid": "ad8c2fc7-05bc-49b3-9590-7ae438587751", "comment": "Malware payload", "value": "61f700182efe3c39535e0d061c6e8bd952afcfaf5e9e425a189b917f97d11baf8b4b395ea8eecff8d25cc4d2cc261923", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "link-storjshare-io", "colour": "#27ED7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748940609, "uuid": "8056e716-190e-49f1-8872-2c3a24db1420", "value": "T1C3B2AC50BBD8820C6858005BB05DF184F6F63F2AD296A5E9378F3307BB1FD8D9E19991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748940609, "uuid": "904229c1-638b-43c6-82af-ffa71a3813a5", "value": "768:MOBnHNZNZSKHVXd4uzr2c2pWkMWFWU2juFogAi7JER3x4dgJ3eW5BLBt6i0/ySMt:Lts/6ttsDBd0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748940609, "uuid": "053eb330-f126-499d-af78-8ec3cd839ee8", "value": 25160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748940609, "uuid": "4c43ff40-6d4f-49e9-a594-5492ae37032e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748940609, "uuid": "51cbda0f-7992-4db6-9d7c-086f9933db18", "value": "Video_Azerbaycan.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d365e48-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956709, "uuid": "dc5b9471-7dec-46f7-bd76-398a5fbf53f9", "comment": "Malware payload (Mirai)", "value": "8ccbf9d2ca460219026b59b870d623d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956709, "uuid": "d1162022-a4a2-40f3-bf15-d906a75e0f40", "comment": "Malware payload (Mirai)", "value": "3a2478fa06525ce29c1d25d6bf356274335284c1aa6d37509ecd561148630729", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956709, "uuid": "68484111-4ee8-4334-bb0c-ac47ab17a48d", "comment": "Malware payload (Mirai)", "value": "8d714b7bd5161afe54e1c9682edea655374e4405", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956709, "uuid": "1326991f-50b6-4341-9545-4fffb03d664a", "comment": "Malware payload (Mirai)", "value": "40681bff08c7c12710b1127fe6765108bd335962b15276c19b2fd597959f0053edef4300041207835e11563f3a2d3ca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956709, "uuid": "85f655bc-6754-41e1-bc62-730328b2bcc7", "value": "T18683D60ABB604EF7ECABDC3745EA1706209D552A30A96F75B534D918F14F20F2AD3934", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956709, "uuid": "af0c18f4-8d19-41f0-982c-8750ce8311cc", "value": "1536:W1XW3UTVavjqVQywbPxPP/wwb9lT2TiUeL6SZJizKzC:W1XW25VYnUjSGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956709, "uuid": "4e0b87ec-ab19-4c4d-966d-ad220b752ada", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956709, "uuid": "a622176a-a9b6-44ad-bced-c73c4e553486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956709, "uuid": "29eafc87-5368-43af-9d11-26bc3b8d540a", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b0044e-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748972963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972963, "uuid": "0a4eafd6-9d27-449c-abbd-02aaa1fd7058", "comment": "Malware payload (Mirai)", "value": "786996168c2657d60dd0028fe7cfd434", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972963, "uuid": "23380f37-f985-4951-b8ef-700fd7dba014", "comment": "Malware payload (Mirai)", "value": "3ad6f7c2ff60cecd2d78d8ebc07a458ef9dcc1c040ce26d81da4a37c50cfe05a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972963, "uuid": "aff58077-4319-4988-98f7-76bb4943b52b", "comment": "Malware payload (Mirai)", "value": "2992ed2c18afd6295bcead53b107b783f45ee1a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972963, "uuid": "439297cf-b866-4e91-9b0f-ebf1b08f56ed", "comment": "Malware payload (Mirai)", "value": "a8cb653380d69df8148cbb867fc50fa42844f13858d908aaa08fd516cd9a03ddc69894b97ad09eb0d3c764988a1131ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972963, "uuid": "b287d417-b505-4ff6-9145-db204fa6d8b1", "value": "T1D9E33B86F6414B17C4D2177AFAAF424A3322D79193DB330689285FB43FC665F0D63A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972963, "uuid": "eb19a9ae-2aca-4018-8666-49903ab4023f", "value": "3072:TrDYS56KwUnA4JxwgpX67DIjvHiL7OYr0qQSgH16rM/9K8u1d:vDYS56KwUnjJxu/cvHiL7rgUgH1SM/9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972963, "uuid": "4df17b8b-a958-46fd-a73f-d7d7e9dd116d", "value": 146307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972963, "uuid": "a94f5796-2006-48fd-a80a-d860c9bb2c53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972963, "uuid": "e2027b86-7be6-48f5-a21c-c5cb75d528fb", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5576de0-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957876, "uuid": "88042c90-d1c5-41c1-b8e4-56665caaf0db", "comment": "Malware payload (Mirai)", "value": "37936ab88e25f832aa009217aebea866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957876, "uuid": "79f8ea31-2ff2-4950-b708-90906e78f76d", "comment": "Malware payload (Mirai)", "value": "3b06aafdb6adca4787248836e0179276c4b979d59d05421f5cfcfcc65893a4d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957876, "uuid": "d640c759-653c-4a55-9054-f8156708b4f7", "comment": "Malware payload (Mirai)", "value": "f21af22a15c1be79428edfc604174bbe3764172a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957876, "uuid": "e9665e79-a113-444b-a21e-230bc9179c86", "comment": "Malware payload (Mirai)", "value": "1488d66226896791d416062648c6b1fd712a2d3b5e463cc4acaabfed03cac0f31db25ad1fe90ea4f93b4ceefeee0d626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957876, "uuid": "57446fd8-4680-48bb-9926-90589de9710d", "value": "T135236CC4A543D9F8ED1506F13173EBB39BB6F07A2029EDD7D7D8A5329801602E60729E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957876, "uuid": "7e9f90c5-961f-4a39-972f-439eaac555f5", "value": "768:A81pBBu2+22SvxfXRLMYaa4I5EnbD4dlYibJWiXO+YEX4a:91zBu2+22SvxPRLMY/5EUlYeJWiXO+HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957876, "uuid": "088e5b90-7e71-48a5-aa87-9e5d4fec2319", "value": 45660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957876, "uuid": "ecffa786-750d-458f-ade2-aaafb9744366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957876, "uuid": "959c1306-31c0-472f-9619-96b870fee63e", "value": "hoho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0987f0-403f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748930214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930214, "uuid": "098c1fa7-9d62-44fa-ba03-00217f23a8d6", "comment": "Malware payload (Mirai)", "value": "8fc8013fb2b7a3a20472a99db5953ffb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930214, "uuid": "1cbf6439-66ea-44a1-a6d6-383a196ce70b", "comment": "Malware payload (Mirai)", "value": "3b66621aab5ecdfdc7d95f719e05a1bc96708b812d1ea834117220ec2bebeb54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930214, "uuid": "38c27b11-0198-4a19-96d8-e807e4b0b1ed", "comment": "Malware payload (Mirai)", "value": "edad096ea4df99028d86497428f41c2e16e55fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930214, "uuid": "49fd406c-d44c-4031-9f72-5cb606082a88", "comment": "Malware payload (Mirai)", "value": "652960c84520329167e7b0f06bd456ede169987c01c52aebe13f84f0f69426ba3dcb2cddd8c0f032d58d49a0d11fe74a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930214, "uuid": "3669e6f6-ee45-4c07-9e5a-ba6316cd38f4", "value": "T14AE2E1B699976506C17C42FEE0EC4C28807058784F5E9BFF620D05F5CEE612852BFAD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930214, "uuid": "66665fac-afe2-421f-9602-c3719a49416e", "value": "384:MgMAj/bi31btAoXq7IK96A1aIesVbWQqg2u1PgDWY2Oa3Cta0Xz6T+arrH1bMKvA:jbbw1bBPReAu1gDWYx74T+arz1AKvGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930214, "uuid": "219ccbac-6dc3-446d-a068-fe83ca40bc22", "value": 32224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930214, "uuid": "c7ac81c7-9345-4463-984a-232862a5aeab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930214, "uuid": "f2bfbf62-b563-4ccb-93a7-7a18ef82c408", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34461338-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748944668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944668, "uuid": "8ee37e71-8bbe-4ef8-bc52-5d8a0f0bd78c", "comment": "Malware payload (LummaStealer)", "value": "a4f142698ec274b7414f1b98cf0d83c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944668, "uuid": "886d3486-5a89-4c42-97f2-2dc369eba050", "comment": "Malware payload (LummaStealer)", "value": "3bd1f7a2a9cfb05bb83e4acc0383d51a199506f797615d83df9eb28c74ac7e84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944668, "uuid": "01326a73-fcfe-4808-82ac-efcd3aba8f97", "comment": "Malware payload (LummaStealer)", "value": "aa4f89a0cef9d7facb5b956484420fe8937d0d44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944668, "uuid": "08d2f74d-8bb0-432a-b685-60a363d1b72c", "comment": "Malware payload (LummaStealer)", "value": "cb27a76eca07925b9ce40d3df667b3030750113186c020f3ab60a21e27899dd8f39e835346cee52f0a3c57feb65b3101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944668, "uuid": "042809c7-db96-459c-bae1-953ee4af6a09", "value": "T1C3953383DDD61A92F7351C71C49FB25C8AB05F0384A5EEF8AD68A0F1CC5736A3502AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944668, "uuid": "69289baf-95df-497f-b21d-7d76932d1e3f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944668, "uuid": "b71aecec-7f05-4490-9ea4-8836951febf4", "value": "49152:DmIP5BTd2Rr3Y+Dv1yBb8GmL85tLM2Kmmok:KIPHTIRr3xxM43856ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944668, "uuid": "abbc78dd-4dc8-4ba3-9d9c-b70bb8a6b69f", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944668, "uuid": "74d04ee4-fecc-4937-a10c-508e42a4e5d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944668, "uuid": "741d652b-5edc-4960-add6-cd96f7262f4f", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41fbf911-4080-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748958005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958005, "uuid": "0742030d-d2b2-4a2b-85b9-bedea26e143f", "comment": "Malware payload (Amadey)", "value": "9bf93861c32c3a2a30ea0d4d995ccc3f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958005, "uuid": "2eef63ca-27f0-4038-a6f0-127e38c4abc2", "comment": "Malware payload (Amadey)", "value": "3c7cd0b8620a6b6e75110c604f7f5ddd5cb51b9fbcf8cee963623ad0e04c4c19", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958005, "uuid": "1b7a5301-5d20-4ed8-9fc2-8dd130a76edd", "comment": "Malware payload (Amadey)", "value": "243cfa1eb61e18d710371c2e5c308ca0cb85b006", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958005, "uuid": "29b2f419-a8b2-48f8-900b-e978b9d15500", "comment": "Malware payload (Amadey)", "value": "d3fc90215fd10997ae9705161640f2954e51edc0adf0edfaa7fab81bcc1cd346618f02fbbf34736997ceeb03a703a587", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958005, "uuid": "679e5be9-93d7-46b1-8864-d7583edaceda", "value": "T12D945C217813C032D66291721F79FFF585ADA8259B7109DB7BC00F769A202E27A31F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958005, "uuid": "d2602864-5866-4511-9aa0-51c82ba39cbb", "value": "1e7280afbf80c2800b272220ce0718da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958005, "uuid": "6b60a587-f5d0-4f11-b93d-efd83cdb2fee", "value": "6144:0iUuGdolfFd313lcnGpPpnbJoHtbspmZfkCw3uWgGUS/T+WiU+9GTA/nw4AO+2j9:0iUuGdolfFd1lGkpbCVkCweWgB7/9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748958005, "uuid": "bc8ed6c8-3a6c-4ea0-8823-c5f13804ac09", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748958005, "uuid": "6313f028-d9b6-4f74-9f43-f02076593f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958005, "uuid": "795a927c-9dc5-48b4-ba40-2a26f8ea0047", "value": "SecuriteInfo.com.Trojan.MulDrop31.10006.15703.16006", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c3d1a5-40b4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748980641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980641, "uuid": "df0e9142-ace0-426a-9037-11450378e2aa", "comment": "Malware payload", "value": "27d5aed1a30914789c475eb2375d7e23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980641, "uuid": "9d6fc44a-6f82-4989-9d1b-21952a78f2c7", "comment": "Malware payload", "value": "3cb8d0f95913cbc5410d60151b6f9ba61880c9165635cd9a0207c678bb4b2a4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980641, "uuid": "20f35fda-66bb-4941-bf8f-3bb815f1c1f5", "comment": "Malware payload", "value": "99cad850abbb63bb39b336bce712effe2ede16ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980641, "uuid": "2e773a27-2fed-4c16-98f8-cca0f12903e3", "comment": "Malware payload", "value": "fe90b806015253c67e470777c3bc33bc655e1c7cc1018a344a6971fa5f816a49f64734e979df1629260451a4f1bb3134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980641, "uuid": "2c85b242-b3ae-423c-993e-3d83ad9e62f8", "value": "T12985AE399152A2C6FC2A00B601A1A5E93472B733C63D2FFF4290F233AE176D15E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980641, "uuid": "b8386347-6ca3-40da-9ea7-b7a8736488c9", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980641, "uuid": "2ba7229f-8012-4b83-968d-2e5f95711818", "value": "24576:T9LATjgcql9XDP81Xbe6A5kS/FHBpzJ+PczY8TmyUevtbj/DyUevtbj/Q:BLA3ibXDk1re61S7pGczY8Sy5nLy5no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748980641, "uuid": "7ee95ed9-2160-4217-b742-cbc339ecff55", "value": 1783296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748980641, "uuid": "b3dcd42a-22fd-4998-970d-80736538d666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980641, "uuid": "c7d05bdd-6150-41ff-84cc-acab53b54de9", "value": "Diamond.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861b4136-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748961126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961126, "uuid": "3d80f17a-f116-4c76-bc4e-05f819cff1ca", "comment": "Malware payload (Mirai)", "value": "95e37d0965eefcb7666c621487360fb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961126, "uuid": "f17d3cd7-32da-4e72-ba4e-e8a8bd993d0f", "comment": "Malware payload (Mirai)", "value": "3ce2f3c76b82783c608debd9e2cd00230a8ec5f2e13990be06948f4988806b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961126, "uuid": "53c5bc4c-4856-4330-af05-48a578420546", "comment": "Malware payload (Mirai)", "value": "8b0bb17b6bf78daad37a97930e6d534bed56cf17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961126, "uuid": "2de12c91-27b6-4bef-a497-3e1be497887d", "comment": "Malware payload (Mirai)", "value": "22ff63dae2e759b66e8640e60109567a1c5746e164b77ca9ea79f5144b4bebfb0c3bca3a789f0c0e5db54b5f3611afed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961126, "uuid": "a5c445be-8e07-4edd-9f70-564d620d1444", "value": "T14D732A94F8819B12C6C612BBFB6E468E3B2653D4D3DA3203AE395F21378351B0D7B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961126, "uuid": "b47a6a85-c4b4-4330-a419-0e76d377ca7b", "value": "1536:iuw5oDVbQkhGYybjVBRUU6T5paCjp6vQ:iutDFRhYVBNsy1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961126, "uuid": "8492a49e-764e-4f35-b121-8b0622e4f0fc", "value": 75208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961126, "uuid": "00e11cf3-9ffc-496a-a20e-6a58dc3e7583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961126, "uuid": "5ac69dfd-835f-4c89-9b10-0fd891228948", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052d21ad-40a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975083, "uuid": "3ce511b1-4e59-4caa-b79c-999cb7823d6f", "comment": "Malware payload", "value": "6fa6f9bbcf1955ffb659b43960a9e7c8", "object_relation": "md5", "Tag": [ { "name": "abokav-info", "colour": "#2C5F22", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975083, "uuid": "87bcc745-acc0-4a5b-add5-ddd7d14c4c57", "comment": "Malware payload", "value": "3d41cec2014b159f7b1657b372de130b79ee7e958ef22db1a3ad28bb3480a699", "object_relation": "sha256", "Tag": [ { "name": "abokav-info", "colour": "#2C5F22", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975083, "uuid": "27e39dd4-fa9c-41fb-81cd-d44e1c6b924e", "comment": "Malware payload", "value": "38a37815edc454a857e6e94531c512470561b4bd", "object_relation": "sha1", "Tag": [ { "name": "abokav-info", "colour": "#2C5F22", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975083, "uuid": "6e694dfd-a066-46af-a429-a27d7f01439b", "comment": "Malware payload", "value": "5bd297c172504548ddb1efa99f630e4be4f04079581d32786882d4d5abca5c27765e6b6b108bfdbad1f2c360ba083785", "object_relation": "sha3-384", "Tag": [ { "name": "abokav-info", "colour": "#2C5F22", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975083, "uuid": "2c2fe4e8-56af-44d3-9a71-18ead8398967", "value": "T1B0B53322C56C3CB15643DACE7E5281D4CE15D1962EE040E28D991F8EAE7F4E86FC1DA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975083, "uuid": "8ca29831-1b32-4e44-af37-4964993d7882", "value": "49152:2Lr8VR2mLU9meBn0rdffQwZ8OTO/TC/XrJKfeUi64Lk5fTpsbpr:2LCde6rdffpZ5O/TErJKZ4Lkx2tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975083, "uuid": "5438a41a-eb3d-42d4-a65c-b5d8484a8150", "value": 2395408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975083, "uuid": "5512e034-64f7-4835-a2e3-446347d684e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975083, "uuid": "4467b497-11fc-4a2a-a2c9-4dbf2432a4a4", "value": "stage_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85cd4ca-4047-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748933830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933830, "uuid": "88d9dc75-4c1c-4621-8293-4be559f4fb7d", "comment": "Malware payload", "value": "1c910b5da0de9705e31ae21a91cd96dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933830, "uuid": "f3121301-aa44-43ad-878b-f6a55035021c", "comment": "Malware payload", "value": "3e9ad89d80219a634c6763fe93f78d1e79bc7fb65440483568c7a719b0090863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933830, "uuid": "65f26ece-1bfb-411c-a9d1-7f176f31e6db", "comment": "Malware payload", "value": "566e4070f8b7f190568b195d2f3eb1d1059eacea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933830, "uuid": "e027613b-ffab-4697-b6d4-bc6031d63d36", "comment": "Malware payload", "value": "0084c1558c76ebaa5f55d55fffbb03d4b2e4040a1235cab419a7d77897278ac5f68b4c681734088b830fbfe3933a16c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933830, "uuid": "a9eafa7b-1c79-49ac-8933-8e6e901c9f67", "value": "T1A8D45B34B597C0E7C302673C4F1CE6651229A8664BB427CB33D52A6B0FE62E7971790B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933830, "uuid": "fdb87553-064c-4f0c-9f3b-389c582ddacd", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933830, "uuid": "a1b1dfbc-d860-4974-8028-c652e11b72b5", "value": "6144:MKvuk6C7SPIm/ZOB/pHXqPNVoWK2GzVoUJly4pjr9lb:VvuW7SPISOB/9Xq30p79lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933830, "uuid": "dc7a5ea0-a5eb-410c-8a8f-9aaa727d8c82", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933830, "uuid": "a8278c38-08f3-4fbb-9ac7-1fc4a908df18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933830, "uuid": "64e8b63e-fac0-4108-b753-f76cfb318092", "value": "Filecscs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b7659e-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1748989150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989150, "uuid": "147ed0d3-50a1-4f6d-b64a-d52dfbbd9f18", "comment": "Malware payload (Gh0stRAT)", "value": "fd190948d809a588c807cf0b5f96938d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989150, "uuid": "80b27453-9dd9-46f8-ac53-8edb3d07154c", "comment": "Malware payload (Gh0stRAT)", "value": "3f9b10ab115bf3fce977970ca3a6254776f83d8de6017c59c46e4c69b3dc763f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989150, "uuid": "d81cf138-6d04-4b97-9735-8beb82ff2334", "comment": "Malware payload (Gh0stRAT)", "value": "65f7fd21c98ac7dc57679366bc00a6b3303ab36f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989150, "uuid": "f6578405-c7d5-4834-b50e-b3c52abc7394", "comment": "Malware payload (Gh0stRAT)", "value": "ed79ec9102e1a1766ae7a34acf433cf0bd1de0b07d03510b9bf3007aa3373ef4b7bd5b281d69126e22479cd5b7853d3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989150, "uuid": "f861e2d8-0b80-486e-b2ca-960134478670", "value": "T1B5C3BE4E6C92C125F5CB83F0A8409B696C2C71BCCAB25BDFDAD0D88524B11F7F47652A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989150, "uuid": "ee1f0ca2-874c-4e4a-a28d-e1a8203570d7", "value": "1f14aeea96d8b17212010147fc24b2ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989150, "uuid": "47df8efa-7929-4c01-b695-658db9c29b19", "value": "1536:bMsGrMikFVitTI/WdHwBCnVYUj+TYPhlBWVnKWz8nTZn5:QZrmctT0WdHwBCnVYE+cjjWz8nTF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989150, "uuid": "bca890e8-28dd-4172-b886-576c704544eb", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989150, "uuid": "6fb40a2a-78df-4555-91f5-9b1533e5fc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989150, "uuid": "ee1b7269-13c1-4b07-a436-ffd2ec52b807", "value": "SecuriteInfo.com.Trojan.MulDrop16.36851.2984.16028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8ad776-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957860, "uuid": "a9008b50-ce3f-4a5a-bf75-5f9631dcbaa9", "comment": "Malware payload (Mirai)", "value": "b005f9ed09a81c97b8d06bc7799e16dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957860, "uuid": "a1f5dfa8-8a67-4fb2-bb4e-626fc362d945", "comment": "Malware payload (Mirai)", "value": "40dc344183d35fbfa81a334ca90cdf4d1dbb66815648ef7371ce45a04b609bb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957860, "uuid": "32fa1335-09d6-43ce-b2aa-3d4301ff0758", "comment": "Malware payload (Mirai)", "value": "52ace3ee933948f1b76c7befe7c322957b2fc204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957860, "uuid": "9047d38e-a730-4fb1-a879-9c0384b0898c", "comment": "Malware payload (Mirai)", "value": "ae874b1ea2598b38471e21431408b02ac8844cc302169b71d40d2a875b99ce2598803185c1f0b70bea8af5b3a3edc0da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957860, "uuid": "816a0bfc-0814-47b7-9ce1-2241dc209a42", "value": "T1D1334A31AD762E17C0D4A97A22F78324B3F5164E25E8CA2E3D620E4EFF14A446547AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957860, "uuid": "bd675f27-ccd5-4ef5-a35d-4b633e2967fd", "value": "768:CeoKgx4q9llWEBkfYm+6AEFDh7ryEMYOP8cbO+2Sv+d:CeNgx4SllWEBkAm+6A2r6/rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957860, "uuid": "278ff055-2897-41e4-9a2d-326bd1c9d3a5", "value": 52652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957860, "uuid": "e48dd530-dbb8-48c3-a2ba-1d672bb27fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957860, "uuid": "c1abb41a-759c-44b3-9325-3d87cb7b1d3b", "value": "hoho.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d16b42a-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748995095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995095, "uuid": "4dab6b3e-a205-4c8b-b583-ce2ad4957ead", "comment": "Malware payload (RustyStealer)", "value": "ab01f8a44acab7e14470681bc15e9d8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995095, "uuid": "e18450d5-ed28-4ff0-bf42-759b38b39bc0", "comment": "Malware payload (RustyStealer)", "value": "4109001a4a7e396adba9c57fb7a10f158600aa7b7f42867e494a61275707cbec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995095, "uuid": "0e696aa9-7d45-48c6-a793-67ff337ccd3b", "comment": "Malware payload (RustyStealer)", "value": "8a19d2e961722a64772df3685820fe1773b79b98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995095, "uuid": "3a6ed962-c7f4-48f2-86da-dc834dbe1bc3", "comment": "Malware payload (RustyStealer)", "value": "a2952ecc2c15b4bb993939b69f8d99dd6f4f499732d88637cb7d19e8c10ccc1188e1422db46a30c9626f1ed9fe1c200f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995095, "uuid": "2dc04c94-1e79-40c5-91be-99fdad1b7d3f", "value": "T1E1955A43E6B2D4FDC65AC0B8935AA232FA71BC8D05357ABB17D49B313E66B406B0D704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995095, "uuid": "ef99d151-6494-48a3-89d7-e04a6b3688cf", "value": "6380e1a78053016344ac18621e1edef6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995095, "uuid": "be30c328-27e8-4bd6-90c7-ef67cd3a726a", "value": "49152:3j2T+yb8NgLpkHHMQ6UIZhwwb+bz9qytcaZaHUHf7gK7ESuBVsyKQzU+:Ika+d7gK7ESuUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995095, "uuid": "9e1f9b42-4661-4d39-bef2-1daf4d366f50", "value": 2037496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995095, "uuid": "5986cac5-ab21-4220-a4e2-307170f04e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995095, "uuid": "40ec991e-bfaa-4962-8655-118c1e3dd91e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12292.23484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dce614-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748928110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928110, "uuid": "9c183617-836b-4bef-ad71-42299574ff3b", "comment": "Malware payload (Prometei)", "value": "5c0a29348345471ade031c44ae9f4a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928110, "uuid": "d4b715eb-02e3-47eb-9e91-1ccf9bf4c566", "comment": "Malware payload (Prometei)", "value": "4129d27aacadb36a07a6993b05ada06463cbfde697dd5312caf5753e14f32a64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928110, "uuid": "e146027a-418c-41e2-bf6e-548552ab45e3", "comment": "Malware payload (Prometei)", "value": "65366f90141df2a58c49f7ac8bf4fce5be637a18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928110, "uuid": "9765aee0-0dc7-40cd-97f7-ec1ac2ba1d01", "comment": "Malware payload (Prometei)", "value": "c630e0bed957f063d1a56759d762ce550b979d926ee13ebd5d67e9f257445b48a326f647ab54dbe7e16c907b57c85f64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928110, "uuid": "e7b6c4be-dd98-4247-8a9b-7912f8c5637d", "value": "T107155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928110, "uuid": "f2ea1451-05ba-4036-a165-43b152a7c2ac", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl4:qmShf4OTjMgXSJhBXEsVrmz9MOup1Khj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928110, "uuid": "16af326d-1933-4de0-b2a7-4d61e12af3bd", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928110, "uuid": "6985d9fe-cf00-4416-a99c-472761fcdecf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928110, "uuid": "d287958d-7ac5-4bba-a35a-32691705c575", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c18bfc-402b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748921580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921580, "uuid": "366b3678-b85c-402a-b23f-5c8c1f97504f", "comment": "Malware payload (LummaStealer)", "value": "6fcf9b7d814b024a6a36e9977def9010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921580, "uuid": "7b0b00ae-b3d7-453e-85f4-4994ace36f91", "comment": "Malware payload (LummaStealer)", "value": "4207d30f41479ae09559119e340900780dfbff9df3dd3e6c576480326ef93903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921580, "uuid": "cac2a3dd-43e6-4441-a65f-b93f904f1084", "comment": "Malware payload (LummaStealer)", "value": "2bd2b3fbe4d141cb47a928f099646fe0359f6619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921580, "uuid": "ff6c2815-496b-4716-a6ef-1d85468815b7", "comment": "Malware payload (LummaStealer)", "value": "87316239fe5e2ebea0780ea0745d500bfeef998ba3302e441f4b2965f238327f10523a6df547f516461b8a9ea814459f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921580, "uuid": "40361745-3b47-49dc-b9f5-a84845ca18a0", "value": "T1AC3523895A984813EEB30134207CF73FFBD39D49A664CB5A718C3690BE3714B1E2A55B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921580, "uuid": "8388ea0c-e37b-43ea-8bb6-a874f0d26210", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921580, "uuid": "577591c8-59e4-4683-9b37-9d5d6c1d112b", "value": "24576:t0a1d/6FdBnh7Qp5Gc1uKBZpl0jtQEN5Lt4ccuVELh1ZN4S:tDYFdBnhO1uKHv0jtQq56c5VELhV4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748921580, "uuid": "2492c367-b207-4c14-a516-21ded8401294", "value": 1154204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748921580, "uuid": "6c5d9224-c023-4684-ab6e-e03d990649c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921580, "uuid": "c0dfa3e1-821b-408b-9013-94886f18942b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fa9641-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994215, "uuid": "93ec903b-c97b-4abf-9bd0-3a3dd42f759d", "comment": "Malware payload (Mirai)", "value": "b073d72c8919ac5254e4429228eeeb29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994215, "uuid": "ff3262bd-ad7f-4303-be7b-07cf2a304fe9", "comment": "Malware payload (Mirai)", "value": "424fc2b9936dd50a4bb161acda1ca7511586305f002bf5502a15fc1e8b5f6603", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994215, "uuid": "81aa41c9-e682-432c-abb8-2657c1550983", "comment": "Malware payload (Mirai)", "value": "10749fe38b5ec1ccc75b1e176a6797ff3df27583", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994215, "uuid": "62b59d25-3867-4718-bbe6-67fc2c102c59", "comment": "Malware payload (Mirai)", "value": "cf19d7d212e3883f0869f730fd2f6668c3ee122a3acc18ce0c46d6c5f1986bd85977af8befc4cb5cf9ff2bb741b5ec40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994215, "uuid": "773b3667-93dd-4b14-a8d3-76d0fd9f384d", "value": "T1DDC308B2B904DF66F40BD63604D34B257E30BFA74E931622732B3966AD362D42827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994215, "uuid": "7b7e1f64-9257-4e16-85f8-b3138b66f4c9", "value": "3072:TqzSKAOCeVRpkR84/1o0/xypX9rHmqYQcuL/1nFWNb:ySChVRpkS2ypNrHmqYQcuL/1nFWNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994215, "uuid": "0f3a2211-bac6-4e86-b154-873a2c2de552", "value": 119535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994215, "uuid": "35c37441-bde2-41ee-8d87-d07ae3b5aed8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994215, "uuid": "e5a22f5f-a5cc-43f4-bfa9-98f5133a0b63", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402a4fc6-408b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748962726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962726, "uuid": "98f93b70-5bbb-47f6-ab21-5b31b206c5fe", "comment": "Malware payload", "value": "b0bf6c94fb6e1b26a45de7893d115ac1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962726, "uuid": "0d27e9dd-4cf9-4e36-9ac4-5fbbb6d090fe", "comment": "Malware payload", "value": "430d1a8bbb941543ee572c21177a3a6b21394e4b48792ba550f6699d2472c05f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962726, "uuid": "f9b01172-dad5-4461-b5db-04bc6b63dabd", "comment": "Malware payload", "value": "0d62f4257f3abe663889bc1c6ca744c54606dbef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962726, "uuid": "b4fb1f76-95ff-45f2-a564-acb560512901", "comment": "Malware payload", "value": "fd839025fe29c26a162543a61b38f337a6dc3e7a737974e23f58ba46b984dd99730b49d07306caacbe012ce066d0ce7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962726, "uuid": "649c5c81-1593-45cd-924c-f6a0028e9f3e", "value": "T1DCA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962726, "uuid": "49a5fa34-8f7c-4b56-a1e5-10179668b484", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962726, "uuid": "1ff8d9e2-9b61-45f4-9b57-08059cf51691", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962726, "uuid": "f5849499-7a56-42c6-a4e5-0fcb6d53b76f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962726, "uuid": "36b75207-6538-4f1b-8e78-51b9c0065117", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73e5639-40b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1748982764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982764, "uuid": "67897c7e-f964-43ef-a51b-a376428d182a", "comment": "Malware payload (Adware.Neoreklami)", "value": "695a694a40167f59059433fe41dba7ce", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982764, "uuid": "89d30dc8-ccc6-492a-8f7f-f6e175c54381", "comment": "Malware payload (Adware.Neoreklami)", "value": "436d6e12fda2a669bf1cb8a46698578f7dbf6d6e9352485b965537a8037c496e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982764, "uuid": "5f1773ad-123a-4542-abb2-3bb62c019f66", "comment": "Malware payload (Adware.Neoreklami)", "value": "9f005f683d7f2bd41f566bcac54717fdd8374820", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982764, "uuid": "00a3758e-4165-42e1-b399-b87977f567ac", "comment": "Malware payload (Adware.Neoreklami)", "value": "16808d50b55cf1aa66db793a0787fbfe9c8ba040c1d5d9ac3218b9ec165e5371b89fb042c020aa07e0d62312f7a5ebb6", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982764, "uuid": "dce9b2fe-7d37-4cab-894a-2bcea4cb18ac", "value": "T18B7633B27D82D4FBD1000A71DB5946ACBCF3E6594636CE6B73EE402C5A74683D409B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982764, "uuid": "f27b61e8-82c9-43ce-85ad-f073f7189340", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982764, "uuid": "e04d5807-b35d-494e-92e6-a12c2bd988b9", "value": "196608:91OdDCDTUR2OLo9GCyphyalOwdj/k82jSJIEaw2erJM2cFT:3OeQR2ykGVOalVl5wo/aJeWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982764, "uuid": "ba1b7d45-3107-4a28-aaeb-2ce75f4c7d8e", "value": 7590862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982764, "uuid": "a332bc55-92b4-4ed0-bc5b-6108e5b53f3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982764, "uuid": "c1a78b85-f820-4adf-92d5-56f24b5fadcd", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3c325f-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928171, "uuid": "0f469e8c-f8ae-40e2-bfed-c72f1f746fa4", "comment": "Malware payload (Mirai)", "value": "edfd1cf317746aaffe3581c7e85229dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928171, "uuid": "28a0a398-da7f-46f4-88e9-16e7e6c1e568", "comment": "Malware payload (Mirai)", "value": "43a31513fe9a068f7777f19d92578530fa6c8a491eab52a5609dbe626a64e1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928171, "uuid": "0377f674-a170-4583-b99d-dc16b0695b87", "comment": "Malware payload (Mirai)", "value": "e2a6d01a678ebaf636b4e57467be8a52347345ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928171, "uuid": "f0cdf9b2-00a7-460d-8487-3059f17c58eb", "comment": "Malware payload (Mirai)", "value": "a4946debc53af30c6826967241cc874006101d38d92f5f94fa96415da02ab3588d76c0525cc2c7b65293c0b1c19e9ecb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928171, "uuid": "28719486-f567-446b-b8fc-9c8e0a762d82", "value": "T1E5E32946E7408B13C0D61779BADF424633239B94D3EB73069928AFF43F8279A4E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928171, "uuid": "192fed44-65b6-410e-9614-b79d6dc4f9c0", "value": "3072:GLSpGuaXuqUJi48DeeuXORBc6UKnOqgM/9CHP:GLluaXuqUJilD++ncpKnOJM/9cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928171, "uuid": "69583ab8-6743-467e-a15d-e1b5d0a634dd", "value": 150554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928171, "uuid": "3f6b9069-3fd8-48b2-a744-9aa48d3a4ac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928171, "uuid": "4fa7b373-865b-43f7-aef6-484a7fd085d9", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4d9d11-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748929218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929218, "uuid": "cc96a84e-f637-4cdd-a906-21818da282ad", "comment": "Malware payload (QuasarRAT)", "value": "71c73155f20d9ec9926e05d45fb9d391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929218, "uuid": "d5d1c5bf-624c-402e-a4e8-2fcd2530a27d", "comment": "Malware payload (QuasarRAT)", "value": "44b55e0a632ec943d90f694ba3e6a99ff0616cf302bcc6fcd34176eeda14d6b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929218, "uuid": "82fcbfa1-0a4f-4c34-9c09-602987129deb", "comment": "Malware payload (QuasarRAT)", "value": "f6d83a604cde11d52680fcf8b38092000d18a357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929218, "uuid": "d9a2ee76-b308-4bac-8616-9e6ca18ef7f5", "comment": "Malware payload (QuasarRAT)", "value": "3209e83498a67644a8233b9631d44fb45ba45e897d5f6598236e8f5962449d34ffee26232dc8036fee1c6980b34354d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929218, "uuid": "aa4b693b-4aaa-474a-8313-4569a60a828e", "value": "T14906338DBF4F86A0C1EDB835E41A50B003649CA2F295D7630E43D5895662B8EFBF3785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929218, "uuid": "d81efac7-70ae-45ab-b29a-fdb6d9c72c55", "value": "575ea90c069471216fa3adaba586119e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929218, "uuid": "343f8dc7-1c9b-492f-a0a4-0c3575841085", "value": "98304:cyVBZTqD5SrSDpM6hiKy1D2P7KK1M0lV9cpi6dXv1VjQtYAgGGP:chvpjiOOKa0lV9cQ6dXv1dnAgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929218, "uuid": "4231911a-c0a5-47b9-beda-5c6d33031db0", "value": 3827037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929218, "uuid": "a8f0804b-96f2-4920-9c8f-41d8de5b68dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929218, "uuid": "70078165-b67d-42a6-b251-88dbcbe10451", "value": "71C73155F20D9EC9926E05D45FB9D391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056ea499-4078-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1748954467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954467, "uuid": "9779b7fe-4578-4be4-b1b3-38a1168f2ed8", "comment": "Malware payload (njrat)", "value": "9a30be4c3e82dc12113e756f7a6e9033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954467, "uuid": "db66c0ec-29af-4189-96fb-a83c8121ad40", "comment": "Malware payload (njrat)", "value": "4563d48e92aedc8eca0d431965a0ee0d4b6785949d5dce9e2f3f17dd74c5a528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954467, "uuid": "c38a2c0e-f9e7-41d0-9014-7c37c06b2144", "comment": "Malware payload (njrat)", "value": "c4635b3f9b92c7f3cda6b8e03424f3c51f3ed961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954467, "uuid": "f2720f2c-55af-4ab2-8d25-527a88a963b1", "comment": "Malware payload (njrat)", "value": "cbad28ef57a11e0b496d5d06c92c4a36e4421b54d4eff312be0349299336eff9f6004af845b24ccab833c2b75beddd59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954467, "uuid": "16189981-37ce-4fa9-b551-3066a59dbffb", "value": "T18F033C4D7FE18168C5FE467B05B2D01207BAE04B6E23D91E8EF5649937635C18F50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954467, "uuid": "cd848f20-bed4-4e80-bbda-378da64df2cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954467, "uuid": "1d861039-f1bd-4490-a6c6-2cf454fbec82", "value": "384:N8veoixJhl7OHg1WykrppPl48uiX60rAF+rMRTyN/0L+EcoinblneHQM3epzXJkH:Sv+R1NkrppqFidrM+rMRa8Nuvkdt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748954467, "uuid": "a6567877-604e-4024-8305-52aa6ac59edc", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748954467, "uuid": "e5541f54-7125-4bda-8304-c9fcd01a5d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954467, "uuid": "39bf935e-4f9b-495e-9555-4116267eec82", "value": "9a30be4c3e82dc12113e756f7a6e9033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe231ad-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748933010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933010, "uuid": "a18e421e-b673-4a4e-be14-7889b517a4f4", "comment": "Malware payload", "value": "915115be269010be6f0feb09fbe7d03a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933010, "uuid": "6bfe8e0a-7da5-4305-aeea-f8cdd1c02133", "comment": "Malware payload", "value": "45f894dda51d84c3af4c7b27b9207cead8845b928f30d16e630d4c6883b56aef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933010, "uuid": "946534c8-bd11-408c-8510-dee52cce9eab", "comment": "Malware payload", "value": "ba820d75fd0876cd6b758c1a1e0127303fc880c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933010, "uuid": "9ea0f707-8dca-4544-adae-d7865aaea8e4", "comment": "Malware payload", "value": "110fbb4e474e8986d0d6a7aa2fad5641cba70d2bdcbe4fe2a3eabb2e75bff2bac0be1fceaa55f8a402cc395679021563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933010, "uuid": "10fd8a13-28d3-4c80-9d80-3ad5e64fc9fd", "value": "T165145C1973A450F5E067D238CDA68A86F7B2785A1771534E036443BE9F37760AE2E332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933010, "uuid": "c66204a3-de02-4f89-8944-7898e66ce49d", "value": "237e391ecbd07a5b623b05d5666def8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933010, "uuid": "5aa5b929-213b-45a9-9ca9-8900d06c75a5", "value": "6144:bI2fxHcrKmYaHTklax52A/JdIk+jleGtM:bI2ZHtZ228L3+IGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933010, "uuid": "54030064-21f2-4f03-8e98-4ee75b2f3b06", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933010, "uuid": "a63ec3ed-50dc-406f-af36-848434e5081a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933010, "uuid": "43b296e9-0835-46de-978d-580c5c11213b", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d0c533-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748971168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "ce52bafe-4efb-46d5-bce5-26f56742f032", "comment": "Malware payload (AsyncRAT)", "value": "673e0d197d420fe420a8d622b4d5495b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "a0231623-7c2e-4ad3-a77f-684386f317c5", "comment": "Malware payload (AsyncRAT)", "value": "4614a2a9f95b14112d9ec7610fd522e0ceb873764efb2ac4f96891e9e3532552", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "e7457558-3fb6-43f6-9f90-28664d056890", "comment": "Malware payload (AsyncRAT)", "value": "53eaa57aa57b1d1c150fe0dd31266f793c308c71", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "1bb399d8-db25-4b46-b75c-509f2ef75b5c", "comment": "Malware payload (AsyncRAT)", "value": "3bd0bcff4e00a8ad998406bf46eebbc1a53b88537e8f3ae8489a6eb98ff2452eb24bcb1804dc06bf12fbedc0a2b58324", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "ab171af2-0b8b-4ef8-9dab-25105bf499a0", "value": "T1E85733161BD1E56FE5CF043ECF25A11B9635949CAB0E2BB4DF1148B3A290A0F5E209F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "a8281745-c1a4-490f-ae79-4b3c36e050e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "cdf1bb04-65ab-4757-9fba-a591bf4face3", "value": "786432:BPhh6pB7CaCUAlQlLR08e/OPXMR9vehszXnrRn:Bf6jgTle08/P/w3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971168, "uuid": "97ef4bf5-e24a-4f42-9c8a-fad967d32913", "value": 29600768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971168, "uuid": "14d75116-760f-42f1-87ab-9c35f0b66f23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "e6c2ec26-45a7-493c-994a-7c8104798e3f", "value": "multicheat_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10938d43-40c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748987128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987128, "uuid": "eda10037-4a22-4bb3-a051-1d08a6f01972", "comment": "Malware payload (AsyncRAT)", "value": "d455ac9a753955f03b4ba3b0bd89c342", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987128, "uuid": "c049ba13-4714-4497-8ab2-2da84a18549a", "comment": "Malware payload (AsyncRAT)", "value": "464cb82b4d3bf7576960a20341ddfa76e985e7edde52c8b668e31fe588d805e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987128, "uuid": "22641962-dbb6-472c-899e-8c172467d55b", "comment": "Malware payload (AsyncRAT)", "value": "4f4dfd7928464d695c23998ce76ea025e8bae89e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987128, "uuid": "24d7b091-0310-4d96-829a-91084887725c", "comment": "Malware payload (AsyncRAT)", "value": "1c49535808a071308a9c0378ff5f7b7bfed0fc747fbea2f3e62c4e469dfa8867c340c699a0a717f799fd5509424b26ab", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987128, "uuid": "7fcfc5f6-0d26-402d-80e7-b2ea6bb94c09", "value": "T1F0C4BFB9B1890F92E10A99F040FFBC7107F275D3ADF5D6A41F6861888FE2B215E4464E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987128, "uuid": "16ffb070-4920-48c8-9cb9-5b1c6bdf69c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987128, "uuid": "e69b41e8-6264-481a-a420-5b41a0418670", "value": "12288:p3IvM1UZrb0Y7fNzGxb2w0T1Qhg8HM+M71ao7DVxZK:dmW8lzGow0ihhM71aYjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748987128, "uuid": "d35f72a6-7b6f-43e0-a7b3-765371d32e06", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748987128, "uuid": "237a2c8b-4df8-4209-ba05-e2f92cae6641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987128, "uuid": "bd72919d-7f0b-4c42-871a-c28e25237f68", "value": "D455AC9A753955F03B4BA3B0BD89C342.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3722093-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748989200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "b2d1671a-8be1-42c2-9f0f-b3c321702a32", "comment": "Malware payload (Mirai)", "value": "841ce0cb932153dac2435fc188f16c5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "fadbe073-ee61-4468-be46-6734b089ef0f", "comment": "Malware payload (Mirai)", "value": "472cf84da81d31d66bb16a7c7574346ca681962a6274ca5b18be89edb453c4b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "284a09d2-eb15-4e55-9e63-7ae9fd1ca24d", "comment": "Malware payload (Mirai)", "value": "499489a6dbb6eb28bd20573cc640cfdb912f2c58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "23132511-87ec-48fa-9592-62308586fad8", "comment": "Malware payload (Mirai)", "value": "753d853043aa4f27e0d6228c2d8ce24caaf7fa839046495080480d4636e1345259f54c497b8a5ce1ca0d491fe23599b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "813d3bcc-c1a8-4a93-872c-7bfb3b9b3116", "value": "T176835B03608490FDC4D9D1740AAF763AD963F47C2276B6AA37D0FF167D49E202E5E618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "4b12b036-7ce5-407b-9a1b-30f8edeae8e3", "value": "1536:sRnA95uUC98svkCsk2UOmTsxdSqgrRKfL91O4GcZjyLzm02I1F:sRIsUC98bvkdOmTsx0qgFKp1O4GJzm09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989200, "uuid": "7f9e935e-a000-48cc-845f-be9550bda191", "value": 83952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989200, "uuid": "6d38578f-466b-43a7-8f09-2ce44489ec8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "68948749-250d-4d68-8d85-80d1f62ef44e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51287660-4074-11f0-8bd0-42010a9c0005", "comment": "Malware payload (StrelaStealer)", "timestamp": 1748952877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952877, "uuid": "2666fc32-293e-4e27-bdd4-b4e3f035d4ea", "comment": "Malware payload (StrelaStealer)", "value": "9f65ecab6a18f8793fc01d2fbc3f5908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952877, "uuid": "435cd6dc-b3cb-497a-a62d-eeb7c67bf76a", "comment": "Malware payload (StrelaStealer)", "value": "4730eb51eb81e0922e34ebe3539263dc47e035cb317cfe77a737ce1f746ba54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952877, "uuid": "51e817fb-c978-4590-9104-e3752df16b8d", "comment": "Malware payload (StrelaStealer)", "value": "0654a8873f3cd7d45d65564afb4d90033f0fb675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952877, "uuid": "37fd8313-41ce-42c6-a05d-6d6df6072a20", "comment": "Malware payload (StrelaStealer)", "value": "b17f70bb2f2e13a069bd83c3a780c3ab7258261d5f9251a98c962916eeeb8a219db79cf2a086f4a5d3febf6a2df8852f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952877, "uuid": "7d96b24e-5668-410b-b6a5-b588c96653ca", "value": "T1FED7333950A31CEAF70356F16269B950A43BFCC6C02A53E33663F9DC233B9B86D11656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952877, "uuid": "14b8abce-3540-47be-bcaf-8b8121f8e42d", "value": "20bd67bca6c560d47ee260a75029b116", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952877, "uuid": "32f97d89-69dc-4464-baee-5514cdb0f0e0", "value": "1572864:oSAVJmv5yn+55iVHMeH3uBm7HU8GEzVZovVhoz:m+GGetTzVsyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748952877, "uuid": "bb77fad8-ce5a-4807-bde2-05e646e2442e", "value": 62572032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748952877, "uuid": "a51b8e0e-a3f6-4c8b-a1ae-543e9235be6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952877, "uuid": "f3191fc5-e074-472a-8cd3-2c4059996864", "value": "echo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c327f40b-4075-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748953497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953497, "uuid": "7b2832fc-3a9c-43b2-9718-eee9018a965b", "comment": "Malware payload", "value": "e5eb755569eade7fb392cc5fd5a89212", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953497, "uuid": "384341d3-8d84-4c0a-b956-e1a20d5eca80", "comment": "Malware payload", "value": "47c3887fe63d3fb9083311d3b20cc7ce2aa498cf0afdb8d11c62e26944e55195", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953497, "uuid": "0ee0fd6a-220e-4557-9fee-f4d6541a9e49", "comment": "Malware payload", "value": "81ba95e98ebd0b10b1793fb08a74af07fe404e69", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953497, "uuid": "39a2ddae-8446-4143-bf21-f4749af78537", "comment": "Malware payload", "value": "a505b6653b5fc341d57faa6a5e1340766a0f156e17bc1098854345b415012ca7ce44e1e4b7dd29adf276d57d544cc9a5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953497, "uuid": "16397219-4d82-4722-b58a-8bc786366715", "value": "T1CF55230D7DC9C91AC06A237C8AC7C4A252289C197F3A42AF376477557C387F269C7AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953497, "uuid": "d2ad19e2-0d32-4354-9d9b-6e1c7b7dd3f5", "value": "24576:xr6mDiqxfRMay1cwWq1kfU9IETxHKOmsu2nZdi5nN4sgLeKscpkex:VtDhR2/WskIIETBmvcHiFmsg6kSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748953497, "uuid": "0ad66da8-4547-41ec-b9c3-a7161d590244", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748953497, "uuid": "5d475bcd-3a3b-4382-88c8-9c3fc49a035b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953497, "uuid": "b3ef04f0-8dc1-4a6f-820c-4e5164ff3d26", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d4a216-4082-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748958770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958770, "uuid": "bcbe316f-eac3-411c-89d6-5fe532975299", "comment": "Malware payload", "value": "e30734bc74fbfdfbcf831c0777f45408", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958770, "uuid": "44f9fabe-e0a8-4bf9-8bcd-1ce5742e757d", "comment": "Malware payload", "value": "47d0353a05251e297a4af7023d833931bc45b1d42065dc55e924f9c404752c30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958770, "uuid": "8af93b40-76d9-4685-8ea9-cb77b75115ff", "comment": "Malware payload", "value": "2a12fbde9de95ecdb5ee2ae561ac3154b8ee6aaa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748958770, "uuid": "7ad313ee-acf7-4b8c-bd79-fafff504bca5", "comment": "Malware payload", "value": "9690db862670ed1f3b3f6f868020fcc7125c25cd10c5a1eafa90032faa53e83f7c982493e54321be04eea6712bed7009", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958770, "uuid": "280a5325-ef58-42b1-a4a3-066ac3a7c5f6", "value": "T1AD11E8DEB22131728E24CF21B466D414916DA2C433A03B1BADC908F6C4E9A007F26EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958770, "uuid": "2d8e789a-1bb7-455f-91be-bf29db223b57", "value": "12:FJKUpYF6FuNIl5kYxz0LKYjUj+ODPsjScTZDjEJSE8tKSU3KXUG6yn:yyYU4NI7kbKS6+YEj3TZXectJLXWyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748958770, "uuid": "34c836f6-bd11-4e59-8df4-29abdd320904", "value": 870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748958770, "uuid": "3bdbb298-1c3e-4617-8ba8-59a4c7616b8a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748958770, "uuid": "c035359a-d362-4adf-bf96-26a5a371b71b", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a63309b-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1748955818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955818, "uuid": "cadae5ff-c888-4614-b5af-7e7794d0a3c9", "comment": "Malware payload (SSHdKit)", "value": "769e93027ae14b5e809db722c00a6ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955818, "uuid": "ea698547-cb0f-42d1-94fa-3c97f7a33722", "comment": "Malware payload (SSHdKit)", "value": "47f284adb080e4ecb37442255945bb18ef6952ad13b3346af19f1392b491172b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955818, "uuid": "2be0f218-5345-4af5-9780-d98ce14be320", "comment": "Malware payload (SSHdKit)", "value": "0319ed027b38da579141993daf1feec7bbf8efc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955818, "uuid": "c2a9c387-7b87-482b-bc34-7b3bb260257a", "comment": "Malware payload (SSHdKit)", "value": "ffdc563c3622d9ad646e9684abd0419c70641d0266a37db9d37f34eb5cec16bbea9c2175228a16f07d5ee98f634dd3a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955818, "uuid": "bfdb8da4-903e-4d71-a282-aef68c8ec827", "value": "T12A356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955818, "uuid": "7f566ea7-0b3e-4c5c-8800-64faa516c6d5", "value": "12288:E8dASOYRNCAJump208iJfll7zmnSrlcaUxo5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsOv82TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955818, "uuid": "0581f042-e07a-487f-896a-5564d05955f4", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955818, "uuid": "292f4a89-0f74-4ccd-b687-efcebc2147d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955818, "uuid": "60a8ba79-3928-43d1-8655-e5e710be5fd6", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766a0f3a-409d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748970548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970548, "uuid": "67e787e3-5f50-4694-ab18-17e8d68cbd5e", "comment": "Malware payload (Rhadamanthys)", "value": "4f7274abb2ce9c43eebb78257f6033ba", "object_relation": "md5", "Tag": [ { "name": "45-153-34-237", "colour": "#6AF097", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970548, "uuid": "31bd4fa2-012a-4816-8306-9c0a3d17ce25", "comment": "Malware payload (Rhadamanthys)", "value": "486a40afea73c0d0669cda4f0610d30dcf9355c4c64d2d7d21f57c9e2458a0b1", "object_relation": "sha256", "Tag": [ { "name": "45-153-34-237", "colour": "#6AF097", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970548, "uuid": "04f16814-5ff0-4be8-8270-d36ce333d6da", "comment": "Malware payload (Rhadamanthys)", "value": "1d9004ab32b37510ecc4fe6f39d8810706a96cd9", "object_relation": "sha1", "Tag": [ { "name": "45-153-34-237", "colour": "#6AF097", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970548, "uuid": "8738449f-a0bf-4a94-ac71-bf0d1120ac03", "comment": "Malware payload (Rhadamanthys)", "value": "949cf3b15332bd14f85360820daff5082518248778e72ae5812c28f9589d038d91643cb4c1c5d18843189af10d598c7d", "object_relation": "sha3-384", "Tag": [ { "name": "45-153-34-237", "colour": "#6AF097", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970548, "uuid": "7a6b3646-10ae-42a6-a654-9bcb28cda638", "value": "T18165336726388433CF952DB991DEEB229AF0AE924DFC160FD0547B253334F870A5D91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970548, "uuid": "d169f89f-bbf0-4a96-9dc2-24e68dfec713", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970548, "uuid": "fcb1ee14-1524-498c-a545-11cd18d8441f", "value": "24576:W0aXph2x0HFXbu3KxtrhJ1JEq9JRKufsO9fbZsFGxX8dE0fRnWYBtR0fANo0iSeg:W9zzRIYFn1f9JRHflds0xX8BfVVBtRuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970548, "uuid": "5901c3bf-c925-45f8-925e-a05e987e150d", "value": 1470742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970548, "uuid": "96c6b4df-34d9-4e79-a510-d2aad8113467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970548, "uuid": "24f89dd2-6053-4e3f-a13f-dddc61d0c215", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eac59a4-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748930512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930512, "uuid": "bc63ca2b-23ce-40f4-b5a1-830045766e05", "comment": "Malware payload (AsyncRAT)", "value": "d9dd561ce8a6f0898846d47a613306d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930512, "uuid": "0d541a96-af24-4701-ae47-8ef32693a826", "comment": "Malware payload (AsyncRAT)", "value": "486d416789d233f798bb69dc3001be232d28efe6dcaa9bda27c96dd46249551d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930512, "uuid": "e094c452-e94e-44ea-b26c-eebf7ca2a959", "comment": "Malware payload (AsyncRAT)", "value": "0cb73d09a2283bf9adf06091174a3d672a91365d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930512, "uuid": "1bdb9c72-dd98-48da-9c00-c9392b7bb587", "comment": "Malware payload (AsyncRAT)", "value": "6b86aa43492db74254f9d70004b0c3088a51fe2998df11097c9f1dcc1874c1a2b6466cdded6acb37b79753be92199fe7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930512, "uuid": "18f9a0f8-c9a4-4559-8b28-9fc653b4540c", "value": "T1AE935BAEA3C98E56E1B90F3EE8F027004BB4F0536B93E78E1984059D2D56F81CD85767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930512, "uuid": "f972875a-455b-4f13-950a-c05f2a2b955a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930512, "uuid": "c310093c-d794-4bb1-a547-ebd1ed332711", "value": "1536:JIq83kS4DbhuIEd5FBJsmKHiF/zZ2f6SmnzZS76Cm0mn:en3kQIEdrUFU6vmtSQ0mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930512, "uuid": "22dd8b26-30b8-4fbc-9cf0-0a88ef7537c5", "value": 93792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930512, "uuid": "253f0f9d-7725-499f-a4bc-2cdda8472d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930512, "uuid": "f0bc91b1-346f-44fa-94d2-309b25b97d3d", "value": "d9dd561ce8a6f0898846d47a613306d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059c8a6e-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1748929127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929127, "uuid": "deb99e12-472f-4730-8c92-5044548ea9d8", "comment": "Malware payload (VIPKeylogger)", "value": "2f2df58dabbb404a1d11a9799bf98f9f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929127, "uuid": "98375474-783d-4cb9-a905-02a22deddbd1", "comment": "Malware payload (VIPKeylogger)", "value": "48ae49add099e5f58de8fbcc59afbf12652c170c576f264c23f0dcd3c86257be", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929127, "uuid": "23f2bfeb-372e-4dee-a986-3869ceb9029b", "comment": "Malware payload (VIPKeylogger)", "value": "67a6d2b953e0439112a001aea7a6ad4942f4bef2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929127, "uuid": "b8f64d1a-4a97-4c7a-81af-01540db85327", "comment": "Malware payload (VIPKeylogger)", "value": "59cbdd705c6893150a751464583039c3bca479078b2f18a26eb0530d263ca70a100a339f9dfd39a5092dfa1e59d84fa3", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929127, "uuid": "4bfc4e12-ea4a-4504-be63-e5c12297cf7c", "value": "T16A11BD256017C257C7B181B2C3C99C86F17CB4859FE29A396828E0FE192A5FE3628087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929127, "uuid": "25488f4d-166e-4950-a0f2-d0ba65712753", "value": "24:KUh05NfBOjmLQdHxg+5B4r44pM2OAfFLy:45BBb8uUgOAtLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929127, "uuid": "e851dce7-24f6-42ea-8917-b4f6794a70f1", "value": 1026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929127, "uuid": "9301c7b6-7e74-4b28-9217-9af3b3e6e396", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929127, "uuid": "fb92a16f-3f8c-404b-b3f3-2a67bdc0f568", "value": "RFQ Aryola New Project 03.06.25.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641acdf0-405f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1748943889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943889, "uuid": "9748b5ff-ebb7-4f6d-93e4-938f872f227f", "comment": "Malware payload (VIPKeylogger)", "value": "88ce57916dbe5b54545802728fb18d84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943889, "uuid": "e2e332f7-8dfb-4434-8e7a-9b60cae116fe", "comment": "Malware payload (VIPKeylogger)", "value": "48ef09c312f5717339d90300b4a4b540c325ff7cbd4fc057bab778db07807e4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943889, "uuid": "ec64d4a8-4136-46fa-9a2a-fc562982ea92", "comment": "Malware payload (VIPKeylogger)", "value": "50f594a3f0f472df4d6c17851632e5166f3d5d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943889, "uuid": "6889409a-0f49-415b-a03c-bf88d9a31bd2", "comment": "Malware payload (VIPKeylogger)", "value": "7a9e7bdbca1f6707f5b332afb3893b36e7558a49afda52f4d9dbe01374115efcc7ccfaef998cf02ed9ac5ac32e8d307c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NSIS", "colour": "#D480CE", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943889, "uuid": "831062ab-ee0c-4be4-a117-e60d5e8a7f26", "value": "T18C151236CB28DCAFF019A47CC1B3E99A6AB2E1305A34592B717D5C365879343186F81F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943889, "uuid": "915e7ac7-cf06-4e37-b7a5-4a3a2cbd04db", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943889, "uuid": "f4e63bed-db02-4ce8-b6e6-414a14650b31", "value": "24576:2cMB/n3dm808q+B2SiW8IRmNWdhrpUoBwN2yysl6lEBcI:q/n3J5BDi/OprCwdyZl6lEBcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943889, "uuid": "21b436a8-1ec6-467c-bf05-94b881edd7b8", "value": 927448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943889, "uuid": "1e08f1d5-8e61-42ba-ad85-d73895b8a400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943889, "uuid": "9757eb7f-9ab6-479b-9d1a-54cbfc0b5f75", "value": "Faldskrmssoldaternes.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc5c5cc-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748973168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973168, "uuid": "a0cab78b-42ea-4234-9a0a-96f3099a75ef", "comment": "Malware payload (Prometei)", "value": "998b9eeb06e96bcf88a100a8e6ad2e41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973168, "uuid": "48b558e9-c0d6-4a88-9f42-67d1fdc7f598", "comment": "Malware payload (Prometei)", "value": "499a1b51189d4425409a795b86af37c5e9450916df48e1c1ce833a7f8a4a847e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973168, "uuid": "b0f9579a-31da-47dd-8b9f-cbc1d15cc7a2", "comment": "Malware payload (Prometei)", "value": "14160f13fdbad158292d2e232b671729f3673951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973168, "uuid": "1eb302cc-5ef5-4de8-a49a-faf7e910155e", "comment": "Malware payload (Prometei)", "value": "79f32c02509f8f332c14f79497f587077951f394dc9d999d5354b45ea8d6b1c2cdaf728b1489b64f4e6f2ff1c3dfcfe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973168, "uuid": "ae5766ba-f213-4831-9f0b-77cfd5a46b06", "value": "T117155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973168, "uuid": "c4423a38-4d80-4e6d-b984-0d041439015b", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplE:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973168, "uuid": "0aa1084e-1079-492f-b4c5-25d095dc81ca", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973168, "uuid": "f8eb3454-4f1e-4d09-a1e5-ee14aa06fed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973168, "uuid": "69aa15e8-2860-4f0e-bbbd-a82d114662b3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8104d057-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GOBackdoor)", "timestamp": 1748934918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934918, "uuid": "2d18f4d6-a191-481d-8bb1-ead55cbfce50", "comment": "Malware payload (GOBackdoor)", "value": "f1c3946164474d95e836dfbcdaae225c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "GOBackdoor", "colour": "#823555", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934918, "uuid": "d64df777-8ae6-4525-9e37-8d3652fa92bb", "comment": "Malware payload (GOBackdoor)", "value": "4a371416a3d24581055d3c4e1514a0aa05ca95a2d6631febb182f18dbbd73892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "GOBackdoor", "colour": "#823555", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934918, "uuid": "1a96ff6d-3f33-413e-bea1-0ec7a4319a27", "comment": "Malware payload (GOBackdoor)", "value": "2c2ba9ced1b08df299ed53b2221538e4791020ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "GOBackdoor", "colour": "#823555", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934918, "uuid": "6b35f799-6847-4a13-9fcc-b95121eb59dd", "comment": "Malware payload (GOBackdoor)", "value": "76ee31715f9f448092403c93916dcbc67103e2aa06a8845840922adb9b05340c2d429c224831eebb0c79433998c4f582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "GOBackdoor", "colour": "#823555", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934918, "uuid": "49221989-d956-43b4-be22-1905d9d25b80", "value": "T1FFD44A34B597C0E7C302673C4F1CE6651229A8664BB827CB33C52A9B0FE62E79757907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934918, "uuid": "1de005cd-b0e7-404b-bd33-9688c0f86289", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934918, "uuid": "abb1a66d-4739-4fef-8ea2-d3cf18fe60ee", "value": "6144:R8EJzsbx9F6xWuX7qGNzo5hNGlrvZ4BWOXU:6EJYl6xWq7qh+rV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934918, "uuid": "7b0d057d-9d31-499d-ab64-e2d6e962ddd5", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934918, "uuid": "db1f9acc-02ba-448e-9807-30b64b75c050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934918, "uuid": "db5eed73-f2f9-4d20-b226-d08066314218", "value": "ghostrik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd1373d-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1748944338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944338, "uuid": "f6bf3385-e3e1-49dd-9e23-42eb7243f6e5", "comment": "Malware payload (GuLoader)", "value": "092cab189b8fc96994aabae01aefa614", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944338, "uuid": "0165d379-6478-412c-b8e0-1dda1bd555c7", "comment": "Malware payload (GuLoader)", "value": "4ac163c1fc709d09bc3b2c1f8cd12b75f566982d2371c258733a6a7916a186e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944338, "uuid": "1490af17-4126-47a9-bd60-6b38b0bde7b2", "comment": "Malware payload (GuLoader)", "value": "39727959d3283f20ef9bdb706875c7f1ba371224", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944338, "uuid": "36536545-d7b1-4a1a-9124-72124a13d5d0", "comment": "Malware payload (GuLoader)", "value": "dc0b3738fd91b6c33e66999eaa44abc8204389abba01b404dd2f2054ee3274856448ba5c644eac79e14e9b769b0c5cb1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944338, "uuid": "a6c232cb-1373-4c53-bb3b-0f75ab2ff739", "value": "T15E523FD62C20FDB64309522A97EC44C9E4FE13B999182407B19DD8635F89EAEEDD60C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944338, "uuid": "674f8f89-b3e8-480b-825a-8f95a591c2ef", "value": "48:3aQOMO+Hd5IlMO+Cid5IEyMso+O1A9ek/MRTMO+01MO+WFKK9Md5IH0MO+oPG:qQO6HvE6nvH7s7p9ekI6k6Wcvh6o+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944338, "uuid": "7b3c21ba-2d68-4375-9390-1e21e1f9d371", "value": 13274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944338, "uuid": "257ec9ae-7abf-4133-b092-d1b015c088fa", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944338, "uuid": "2b91f5a5-7091-46c7-a6d9-29b5792e6ae5", "value": "wegreatnesswithgoodnewsdoodekittikionczsekingwith.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fa0c7c-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1748931294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931294, "uuid": "7e1e8d2f-7a8b-43e7-a992-c325ea568e99", "comment": "Malware payload (GuLoader)", "value": "997af41662107e12006c1d1f1fa820a9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931294, "uuid": "61832687-0207-488a-b512-1895519f9466", "comment": "Malware payload (GuLoader)", "value": "4ae962f561ddb05ee4d85576b24dacf22d44d4dac5cdd3b8e40b5cf2eca36e79", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931294, "uuid": "50f71343-b0f5-4d73-b862-6aa11b27f0c3", "comment": "Malware payload (GuLoader)", "value": "8ee463d377ec6b90bf6615af70e7f89654b84255", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931294, "uuid": "d4b96ce8-6eb7-48d4-89fb-ba89986825c9", "comment": "Malware payload (GuLoader)", "value": "968f7ba43265ab276b96b4eaef80ef4aba6f42ee42ff07be50fa392061cfbaaf9de6012865ba5ef2d63fd042b13c9830", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931294, "uuid": "2d4364e7-fb6f-4a27-b65b-c1683f763a6c", "value": "T1D4F2396BFF2510874E9E16D8E92C0F6B89ECC66145323C71ADFD374A8006A6CB37D529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931294, "uuid": "68a6418d-e347-47ff-9cb0-9fb5f2158c18", "value": "768:qZr34fEC4K4Q1c84HYQ2OafKld3UtqizFnY/mUK3qnFDFNZJ5ieJjn:xff4fQ1cXY1CldZfAqZZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931294, "uuid": "3541c75b-82f9-4196-90b1-c28b53435d0c", "value": 34830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931294, "uuid": "11329706-ccd1-48f8-a366-3d910f0e6bb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931294, "uuid": "0fa10ca8-726d-4b3c-9f69-33ffc68d4226", "value": "PURCHASE ORDER_34002174.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a27f07-408b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748962737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962737, "uuid": "bd09f2db-a5f7-407b-9447-40dfc1850135", "comment": "Malware payload", "value": "2684a688f7ae337beb8eff162ebf96e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962737, "uuid": "07d2f97b-c62d-4414-a5c3-63b1266129e9", "comment": "Malware payload", "value": "4af7cdfc73025676c41c2c3e04518beb8d8f922a2421a305bea1631393241930", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962737, "uuid": "06f61494-8082-4179-b40b-a10a9af513cf", "comment": "Malware payload", "value": "58476a5d69a5c66dc0ae70ae12bd8d0ec23cd4cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962737, "uuid": "a7ff3cb8-0d36-45ee-b116-bb9f3fc83160", "comment": "Malware payload", "value": "a75a224b9987a12b03905c8e527e40dcf2e4805c9ec5ab3f3bccf47b5d67a32d4dbe4ef0d1866f2c18f7c200881e93f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962737, "uuid": "e20d45c4-7487-4e48-ab6b-b2e643aa70df", "value": "T1F6A41212E290D8FEC4DAC070469FD27BFD7A7C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962737, "uuid": "dd89d7bf-aeaa-4d77-b2a3-1d199b5d4b8a", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962737, "uuid": "9ef38c58-70c9-4c11-819f-a7db6b997a4e", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962737, "uuid": "04cdd15c-659a-445d-b9fa-02425558f851", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962737, "uuid": "491b9803-328f-41ef-b3af-00528c73b81a", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf64c5a6-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748931157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931157, "uuid": "003730a5-b60e-4fd2-9fcd-691fe26288a4", "comment": "Malware payload", "value": "e3cf0019cbc6e94877630916a0fded0d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931157, "uuid": "94d3d423-fab6-4c52-a006-b396bb506b7e", "comment": "Malware payload", "value": "4bf3152884d9dcc527e7f75a542bd641be860ce8a2ab0f06eacc975aca04611d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931157, "uuid": "71843c33-c47b-4514-9339-2ef2f24dd78e", "comment": "Malware payload", "value": "ed5d2d30940d46a317083fc52878bbe1fc7ba808", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931157, "uuid": "a59131b4-e49f-45ba-bdc2-98f1a3888b5e", "comment": "Malware payload", "value": "a6d4802642713f47196e3bd577b32880ff4bac52701933284e6ce29d2070d0a65898383316f1c23cd158a03170b5a991", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931157, "uuid": "6e12f9ac-d5bc-435f-9a49-08f723a61316", "value": "T127B1E12397FD5404F2FA5FB0D9B85205587AFCAA9C38844DA9208D1C59B1A43CBB3B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931157, "uuid": "d35f8a19-f1a4-42e3-bd37-8fdcd8fcef91", "value": "48:8/lcW/vRLF2Dlgv3zfVCiExLLYGIDYwB5xGLteFnDElxKi/ML59PmEuYgF/mvGVx:8/OWx52BgvzeLzSYkuLunl1LeVY6MS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931157, "uuid": "d93f770f-b292-4c01-892c-46b2db54a423", "value": 5133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931157, "uuid": "e14bbb46-16f8-46b4-a27e-14824df1b8f7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931157, "uuid": "b23c4ff6-36f7-4a9a-953e-8f73d4890933", "value": "Edward-Hall.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d0edda-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989096, "uuid": "dbfd90a3-b8ec-4abd-addc-cf0e91bacbe5", "comment": "Malware payload (RustyStealer)", "value": "689eba8641d09c9775bf8be399125d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989096, "uuid": "5b32d45b-3d04-4045-9770-9b3611ee698a", "comment": "Malware payload (RustyStealer)", "value": "4bfa984563295e341a99352eed584bd4e1ef02b5b0db5ff984d0bc3b01122b30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989096, "uuid": "5c8c6fbd-0721-4cb0-85e6-9ba10a5fa886", "comment": "Malware payload (RustyStealer)", "value": "681b28d5dd6d49fc7ffeb67871e3a98a6f97e5dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989096, "uuid": "e891b0f0-55b5-470d-934d-6014414d6458", "comment": "Malware payload (RustyStealer)", "value": "d93c72105865d3d579d4638fa7f81e5ee262fba69a1cbeef6aae354908984e7fe34d9316c5c2e4b16d43dd39bb0be55a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989096, "uuid": "1fd2b8e6-e13e-4b3e-93f4-967457448f68", "value": "T1305412E08EAC194AD83F0876F7BF990FF6B454994B50A8F3F9445969882C3312DB315E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989096, "uuid": "fbd35189-8363-439c-8727-0ce28f99a17d", "value": "8d29fb8933e2d2d6108bad2ac1a2675e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989096, "uuid": "42afad97-49e6-4d96-9ad9-22fbf40e9b9e", "value": "6144:q6ps6mFeg8i1c2te0V30Bp4i1RtBbScgTwDFrKa2LD37NDlShl:ktFeg8H2MsmtHbSvMpG337NDlShl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989096, "uuid": "584946fc-48e1-4dbd-9167-9ee024449486", "value": 295848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989096, "uuid": "ba8cc0e5-f141-403a-ae34-c01859a10476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989096, "uuid": "4d117380-8a58-4f04-b0cc-d21791f42504", "value": "SecuriteInfo.com.Win64.MalwareX-gen.24948.3293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39282482-409c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748970016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970016, "uuid": "43c6b930-160a-4822-a4d5-a71f213c3d20", "comment": "Malware payload (MassLogger)", "value": "e368100585d76f57dd2be94fd250e47a", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970016, "uuid": "4177a910-b025-4d87-a135-b1d2cd228c16", "comment": "Malware payload (MassLogger)", "value": "4c0eaa01c1e671b9163fc2659993a0547055f868035f7ca0037aff64e626f200", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970016, "uuid": "17a55e70-41e8-4290-81a9-be3494f34216", "comment": "Malware payload (MassLogger)", "value": "fa147a836e1eb8c281a8a44dfc62b434fcab123c", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970016, "uuid": "40441fcf-33d2-49e9-b403-a5cb1d5b4c70", "comment": "Malware payload (MassLogger)", "value": "ad79d2c0732c0391c1e08a949bfd8955da2cbbff3268eb7b3012af1460b3ef894fe963cac14268f95e459866857945ad", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970016, "uuid": "9b57b028-f764-4cda-9b74-23062a7c3197", "value": "T145E312C46ADE8086C1E7BB8E90536E4F7D6E5137264C34631F739910E31A287F966E22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970016, "uuid": "9e6ccd94-e1b3-4bac-aa44-774fd8d2ac83", "value": "3072:Qv3cXTWZwpZA/qBJ6tmRBH+Mzxbb4eUj7KWLFo5qgRNK6f:SZwpi/AJ6tWBH+MRSj7KZYgP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970016, "uuid": "a923acb4-f8f4-49c9-9d8d-7f56866b0144", "value": 152517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970016, "uuid": "3e11455d-fb59-4a85-81d1-32baad979a87", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970016, "uuid": "91057534-c95c-4f59-a68b-ecc459df0b29", "value": "nP_U_xlsx.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610aedc3-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748960634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960634, "uuid": "270afb26-50f7-42d5-aec1-113824d8deb6", "comment": "Malware payload (MassLogger)", "value": "0c3bf42d86c6e33a3b1811d51884b8bc", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960634, "uuid": "3e21b271-aaa0-4ba1-85dd-6bd5536032a6", "comment": "Malware payload (MassLogger)", "value": "4d4b08974e7bc55fb12d6ab8823f697bb6571d24c2b972853dc19e4fa8c552b8", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960634, "uuid": "39579708-e6cf-424d-bc37-902a7d4d1c62", "comment": "Malware payload (MassLogger)", "value": "9b2be130cd5ec1f6524c2d4544e591a81187b17f", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960634, "uuid": "ea5a4293-d2fc-4e1a-93be-c2efbf0e4b56", "comment": "Malware payload (MassLogger)", "value": "7f4e342af9ceec9496fdc696f942be60958e998879b809082282d613147d419c62afdec7b3fdbfe545fe1d27743e088f", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960634, "uuid": "50463edd-2193-447f-89e5-115549cd27f0", "value": "T10335C25D9470ADD2A054FDF4F551AF97CCDB239416278A021FD1A0AD23268C3FFAA2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960634, "uuid": "79629bcb-b640-48dd-a7ec-67079a23ef55", "value": "24576:7Ivw50tf0XqwIkgQVjBMFhiW02gQlJpx3NPliUFNlSFUbrqJsR:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960634, "uuid": "fd89e898-872a-40ee-a1ac-ed21f8d33546", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960634, "uuid": "0e7904d3-887e-4a54-b9b7-25ef3612c8cc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960634, "uuid": "a33f3887-6326-423f-ae45-e9021a459f2a", "value": "rrrkkc4453290.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e67389-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748933364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933364, "uuid": "0040d5fa-2ec2-4c5a-b389-3aadbd7d1b13", "comment": "Malware payload (Mirai)", "value": "23bf1892de2b0efc696ac810232d2549", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933364, "uuid": "056ee628-cd55-472e-bf53-ba8533033f0c", "comment": "Malware payload (Mirai)", "value": "4dea29b69a93dde3fd5fd27c9b45b319f049198ed13e6a0e5ae24de95b87fc86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933364, "uuid": "84bf548b-a97d-415f-ad64-a5baaf117227", "comment": "Malware payload (Mirai)", "value": "5858ad6b9d0e540680adbc62b0be8fbd0b22c1ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933364, "uuid": "2b49d95c-8157-4435-ad22-5e3b35202599", "comment": "Malware payload (Mirai)", "value": "1428703b228228c41f53f34778fecbc16f3a8cc14f253f99d618ebd54be449facb047533e31d009729251e4ce07eae02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933364, "uuid": "77038f78-b863-4847-b05a-f331c6eb2fb9", "value": "T1E653850AAF214FF7E4BBDDB395F94741248C695B21A93BB5B870E424B34608F45E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933364, "uuid": "e52d8d58-a6cd-4721-aa35-c76c2a537c36", "value": "1536:zo+iCgWxeE2XOaFWFf0JmdMpwOxuT0R1s+A+JvLm:RJgYd2XO8WFf0U4uQR1s+AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933364, "uuid": "a91cf02a-34ae-46d5-b9cd-d92ed0ca399c", "value": 66436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933364, "uuid": "9a90b245-3fd0-46e4-836b-dc0d5a03fbea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933364, "uuid": "7c93a7b6-900d-44ca-bad1-747a004902b7", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6fe5a8-40a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748972495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972495, "uuid": "0e33b48c-5150-4396-a7bc-4c2f4b4ef464", "comment": "Malware payload (Mirai)", "value": "395c26bed5a6d7ac4f4d411b4470bd4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972495, "uuid": "e950645a-baab-4740-9124-6f0afdee9ab8", "comment": "Malware payload (Mirai)", "value": "4e7f922043e1468db37f849e7c72bb5ebeb897fcebae08feada4cbb14e111356", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972495, "uuid": "beb65d5a-0fc2-4b41-8702-68a177fdbd4c", "comment": "Malware payload (Mirai)", "value": "d8d32d7ed3ddfb4bcb9a4f222e4c286de8ab3167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972495, "uuid": "dad2f676-1709-4a31-b976-3954e6124abf", "comment": "Malware payload (Mirai)", "value": "5cb7b596922de75e0cc92eac050b150eb436af4085815acc95f72556c684bae3bd1b0e559c5a2cf328c42970593ac080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972495, "uuid": "1b14a7f5-907f-4bc8-9f0e-563f5e302e1a", "value": "T1A673189AB4028D3DFC4FE5B904560E09F93163811B830B27ABB7FDA37D731A5A906D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972495, "uuid": "29200b65-84b1-4b0c-b389-82c74e23b0e6", "value": "1536:vMjw8SxCfV3X6DFcc0JKdr828D/esa+5/ebY1xyRn:vMZuCfVvcIKdibla+VebY1xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972495, "uuid": "af1478bf-1333-4f12-b972-015615940eab", "value": 74868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972495, "uuid": "96b4dc3d-cdd8-46db-867b-4e8d09772299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972495, "uuid": "ca4d210a-d685-461e-882d-cdbc82c11df8", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab53fd4-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SVCStealer)", "timestamp": 1748935176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935176, "uuid": "7a74d818-a312-4e00-9987-585d26d8c579", "comment": "Malware payload (SVCStealer)", "value": "9860733f99d54cf3235b10fd425360b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935176, "uuid": "55e7b3cb-67c3-4467-9dd0-fa03be6fd717", "comment": "Malware payload (SVCStealer)", "value": "4eb032c9d454b604b2277d7a019937adb2125ce6ccb9175af94da8b908b31e4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935176, "uuid": "d3e5aeae-ebab-416c-a9df-75e66caa6077", "comment": "Malware payload (SVCStealer)", "value": "c7049724ad1ee99468be0015890f6875a28329ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935176, "uuid": "9eda67db-0e55-4723-bba3-31f58fb08c0f", "comment": "Malware payload (SVCStealer)", "value": "756ed5fa66de86dd25a59b443f3f3686e34e7d84c39f7b237cad8fd693a8c1b53d7223d879c172c96dac9a252ee93507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "SVCStealer", "colour": "#9FAFBB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935176, "uuid": "bde96941-466e-4e5c-871d-9538dd19cda1", "value": "T14B647D09E7A614FDED77853CC9124505EA72BC5207A0D6DB03E04A9A3F276D0AE7FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935176, "uuid": "29f9e841-8d2d-4a73-be60-4d343bcf8803", "value": "8e0fb85f7f21f6e885309baded3ceb89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935176, "uuid": "2eb1e677-8cca-4767-8a1c-1c8e4c663c95", "value": "6144:TfACsTA+shIX5t3cSj5F68r7qLN2nnoJVOe7:TIlARhqeIFB62noz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935176, "uuid": "c4a4a8a0-4733-43ff-a757-a8d6d1168cf3", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935176, "uuid": "5b6044a9-5020-4314-906f-eddaa0b40749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935176, "uuid": "d174178a-8927-4630-81fb-c6b350acea28", "value": "moons.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2b8c85-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957863, "uuid": "d1318cc1-aa70-44ca-b90d-5d8e16aaa1ee", "comment": "Malware payload (Mirai)", "value": "526cd4bc4d7378db70d669db73027f44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957863, "uuid": "a574c3fb-65a2-41d6-8e8e-53eda9281300", "comment": "Malware payload (Mirai)", "value": "4ef3c861a0e862c6171f7a530a8102bc91392c8151c9b7001bdc8749db74396a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957863, "uuid": "8b1447ec-81c0-40c5-a8f5-f9bd1164f198", "comment": "Malware payload (Mirai)", "value": "eea5262795d75cf979253680d8c531b2a0cb719e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957863, "uuid": "3d26b4ae-5b1d-454a-a328-d84fe5f343fa", "comment": "Malware payload (Mirai)", "value": "449a5046abc404d7fb8ef161754d17e2679d294d9a68461df7c53362447d430a37390ac8810e6ee1a5d9b0a6a0399967", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957863, "uuid": "aee99e50-9c78-4639-a6f0-919d0d80dca8", "value": "T1A2137DA6C46AAFD4C11845B4F8358F782B93F5008B666FF65A8985A24053EFCF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957863, "uuid": "d7590e17-b545-4104-9dc5-ba855c31b197", "value": "768:Aaf+ywtYjrNqGFZFeVNOa+ESE3HJJ/qdCboL4ZCC:AaWywtwDI6ESE3Hr/qdf0ZCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957863, "uuid": "c892ddf0-27ca-47d4-a6f2-6d787bf0aa57", "value": 44736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957863, "uuid": "6b337d0e-f8dd-4516-8012-217c4ec182ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957863, "uuid": "a7e5d513-ebcf-4f44-8d97-567e9c817afb", "value": "hoho.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4eb3720-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748995108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995108, "uuid": "ff308f0b-5fcd-492f-b2af-c877808ce530", "comment": "Malware payload (LummaStealer)", "value": "f9e45ded772b75548c6288e0ee4c1bfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995108, "uuid": "b61d52dc-7212-42dc-91cd-8449bed04181", "comment": "Malware payload (LummaStealer)", "value": "4f82280b82ff4416b4c5a4d370bd497a59fd17888e3a316bd749e8e6209c1eea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995108, "uuid": "7434c312-ee38-4652-9f34-b1a440a50df3", "comment": "Malware payload (LummaStealer)", "value": "7e5e4e1ad8956aa94e8a378677e77c8a30bca1d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995108, "uuid": "a872860f-bf38-4a26-aac8-4839702dfb44", "comment": "Malware payload (LummaStealer)", "value": "a8e3cbec9b2c91f31c694de40dd1d40444a144d956af8912fbd3ce062d037f1e17f3d7de0bf072ff349e1d6869702c6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995108, "uuid": "253e8297-c73c-4bfa-be6f-da69129bb69b", "value": "T11D767B11F9C74AF6E5036631559BA36F233448054B35CBDBEA887B3AF9772C94C3A206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995108, "uuid": "de391228-3228-41db-95c5-c8c08270ce3f", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995108, "uuid": "32e43a10-8620-436b-916f-fc31f55bcae8", "value": "98304:KvNGwep+QKTbVokjZrxzbgIGWF2VBNb2WroS200r:kep+Qyv9rxzsbToSUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995108, "uuid": "493bcfe5-ca2d-4faf-abaa-1fff710ff053", "value": 7390720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995108, "uuid": "3c15cff7-7cc0-403e-95a4-2e83c9b4adf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995108, "uuid": "8bcd46cc-744e-42ef-a869-c6305b120daa", "value": "SecuriteInfo.com.Win32.MalwareX-gen.6917.26405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485f6c2a-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973048, "uuid": "ca77f703-5f52-4012-86f0-c99bdfead4fe", "comment": "Malware payload", "value": "ac6455d6d5574f2d2b800b8ea5e78475", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973048, "uuid": "4aaaf07a-02bf-4f11-b777-3bcbcfe8395e", "comment": "Malware payload", "value": "4fbaf052aed9eaa13180ee0ab4160d128b33894deab9a7ff8ea61bc77807db5e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973048, "uuid": "846222cb-ef0a-4d4f-b7f6-acf42e6ae511", "comment": "Malware payload", "value": "5c1ee52b90edfb147c1de68091a1b6c0d2fdf1cf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973048, "uuid": "08d236b5-4a60-4eb4-b4e3-b21801301f7f", "comment": "Malware payload", "value": "859cb79559a38631a8f6d38f4d1d623601eb23f615273ffafb87e3fe0985e0fc2ba3ec477eecde694ad12049e3464ae0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973048, "uuid": "6ded3e67-f3c4-42f2-8eb4-0f233a49e45f", "value": "T100B1281313978DD0C9EBBF393D01CE82064FA2227DA8713B1E05BC51554BEFB2E22525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973048, "uuid": "902d19c7-0800-4855-a48c-9a6f34dbc188", "value": "96:gnw/8aR4Qo5fPyUazS/0z9og5U1X4aGYw75C8JqFrYatNRgTZ:gw/87hPy1zvog5U2aGYw75Cv/st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973048, "uuid": "90898896-925b-4780-a3b3-be8f0f4109ae", "value": 5331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973048, "uuid": "469cd87e-a51d-4585-afd7-2d92a0d6f24d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973048, "uuid": "e740710d-0b6d-439c-a453-ab6480a1826c", "value": "mail-spammer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37dd7c2-4088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748961658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961658, "uuid": "e68327a3-aa66-428e-9f1b-09e9759c3b8c", "comment": "Malware payload (Mirai)", "value": "9aa8caec4b0810ed70476b53b949742f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961658, "uuid": "fa051714-ae51-41f1-adc3-19cfaa66bb40", "comment": "Malware payload (Mirai)", "value": "504440bb5ee0fe44b5950f662c2dd1a6b0ed122958c8e1fb20632599b7090b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961658, "uuid": "3b1cd8ce-8359-4244-814f-b32ffbeda4e2", "comment": "Malware payload (Mirai)", "value": "58e917e1b09578fd96d7b14dcc317bbed2b10699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961658, "uuid": "aeadd096-08f2-4fe4-b13c-3e3394d51909", "comment": "Malware payload (Mirai)", "value": "6a2208650d0a7aedf3b579c1c40d65882a9fc12b4356b56312ed5443caa04ffff8bb13520f35827828d177920710d889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961658, "uuid": "9aa970d2-aca6-4213-bd28-7d199e1c9b48", "value": "T190031991F8838A6FC1D15379A76E5A4E3760B3E0D3CA3703CA641B357AC661F1DA6E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961658, "uuid": "c71182ca-4074-44b8-ad80-a9e2f04f1de8", "value": "768:RE8dySRsD04zfZf5XDs0B2QDuGOlqcishQo91vjy4/:RpRE1X40B2QsqcishB5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961658, "uuid": "79d696e5-3f74-4bc6-8ca2-c15fbb492909", "value": 38576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961658, "uuid": "22bb916a-93c7-4fd1-82ed-30b9224aa251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961658, "uuid": "7b0ef484-8aae-4713-b238-64c25ee591e3", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838c1742-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748931486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931486, "uuid": "d5be52de-b3d4-413b-a3a5-4cd1262dd758", "comment": "Malware payload (SnakeKeylogger)", "value": "5d90397b514071a036a94fd044a86c7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931486, "uuid": "d4e3bd48-b957-4f12-8f1e-5d94b4c00415", "comment": "Malware payload (SnakeKeylogger)", "value": "50ec898674f779ff3115b5d856c579eb89aa9702db8355a6a8f34616223a889c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931486, "uuid": "3deb9d85-3224-4bf7-a0b7-587921c8c51e", "comment": "Malware payload (SnakeKeylogger)", "value": "c0b1956fe8aa9164c6bb5b03ef789749b6682b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931486, "uuid": "32c70180-095e-4558-a181-b3a444e70e21", "comment": "Malware payload (SnakeKeylogger)", "value": "b74f833e9239ac2fa504a8b7348eac7fe9bacd8df5dbd5a3898800e6fd31ea190badaa00d361322cc857a183b2745e59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931486, "uuid": "649fc147-be54-440f-84be-363bd00c7fcf", "value": "T19BF4128A2BA5C107E07B0F7482A2D2B4577A9ECEA652D72B9FC42DCF3D2630455703D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931486, "uuid": "8524b9e8-6e5d-452c-889e-9931eabdedf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931486, "uuid": "c2850705-f4b9-46ab-8a08-5e733f031287", "value": "12288:uvNDPe20mS5V4g6xuCyXZeRRjQ6SHMmqGH8k9ne92Q0KDfmkQXX3f38o0Qfp:qD5S5V4xkCbZaMmWJVbmXXX/Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931486, "uuid": "ddf8b867-fbae-4e2a-833a-bc60c4e8be13", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931486, "uuid": "744a5f7d-1f39-4a0f-bbbd-657540bae08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931486, "uuid": "fd6f0a89-63f6-47ae-876f-202f338459d5", "value": "awb 2795943570 dhl CIPLBL doc(s) Piece #1 JD014600011215110835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d2103a-408c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748963350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963350, "uuid": "6565870f-1e1b-463a-bcd1-d6c442b3a743", "comment": "Malware payload", "value": "6d5d607b7b18c0883f6696bb6cadef76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963350, "uuid": "1f90d6c7-1e21-4eb0-9b14-3ae19374fd0c", "comment": "Malware payload", "value": "51066c76fb43a40658dc5fbf7ffb4a1b37ca13b6fc55023c9ca1faa427ff7f23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963350, "uuid": "213ab4f6-67f2-4c6b-bebc-39cc26a87ac5", "comment": "Malware payload", "value": "8d1bf810436eea7fffef0616c5ad95ef84bfe61b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963350, "uuid": "161aa819-57b4-4c53-bfaa-62dd270eb798", "comment": "Malware payload", "value": "2e62ca11e765eb7dcb895700893a8ae1e3b819fa345f05ce65313c4980d16440282d04fce9a0c4f5d9b743d11153d47d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963350, "uuid": "6f8e73b4-d8cb-4b12-8a0c-32d87367c092", "value": "T1B1A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963350, "uuid": "73f4f86c-da32-4572-96db-5f8f15e7f10c", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963350, "uuid": "5df6e2b4-6dc6-475d-a0af-d95a7a65c871", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963350, "uuid": "7260a178-35ce-4e5d-a841-2c1e8eb33204", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963350, "uuid": "5c82640a-808e-4b80-b957-59328052ed04", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afb8948-403b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928465, "uuid": "177aef54-4d84-4d32-a7de-70e4d4a583ad", "comment": "Malware payload (Mirai)", "value": "d082cd95214e876e3798926b6f92b725", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928465, "uuid": "c5e7872a-57e5-4fe5-8149-01209c22f256", "comment": "Malware payload (Mirai)", "value": "512580ac4df6f5ff306ea2082106449a93263e4878e35182b130eb9914eccd3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928465, "uuid": "ddfea9a4-9e59-4b35-bd4d-9e028f7854cc", "comment": "Malware payload (Mirai)", "value": "e12750cbf583dc5344579b920ef21dd576915516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928465, "uuid": "336fd39c-ac55-4ba9-aa15-6b949bef0ea1", "comment": "Malware payload (Mirai)", "value": "c4ca5bc3ac998d08a7e4c2d352412c8f78fb40a107f41f6ee639230ad8c142c2a2d45868bf71e4c338f8e6c645ec04fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928465, "uuid": "25a140df-da01-4662-aa23-3712fc5629bb", "value": "T13E93C81E7E329FBDF6A9823047B78E11A79923D627D1C585D29CD6001E7024E681FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928465, "uuid": "f64fbb67-95ef-46bc-8f9f-14d9d9a9bab3", "value": "1536:ZxXvhjquS+HyJaYVFg7sh2vSG1eshUyMP6v0eDD:ZxXv3S+fYVC7sEvSGwyHv0eX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928465, "uuid": "084ff0c7-c29e-446e-b206-9ee707689949", "value": 89000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928465, "uuid": "62f0fd15-6029-4e1b-aefe-81000790055b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928465, "uuid": "1cf71c70-34cd-4bb4-a02f-e1046827412f", "value": "neon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f45842f-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748933036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933036, "uuid": "c25fcf8d-5dae-49ee-9824-56de963b24d5", "comment": "Malware payload", "value": "f6040cfe16d96b4b096d09f93015207d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933036, "uuid": "ad607336-b786-4687-b170-80db7175ac03", "comment": "Malware payload", "value": "5132f479f6aa1efa992936a8a038b3dbdf072eed019fa973f46300ed91af544a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933036, "uuid": "10dfeddd-6880-4b3e-8b62-62892ca818c4", "comment": "Malware payload", "value": "92832494cda428fd348ab494e2c2b35253181b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933036, "uuid": "0d98aae3-714f-418a-9870-5e298e1dbf80", "comment": "Malware payload", "value": "e18c9400a8f176216eb2f6206117835e7a8277887b5ba5b0226c1298f4eb0843eccaa718da09da54a3aadca11de62944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933036, "uuid": "1cdc151e-e5a2-4e98-aa37-413938d2c173", "value": "T1B426336B1A139D63CCD9D6F2E4D16910EB23A14E0C995CF0366E075BF8A339713F8664", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933036, "uuid": "f72d2e88-ab8a-40c0-9c32-24e384553244", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933036, "uuid": "18f83c39-54dd-42c4-bd4a-7c94c1c12615", "value": "98304:rX0G57RTXtkztjbLn8qT9b/9og49bZoy2HcDF60a1JA6G:j0iNTtGdDpT9b/Q9beyztmJAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933036, "uuid": "c6772270-ba77-495a-be53-8b58ce7a4583", "value": 4705792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933036, "uuid": "552e3e6e-f8bb-484e-a543-ee5806f1ad30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933036, "uuid": "7b3b0dda-6170-4c0c-8806-500eb1341acb", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f88525-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957869, "uuid": "19aa0a40-b3e1-45dd-a444-70178a195cb1", "comment": "Malware payload (Mirai)", "value": "74c0ad8e79203563f3f3014c733648e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957869, "uuid": "a7faf822-a1c2-4998-ad1f-a270a5cc43ce", "comment": "Malware payload (Mirai)", "value": "51340327687fc6da8fc99ce5e2113079e424c17bf4e48c013c2880a3589d82fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957869, "uuid": "878c2886-3146-4204-b985-2ebe351d9384", "comment": "Malware payload (Mirai)", "value": "adcf7bc0c3ae4aa4a425c5aeaaa9366bfe2788df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957869, "uuid": "96e457b7-db4a-4d02-b8bb-2d9d61685c3b", "comment": "Malware payload (Mirai)", "value": "85a3e3730c459f9b52b9bda7f5befe591bda7a74d4f86100e443ce6c45dcf860c0a8ed334ed3fe0cdaef89ef64f29a81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957869, "uuid": "89ebad99-197c-4503-a120-0e26e8bb7468", "value": "T15A130A96BCC29A2AC6E0637BBA6E418D331163E8D1DF3257CC152B047AC951F4EB7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957869, "uuid": "e430d720-c5df-4351-a228-347bc485b30c", "value": "768:Fut+Lv2vmf7/fwpKLl1wgvjIfB4D1TBFZADDoCerCAsUbn2/vYPFuh/hqij34YjR:wt/mb2alvbFZlsUj2/Igh5Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957869, "uuid": "e10a94ba-7936-4ad9-9bd2-a24d8bdbdb3b", "value": 43248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957869, "uuid": "19ca2334-47fa-47a3-a807-59f6b1c71084", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957869, "uuid": "588d1db1-29e3-45c2-9525-dc488e3f6978", "value": "hoho.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab9f0d2-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989131, "uuid": "be4a3fe8-592f-4276-81fc-26a3ac00682e", "comment": "Malware payload (RustyStealer)", "value": "70ebddeb3330b42cac2c111726691ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989131, "uuid": "d32b79c4-22a7-45e8-8882-6961607c06e1", "comment": "Malware payload (RustyStealer)", "value": "515d696ec6cf325b47f4088de28c321fc47bb1f43cdcff9b1c3ae0f81a342f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989131, "uuid": "9bb8382b-563f-4348-a0a5-6830eaef9cc6", "comment": "Malware payload (RustyStealer)", "value": "d6b5f6c9897ecb4d6392a5a69047ff8633b7fe0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989131, "uuid": "458b5857-5a28-429b-881a-389a9ee05085", "comment": "Malware payload (RustyStealer)", "value": "9c58988e48e28001c74dddbdb99655dfc52f9630dbc2713df69fc99546db3b9261311d95c09c2eb9c0e5f96be94cb1e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989131, "uuid": "18be820c-5dd1-4c15-aa51-18e3ecc49ba8", "value": "T16F3402B085A5DFA8D41E44F6BBBFAD4FB63559CA4EA39ABB85080005C140B717FF618C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989131, "uuid": "97fa0fd4-7e6c-4717-a283-90c8e68effbf", "value": "b4425ca00d20a616c3daafc30cf1e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989131, "uuid": "8ee6af64-b226-47e2-b7aa-174ec604bad4", "value": "6144:mCUDFnwaZgp0LZ67igr3HNHvfepp0gL/2lFKBguXsQ3NO:mCUDFnwaKcZ67fzJHBQ2epy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989131, "uuid": "49f490ed-c81b-4c1c-ac49-23318bfc878e", "value": 247720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989131, "uuid": "e188d74f-95b9-4c5d-b914-92efad78320d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989131, "uuid": "7714b4b4-4299-4473-a64a-5d78af37c0aa", "value": "SecuriteInfo.com.FileRepMalware.16911.10773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53838aa-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748956883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956883, "uuid": "1d6f8e1b-1567-4a49-817d-73d63194ef13", "comment": "Malware payload", "value": "d9c75c47421a620b637195ecf3adfa80", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956883, "uuid": "3f4cb369-5d28-44a9-a43b-513072c7586b", "comment": "Malware payload", "value": "51b7cc9099b7dac0a5b923ed93f87cbd1edfdfa78d391178b366a8b3817532c6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956883, "uuid": "39447a5b-c621-423a-a252-9a53b371e2c7", "comment": "Malware payload", "value": "1306be1b73344bedf8016646f571a1529c001699", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956883, "uuid": "35f0ab83-c2c4-43ea-945f-645fea9e2060", "comment": "Malware payload", "value": "9fd3a8a41ec66dec9bea5886315848a4cbaef183a4fa49904a14cba8caa4791817c47c797d2cc63da9724ecf35dc48cc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956883, "uuid": "66abd75b-6552-40ce-a2a9-56348e5924fd", "value": "T16E4633A38EDDC4A31462D8D12F679BA3D209C45A3EF770634AE896F01F4E7827141BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956883, "uuid": "1e7f3e12-fe17-4d63-9aee-5bb1f0f3deb9", "value": "98304:lw4Gtpjyu0nrtODpySzTtm4r/1nigk5lGitnX9NHRKRcQtQ2wHelLle:lwRtpjyu0nxODpXpm45nilBtnX9NHqbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956883, "uuid": "c675beb2-bfe9-40ca-9e55-d8ccfb5bafa8", "value": 5551456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956883, "uuid": "cd03359f-8981-4570-a57b-54dc4d53e433", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956883, "uuid": "4ff99b46-9fbc-40b3-8d90-5034a16f39b3", "value": "GANG-Nuker.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460250ea-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748934819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934819, "uuid": "ef7d6e2c-ebc5-4fe7-a32b-05f14894230c", "comment": "Malware payload (Prometei)", "value": "7b111b2e20c3735c90acfed687778934", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934819, "uuid": "ad5ed41f-6782-400f-89a5-cc0c3e9305cd", "comment": "Malware payload (Prometei)", "value": "51da8ed43a081bb78781a1d816a15cccf3c8a8821f7f648a0728a595b5008a9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934819, "uuid": "d3a5e997-b48c-48e8-ab10-fa525c33454a", "comment": "Malware payload (Prometei)", "value": "466769290cbd6d78518923a2d1f58d526b2d0227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934819, "uuid": "792caa3b-ea49-49ac-ab22-929591d666be", "comment": "Malware payload (Prometei)", "value": "b0b478464ef67e360e46f069f57106fa4faabb6df876314d0d68d708711e0767f58602cd49fd3ac8340dae1537288666", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934819, "uuid": "e5e7e157-c67f-4cc9-9492-b49f239d6d59", "value": "T169155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934819, "uuid": "367198d3-07d2-4fe8-b5b0-448a0c54b5bd", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpls:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934819, "uuid": "e9aebc2e-54f6-403b-8c00-8fd293245c63", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934819, "uuid": "8caa3709-db8b-4657-8063-6015ad7c553a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934819, "uuid": "73370ce1-3b3d-460d-838e-946ef24b555d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de38fb8-40ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748977755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977755, "uuid": "05b23f6b-d04a-4084-baa2-2079a3237976", "comment": "Malware payload", "value": "9476256f46500d7b10360680ec8e473b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977755, "uuid": "0142f9cd-9fb7-4385-b64e-ac9156881db3", "comment": "Malware payload", "value": "5255aa5f489c656c6ba3557c47aa26805c7c5b29c8e5e107c87dcdc9b08acbe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977755, "uuid": "a7ad3241-ddf2-4c1f-bcbc-e27281453dfe", "comment": "Malware payload", "value": "2a7379c294a646d5a9b930fab23e652d68873906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977755, "uuid": "a5baabb0-587c-43ae-91b5-532594418a89", "comment": "Malware payload", "value": "2f128c7d4d1c741e55fb50897ac31a94cf76ddf40a08178b838387302782500238c5a1124712d0ece61b33e2497310cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977755, "uuid": "22b3f4d9-bdc5-45ee-95bc-2e1b9ce76e65", "value": "T15BF35A4272C1C8B6E46215325861CAA15A7DFC704F20DDDB73987A3B1EF42C19936F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977755, "uuid": "b0cc0d09-978c-43c0-bffe-1e408985ef78", "value": "a3337d999634ecc17a910987ed329188", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977755, "uuid": "a501a743-ea97-4dbc-809a-73bd037dc1f5", "value": "3072:pz4VExDuFn1ZYOfC9xPMRq5g3q69OtvTIXfNFEq54aC/q9l//bRRlTHGTK8q/qf:pz4VquiOf2aRPqKCTuCK8N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748977755, "uuid": "4e0e416d-7aee-4470-86a2-8aca66c9031c", "value": 167520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748977755, "uuid": "f068be80-a147-4d51-90e5-aa04f7490bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977755, "uuid": "92ec25ad-556a-40bb-810a-635af0d6f750", "value": "OperaInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e5ea37-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929616, "uuid": "55f0721c-bedc-41f9-b00f-5f8827077896", "comment": "Malware payload (Mirai)", "value": "d034c665bdd2575cd0d1d77491a9041e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929616, "uuid": "78190a95-5fbf-4411-8d38-17c4d50910f1", "comment": "Malware payload (Mirai)", "value": "532e37f20b2a33319c95dbbe50c86b6c6ec7c72ac72cf12d23e7323da67b3745", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929616, "uuid": "b0827d8e-dd30-40f4-8cf7-64a3f16e454b", "comment": "Malware payload (Mirai)", "value": "fde6002abb9b351cf6689ec1912a4510b269a804", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929616, "uuid": "27d507a0-8d79-4284-99ed-7e5468ba8501", "comment": "Malware payload (Mirai)", "value": "edb381bf84be009998a3384cab1dd7101cc960f9eb8e27135746664a0a195752e96be709be7a1bed468db790a898d278", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929616, "uuid": "a459ae64-ae01-4088-8c83-9b97c5c5a177", "value": "T1947329D7F801DC7DF80FD77B4867490AB531E3D206831B6637A7B9A3AC361A50826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929616, "uuid": "1e744eb7-c442-4ed3-ad82-456d9c318ccd", "value": "1536:7BDdpd2pu02W0C2+nA0TBgV8Kp+5LJtnYkf2rup3D3Fpst1YIRMIW5V:7BDdpUE0bxA2Bgx+1Dfmut01YIRMN5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929616, "uuid": "2d1a9433-2da5-48c5-b55f-2aeeeb08f86a", "value": 78160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929616, "uuid": "af427ca3-bd67-46d3-bf8e-7a2cf9b6cfc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929616, "uuid": "0982ddec-1f5b-4ed3-a24c-13df6c0df2b7", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3997c5b-405b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748942358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942358, "uuid": "cde69244-c3a2-4a75-ae98-7fd7207f2c16", "comment": "Malware payload (Formbook)", "value": "c81cdb02b8df256d53407cf3f06ae17f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942358, "uuid": "718749cd-3dd5-4aaa-b3e2-0a341e4ebf3a", "comment": "Malware payload (Formbook)", "value": "53d30b6b4749ebdfdfebc9a93793ea3863d5c5ef93594e3c215d91b347db2bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942358, "uuid": "5f1e4131-b01d-491f-b2a5-ed7fd32cacfb", "comment": "Malware payload (Formbook)", "value": "2516c13fe069cb48d70930a83d6b38aba3e7c97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942358, "uuid": "8384cb0a-2716-46e0-81de-21e91ad8f5c4", "comment": "Malware payload (Formbook)", "value": "5fb9bdf007f9289ddd76963d2ae9ab4c13d375bf21c8d383cc99527bee7d8582a8abe6861455c076482fedfd86861d27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942358, "uuid": "b55a91b2-2721-4031-87f7-a15fb3b980d9", "value": "T1A2E4024A27A6C103E07B0F7487A2D1796B77DECEA942D3176ED92D9F7A1238411B13C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942358, "uuid": "c0d75e24-ced8-4c7a-9e9b-dfeaf6080de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942358, "uuid": "8a9c44a8-8277-475d-adef-4dc27c15b4b8", "value": "12288:6rCDvYguf2VEh7bT8PNJL6JiG1I6UA50uEqwpjyqTc5kR:9cH2uraJ8I6Ubewp+q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942358, "uuid": "300fd0b9-839c-458a-8470-1c0f48ec0231", "value": 680968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942358, "uuid": "48f99c50-198c-48bf-81c8-0dcb90f62291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942358, "uuid": "6b97332f-08ca-4945-a4f7-c17eb35d9453", "value": "SecuriteInfo.com.Trojan.PackedNET.3345.19175.9791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72881503-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748931458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931458, "uuid": "aa894c54-4146-4f05-89d7-289e550df8ec", "comment": "Malware payload (MassLogger)", "value": "c566da3b6e2174ddbce2483a1a94f02d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931458, "uuid": "3ec9f42d-4e98-4821-a815-63ad2c13f436", "comment": "Malware payload (MassLogger)", "value": "54e2bde839e16579f55ca4ebd209bce0dab579ecd90e0c7d7efb85ea31cb357f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931458, "uuid": "d41a6d85-688e-401e-9048-c75adaff23e6", "comment": "Malware payload (MassLogger)", "value": "01539c69dd18e8e1c8df0e03c7d071183675cc04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931458, "uuid": "c5c44b7f-0b82-4e90-99e6-94ddd7121438", "comment": "Malware payload (MassLogger)", "value": "c63002f6e2b4ffb8e708912bad3ab8af821f44d7d8728ac1cca06755bbf5b382e5c981394ca0383bee46c30db674bb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931458, "uuid": "3f10272a-f926-485e-bcc0-9634c2bf02de", "value": "T1D835BE2373DD8360C77261737A5A7781AFBF786506B1F99B2FA4193CE860170422E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931458, "uuid": "025e2c19-08a8-4b1a-80b9-9d90ee611e71", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931458, "uuid": "5d8072af-eb95-4a16-8a65-a201bedc4ff2", "value": "12288:Utb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaGB1ILuCyh76A:Utb20pkaCqT5TBWgNQ7aGB1ILuj76A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931458, "uuid": "aacab3d2-c393-4688-8b26-32d5230d6713", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931458, "uuid": "72c16333-b7bd-4f57-ab22-eb9d1ad9668a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931458, "uuid": "1f9e913a-215d-41fd-8413-09a5c14e2a90", "value": "e-dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd35e4b-406f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1748950643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950643, "uuid": "c895da31-0ec9-4573-b538-fbac902f8b68", "comment": "Malware payload (DiscordTokenStealer)", "value": "f38246fc8539e550ea58e545193805cd", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950643, "uuid": "66178c72-1835-4998-8eca-daf26a8e0685", "comment": "Malware payload (DiscordTokenStealer)", "value": "54ebd0664b4a8b776d96459fd11f815e716898bf15846fe0bd6555a94e006094", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950643, "uuid": "b9606a8f-2a85-4d5d-adc9-22762b055eed", "comment": "Malware payload (DiscordTokenStealer)", "value": "1a23b542770d37edc92197a628443affcfcd1237", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950643, "uuid": "abdb96ef-edf3-4a15-ad39-f905245f4a2d", "comment": "Malware payload (DiscordTokenStealer)", "value": "a6eaf1f5f4aef9665a29baefe6f202f20a636d9d0d6cadda1258c575acd037e74ce76bb7b372fc417b3abd8cac76ca11", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950643, "uuid": "37e17002-5de8-4da2-9c4b-ebaedc5f0c13", "value": "T1660833387B38648DF3A45F3685A289098ED9E00A1ADF84466FF454642C734DEF6FEB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950643, "uuid": "693e7a17-3bd2-4a60-b91f-3da7c79f4656", "value": "33742414196e45b8b306a928e178f844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950643, "uuid": "0b1c062f-5edd-4f4c-87cf-d2d22609c3b0", "value": "1572864:DScKbWp01CprVd1AEJ5Rh1+BDDy4gds8KN2LC5oeSqjiKhCodC:+n67prVd1AY5bADDxgds8k6eSqjBCod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748950643, "uuid": "35794602-8b96-458f-b3da-a8bb1b0f4455", "value": 77790051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748950643, "uuid": "92ea6e89-927d-4559-8551-9ee3045e3cf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950643, "uuid": "d5b28bda-a7ef-4e9d-860d-f3c58e1d9948", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adb95b6-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748995091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995091, "uuid": "6b377a6d-1838-4f12-94b0-5d128ffc4f5b", "comment": "Malware payload (AsyncRAT)", "value": "c9d9ee3ddd65ea0f67a424cc2524168e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995091, "uuid": "eb5b93e0-bd0f-4012-9cb3-f1e877ee43c1", "comment": "Malware payload (AsyncRAT)", "value": "54fb069a625c765bcad6274dee9288ca9b3ce6cdcbeacae37a1248edfc5bd89a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995091, "uuid": "57947717-ee96-4f23-abb7-6f32bb862d1a", "comment": "Malware payload (AsyncRAT)", "value": "e30e4108dc5ef2ddbc97d1c95bc59c879845a7a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995091, "uuid": "3f8e78ce-4c78-4c64-a4a1-4a26a555c8a6", "comment": "Malware payload (AsyncRAT)", "value": "7a44f3058b2218b2f60f741697239a61551f3452658a8b771b96567c486bab7aacdcbfdf2a33a3dde9772a3af1d35639", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995091, "uuid": "3d5f5e80-efff-4f80-8f66-2ba57ef680dc", "value": "T19AE4F184727ADF27C86D0BF41431D2B547B47E9FB432D30A8ECA6CEB3911B8069156A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995091, "uuid": "191c6c99-1ed5-4529-8568-413ff444d392", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995091, "uuid": "441fe0c2-a688-4a6a-80ae-ce43d3409021", "value": "12288:tyfEAUjuL59N50g6eFMFV7sEKynC70lqeicJoyjJyCyVQMQwgPOGLgVSFO01PN5:WoEFMFZ7BqeiciKclQJHgVSPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995091, "uuid": "dee9ac17-7c6c-4573-a719-4137a8caf262", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995091, "uuid": "af1787c9-83e3-4191-ae53-cfb8293705a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995091, "uuid": "3d45e821-be2d-46aa-b4bf-67848ef50cd2", "value": "SecuriteInfo.com.Trojan.Fbng.156.20111.21101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a8f2a1-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748934837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934837, "uuid": "3d97de6a-2fcc-47d8-962a-362b5ef440c3", "comment": "Malware payload", "value": "997025c969214a6ce6dc722d9836dfac", "object_relation": "md5", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934837, "uuid": "a04076f8-578d-4783-b349-d5acf5be5f23", "comment": "Malware payload", "value": "558027a2a8699f850f2ddb4cb5ff16d8f796139382bbc3c2d406f277f674b44d", "object_relation": "sha256", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934837, "uuid": "7a3f6b04-2ec8-4f0e-b393-f36e8124342b", "comment": "Malware payload", "value": "e4b7d8ffe2699ded161ed189fb2335d2384adca3", "object_relation": "sha1", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934837, "uuid": "d96e82b5-3e8d-45fd-b419-92d048c54d36", "comment": "Malware payload", "value": "ebcaf76ca09ab9d33e05258be1da59896493715027932a3d57962a527bc1669fd11350896b91d6b49bc8d4050d65c517", "object_relation": "sha3-384", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934837, "uuid": "41d0ea48-e954-4679-9ee6-277898b23c2d", "value": "T1690147B1BA9AC9614C9159E3DE3AC9AA9EC0A61333B3C1A53E8C8D801549424A7CC0B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934837, "uuid": "19c40d49-7143-49da-b63b-47ca22a3eb37", "value": "12:/DL2VR5hI7ghKXYDwKZdsVR3QQsVROM9fL2VReZH7eRNSZidWTAW:/YS7sk8wAdOQQrMVw8TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934837, "uuid": "64e4dc57-7d7f-4f04-ba44-b6350b92a79e", "value": 684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934837, "uuid": "cfcf6ee1-2f7d-4942-bb75-642797b00860", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934837, "uuid": "6f1fef69-544d-4c7d-ba6d-eb6aa19dc27f", "value": "1tronvbs.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017fa5af-40ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748982808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982808, "uuid": "0396cfa3-1579-4f15-aa3e-81ee39735399", "comment": "Malware payload", "value": "fc5a7ffb1cc8909ebf3273d4caff86e2", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982808, "uuid": "4c096179-6acf-4811-9462-9750a541081b", "comment": "Malware payload", "value": "55cbaea8f444c1d7d9a84e22fba0d8612d31008037bfda6fe50917c7bc0d29c8", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982808, "uuid": "51d854b1-fd1d-4044-8b83-f4631cfad76a", "comment": "Malware payload", "value": "2c08f5c428b8c5e420c634536d0e5fedf2ba3e84", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982808, "uuid": "ca9b0a97-b2ba-4ccf-95c6-42a6a16bfad4", "comment": "Malware payload", "value": "5e11d0ab18857751314f832dcb6fb1b0810aa36fac294dc0d31115c76d794ec246a1ee3ece605fc07f8d4307d350fe10", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982808, "uuid": "afe68191-f33f-477d-8c3c-d68103e9ac48", "value": "T180F78C0AF702CDA3F0094534A88586A52762FC72E691CB0372CD7B1E6FBFB644DB1995", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982808, "uuid": "86a19d4b-ca67-47d3-addb-872f9dcdca7a", "value": "9b758e03824033e09e85d431294ca8d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982808, "uuid": "682f736c-6a42-452c-8670-c906c40591cd", "value": "393216:sLheRgaI8D+c4ratGbpr4weyB3Zdp1uPGiSPWw1JBFcxnjX3T7t7:sLheRgaD+Zatrw7Vfp1uVS+w1ev7t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982808, "uuid": "a7c63526-0c13-4d6c-a6b4-b9669873d876", "value": 76428816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982808, "uuid": "1618d296-8fe5-430e-8c14-98634b4ae25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982808, "uuid": "6d2e1665-0bea-4f59-bde3-ffc4ae067fd7", "value": "axx036.76438.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b101ba4a-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994269, "uuid": "28360653-65fc-46b6-8c86-132555b8087c", "comment": "Malware payload (Mirai)", "value": "619d0611bfb41177e45761815189dacc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994269, "uuid": "c7e1e9a6-490f-416e-be59-5b7066e1be54", "comment": "Malware payload (Mirai)", "value": "5613babd4f64f5b8e82812402105d3413b113338810303800d5a1a7b1c8f8643", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994269, "uuid": "2edd8abe-6fa8-4ea5-8f60-36520ec2b68d", "comment": "Malware payload (Mirai)", "value": "c9116356e915ac09b2cbc7120cb6cefacbe1540e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994269, "uuid": "24431051-9606-4d15-a0d2-eebaf772652c", "comment": "Malware payload (Mirai)", "value": "3ba16d5c2e8da0561fcdfa5dd407db3060a6e545528d7ac60b773032f0f52925a57465c2c0f574a536eff68e58fef261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994269, "uuid": "67a1bfb4-8bfe-42b8-8a43-2fff1530be5a", "value": "T19EB32973A4615FB7C042697125BA5A200F16AD931F4F1A99723CBAF4073B5CEB80EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994269, "uuid": "45a6e676-dc14-471b-9edb-9d1ba0f47740", "value": "3072:JsmnW43UTX5LrAVN21zjLA00ms1cuEEvnFjN/:JsYTO/AS1zjU00ms1cuEEvnFjN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994269, "uuid": "03102c1b-e74e-4d30-a588-57e98ba3b426", "value": 113138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994269, "uuid": "415247b4-d8cf-43f3-88b9-197c637da154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994269, "uuid": "0703dfad-f968-4f2b-ae98-1dc875289c3e", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee276e7-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748930646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930646, "uuid": "435e1a94-2041-4313-bc07-d95d0c1814cc", "comment": "Malware payload (LummaStealer)", "value": "769a06e6437a18908e4f1522af90bb8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930646, "uuid": "4456cf90-bf57-47c9-a424-532dc29d889d", "comment": "Malware payload (LummaStealer)", "value": "56162db01c93539b352675b59709d36c0bafdff9b502e22037c417e4c5964293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930646, "uuid": "fc8d526e-05bf-4695-b815-282350da00df", "comment": "Malware payload (LummaStealer)", "value": "469bc6c82f70339468cc23c0580ebaef3c9723d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930646, "uuid": "dba1ce4f-ba8a-49a7-9ab5-4a8672b5b925", "comment": "Malware payload (LummaStealer)", "value": "5aa373ee0942bde06f93c0478d29154d938b3c013142c6c9a74f60c9af4b2081cabd920abd36f6f620676a152ebd4bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930646, "uuid": "50a7fdb2-3993-4032-8c9c-8267f9444daa", "value": "T18E85338A65725E9ED6281CB8B98C9BCC2DA8FF75C8F1374A4B1A3530193F64002D4C9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930646, "uuid": "9db28afb-8002-4882-a05a-ddc7bed54815", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930646, "uuid": "d03dbdb2-aab1-4c98-b6bc-8c52d42a4871", "value": "49152:fev9sBE613FBLKaKmfm3xybVcr9IPYtN5eTl:mF8beIAtHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930646, "uuid": "1dcc4a39-909b-4c13-9d79-c7870324e014", "value": 1872384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930646, "uuid": "97b09047-eb84-40c4-bacc-a2af29fb84f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930646, "uuid": "ed4e0837-871d-4bdb-85ac-9a7e6b1fc651", "value": "769a06e6437a18908e4f1522af90bb8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9ded17-40b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (BlankGrabber)", "timestamp": 1748980890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980890, "uuid": "8c52e599-13f2-4d1c-b4e8-4c259f97b55d", "comment": "Malware payload (BlankGrabber)", "value": "5c46d4a6119adf3954e0151c59e16b95", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980890, "uuid": "0d71bb62-9e85-4345-ba91-da0500a32114", "comment": "Malware payload (BlankGrabber)", "value": "56e087ab0dd6d5a31fba5823e462ade04159642b9ead0762524d1be150de446c", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980890, "uuid": "b1c64c76-3b54-411d-a97e-857c2b506745", "comment": "Malware payload (BlankGrabber)", "value": "c5dbbe0c779b0a84c331aeb0c3986e47bac048a1", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980890, "uuid": "ee2e418f-cc7b-40a1-8360-c67f3bdd6c19", "comment": "Malware payload (BlankGrabber)", "value": "0a6d305e70b713bb28ae64cfde4ab9b5467f0c592acc4c2c9449a531b3cedb7809065ab168fc29bf3b347b9fc2661708", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980890, "uuid": "ee02e6cc-4a27-472c-963f-c42c6ba4d2aa", "value": "T172473345B8D897DBED47DAB029391AD6C0FE2C181306E4274DB7467E22B3F302B68756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980890, "uuid": "0842697f-cd4f-4e5f-9866-00cfa98c4653", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980890, "uuid": "dcf72933-4528-47a8-a261-c29fb6fb0c7c", "value": "393216:/l4gsESdXCCInRmOESAVRKLfT842QeVE0cuBr1kLMW+G:/OfBAmOErzCR2rn1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748980890, "uuid": "e9e485d6-c15b-43d5-ab77-662e90d81667", "value": 26319360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748980890, "uuid": "aa84592b-a290-4595-9b26-570a094b7ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980890, "uuid": "54dc3c72-3a7d-4df3-bae6-333b18005309", "value": "BootstrapperNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8516eed3-4075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748953393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953393, "uuid": "169b0db2-39dd-4059-9118-63e375ef6030", "comment": "Malware payload (Vidar)", "value": "9eb0bfe46532f17b524365272113b583", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953393, "uuid": "9f6e3bb8-4203-471d-9e00-d3336829a393", "comment": "Malware payload (Vidar)", "value": "575aa049dffd627794f16450916290e936412406e23f9aa8acc26dd0ffa51636", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953393, "uuid": "35ab7b18-9e32-4dd4-a65d-5588f29b8ef1", "comment": "Malware payload (Vidar)", "value": "7ae9dbe2e93e56600d415b1b042b5491a5dfc863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953393, "uuid": "60a0f74e-0448-447e-835b-a5f34a479c5c", "comment": "Malware payload (Vidar)", "value": "a2107f198ff4ec6f73ce17563d1fe4baa1c80fa1e6afe11fbcfbd7d7353d1f33c9a2aef160a334fe4cbd0778c7c29abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953393, "uuid": "947bfa09-6699-427f-88df-195f5c28c31a", "value": "T1DF658D399152A2C6FC2A40B60161A5E93422B733C63D2FFF4290F333AE17AD15E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953393, "uuid": "3d6b40af-10d0-4e8e-bbea-4d3437dabe55", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953393, "uuid": "bd637208-43f5-482f-8d71-8c438a079b58", "value": "24576:j9LATjgcql9XDP81Xbe6A5kS/FHBpzJ+PczY8T7fbQ25sfbQ25O:xLA3ibXDk1re61S7pGczY83k25sk25O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748953393, "uuid": "69bad593-91a0-4411-8db8-5dee073a67c9", "value": 1500672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748953393, "uuid": "a47fac28-ba03-4800-bd7f-ec398ccb9a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953393, "uuid": "94305644-074a-40f1-84e1-9d0aca6382ad", "value": "9eb0bfe46532f17b524365272113b583.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca0e0d3-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956036, "uuid": "1f49a267-bbef-4900-bee3-4781029cf8ec", "comment": "Malware payload (Mirai)", "value": "e0c4a5d171a28486418fa5183e8957dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956036, "uuid": "d5ac8576-00ee-42d1-b395-4c8015b1b6f8", "comment": "Malware payload (Mirai)", "value": "585410f57b3286ae83c07a882a1385f43b13040c9df9aaf35dfcbb82f8f76e0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956036, "uuid": "d0d1b509-9ef3-49ea-a9ab-d836d6d4964d", "comment": "Malware payload (Mirai)", "value": "74a417eaa61e1316a72d48b46d4a90d3d4a991bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956036, "uuid": "c2662521-0921-4686-b63b-86ebfabf5c4f", "comment": "Malware payload (Mirai)", "value": "2e60ddd23f2faf343efacd75329256ade64254ec262b4277be562a322d0dc70423e2092fb546d9ff00f2bfb2bc354d77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956036, "uuid": "28721ebf-024a-474d-9587-6589711e315f", "value": "T1B0330262676E6AE251B08777FC32AC1AA6AC17F8586730D63CF4691577C18034FF2782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956036, "uuid": "a1008011-c7ae-49de-bbcf-e8d7549b04b5", "value": "1536:j9O/ZMAXIxNUk0++3/LcPqF1aBexo4opKZbs:j9O/ZNKyC+vLGqFUFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956036, "uuid": "dc7ab8f8-1bad-42f5-b934-f352ebe72d98", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956036, "uuid": "be251ab9-6a6f-4809-b084-7f1999f0bf1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956036, "uuid": "3a560000-19d1-4be7-9cd5-71da5d1382b9", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b1edd3-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1748935354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935354, "uuid": "073a4f7f-ca24-4d21-801a-c4e4ebf09ea2", "comment": "Malware payload (Stealc)", "value": "e1e13ff6d0097d70e6e3bcdc997d7da2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935354, "uuid": "c455778f-7e92-42ab-8a89-7692746f44f4", "comment": "Malware payload (Stealc)", "value": "5913df59ea963ccf3e55079579beb5344ee52a8ee3b41ac3e27d1a4755c4785b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935354, "uuid": "31f6d4ac-7fde-43d0-a35c-38a3f251491a", "comment": "Malware payload (Stealc)", "value": "73422949085f513bfa86e7a4987df6f8de6c8474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935354, "uuid": "a9929685-6e55-4c99-8ce5-393f82d58547", "comment": "Malware payload (Stealc)", "value": "6ff1320260bc4662802dfb6ae6707ed58db0c8989a807e14dd0e7f6fc7e11c132daefd29d4eabe245aa78b1271db109a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935354, "uuid": "81009e75-c805-4452-b162-3092cecb2daf", "value": "T137D44A34B596C0E7C312673C4F1CE6652229E8665BB427CB33D52A9A0FE62E38717D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935354, "uuid": "affb1b32-c6ce-4cd0-ba3f-ce197ff7686e", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935354, "uuid": "c46f00dc-be7b-4917-a7bc-effd6380f4f7", "value": "6144:+DAVC3luaa0vhKBw4NCqFhIcINuo6bB5d9G06bf8Q/z4qo:WAVMua1l4NCq7Icvv406Aao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935354, "uuid": "fe095f72-6121-4b88-a7cc-f2029e3c595b", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935354, "uuid": "976e18a9-f06b-4254-b327-f43b356d4255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935354, "uuid": "8875ce33-8aee-435b-bade-5fdb0c296ff7", "value": "xenosi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a4945c-409f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748971398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971398, "uuid": "05139edf-bea5-4d51-95be-5914b646f192", "comment": "Malware payload (Rhadamanthys)", "value": "eaea7bd469a6633ed06becbcd4c909ca", "object_relation": "md5", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971398, "uuid": "8d212ad0-f7ad-4ffe-abab-0832bcacb0af", "comment": "Malware payload (Rhadamanthys)", "value": "593f198e780c1826dbb0b6f6c34fde2d0c0442108ac0521691c03d3643f1ca39", "object_relation": "sha256", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971398, "uuid": "adf4c4ca-3fd3-47fb-a31f-7840f94fcf8c", "comment": "Malware payload (Rhadamanthys)", "value": "199f731eea170ffa9ee55e43fe76b96e83dccc84", "object_relation": "sha1", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971398, "uuid": "d5c5fc73-a18e-49c3-b409-145da8c9e49a", "comment": "Malware payload (Rhadamanthys)", "value": "8b0195dafb06173be903aaeaf610854c1aa509db10b4e432f3f3eabbe9b4eb5d5ad2b3691ca989d8871841fb57692b43", "object_relation": "sha3-384", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "RenPy", "colour": "#40F6C2", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971398, "uuid": "7969bd7c-3159-4d34-88f4-59630e9fab99", "value": "T13977237EE61CD788FF0795F29AF5814CC4E56C10619298A63B1C2966CCDB1D0EB3278B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971398, "uuid": "2ef06851-0273-4d6e-9376-790eee854f27", "value": "786432:xoRxPLqqTzcCVGXPuGXhQOsYseq7Ro8T4RXedejWLs:xqLqqTYYsQ7Y6uq4RuTLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971398, "uuid": "5094eb79-1211-42aa-afe1-eb1c01b3f183", "value": 33727643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971398, "uuid": "35d0c626-16e4-4741-b707-fd91867d7c35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971398, "uuid": "fb5e3a87-1e7f-4970-bf05-bd26cfaaa8d0", "value": "Free Download Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889c5750-4013-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748911308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911308, "uuid": "1b9fd1bc-56a1-4533-97bc-6a383c79c090", "comment": "Malware payload (Mirai)", "value": "42a578d799c4a9afc3df680e9dbb6e49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911308, "uuid": "d888e14b-6911-40f5-a066-964c0174327c", "comment": "Malware payload (Mirai)", "value": "5adc1be44f37bd6625094dcb7e5f502f0bfbbb338b331420b4259ead503fafbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911308, "uuid": "dda8da59-a2d7-48e7-82ea-92c9625d5dee", "comment": "Malware payload (Mirai)", "value": "fae0b7c4beedebe22164ceafb3a2c7146b16a0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911308, "uuid": "dd4772e2-9fa2-4213-8e7c-ad10ce292950", "comment": "Malware payload (Mirai)", "value": "c265de1b49ed804de3947c3a85a192919a5aa64e3c20a7c959abc7440f4c463dce1cb7928215278adb2061d25e7d8e0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911308, "uuid": "c5fa0928-8449-4bc7-a861-c14960a696f9", "value": "T14BB2E08DB5F56ECECD8D243D54AB1AB62A84E1E8325D4F8583945D88BF33443BBC50B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911308, "uuid": "0b220b2b-f3d8-47d3-b332-a7426793e3dc", "value": "384:bqn1XZWc8t9Br+VT5eojDUW+VhghmzfbdTl2V8ZB1MrPHmRWGVCz7zZNv:bq1mtbru5ewDb+gmzfbdsMMriWTN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748911308, "uuid": "4da44da3-0523-40d6-ab87-d5a8e5980c86", "value": 25068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748911308, "uuid": "322e0296-9c50-48d5-96bc-c42e3697b314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911308, "uuid": "1b86008c-82a2-4ed8-a093-1e6272ece33a", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a473d0aa-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928105, "uuid": "6aaca0a9-f333-4479-a2ef-13e740c8af2f", "comment": "Malware payload (Mirai)", "value": "bf3629fe1edfd991e55bf9a2c3603435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928105, "uuid": "5100e249-1bba-4c06-8e3e-27498a206f9b", "comment": "Malware payload (Mirai)", "value": "5c1707f560f59eb29a6ee7f51044aa00a11de703d21787a56a1ee678743719f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928105, "uuid": "6fc8d6da-b406-47b9-8d15-5a8a55197419", "comment": "Malware payload (Mirai)", "value": "2a27b04eddfbbd05c17300ff5cc145064a059c89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928105, "uuid": "73018ff5-a970-48ea-ba80-fc18696ff1c1", "comment": "Malware payload (Mirai)", "value": "3b1c18fee675db0a6ab3af8baa10bb04d6e03de34b584f8842123337717dfa175c4478577e2548c196f5af933cfe2b84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928105, "uuid": "31aca69a-8371-484c-af28-ff36cc42dc17", "value": "T1B0438C26E8261D54C55940B4B4289F362B23E5C087876FFB1339CA76A047D9DF84AFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928105, "uuid": "f84210e5-b9ca-4ae6-a46b-e1644a1aeb74", "value": "768:oarMUfuWx4UzG9fCkkBlKg4LhH7TaeoXckT33C/cdRY03GdjPf3/k66FchIs:oa4dWAfXAKg4LZ7ehXz33C/FICs66gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928105, "uuid": "6582ba81-1f10-442c-acab-2f8d3f25f821", "value": 59808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928105, "uuid": "97731d8b-379c-4de0-98f3-001c01670718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928105, "uuid": "1a0a0e31-8fb8-4367-a8d1-e35753b9ed06", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f628e84-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748994213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994213, "uuid": "d71cbeef-c69f-47f4-94e3-6b273e185609", "comment": "Malware payload (Gafgyt)", "value": "598c0af772b2a23ab3828551084c10f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994213, "uuid": "232d7e0c-bfb9-40f6-a5ee-503234ba8bd4", "comment": "Malware payload (Gafgyt)", "value": "5d9ef64bbec4fc4903f87f011b80cff96070d5e688250559aa75049ac2e5d231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994213, "uuid": "5f66f494-201f-4905-a4ec-0201eab5bcae", "comment": "Malware payload (Gafgyt)", "value": "7953e1b0ea77c91a2d7eb6680282afeb370b636f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994213, "uuid": "cf76fe37-81da-4b91-8e8b-5753395991a3", "comment": "Malware payload (Gafgyt)", "value": "9b7a9d8e041cf5fb254a8376850a3c9cac8eb5e7cfea0a22bf0c59230482a491060a9ad55e4ca5cfc1d1f07c75dc5670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994213, "uuid": "f0418b56-0356-42f2-89e4-3d8a7e97c4b4", "value": "T1B4C3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994213, "uuid": "1c2e9813-e4dc-494a-95c5-0d6349672ba4", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtA1Rdc0sfm7ypwYujl3IdnuW:ZP0DNPAg5sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994213, "uuid": "9b79142b-cb56-436b-8a49-10479386cd70", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994213, "uuid": "a7fd5118-274b-4d62-ad57-c2d82e05256a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994213, "uuid": "ebce37ed-335a-4095-940b-c663699a1117", "value": "dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a613858-4079-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748955147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955147, "uuid": "08c17b44-f8c6-45db-a64b-8a34b57ce766", "comment": "Malware payload", "value": "369ea705635e9cc05143cbe66c73f8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pynamer", "colour": "#209251", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955147, "uuid": "368e3110-7ea9-44e2-8a2a-9ff880e3b0e0", "comment": "Malware payload", "value": "5ec25492c4e7645fef1634e5d2734c5d5a8a4d9d41b5331668f121d4ec51a0c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pynamer", "colour": "#209251", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955147, "uuid": "cc08bf6a-cc63-4989-9443-9e5da1ab9a8d", "comment": "Malware payload", "value": "710216beb645293beca56771a59d8066d261d374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pynamer", "colour": "#209251", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955147, "uuid": "be36ee31-42fb-4b4c-946f-a2c8b02f2c15", "comment": "Malware payload", "value": "d41746fac0df84d5c44675ab9612d1439c60e654bb5a867132bc95fb33613e9308dd268c4e8f23dbf9dca9df7a6bbbcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pynamer", "colour": "#209251", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955147, "uuid": "156c57f6-7122-4ce8-876c-639f6a33afc1", "value": "T12E1512A17AC1C072E4731035AEED97B0B9B1F9711671588BBB90077CBF329A1E226753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955147, "uuid": "00fd47a3-c384-418a-85b4-00284688ce71", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955147, "uuid": "7ffe1623-7c1e-457c-b6ea-0a458eaffbf0", "value": "24576:Ft24sJ4axZV//4mknzCJEOQEZ0fYV++J9IiUH2Jif:RlEZV//UnzCRSK+j2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955147, "uuid": "97487dfc-6c22-4f32-9c64-6638f2701540", "value": 948313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955147, "uuid": "d9643ede-1af5-4465-8a17-6cd0cb14b3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955147, "uuid": "083011e4-1866-4202-a379-f802e94abfad", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f988e921-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748930825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930825, "uuid": "4d773388-9ff7-44d1-841a-cd25e1eeff7c", "comment": "Malware payload", "value": "2f992258c3ed7b597644fe0ba15714de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930825, "uuid": "91e701d6-8e46-45ec-b15f-2fd32b8fdcee", "comment": "Malware payload", "value": "5fa056bad4f96de051dc0c09879956e1da24f3957cd7aee27145067891385af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930825, "uuid": "7aa1038c-a40f-435f-9468-db377b7a5f8b", "comment": "Malware payload", "value": "994a05dc14b76276f2d1165b1665682586461975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930825, "uuid": "8c1b1123-e0b9-412d-9d42-1275a13b784b", "comment": "Malware payload", "value": "5dd47d2b2b54aae82089b4aa327437aa8c9b0ef36d39dded650a62d9960530a82ea98ca2ee7b36625214007828b18205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930825, "uuid": "b523ecd4-3a61-4dbf-9492-1c284d788c95", "value": "T1DA463396B67F83FAC7591538A2DBAD2C93B4618A042AD438DC4C4CCF7604BD6528377B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930825, "uuid": "99b23001-877c-439b-a4d4-7efeba586ca8", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930825, "uuid": "6d27e271-02d9-44c0-a989-a07378e8bf51", "value": "98304:JIJ/2E/My2af1AymyAD9OF7a5vTPk25Yj2r7mQjiGNY2AeI/hZfw+yD/TIcExIC:i99Y21lK0a1k25YjLyKX/hZ56/TIcEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930825, "uuid": "6c704e9d-4450-4afc-9d51-4c6e9fcfd37a", "value": 5624832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930825, "uuid": "4d9558e3-08ea-43cc-b08c-1727eeace649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930825, "uuid": "fb46bc67-0bda-411d-b565-7bb496d6ae64", "value": "2f992258c3ed7b597644fe0ba15714de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefd80e3-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989165, "uuid": "a12b896e-e933-437b-9d5b-83f5a87975b9", "comment": "Malware payload", "value": "b7e513e5a80b1aaa2f205f398ea4460e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989165, "uuid": "d38c5b52-0df2-4d06-8054-84f4dd86dc66", "comment": "Malware payload", "value": "60a3e9b585d2296977b7074e4d1ceb6dcad8e66453683f2f1212d75c06730737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989165, "uuid": "2ca04c4f-da5f-4225-85df-523d01a1d31e", "comment": "Malware payload", "value": "007a45e20a3c2b17e590a4c91d9f4fdc8901c74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989165, "uuid": "2cee0c12-2e41-4e54-b824-8be1dfe275bc", "comment": "Malware payload", "value": "cd59295f9ae9b0cdf80ca1ddcfaa3c34eb5a453d1864bbbd5c033ecc4f0ca7c6db93bc5cac8f34fd461b7c47e4d97033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989165, "uuid": "520689d8-1e71-4ecc-9157-34e860af48ad", "value": "T160D533E44B1B03C3DF91C1B2EA30A9D59083AD11D6D62D751B36AB99B2F034B47F4C6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989165, "uuid": "a1d8ff3a-f4ce-483d-8f9f-809a9b79ab4c", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989165, "uuid": "f79ec9a5-abb9-409a-ba92-f208ceaaa5ad", "value": "49152:WRVMVmC89MUeCGfs5GINRQS3YTTZl/GTX5qhEY5Eo5OsXKkrdrtHL5B:1o9MUe5s5GAePTTruTXUhXEoE6HDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989165, "uuid": "9898a146-9819-4f10-9147-78558934c483", "value": 2944000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989165, "uuid": "4cc2e07f-a237-41e8-a0dd-04ee1d079c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989165, "uuid": "d6df0576-e5b8-430d-95a7-340281f50282", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.34927.15068.26030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51f90eb-4079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955165, "uuid": "ba5b080f-6bcf-4fc3-83fc-d5c56f22973e", "comment": "Malware payload (Mirai)", "value": "ac3108bbd83d51fc0ef7676fa13e5677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955165, "uuid": "8ed1f78c-f8fd-4eeb-87ee-c17b58ec298d", "comment": "Malware payload (Mirai)", "value": "60db401586da193717c0fda4e6786035234430689277ce82ea7ec08c35dbda45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955165, "uuid": "4b700171-01aa-4f76-b685-cd2f6443052e", "comment": "Malware payload (Mirai)", "value": "9202c9ebd07e0b5c37c835bb3cca27c8ed85c3be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955165, "uuid": "449e1074-f8b5-4b73-b7fb-b27b336ec42d", "comment": "Malware payload (Mirai)", "value": "82aeb0565c1fdabaf85013c967c2179c3e9b219bb64cc13acd95d78e8450371d89e8daae916e9b382b7e4aea3a838aad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955165, "uuid": "6c218bc8-e9cd-4b98-9931-75a157c272f6", "value": "T192C2D044F041DB45DFFA29F52E84CADABBE06B5F69668E8022A093815B5C3634306EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955165, "uuid": "fcb7c706-78e6-4c91-afd3-e96d906d6c70", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7Pi5dv4uVcqgw09o:tam+AnKehPRa9aA4u+qgw09o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955165, "uuid": "4b3a035d-e400-4a35-9e59-81c29fa8471e", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955165, "uuid": "b042ae36-0fb4-464c-bb14-3be0a55c436b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955165, "uuid": "62f0e3d7-6609-45e8-bd61-c7aa03ea2205", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c3d8f0-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748989200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "8282efa8-b7bc-4643-96ff-19847d85b2f5", "comment": "Malware payload (AsyncRAT)", "value": "a2805fcc8241bef34cba7005a4c38015", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "95a7ad59-29a7-4765-b512-f14437ee082d", "comment": "Malware payload (AsyncRAT)", "value": "60e469c8d8423b4f4a11c3ff2e217e7c3b7a8d2d65f01c58db75227e751c0f5e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "a0e5c724-b6c5-4b64-9c21-deac29db3674", "comment": "Malware payload (AsyncRAT)", "value": "50287d927e66c4f6a578bfaeb660f688bc6913f5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989200, "uuid": "e27872fa-25f1-492d-8f78-f6a2784e8442", "comment": "Malware payload (AsyncRAT)", "value": "16d4fdc533a2215a8f62e801f03d313143ef53d4aaaa6bbdf42e9e1cac8c15247f55c369f3eb4c1ef47482c91143b493", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "3bbb26d9-2a82-4564-8602-2d4dd3b57981", "value": "T163C45A0EF6B19098C57E0D362C7E536083765A269F435FBB4BD8366017B24A27F3A538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "2265219c-0182-4c0e-baa0-db524501a4c6", "value": "d4b05170ea1a9a5c6b21bc3ea6061fea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "5a069b52-b76c-4a6f-86c1-074771cb2772", "value": "6144:9BQgbEeKe1H9NIuZ2mK9K+TUakhvP4VGqeRnfElydhSKQ6JuWxBB2qzH6T/qcH:9keHFNKZYpX7fcydhGsuWQqzH63H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989200, "uuid": "3fbdc1d1-be5b-48c9-8462-74e4017d81f0", "value": 579488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989200, "uuid": "5b9d0a7f-a971-45f0-907d-5158dc384466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989200, "uuid": "ceb50f5d-f4a7-4b0a-85d3-70fd5983436a", "value": "SecuriteInfo.com.Win32.MalwareX-gen.27720.13489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3fa1e5-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748935527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935527, "uuid": "ca99118e-4587-43ec-aadc-75c9900e2da0", "comment": "Malware payload (QuasarRAT)", "value": "3c3ca913472ab9874c4c82bb83e782ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935527, "uuid": "12398f6d-0f2e-4505-b512-965012e715c3", "comment": "Malware payload (QuasarRAT)", "value": "617522e53742abc202436a8098084b4a26ba3a6a6dfd8899e7527269a0f55e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935527, "uuid": "907fdbd9-6c09-48fb-8adb-9fc1e1626e20", "comment": "Malware payload (QuasarRAT)", "value": "1e60fc19497bf3a6a134dd98d15b83993c2777a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935527, "uuid": "08ad2384-8fa6-4c67-a657-30a4db35721a", "comment": "Malware payload (QuasarRAT)", "value": "b4643e36037486832aad9bf8029d94440056c0ae54c22dbde1954f2a07053901b2fcf7380578d3f0889ce76bf730ec9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935527, "uuid": "171ac831-6e75-40c3-a564-d00e30e6eb09", "value": "T1ACE55A0477F85E62E56BD3B3D5F0542363F0F82AF3A3EB0B5191667A1C93B4098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935527, "uuid": "ffd42a8b-eaa4-42ca-af89-cdd3c43a4e1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935527, "uuid": "1a219406-9cb6-4ada-a52e-9cbc052d773b", "value": "49152:DvyI22SsaNYfdPBldt698dBcjHM4mKmzqLoGdJTHHB72eh2NT:Dvf22SsaNYfdPBldt6+dBcjHM4mU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935527, "uuid": "bf48a73e-81ac-4981-b683-654dc9236dba", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935527, "uuid": "571af90a-f378-442b-a3c5-e91ee5c65d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935527, "uuid": "5022c6dc-9afe-4305-9a0d-f60605595377", "value": "617522e53742abc202436a8098084b4a26ba3a6a6dfd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae590f3f-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956039, "uuid": "faca6426-86b9-41d1-b96e-c086b6e1cac4", "comment": "Malware payload (Mirai)", "value": "16df62e0ad18511a767544f342f0d0ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956039, "uuid": "3ed5e343-0eb4-4a90-9c01-85b59ffd1d89", "comment": "Malware payload (Mirai)", "value": "617a2025c38d32fcb06d3eea2a56c4abff53e633bed1b9324aaf00bca3c1084d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956039, "uuid": "06f42efe-9b61-46ab-bd94-760e023bfe92", "comment": "Malware payload (Mirai)", "value": "32f797d778955596816e2ca84f202ecd8cd2ad22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956039, "uuid": "facb2746-a3c0-4f8c-a113-f9c18144007d", "comment": "Malware payload (Mirai)", "value": "0deb30fd5862be7d9253a4fb19358ac7fb3702438e38477ccbe3b91e377f87ad53067696e5c18442b0337e01aa14e106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956039, "uuid": "8bfb55dd-5bdd-4612-8984-240bfe49ced8", "value": "T144F2E19702B3D13CCC7FD4B52D9A8014FD207D539A4BAF6B094E792D9932B44DB63A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956039, "uuid": "95bcf7b6-85f6-4663-a282-bdd23f2f9ead", "value": "768:6nspqCwqaalwRZqUoHlQz3o3hSXBczPR79zSR1w+O5x092:6w6zilQz3OhSRYhVSR16c2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956039, "uuid": "350aa1bd-4ed6-4e52-b4cc-3be14f6dfea5", "value": 35536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956039, "uuid": "f856534b-f95d-43de-a89d-15a864dc3337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956039, "uuid": "eaee86fe-a774-479d-95ed-0cb5104d1938", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a0f998-40b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748982595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982595, "uuid": "b3d66c2f-2ddc-4adb-8114-200a333ad37b", "comment": "Malware payload", "value": "623ae65c1482740a826e1313e8c781db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982595, "uuid": "17b0b642-bb6f-4403-8383-3d0f4a2197f8", "comment": "Malware payload", "value": "627758d18d773a74dd10d6066d68e72c1db2ba5fa81f5535b6b00c4e9b01927b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982595, "uuid": "aaf6d058-69fb-435a-9488-fa069d0165de", "comment": "Malware payload", "value": "a4b664d5e7486ef428ef5f3310c497965d6afcfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982595, "uuid": "3918f9f0-55df-465a-99ea-8fe9fa15aac9", "comment": "Malware payload", "value": "12625bbe5d46c6a198f2e998c636cbfb8f66136937aca4825195a118a459674df906d0a2c6c252638599e97f3d6ce894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982595, "uuid": "035759a7-a458-4d4f-9746-790361f716a2", "value": "T1EEE56E21B2D28637D4731E799C3B97A8A8397E211E24584B3EF57F4C1F397816C29293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982595, "uuid": "2505926f-459d-40aa-94bb-069298f8ea78", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982595, "uuid": "394fa40c-a350-4ee9-91d9-d1142bce16d2", "value": "49152:NnsHyjtk2MYC5GDqTT/eC2wpBBseA/FsZDW8nTeCPGXOyv:Nnsmtk2az//eC7BBdA/cFPMOyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982595, "uuid": "8cb38361-a94e-4280-ae19-8f143995ace0", "value": 3193344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982595, "uuid": "99fabbad-1604-46ba-862f-f45f4bedfcb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982595, "uuid": "9d5a265f-49c0-43fc-abde-cbbb26ff64ec", "value": "IObitUnlocker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56df9486-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748944726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944726, "uuid": "908ac7e9-7ebd-4865-b108-0044de3b6c27", "comment": "Malware payload (RemcosRAT)", "value": "23d7d5b5ce7666fcd9a5426ae98f5af2", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944726, "uuid": "ad4e5ccf-165d-45c5-a672-f478c1e476ea", "comment": "Malware payload (RemcosRAT)", "value": "63c408786fb9eaaeeebc782da1fceee815ee150b591b6eda8ddea9c54ffb0cce", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944726, "uuid": "06559654-5da0-4065-890e-5d3a6e700e27", "comment": "Malware payload (RemcosRAT)", "value": "ce0ea8979e4e5b83d00db3a416323bfec8152778", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944726, "uuid": "86ee59ea-6675-4b03-88e9-c27012ef5f52", "comment": "Malware payload (RemcosRAT)", "value": "4c5685d6ad05ea3f7aa6c692e9f2ee4af0bdcd32e8d952fe4c84bafda0bc2f5582b9590f24097458d1d017fc7a88a3e7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944726, "uuid": "70e6b853-2fd6-4b20-91a6-825ce8aa3bc8", "value": "T1B183E78947867CFD99E1BA982D60D3B1E6ED253D8C71C08A74C0B0500DAEAED5DD0FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944726, "uuid": "e43ead6a-2955-47f7-8f0f-806a83f5630c", "value": "768:w2eq7Q2eEn7kcHz4Be9fWbX2exQ2ey7K2ev7:w2Js2bnA2z4Be9fWbX2gQ2HW2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944726, "uuid": "dbd9417d-24e5-4c92-b55d-eb4048ad438e", "value": 85671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944726, "uuid": "40130326-9cf3-41bd-94ce-fb6838d79204", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944726, "uuid": "da351b06-801b-4105-80d0-54c7a4cb9e3d", "value": "webneedtocreatebetterthingswithgreatnessofgodshake.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a79f3ec-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748944678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944678, "uuid": "c3a87706-47e7-4ef4-87a3-1c466e5ee6ea", "comment": "Malware payload (Amadey)", "value": "aceb106ad014ae417fe774ebd38b4d65", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944678, "uuid": "bb83f962-404c-43db-bbb5-b2303611c26f", "comment": "Malware payload (Amadey)", "value": "642e4420c4f480ce367d90715dccd8e1cd869fec70dc619f3628b2085053b6d9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944678, "uuid": "5779a695-57a7-4aff-b642-1c6c2dcd450f", "comment": "Malware payload (Amadey)", "value": "8328bdbd9df20c1d9e8e088ed464c5ae6b6840cf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944678, "uuid": "f9a1b79d-0afa-473a-becb-082fdd6fe33c", "comment": "Malware payload (Amadey)", "value": "fc14b17c884cde798c86ee66d4f6540ced938cf3b444884624ad7d7afcb5396efeaec100c89963dfd0b07a6279cc70b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944678, "uuid": "87182f70-f57d-43dd-b98c-7d9dfdc749d0", "value": "T16DD53AE2A60572CBD4CA27B48827CD8A9EAD07B647208CC7D86C757E7D73CC615B6C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944678, "uuid": "459268b3-51a3-4d95-a662-5af34fdef094", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944678, "uuid": "888ed095-431d-4536-9c26-4f722436e35e", "value": "49152:hGrSPKwnEO/RgBc2UPHDaxk2Du/6zXFM77ABY:YQKwnE+iBc2UPjaxtpz1Qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944678, "uuid": "02ce715e-7191-433a-84ef-bbf02abd20f4", "value": 3016704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944678, "uuid": "03e92d42-ad7a-44bb-a67f-c8cb3bdb775f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944678, "uuid": "acbe3316-a291-453f-ae36-f3bdc39563f3", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1294ba-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1748971096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971096, "uuid": "5ea55e3a-0a92-438a-ad22-52c7f571fe96", "comment": "Malware payload (ACRStealer)", "value": "7233ae3484f377054d32879b632efd7f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971096, "uuid": "6e19d55e-35e1-4b25-97ed-191c7981e8c6", "comment": "Malware payload (ACRStealer)", "value": "64323f178e9c379ba325fa7440a80c2640132a881aa3c7a35fa4fb29fbbb5a31", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971096, "uuid": "070c0a05-bf56-4731-989d-07d468e753da", "comment": "Malware payload (ACRStealer)", "value": "a68f8038b20841d9629cfaaa643971486c165f57", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971096, "uuid": "d32b101d-9726-479d-bb44-6ae808ab07e3", "comment": "Malware payload (ACRStealer)", "value": "969fbcd6c2ad12d586a01eb639b6cecd95a7e600e9429b97b07ea73f0a64ef77446642e66c7a82dd5ca1b2f5966d7282", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971096, "uuid": "06f19ce0-190b-44c3-a3b6-e7cc943b68e1", "value": "T1B9C5F112F5418031DBA110B159FEB7618D7CAD640BA88BDB93DC8C295E709D1BBBB387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971096, "uuid": "f42341cb-f679-45d8-8593-a1cbf4669e6e", "value": "e5f20e967b07e1f976ecf70edcd6279a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971096, "uuid": "c8278f54-3491-496b-b683-9fedfabce5ac", "value": "49152:hJQ0p6K0Vdn+8B5UstugixzWetk712x3Hje88FVqd3xRj:FN0dn+8r3t4DtmEJHjGExRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971096, "uuid": "86c56b37-382b-43aa-918f-dcec9e13afbb", "value": 2499704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971096, "uuid": "c555c462-d1c2-4868-9307-105c0e8a215d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971096, "uuid": "47f33bb0-5270-4a9a-a98c-eac0e6658317", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17914fd9-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DonutLoader)", "timestamp": 1748960511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960511, "uuid": "6971d165-2766-4d26-828d-3ffbaa7349ad", "comment": "Malware payload (DonutLoader)", "value": "a2436bf6324e717f20aa74e6d7908745", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960511, "uuid": "c95d5e80-6808-4a5d-965a-7ad9d9dbaff5", "comment": "Malware payload (DonutLoader)", "value": "6493d8528b5aca043772c1f657125bcebc0cf762efc69b7e3c99b2f4a3095726", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960511, "uuid": "8897dbc6-8130-47bf-bea2-1020e7f965c4", "comment": "Malware payload (DonutLoader)", "value": "09f3ed25ba2bf95e4a65c67668c38b69a71c152d", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960511, "uuid": "a1cb9a9c-7cca-45a7-81a6-b42edfd67680", "comment": "Malware payload (DonutLoader)", "value": "9a320ec688592a9b5c6ec69fcf64dd2abd6747b82fadc55d76b502dbe03187a49e7630bedf2b694c9e280ac941f5d241", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960511, "uuid": "1dd8f435-444d-4680-be1d-9851d78c3d9f", "value": "T17C473330343B0523F8F9D87944B342F499AD2AA9A1468C7E8ED5FB88079AB3D45DF11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960511, "uuid": "5ed8686f-73bd-4cb2-88dd-5fa51775d98b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960511, "uuid": "a8b4dd3c-4fd3-4a02-be79-f1036e80e472", "value": "393216:R+HHB4lmt14sRdjmq5aGzwa3JpmJLGzgU67KOvD/a2ilBqBsaWueMIPeld:R+B4lWdjdYqwEJpmJLGzgHD/adOBsFuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960511, "uuid": "549c396d-ec2a-4f4d-92f4-9416cc009fc6", "value": 25157160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960511, "uuid": "6281529d-8c21-4002-8ab2-74f96d56babb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960511, "uuid": "041fa05e-606b-41af-b185-7520a66cd8a0", "value": "a2436bf6324e717f20aa74e6d7908745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17211446-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748934311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934311, "uuid": "f5942835-dced-493a-afe3-fad01accce0a", "comment": "Malware payload", "value": "4c84d4c3e16e62f2bf78bc7b94aad1a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934311, "uuid": "67d41e46-fe19-40dc-9ce1-4b9305b76796", "comment": "Malware payload", "value": "64ca8b3deef221096966608a5c878035e1ddd0a82c0a28c973e11a666024f468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934311, "uuid": "83666049-2d39-410e-a934-cc7d8352bd44", "comment": "Malware payload", "value": "6194a42a955d004e2aa6b0d2adf07eb495163106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934311, "uuid": "fda3f18d-4447-4d4c-bfd8-264f4e4235cf", "comment": "Malware payload", "value": "f7e3d198695e0e0ff0148eb1af5f75a1ec869b78037808b1020f4e47c89ac9cb9609fdad348636e1198844a0750b3ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934311, "uuid": "2999833c-2637-485f-9a5e-28b9b8d0ae43", "value": "T1B7C43B34B587D0E6C205273C0F1CE6555239AC6A27B8278F33D52A5A0FE52DB9B17E0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934311, "uuid": "2b85e16a-3a30-447f-90d6-7451dbcd581e", "value": "4d02eb2fbb9b9c3f900baf49d5bf7f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934311, "uuid": "41ca6cfa-e6e2-4cae-99d5-e3983d21179d", "value": "6144:1iOa6xw6CVcm2V3GiLsjamDiA6ILR9IRZb2:8sw5Vcm2VdU6Ma12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934311, "uuid": "198d51b3-6d94-4049-9ac6-ea5fbc25599e", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934311, "uuid": "8d2d7706-5472-4c9c-a2c4-0f051bd86580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934311, "uuid": "3f427972-c145-4d56-a164-9d8458845342", "value": "Filipikc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a709d2ce-406f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748950873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950873, "uuid": "64eb2f01-0f4c-4cde-b86d-c090921838c0", "comment": "Malware payload", "value": "1b13e6721e7456b6a42868aa17e6f68f", "object_relation": "md5", "Tag": [ { "name": "bokneeg-com", "colour": "#6643D2", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950873, "uuid": "e46f8908-8033-4e24-bd6a-f6660d21b6fe", "comment": "Malware payload", "value": "6552fc9fe8f5e4358041f6a80681dab8e400261ba9637a9b57b15d97cf3bb82a", "object_relation": "sha256", "Tag": [ { "name": "bokneeg-com", "colour": "#6643D2", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950873, "uuid": "b3fe0126-ec2c-480a-b5d8-cbf0a6052bdf", "comment": "Malware payload", "value": "ff6f45dc83fdf3cbe1c2c27d5b179ae0b7feb0c2", "object_relation": "sha1", "Tag": [ { "name": "bokneeg-com", "colour": "#6643D2", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748950873, "uuid": "bdd576ba-cf42-45da-b279-33271daae473", "comment": "Malware payload", "value": "374c5b47dfbb7917079b965ad52e0f11ef55015375da4389731433e56022336d2ba2dcd64619802f04c0aba2fdf98151", "object_relation": "sha3-384", "Tag": [ { "name": "bokneeg-com", "colour": "#6643D2", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950873, "uuid": "64f584f6-2f20-4c65-8c98-aeec555b596d", "value": "T1DE01C096634943128333CFB4B0F65713DAA1105B242D692239FC5DC21F38A67C7EBA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950873, "uuid": "05ab3f8b-3863-43a0-a910-9da78d1669de", "value": "12:A2xWUu+C1MhA9n+NBTFoIYAHpckrIBfNpathSEjhDXd1u3IcDiZutUWPHC2uTQrP:RWUu+5hAlKFXcpNpaxjJXdI46AuOWWTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748950873, "uuid": "9864e5bc-2932-4d19-9e1d-e24ae4dd10de", "value": 746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748950873, "uuid": "7b5be565-516b-4c80-88e8-8da13de0080f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748950873, "uuid": "8d898695-3fea-4eb7-a37a-a56c2ca9a90d", "value": "bokneeg.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d85f7ff-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748929624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929624, "uuid": "521d0917-7b67-44b2-bfc9-1e3bdb07ca62", "comment": "Malware payload", "value": "492a47a62ca6a1fdae5a4b7cfa15da84", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929624, "uuid": "bb7cda1e-f23e-44f1-884a-96c6397166b0", "comment": "Malware payload", "value": "65c08bcfd80815e7f7de8065682ba91861bb2199a7ea9b9dfca7a59ac45af655", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929624, "uuid": "7cf07227-8eaa-4062-a84a-b93f0cf248c7", "comment": "Malware payload", "value": "3454ec57fa1dff22752bf8979d02e1072d56969d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929624, "uuid": "5fbe5b45-7e17-4f04-a1fb-65a772fd4c7f", "comment": "Malware payload", "value": "4dedee566de68e8de6f6ed7c45e76fb9e621ca20ac11eef05ca760a0cfe615bd5bb4ee55eab228713bbe32c5b6ca69f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929624, "uuid": "208e58e7-7258-486f-987e-0fb8adb5893d", "value": "T1C2E0DFD606403B34F4CFE87A3967C75F40A4A1D614130A28F8A8E0788C88D68AC42F00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929624, "uuid": "0abf8d38-9978-4e6d-a4d8-e504d7a4b9f1", "value": "6:UrmDoSuFXJMbtOmDoSuFXqjI4OmDoSuFXkCD6FLXD1vc5Q66FTWXD1vxISD:UrmMSlMmMS9umMSxXGuuUSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929624, "uuid": "b4cc9485-032a-473f-a598-603f10b336bb", "value": 338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929624, "uuid": "ad753f7a-38fd-42e7-8c51-e8ccb9adf8ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929624, "uuid": "b0249d1b-ba7d-4ada-a5ad-8d0932b64904", "value": "g.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20416df2-40b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1748982000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982000, "uuid": "7f06b148-dae3-4853-b46f-1adb6cda28d9", "comment": "Malware payload (AgentTesla)", "value": "6bcfaf9495d34bdad0e2049272bc1073", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-rusticpensiune-ro", "colour": "#CB0C6D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982000, "uuid": "471b7e99-6673-4d26-9021-94f95a60409b", "comment": "Malware payload (AgentTesla)", "value": "65d3ca4a75fd5335819bee46b07df21e5f42168f1e13b6d65f76de70915ef39b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-rusticpensiune-ro", "colour": "#CB0C6D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982000, "uuid": "8b5248da-0b6f-469f-a46e-294c89415581", "comment": "Malware payload (AgentTesla)", "value": "b117d5ce4562eee24de0415379ef5b4acf12eca2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-rusticpensiune-ro", "colour": "#CB0C6D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982000, "uuid": "3152937e-b312-41af-92bf-a29499c54a91", "comment": "Malware payload (AgentTesla)", "value": "0ea50c9199a3c0fd5560c5d274a43bdbb6d3f9778f564d4ddce1dc767e725165d57c6911cd978c91972beaf669afd1b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-rusticpensiune-ro", "colour": "#CB0C6D", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982000, "uuid": "9a95147d-0aab-4ad9-bb52-d4a5adfd12b4", "value": "T120652326B7B0E2B2F15B02F0DD5A57EE35A05D348224BD07B7C07A4B2832BC6662D1DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982000, "uuid": "8788ebdc-4e5d-4e67-8ef8-940eec9dfb6c", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982000, "uuid": "266fa1ba-4375-4d21-a22c-3922409c03fe", "value": "24576:UT7Ooju+k1SrL/SXpbGGQL2Gh2q1mfhEYeXB2jefJu/83ksU4K8:UTa0u91k/+pbbGkqiEYvOugk2K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982000, "uuid": "4fdb88a6-c223-4855-9172-4a0b386134ae", "value": 1428184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982000, "uuid": "3287c855-71db-46b4-af95-6fdf68b84e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982000, "uuid": "bda8e478-70a1-4b0f-86ec-789bb4690dec", "value": "2506031163982291183.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2edff96-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748934975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934975, "uuid": "0652a7fe-2e73-40d7-976f-e0ca3315f4c6", "comment": "Malware payload (AsyncRAT)", "value": "b9faeb0784e9a3cec43989ea6a9d908a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934975, "uuid": "1a0fb6e7-e1bd-4096-b2e7-22ef9bbf4259", "comment": "Malware payload (AsyncRAT)", "value": "669dfcbc12f8dddc33c8190908830b0231386baaf17f6cec72a70f3776923238", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934975, "uuid": "51b70297-6f55-483b-bef0-9c0928c9e625", "comment": "Malware payload (AsyncRAT)", "value": "c137faa030497f6540a921aebd6e9c60b4d37a6c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934975, "uuid": "2dbe216b-acf9-4892-9c49-98bf571c43a7", "comment": "Malware payload (AsyncRAT)", "value": "9a10d09206f4f0ecf9f5c79080bdbdf19230c530d88294f6585d25add18047857ec69cb600a507ddea0e26c8aa4ff1ef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934975, "uuid": "ac16abc3-665e-4024-b9dd-a920ad04c085", "value": "T182D45B34B497C0EBC302673C4F1CE6552229E8665BB427CB33D52A5A0FE62E79B17907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934975, "uuid": "cf4322c3-3118-4eb0-a0a7-5d4e712a7f48", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934975, "uuid": "cc744fa5-cab2-4de2-a5c9-a57ff4f6ee34", "value": "6144:0+vBV+1+sQHHDlfZRXnK/NVouKeGj1YvYTDy7LiCcgj:0KBw8sQDlfZ1nKn0pT0Lugj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934975, "uuid": "f51a9f97-549e-4bb4-a85d-7c9774acebf3", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934975, "uuid": "9549652d-c883-484f-9e0c-c9ce21c82160", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934975, "uuid": "f61f5e3f-2b87-49c0-ac41-34d8194224da", "value": "ksivaaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2869be6-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956100, "uuid": "b08d951e-8616-40ee-ba23-14d2f5dbeea6", "comment": "Malware payload (Mirai)", "value": "a5e1501aad56769b284154195e6a4dad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956100, "uuid": "372fb4d9-693b-4863-a2eb-b09f6188554f", "comment": "Malware payload (Mirai)", "value": "66cf57b3008d15df344a254440fa03837299a382c7561a90497cae08eea171a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956100, "uuid": "643f60fd-17d7-44da-b3fd-d72dd198419e", "comment": "Malware payload (Mirai)", "value": "8c601eb68400ef284cac74f1f16e00faef5407cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956100, "uuid": "ef48b120-681d-4f4b-bcc1-6aa5d97aa28a", "comment": "Malware payload (Mirai)", "value": "cc24a0edb55ac01dd2562175165e95bb25c449abaf04aa93f36f72e1237773bd7c49a63aaaf007c7fa1f3284ea2e713d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956100, "uuid": "9365497c-fe60-46ee-9aba-f2bce7a44a89", "value": "T1C9E33B85EA408A13C0D61776FAAF41493322DB55E3DB73079D189FF43FC6A9E0E26606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956100, "uuid": "31f2e652-fbcb-46f3-ba13-0ebb926b2755", "value": "3072:sqlhEFZBB9qPoLmpMguHcUlVUHalw7WguH0vsfC0XxmjX5Xa/NOL9eXgIncdVm2J:sqlhEFZBTqPoLmpMguHcUlVUHalw7Wgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956100, "uuid": "bcb0d215-85bc-40f3-a1ac-b45550d21cff", "value": 143882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956100, "uuid": "4d2080aa-4a55-471e-a0a0-469af27d594e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956100, "uuid": "34588ea8-ab43-4027-bfce-9b3c9224774c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1c1614-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DarkCloud)", "timestamp": 1748929385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929385, "uuid": "61bdfd23-9121-4c5f-acaa-9048fa6febc9", "comment": "Malware payload (DarkCloud)", "value": "b73e598a8e326573a98e09489ac178cc", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929385, "uuid": "a11cc109-66f8-458c-a449-134f05c9641e", "comment": "Malware payload (DarkCloud)", "value": "6743ebfdaea95d355e53cc67b64b30f7af9a82507b077ed5f636cb6935ab4af9", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929385, "uuid": "88f9aa97-99c2-446d-9737-394ce789dfa3", "comment": "Malware payload (DarkCloud)", "value": "d23ef32ab406a980fadbd4eb55f2909e64a4b48e", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929385, "uuid": "995f540b-4b17-4e45-b980-cdc4f407f88f", "comment": "Malware payload (DarkCloud)", "value": "85d0953054c64497293ae36a5838c5daf81f9768861fc8dc8bcc1f1519fe922e804d151321eec6404a48557ecb0ada31", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929385, "uuid": "b23ca862-0ba9-42ab-b7c8-1447bbecb91e", "value": "T115335D1CB3DC8A26D71D197E94F2826803F8D5E73603E3477E8861E41C43BD5698A7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929385, "uuid": "4f9ba39f-5bf6-4d66-bded-22ca5697d451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929385, "uuid": "d0f40507-b16a-41bf-bda8-e8a9d14982fa", "value": "768:VpwfzKDgUS1of9s6v4cFuBH8GmhNWnog1tzJfVSZHCTFVlm7iffl/VGiAIGeoV8y:bwfzKAof9sQFcwhN4H1r9i4Fm7vePo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929385, "uuid": "0cc26af1-008f-4de6-b45d-8b181554cabd", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929385, "uuid": "c6f84480-7796-431e-a5c5-a6bb2bb991c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929385, "uuid": "1128a1e3-23bc-4032-93c3-55a63da6331f", "value": "Informaci\u00f3n de tu transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9970e729-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Stealc)", "timestamp": 1748930664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930664, "uuid": "714a9193-9741-4725-9de8-214f9dcd7a99", "comment": "Malware payload (Stealc)", "value": "39f625b7714ac6c16fef329b2cdc3749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930664, "uuid": "a7fa084d-17cf-4ed6-8399-1baf965f31a2", "comment": "Malware payload (Stealc)", "value": "6a4ca5c495880136ef56789b52038807046d66960ea4ecc60aae6a916a0a192f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930664, "uuid": "70605875-77c4-4eb3-a792-7e93b589ea10", "comment": "Malware payload (Stealc)", "value": "0771a3e9f893ae0e7c73bc7ab691d118a3553538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930664, "uuid": "fc3d6fab-a81d-4a74-b227-1e4189dc97f8", "comment": "Malware payload (Stealc)", "value": "d01a23d6373b0680995d07ad9148d3eae5900c1fbc9de3b731b68b40ace977b03c43e2d36f79a9e99dedcb7cb78a42b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930664, "uuid": "c6031cb2-678f-4e7e-9b6c-99b98558fb3b", "value": "T11F95330679DBF53BF9B7AFB04133EDBDC9100CE20060A5C266D944AEDDCAD64C9A1E85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930664, "uuid": "3b8beb69-fe6e-4762-8b25-bf64c5f3da13", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930664, "uuid": "9d048a1a-9727-4f4b-8d32-e3793a308dcf", "value": "49152:WTScTYStlsJXaw6zuEt2isWgxx+AvRQgVoW7EJb:WTPTY/mu02iWxsIRjV8Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930664, "uuid": "d4295c6d-ea1f-46fb-a3c3-51e368896eed", "value": 1946112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930664, "uuid": "626fb33d-d7ac-431f-8198-dbabf4919ca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930664, "uuid": "94bb391f-9a68-4dbf-8237-70ebb18ce52e", "value": "39f625b7714ac6c16fef329b2cdc3749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c68264c-40a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975605, "uuid": "d17878e3-cd6e-412f-be55-91837ba9abe4", "comment": "Malware payload", "value": "9a14f97d07b11cca657c35274dbe072c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975605, "uuid": "fe7051db-9420-42dc-a1a3-0099b3e42d13", "comment": "Malware payload", "value": "6a76875659079d61259e6842476feee2d234ba3e209b62634bb4bc645d1ae32a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975605, "uuid": "2846714f-4506-4eb0-9575-0307e3c19c1e", "comment": "Malware payload", "value": "0c253f45d3efb7b4fddb5a63417368e69066d8bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975605, "uuid": "0549233e-596a-4182-baf9-03cd99ae9bfb", "comment": "Malware payload", "value": "c2af850883a0fbd7af0b435fd058b0ad9bdc46aa85fc1f8d43e367b2aefc3a9f50884f5c1cc9e7f3221085a989dfb512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975605, "uuid": "df0a56ef-1159-4964-9dc0-ffbc2f3a671d", "value": "T104644C22E1D1E02AF8664DB42BB5DFA7C50DED61CF9836C373D00E665A245C846B2FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975605, "uuid": "af3ede89-003a-4da5-85ff-97d33361466a", "value": "7bd2c86ce9b6e22a2db1ece395034cde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975605, "uuid": "acae5067-93e2-4373-8652-996d2fa8428a", "value": "6144:eCdBv0/M++GkzXNpSTNFZshHb1+xOhHGFfGlA9:7dBv0/wzXNANFZiZgfoA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975605, "uuid": "f6f9b7d6-d810-4e46-b20d-02fdc67c9926", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975605, "uuid": "cdc68bd1-6403-4506-9340-2b15f1fe8a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975605, "uuid": "0945fbbd-decd-418e-8a60-60f6714deec9", "value": "BootstrapperGUI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f798c40c-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748931251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931251, "uuid": "eea4bf52-3a53-4a36-a910-edf11e483f01", "comment": "Malware payload (CoinMiner)", "value": "e8c3b6beadabb116c2852e4a7d333bff", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931251, "uuid": "a31b7797-7cbb-4dc9-b27b-160d318f879a", "comment": "Malware payload (CoinMiner)", "value": "6ac8e3eb24a18a2287918d544ca7a102aee3ebc38b8a16b6ac7deefbe11bdecc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931251, "uuid": "188e55b5-2248-46e9-996b-f5fa8f44f8f9", "comment": "Malware payload (CoinMiner)", "value": "ff43dbb6991c7637ee1eb1e53c858527f2189094", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931251, "uuid": "f6f7d235-0e37-4cf4-8d19-7c055cdd4181", "comment": "Malware payload (CoinMiner)", "value": "c0a9334212eef45523991f76cf640c80b34813c89d79e84d0e26e52b9384bccab4e7a0e17964da0b16caa3df852d05b3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931251, "uuid": "40d4a71a-652a-46de-aa57-24fc14205640", "value": "T13C52E90AF6EB26758ED0AF2FD8C21854BF1E13446B152173AD23D62C74D2A28BFD1635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931251, "uuid": "ca0f4606-daf3-4068-aa74-69c889a09e4d", "value": "384:HqyiWk7wVSx/7xcXbFarNSAiVCSq/ctDdYz8D:KuQwVSx+XbFarNSAECvmDdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931251, "uuid": "491f3343-0896-4d7b-b37b-41afd86ebdad", "value": 14346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931251, "uuid": "bb34ea16-e359-4ac7-8a2a-5220da7e09fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931251, "uuid": "2663fe5e-b602-42a0-bdbe-b3e0681619f6", "value": "Notification_Of_Dependants_2025-5-24.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43713e2b-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748935244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935244, "uuid": "4f8cbf9f-c50a-447b-848b-83f3be4e6811", "comment": "Malware payload (AsyncRAT)", "value": "72779a6d843215e5b8ee54d91f6bff40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935244, "uuid": "7094d4f5-5be4-41cf-9776-5fc5583194c0", "comment": "Malware payload (AsyncRAT)", "value": "6b0eb2284662649f86bd82d788c88855cbe1bde738b20b8dd552a239eaaed573", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935244, "uuid": "e2c50ddc-8dc9-483c-a839-45453de54274", "comment": "Malware payload (AsyncRAT)", "value": "0274155dc0a478534fd927c7912ec9e60cba8a60", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935244, "uuid": "6ca4d25a-de0c-4303-99db-e4142a1075bd", "comment": "Malware payload (AsyncRAT)", "value": "3202515d9bf401c41b75b14e8c6d435c0d11a867a335151d3f0299c63d3049aee418cdd2e8ebf1f2b4439ab1d62231f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935244, "uuid": "5c43d096-8055-4d21-a711-03b67c66a17b", "value": "T1F1D45B34B496C0EBC211673C4F1CEA652239E85A5BB427CB33C52A5A0FE62E7C757907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935244, "uuid": "edf52a35-d3cf-4f00-92db-6d8acd5380ff", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935244, "uuid": "b83258a5-a51d-4dea-a540-2c624aa29b36", "value": "6144:MqrGdX35suSfIjTpxKYNWoLpUGNskLHOz/ws:lrqX0fIjdxK1YskLHO7ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935244, "uuid": "63650d1f-ea70-4d7e-959d-92e48c83df52", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935244, "uuid": "21392a2f-c0e5-48dc-b9b7-83fd1943f0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935244, "uuid": "4c33c958-9c0f-4ecf-bf59-24a6893f463a", "value": "mrnakrokaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c2621c-404d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748936005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748936005, "uuid": "f5e832a5-e093-45e5-9225-d526fbabb8d4", "comment": "Malware payload (Vidar)", "value": "f178cc05bee53f2a882ffb959d774b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748936005, "uuid": "b7e46d38-408d-4f47-9761-2ae5855b2a3e", "comment": "Malware payload (Vidar)", "value": "6bea65194265c5be125057323d34c9cba20d19f11986ad614c045d0254a8374a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748936005, "uuid": "d14f8bf0-a2be-429e-8eb5-af9280440644", "comment": "Malware payload (Vidar)", "value": "d4831a49928ff8eee8cc407e8d4feb8df26cdf12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748936005, "uuid": "f41d8b88-915f-4200-87cf-160aa2520e24", "comment": "Malware payload (Vidar)", "value": "caa55ad36fd320a28f9c550c30f406427e7752f4cbf37c7c454c3a7a9d7dbaf89837899ddbc6de3b5d1e836dffe9a7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748936005, "uuid": "efdfec54-ee5c-4729-80bf-84a0c7a3ac71", "value": "T16786335A35D92932F1E387318CB39583E4327E1572E48BFF3121F61D1D6B1AA13B821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748936005, "uuid": "4166bf02-f146-4b3b-8021-daa929cb52e0", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748936005, "uuid": "7847bb4d-62e9-491d-b985-300fa420d15e", "value": "196608:+XI27SbVelU/NTDEueuV+gk8sIMvkZuXfyjXdx/XVz:+rGEuNVlsfkZwwFXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748936005, "uuid": "4e05207b-9e9b-4e4a-a2b9-97faece2db7a", "value": 8153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748936005, "uuid": "a7eca8f1-23d1-4bc0-8511-c21bc419b40d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748936005, "uuid": "bccea0e2-74a0-4192-9b45-0f16ed301f76", "value": "SecuriteInfo.com.Trojan.Inject5.54728.28257.3722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3fa5f5-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748930888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930888, "uuid": "a713132a-6a88-46e0-ae82-4b2f3492a46e", "comment": "Malware payload (RemcosRAT)", "value": "050d0fd2594d92e1bcde3ed2845a2ef1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930888, "uuid": "b6548f43-e54b-4df1-92b9-6edab9dd1063", "comment": "Malware payload (RemcosRAT)", "value": "6c1c8320acbfe024051137623e3eb8a376ec16ac412ec836b3db75ed6772111f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930888, "uuid": "8930e623-b11c-4d45-b2ce-63267c4c7df5", "comment": "Malware payload (RemcosRAT)", "value": "5793045aecd54d5277df737b4b2adbe84e29bcf6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930888, "uuid": "0a0123d7-3011-4cb0-ad9b-da7d7597d61e", "comment": "Malware payload (RemcosRAT)", "value": "c8e729e62431c476ca44288e2ea7bfd2850dc1e51c37685452f4a6f2485431d3bebf123fe7b963cf394a3b8df383bf55", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930888, "uuid": "a893f36f-86b3-450e-995a-09da15b4d863", "value": "T173F4238AF4D48E9BC0A324B448D8D0DB636FBD0FCAA69557348A731D3139771D198A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930888, "uuid": "be0218c4-394d-4364-b40b-0188f6fdffb4", "value": "12288:bO0SXkiBCi/cxZq9ztZ3LfcZf648s3+20mzEUJ6fyRotWg+f:bktjjn20CH2lJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930888, "uuid": "ac8a3f91-86c5-4b5a-a074-5e437040391c", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930888, "uuid": "f7c1afad-cfb6-4a0e-ae63-059438cacd2b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930888, "uuid": "22bbfab5-ade7-4e90-98b4-7a976fecba6c", "value": "Purchase Order AS1601253465.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaedd415-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748932089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932089, "uuid": "b0e2cf1a-3971-4a79-9cdb-baaa37cfcb2c", "comment": "Malware payload (RemcosRAT)", "value": "9920b89c05db3c544cdf53401c21f182", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932089, "uuid": "8be45c6b-4920-4747-aae4-7666809a5431", "comment": "Malware payload (RemcosRAT)", "value": "6c2642c1e81ef61c6d6a8fd297bb7fae17dc49051a51d28c99b6b23afc7876fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932089, "uuid": "4f64f186-920f-4563-ac4b-fc32bd729d89", "comment": "Malware payload (RemcosRAT)", "value": "716f1c257718382bf0dbe8cee52f4b0f3d278218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932089, "uuid": "2227e311-46e0-415f-ab54-424664739ca7", "comment": "Malware payload (RemcosRAT)", "value": "dcc6d3e98bd35428fecf328c642183607022d0e0f1da21a44e9871157f058aa7b5a2d864945352443be38ef5039b4ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932089, "uuid": "72b5f198-08ab-4335-9828-27d4708f8723", "value": "T1A73501A81385C901C2BE6BF6E4A0E63557B8EC5BE011E247DBE4ADEF3D31B4059091CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932089, "uuid": "8f6cd1fe-6377-4ab5-a0a4-217f481117ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932089, "uuid": "5f574541-d78b-4386-ac59-268d8f36ccd2", "value": "24576:tZGK8zEQU+ua60dq5FAlogF3Tm40e2gT3mogCX1:tZ8EQUBYkelVDm40+rK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932089, "uuid": "2ead5816-8f48-49d1-8831-0a5223d89a14", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932089, "uuid": "11787baf-67a0-4159-b1c6-4e1c323dcd83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932089, "uuid": "878a9f6b-b2e2-4b3a-ac5f-f54e340b0ee8", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.666.15595.6845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7403239d-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748960666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960666, "uuid": "493ee5b8-f4d3-4312-8056-9f4178e0515e", "comment": "Malware payload (Formbook)", "value": "cf84d69f2cf41f746410ac7731e7469b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960666, "uuid": "68b48615-71c6-48ed-a39c-04415b8b036f", "comment": "Malware payload (Formbook)", "value": "6c6cb8625f36ebd02fe3ef1e5647b8b1f625500795b582cd3d21dacadb00daa2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960666, "uuid": "7993fe35-a874-4f09-b884-222dcddf6a47", "comment": "Malware payload (Formbook)", "value": "4164ec85fdf0db6ba00ec567616c65defcfba8b7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960666, "uuid": "54950b76-fad8-4b8e-9a81-64bbeb90e50c", "comment": "Malware payload (Formbook)", "value": "5e110f64797322ee19799506f2551d82fb4f1fbb622a7db573fe4dbc79c34bc44ec19e6d927ffb6bc60a5a1cef25d39b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960666, "uuid": "ada7c715-7032-4892-9eb5-ef64497b05b3", "value": "T168E433936C9EC53A4B8977293455350ACBCB3364AB7E64D57B6ED00F983088F26E523C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960666, "uuid": "4f20fc48-939c-4b47-bf89-73ed65475540", "value": "12288:nJNLElJnvBuNLKD4/Ktfg6CAA8akyTpFUUG5J4kB2Ph4MduuM3jLnDD+U8JHEQh8:nLETpuN5/Q46u8qLUU6J4kBXM0usLnc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960666, "uuid": "03b1c47d-fb7c-44e7-a00e-4101904bf17b", "value": 716433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960666, "uuid": "c7b3438f-00c6-423d-bad6-8243dbb80704", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960666, "uuid": "1932ded6-89b7-4e1d-b400-51cdd6669606", "value": "Order Confirmation.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3108eda-40b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748981441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981441, "uuid": "8db4e26d-795c-48fc-9aea-b9797c6f6f13", "comment": "Malware payload", "value": "486ca710529a665d7c5ceedd0bb5aa31", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981441, "uuid": "8197d011-1cac-4780-a49e-27bb04d6a71d", "comment": "Malware payload", "value": "6cbd38f81cf22a505ceb5deafcb4bff7c1aceecc2ce89e74211c5ad985f6aa4f", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981441, "uuid": "a5991107-276c-4d96-abe7-e8e3e5dffdaa", "comment": "Malware payload", "value": "d79ee5879653ffda368ed6581d1b8fa20ef5ea5f", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981441, "uuid": "3c76e1f5-f5d5-43b0-920a-469b3121aeb6", "comment": "Malware payload", "value": "05697a2cd2b2911b5975da3157f94b34f8214219a16461cfdcc388c4bde089fac216f09b49a5c446c2668b18d6caebf3", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981441, "uuid": "57d806e4-4aaa-41db-b0bc-2df9082a0122", "value": "T146E73335C5DAB96ED3939C3951BA5F2684C448E36EC9B2CCCC496700D9DA4C3A2F7B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981441, "uuid": "83b95670-9fb1-4fa7-a023-11d792f56924", "value": "85ab324a26a79adec77a3fcbbe46e5a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981441, "uuid": "faeab70f-fa0b-44c1-af4b-ad1676da7018", "value": "786432:AQBrSGemWyjXlX7PlfPqvtrr6l76HyiO7HmWHa+5ZRMTR/Ydvb6z/b0nMvYAQdu6:AWSrtwy0KgHa8Q4T6knMO3qx+2209fq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748981441, "uuid": "2a35e7a5-af70-4fa7-a657-8c4af1ad075c", "value": 67584399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748981441, "uuid": "4bf79c51-a155-40db-8ed0-c997a6a96342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981441, "uuid": "9c36fa7d-4cef-4c40-89d8-23e7098db072", "value": "AmyDosk-x64.5.8.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a729f647-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989099, "uuid": "78d5f08f-7693-4b87-a94c-17b373fbb550", "comment": "Malware payload", "value": "e0d74398c506a6490a8e2a87d00afe50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989099, "uuid": "374f99db-8e12-4e5a-b8df-6470b3ff3913", "comment": "Malware payload", "value": "6d97f31d1c16d7cc994d3da3cf32761321a03600b5d677e9b382627e28ae7762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989099, "uuid": "622f25c8-2319-4063-9bd2-06fe9b464d08", "comment": "Malware payload", "value": "4f9a4af2f838bc3039da1c8eb2dfb34f38097209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989099, "uuid": "ebe5e552-7357-4fad-b0c3-ef51dba48591", "comment": "Malware payload", "value": "d4719a1ce813505655ce1bd54b2b605144606ae33488f8e1261c5c7bf750b3335f8763e9f7493b7237cefec1bcac4665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989099, "uuid": "4312f4b5-95bd-4da3-813f-867ca6a08f5c", "value": "T1269308D2F24086A4EC394B75D4374A700623BD7ECDB49A6F788C7D263BB72914027A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989099, "uuid": "74a6860f-958b-48de-8246-7cc7dd1c1e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989099, "uuid": "1e04eb17-9a61-483f-a943-67d736d0caa9", "value": "768:dI2uFqlJ9LDETsfY/lVoTlR1vCU/he6FxztYcFwVc6Kl:qnu9LgTsw/joT3/4ujwVcll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989099, "uuid": "caf41e02-200e-4d60-9393-571146cd85fd", "value": 91304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989099, "uuid": "17c6b94d-4b6c-48d2-a15d-565713e3b7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989099, "uuid": "10fcbf54-50da-4267-900f-414f2c7f70e5", "value": "SecuriteInfo.com.Win32.MalwareX-gen.22309.7107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b57602e-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1748928734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928734, "uuid": "59dc8f42-5b3d-47bd-a63c-f60119d1e046", "comment": "Malware payload (AgentTesla)", "value": "6c822cb362cabea8d049e2addbe1fb91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928734, "uuid": "95609f07-7a07-4ed8-98be-bdb64cfc8e2c", "comment": "Malware payload (AgentTesla)", "value": "6dabf963ef9eca5a460464b5fe95d158d78d53cff200aaaf5cca3a0c43a57f60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928734, "uuid": "cc86dce6-1f60-4b17-b5b2-9b61d7c5625f", "comment": "Malware payload (AgentTesla)", "value": "10fe7e5cb0bce1635c31e9c8c17c693656878715", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928734, "uuid": "bb0a76ec-5944-4d4e-abe6-6b7e1029701c", "comment": "Malware payload (AgentTesla)", "value": "f956765b14502f0fb872d672cf74def930397248e67e990a7c3e879b2d1a59236e028b22c176ded7f0c968374f821313", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928734, "uuid": "13dc34a1-6117-484c-af6b-47ded9c10f0e", "value": "T1101512D03653C687FF2B52336D23A36627F57C925820D61BB3E0BB5F3DB6541A10AA09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928734, "uuid": "d1bb263e-8404-45e6-ad9f-95d3da7c1ee1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928734, "uuid": "dca75178-1c1d-4aa4-b94d-113d8946a571", "value": "24576:IMwDf3DrpcBVlkvg6GIHV6zsktumBbkw:IMw73CBeg6GSKsku8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928734, "uuid": "e3b21478-d094-4338-9b1b-75ab266df47b", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928734, "uuid": "61cda1ad-7cfa-4158-9c71-5e08c4096366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928734, "uuid": "db964de5-a8de-49c4-91ad-4f4331b34441", "value": "6c822cb362cabea8d049e2addbe1fb91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e62d526-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748944336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944336, "uuid": "5cdb46d1-6007-40a9-9e61-82139a18807f", "comment": "Malware payload (Vidar)", "value": "314bca3b7a40cac4112fe32b33731f46", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944336, "uuid": "1dca2ed5-71f0-4181-aa3f-042c773c9650", "comment": "Malware payload (Vidar)", "value": "6ddd371977982c7dd08c494b644dfb1b120bf3098433d0d5e6580068c3e28456", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944336, "uuid": "6ff622ed-60ab-48d9-b196-dc029c6bc0cd", "comment": "Malware payload (Vidar)", "value": "ba4e0f3e1e9c6ba5a4b867d3b8798e4f059bb75d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944336, "uuid": "e375c77c-c595-44bf-9e74-39b4a6646207", "comment": "Malware payload (Vidar)", "value": "625af2dcd7b86ebe38a40ee87e7cbb6fbf8d08fe710dd5a0f054d919043c08a0a507ba8c999ae52f14bc7c1e07e02db0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944336, "uuid": "c72ae57f-693d-4895-9b89-b4a9625a0c9a", "value": "T1AA33BDC32FA9B007218F5BA79F1668F7F06E97E535402D036328B6CDA959D02F1A4E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944336, "uuid": "5add3e63-f67a-4485-8873-47eddd7088bb", "value": "768:dKtCnrwYMODN9mT/T9uprA9IHvMFOndmzRwA/8gM3B2P4Rvc7/ZOGlf3nWlOCoU3:MxsscVJaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944336, "uuid": "e97f4b6b-5f4c-4280-830f-491ff1dad09a", "value": 54413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944336, "uuid": "11f7e3af-1cf6-4463-9bbe-df271deb8948", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944336, "uuid": "30951a6d-5ded-4ef0-bf2e-7c448d8561d3", "value": "test_installer.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4e875d-4019-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748913702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913702, "uuid": "c6f44edd-5f8c-49cb-afcd-296a3a8b3e56", "comment": "Malware payload (Prometei)", "value": "b227a4d01867f2bf151bfc9eea5e7174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913702, "uuid": "0a2976eb-ed26-487d-9093-b6486c9c90f5", "comment": "Malware payload (Prometei)", "value": "6df374ac204ef5c1fd0ce702be0d1a1862b62e8a2aa3e7596695439710d05baa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913702, "uuid": "7fc7e541-b47b-4438-b59f-86fdb1b85a04", "comment": "Malware payload (Prometei)", "value": "4af03c4b8411d66e513e37aa8265380e0ef1e4b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913702, "uuid": "e4a40b28-8500-4f2c-92aa-1b20b27d7ebf", "comment": "Malware payload (Prometei)", "value": "ed10a5a465911928f768ec7292a8d063017bcdb3b68d8a9c883888ff8c2f80c29ac634f511dc2d439a8de46145e96692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913702, "uuid": "14d4687a-0506-4a42-b971-5bcd0718e23a", "value": "T16F9423F8C83D2E3098169F3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913702, "uuid": "77a89d78-0832-4e7c-8a5f-5c70d9e0f8da", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgJ:25WOSACZSV6eKRH5EPiamb4DsDwwc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913702, "uuid": "d62790c1-035f-4d44-816d-3e18ec49cd5f", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913702, "uuid": "9295ea7c-caf5-4886-85fe-0016615170e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913702, "uuid": "d4fd4c18-95de-48a7-98fa-d85cb7ad8073", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31685b47-408e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963990, "uuid": "60633d81-1cc9-445a-98ef-f162058cea0e", "comment": "Malware payload (Grandoreiro)", "value": "8b931db234ab5e81e3d264e4a6229c83", "object_relation": "md5", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963990, "uuid": "7e1e0c91-e7ac-4a04-8873-dfe0e551eaaa", "comment": "Malware payload (Grandoreiro)", "value": "6df38d35a9977f9b07be98a328c1f3387e3cac1621c4231d37311126983dec88", "object_relation": "sha256", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963990, "uuid": "f48d55e4-a111-4b4c-a7bb-b77bb98b5348", "comment": "Malware payload (Grandoreiro)", "value": "646c6bc97db0c0a67f695ddfced5d4598ec9f448", "object_relation": "sha1", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963990, "uuid": "a0bc7d17-6614-48eb-b666-fa967dde7e80", "comment": "Malware payload (Grandoreiro)", "value": "ba21f4a875f147de062f06f10e164386b3dee05a52f8008ef37d8e308c50e784d4f05fa30f77d36703e87c11d4cfa82f", "object_relation": "sha3-384", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963990, "uuid": "aede11d1-22f5-4f4f-aac0-9ab62da557b1", "value": "T17EB522F4BD258E85FC4194B306420F98EAAB007053A1D7C747B4A6773B632962F57CBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963990, "uuid": "94473697-c765-43ad-a15f-ba57e2a6fe15", "value": "49152:2Oadj4Q9+iAbjrgoOuhPKpRA/dX3iHx5HjQa01RjlUysLVHW+Lbr:2Ou4qAbjkVuYRA/py/UjlTKWGbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963990, "uuid": "a7a781a9-fd47-4a90-a897-dac00a596260", "value": 2311669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963990, "uuid": "ebd73c66-e54d-4853-913e-d5335feb6443", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963990, "uuid": "87cee646-bf6e-43d0-9671-f90caf7356d8", "value": "grandoreiro3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfebb5e-4047-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748933705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933705, "uuid": "37d75873-95ce-493c-a367-867dea912622", "comment": "Malware payload", "value": "e447d3b92a981234383564ec2b15d041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933705, "uuid": "9cd2771f-6d89-42c0-b4a7-68ef3f55dd64", "comment": "Malware payload", "value": "6e0585bd8651ae115f5790e7eac9bdbcb7f21230d4b749448a0c90221343a261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933705, "uuid": "3b1578ac-b666-46e8-8016-62615fed82bd", "comment": "Malware payload", "value": "407ae54c2456f08c4c6fb3d2528830aa7332fc18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933705, "uuid": "475b7838-dba4-4dd9-846a-128ffd20524d", "comment": "Malware payload", "value": "b255e7194165b464b43d0157d7408438d03af34cc910333ea8914b60eb53d2bb928f3719a91206f92b7f443c2b42e5e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933705, "uuid": "44b1574a-63b2-482f-926c-b25ee40fa7e0", "value": "T1EC469D03F66459ECCA9FD238839E6336BB3578884532EEFB06B197341D12A91AF1C715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933705, "uuid": "dded6fed-2118-4e5d-8158-cd3b6b85c51f", "value": "6dac242c8a70dfff85e851e0f9e6f899", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933705, "uuid": "2721fddd-54c4-4837-b4b5-f52a66ffbcef", "value": "98304:kEGwOF3ekG72b817wie/sKaisP+sL5H4ZHsj/1G7Kxxz:cOefsP55R/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933705, "uuid": "6660990b-1403-4665-82bb-38cd42bbc66c", "value": 5867727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933705, "uuid": "04cdb9de-194e-4fdd-8f31-72f66e831a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933705, "uuid": "dbda62cf-bf46-4de6-ab08-160612732d1d", "value": "vddddddddgffg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddd4be7-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748930886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930886, "uuid": "9d8084eb-2521-420b-815b-12eae6f800ad", "comment": "Malware payload (RemcosRAT)", "value": "be68be77ff9c8cf5262fb88e943f8791", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930886, "uuid": "07101173-b60e-4152-9658-312468647fca", "comment": "Malware payload (RemcosRAT)", "value": "6eb43acee1a24c77add6950924f499924963944150491a274e7c3561333ba736", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930886, "uuid": "5531feda-99ed-4c1b-a481-41a2b4bcf17d", "comment": "Malware payload (RemcosRAT)", "value": "ebb28b71baeb17d673e8a34e7837efbc66fb2e78", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930886, "uuid": "891cb954-0f37-43aa-895b-9b6eb197a0f8", "comment": "Malware payload (RemcosRAT)", "value": "c2c8c07daf45b7b2f0071e2c9dd57abf1c6724d55f5f3b3744dd3a4e1aeea631b16b3badb11c633b664284377ca247e1", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930886, "uuid": "2ebe8d38-dc96-4260-a902-b4204eb541d4", "value": "T18365F113A9188742D02942B8BE430DAD1F456E1CA8C579AF305F7E8B7FB13720D9E52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930886, "uuid": "d52fc7a8-6500-41ce-b9ea-9ed4fe218462", "value": "24576:2+sYEv01gbz52s6AP8P9U8dYGWM+qBlfFIHBYUsmGVmqKJja:vsK1gvxlK9U8eGWM+q/9G2UXXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930886, "uuid": "a42e78df-7000-4f64-8dc3-5517b27427bf", "value": 1447936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930886, "uuid": "d4587524-5998-4b8c-975a-3e59d07d1de4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930886, "uuid": "9a727d41-d2fd-442d-ba44-5d2a40d67e77", "value": "Narud\u017eba.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c0d1ac-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (StormKitty)", "timestamp": 1748989182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989182, "uuid": "e1b66126-8284-47c6-9a3d-8c7b07d04159", "comment": "Malware payload (StormKitty)", "value": "cef5083e567b611df0a4f867b31a2492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989182, "uuid": "25864631-08e9-4dca-9f11-49f2c100ad06", "comment": "Malware payload (StormKitty)", "value": "6eb703d42a766e8c41a158eec41395d7a56e7ab1a5f6b79b308c6e32bc09eb55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989182, "uuid": "1c0a847d-c503-4b78-b84b-ebd877458083", "comment": "Malware payload (StormKitty)", "value": "46f391b9eaa63e47b1365373e3208bd61a7a7293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989182, "uuid": "0b284384-403c-4d30-bfcf-fada69028c99", "comment": "Malware payload (StormKitty)", "value": "5de9ef508f8221421f1bed107a97d1e4cc42e3276b5762832eeb7a1e0dcc76013a01106847677ca00922d85b977687df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989182, "uuid": "7be7185f-191b-4285-b9ad-32281348625f", "value": "T19C8318892BEC9711E2FF8ABD997142145730B0976D22D70E1ED5A18E1E337E4C908BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989182, "uuid": "64238aa4-da57-4532-9b5d-5476bf201987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989182, "uuid": "5fe07f3c-34fe-47c6-8ca7-48e5d2804617", "value": "1536:g7ga+4vv+6V0Zgde+eboQ5uqSBSu1dJX2cT2qvrO7vN8tSIaBZBI:st+4vG6V0gQ7SBSu1fX3CqO7vN8tSIaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989182, "uuid": "3b7e0b46-84c8-4aff-82d4-7d8bb95ba0e8", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989182, "uuid": "46065941-10c3-4d43-913a-4238c1dcd7ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989182, "uuid": "aa5e54ab-8fb9-4d15-bf29-2e156f38abb6", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.24635.21783.2287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdc9fb0-408e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748964035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964035, "uuid": "b18c2e99-6d35-4c8d-a0f6-a54403cbdfbc", "comment": "Malware payload (DCRat)", "value": "aae3be8e5c8426e6b7972adc1d61a7eb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964035, "uuid": "d67fde7b-9717-4378-b9fb-9743c75ad056", "comment": "Malware payload (DCRat)", "value": "6f0d20e033f66c773a3e150dc1b336545b1818ada0f88ca62ff051df78615ac8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964035, "uuid": "75f9e1d3-aaeb-4c43-8359-a0801afba563", "comment": "Malware payload (DCRat)", "value": "92e17baf195cab109d23fec7446ea584adc40af7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964035, "uuid": "0af1627d-d515-45ef-839b-d987033b4816", "comment": "Malware payload (DCRat)", "value": "254f23f143dbbbda823b73527690c5182a18fc0b40d220dd604c2c71713f861436288dcc90ffab71b3b1c60ab03774c6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964035, "uuid": "fa37ccbb-f415-47eb-96d4-a0212e0845fb", "value": "T1C7A5BF5776D18E33C264177186A7523D92A4D7263A52EF0B760F21A2E907BF0CA721F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964035, "uuid": "c6f52ba6-ff96-40b8-a507-b83034c463b3", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964035, "uuid": "292ff43f-f0b0-4b62-b7f9-95b83cfecf3a", "value": "49152:IBJj/j2SClKhUia81YrQU3S40YUQS30nIXEo:yJ/UlM6JCyxnI0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748964035, "uuid": "fb523062-3818-41c2-b836-9e9821113bb2", "value": 2235203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748964035, "uuid": "bb006de9-2f5e-4fec-ad8c-be719a9954c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964035, "uuid": "a04c22e1-07fd-4e94-8c1f-39cf0840e03b", "value": "AAE3BE8E5C8426E6B7972ADC1D61A7EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0c615b-4092-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748965916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965916, "uuid": "ef746105-2ee9-4912-b1bd-0f7c890efc50", "comment": "Malware payload", "value": "530930f6dd8e9415570ee53159bc4c2a", "object_relation": "md5", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965916, "uuid": "ca10326e-7fe4-46b0-83d8-c7d9999a02ec", "comment": "Malware payload", "value": "6fa549f446a541856784695db808de2e5c67da271c64ecc966c7c0b02622d58b", "object_relation": "sha256", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965916, "uuid": "7e0cb5cf-f9f4-4f0f-8bdd-83853b9c8979", "comment": "Malware payload", "value": "e0fb15660965945c8e36e5e039d0e00d8b47ab32", "object_relation": "sha1", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965916, "uuid": "28558c4d-0880-4e8a-b256-79ab618ed70f", "comment": "Malware payload", "value": "5868ee5c528cb7e33c2f15ebe636107bd8e250cd6391b23e66a5d7bf8e69af66bf1f54dda43252eed109dd5342b22b0e", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "classroomseven-com", "colour": "#FF71B6", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965916, "uuid": "94473d90-1a66-42dd-b864-07c56ca6a94d", "value": "T1AD43FA7403E0AAFAD11893D5D6B1B47D1EBF95F174442EAE57D23EEE8C04D930AA480B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965916, "uuid": "11899bfc-3a7e-4437-a9f4-06c8812c036a", "value": "768:lkqMKtEaIFlC1mgT9QX1VgvcmhWln7hGRyjy2/RmlOUOBr/sA6deV0RKe:+qMKtLIFEfZvdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748965916, "uuid": "6bb820b8-f92e-49b9-bf34-c52d28244df9", "value": 59994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748965916, "uuid": "615ea7f2-18c5-4fc9-b35f-2c58dec93631", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965916, "uuid": "55ae7a6d-5906-4593-abc6-73c399f5f89c", "value": "logs.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd32fb36-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929006, "uuid": "bd9fd65e-173d-42a9-9c8f-08faea05ec87", "comment": "Malware payload (Mirai)", "value": "2543ee8229dfaf2866c1c5574c652835", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929006, "uuid": "a0383ce1-4625-44c7-abac-c8491ba9069e", "comment": "Malware payload (Mirai)", "value": "6fbb1fae8a9b1e4ca46b961e14bb2d48069e85a61545b141d76d7cf6dc6442a2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929006, "uuid": "87d17ad4-2599-44ff-8fc3-cfc5630ed084", "comment": "Malware payload (Mirai)", "value": "de1fdb4e5cefbf95185f8ad536c6de02fb0ae085", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929006, "uuid": "b2918015-3190-4485-a759-8d00e2dde80e", "comment": "Malware payload (Mirai)", "value": "1f89200c0f69c44f749de505d38c5bffbf951257558e1d67c239f94f91e3a98f118b8f41e3896c948bd5f2bb4790668e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929006, "uuid": "dc4ffbce-850a-4099-b8d0-b7b42116f4ab", "value": "T11901E3EE16D12776905A9DAAF0B18906A04EF7D536B40F0CF4C938F60F89908B805F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929006, "uuid": "76a9b18d-3365-42ba-8761-87a8c556885b", "value": "12:QvJXOpue8f+AiJKggrWKIw+Yw6hXOj/Kwvc0LK71:QvZi4w3RjeXOji6fKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929006, "uuid": "62e595fb-c383-4423-9024-f7e03ff04c21", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929006, "uuid": "1a30b9c5-5d79-4c95-91d2-da9008a1e9b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929006, "uuid": "5f674508-3759-4063-8ead-c5b563a85c05", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4c6f96-4089-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748962133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962133, "uuid": "2441ac89-bcbb-4f73-a99b-7bb258efef55", "comment": "Malware payload", "value": "4dc85b045597c63a9486f2db9d20c228", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962133, "uuid": "07277495-d878-4f5d-b57a-af441b38c0fb", "comment": "Malware payload", "value": "7064372c6b66c544d6b66ae10da633c7dbd909d30774b97fa40980ae1981e9d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962133, "uuid": "81120443-f959-43c2-9e79-bed18f51c0b9", "comment": "Malware payload", "value": "d5c09571091fd14c1da92138ca964293f6edcf3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962133, "uuid": "30e92f0f-b559-4592-ab80-4a5301077c27", "comment": "Malware payload", "value": "ab2767ef9221eef74d3ec55d889a3a89b2c4354f6680908776aade8ef80cfd90a6c1ead86a79cb0c21a1a00eb4362b65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962133, "uuid": "fbad6973-e5ab-4fc0-bba0-8e004d529b59", "value": "T194A41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962133, "uuid": "57f5ada5-bc62-4091-af70-6995a91043fa", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962133, "uuid": "adbd0b41-2e33-411b-9e5b-2ea0cde24a93", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962133, "uuid": "4f624434-9d13-4e79-8282-921780c0ae9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962133, "uuid": "fd4c2ded-be3e-4b1e-8390-0858738cf706", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb11394-4072-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748952284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952284, "uuid": "a691b4cf-9d7b-47ad-93a2-35fa9ca4753d", "comment": "Malware payload", "value": "190b93da3d68534225f8200bc8300e62", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952284, "uuid": "bcb1f2a8-9ab6-4d7e-ba28-1f12b3ee2743", "comment": "Malware payload", "value": "727911123c9cdcef6aa9fb32ff5656b31a793a828097c5d5e00661696cfbe540", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952284, "uuid": "c2c483a6-e4c9-4e25-8069-f546fa19ebf9", "comment": "Malware payload", "value": "103dc98985f8af4f878a867147c76d5765efb254", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952284, "uuid": "1c794ac3-e907-4f2c-a096-5455a09e7b72", "comment": "Malware payload", "value": "f2f6dfcc9738f609bb8a2fa61afbefaace1421f798f833529097288a4f3f84a53b744a6b47c3e1e0373a86afdeac5e50", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952284, "uuid": "564ce45c-4512-4108-94fc-898de60a134e", "value": "T13DA2F1FFB019A133995E6833FEA624B66D57047B197D82AF93B89012559C3BC5F000CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952284, "uuid": "37b1e6fa-f688-489e-b108-4e7e304fabb7", "value": "384:ptkwlR4umB/f7V6mMHkXogFcsCwEdiKSfCZDsrNEmAf0qOK5bOwm+7mgdNYD2q2F:pAusHQ5HyCwHKSOD1TfcK5bP7mmo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748952284, "uuid": "b479ebd9-50fc-4cc6-b23d-f146c72f4991", "value": 23002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748952284, "uuid": "d8646d0d-49ec-4b9c-8d1f-66155063b7b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952284, "uuid": "4fb678cc-270a-46b0-8836-54fce8c897b5", "value": "727911123c9cdcef6aa9fb32ff5656b31a793a828097c5d5e00661696cfbe540.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75eb5e2-40ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748977610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977610, "uuid": "bd7225ea-feb8-47f4-87f1-830813734711", "comment": "Malware payload (RemcosRAT)", "value": "a41f99398f3d8bfa83faee2439e4bd3b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977610, "uuid": "9a08f88a-798d-4a67-8677-917c1222359f", "comment": "Malware payload (RemcosRAT)", "value": "72c94eec24ec8f265f2fa9b7df0e0795e261df5c383ca245bca80247f29a4219", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977610, "uuid": "683141d8-2970-44c7-a662-764a703a0025", "comment": "Malware payload (RemcosRAT)", "value": "9616a1a6d8bcee83fdc2a1d6d92c48a0cbbca46a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977610, "uuid": "4d54c7f7-1268-4d42-bcd0-bfb8d50d4cc9", "comment": "Malware payload (RemcosRAT)", "value": "3d8972a6661c6249a4b1af78d8a427ee6a11f8878544d57b2b23a42a0242563d1321acc1d8b7306ed9f2b686adf0d465", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977610, "uuid": "6a2ece5f-eab2-4f82-8825-c1d4344a85b4", "value": "T17C9248A6C7BBBD86CC53BB2EB57C6324015D082EDDB9C8941A51B00698E8709F5F46CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977610, "uuid": "be56d05b-99b6-4f72-873d-d00addcf14cc", "value": "192:/rtEid35EiVnxQhGrGyQfvqzgTiCjEiWhs0:aiwiVnudBUic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748977610, "uuid": "1d408018-b93c-4f1d-a519-beb4633d8d6c", "value": 19607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748977610, "uuid": "e44e17e5-0473-4598-b51e-4d22b0237337", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977610, "uuid": "6671a9a6-fe57-46ee-bdc5-33f9ec636cd9", "value": "bestgreatkignbacktotheearthwithniceprotocolstartedevenbetter.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6073db8c-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748961063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961063, "uuid": "e0afb947-bbaa-4ca1-b64d-39584fb916bf", "comment": "Malware payload (DCRat)", "value": "a6c2139971fd8fed7b6a581409cf57fc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961063, "uuid": "7cb8c6fc-57e2-4951-af29-e3bd3e75416c", "comment": "Malware payload (DCRat)", "value": "733eabdf4afd51ee67be1cddfbad3e8ee28e8503ad5ee091a131ca7fe87e6918", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961063, "uuid": "d34b7ffd-f8e5-4ccc-9882-c0f149233f45", "comment": "Malware payload (DCRat)", "value": "ae5dfc9fcb42d954c0a10f17866487c194cf6a62", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961063, "uuid": "555c4a85-9215-4fe1-95e8-5166af9ade48", "comment": "Malware payload (DCRat)", "value": "10520162c07982ea0762ab32cca5520118d37e49a6d16b893c04831dab83b161e16f0f81c59913cbac69bbe0e7a766fc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961063, "uuid": "e704fad0-689b-410e-90f1-4eef103887b4", "value": "T13D06F11679D24E73C26456318657023D5290DF657A22EF5F362F10A3A817BF28BB22F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961063, "uuid": "43e5c951-6ed6-4487-84b5-4497ee213942", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961063, "uuid": "ce285bec-8da5-48bc-ad46-b50edfdb808e", "value": "98304:yXfVhLyYsmUJ/bwbU6b/ATyQD8++6P7MI0:afVhSkb5/UySP7Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961063, "uuid": "10816258-b5d1-4fbe-a720-f0aee2a38d92", "value": 3941575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961063, "uuid": "f4b515d3-3957-4f05-948a-efef50f002ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961063, "uuid": "e36bb9d5-7732-49b3-a507-82b830cc8a14", "value": "A6C2139971FD8FED7B6A581409CF57FC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c0fc92-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748960885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960885, "uuid": "8e3e1f8e-4609-44a7-ab07-5086e10c7027", "comment": "Malware payload (Mirai)", "value": "a0059f427c3b3c74e1019df3493e42c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960885, "uuid": "fc6fcc92-5613-4e42-ac5e-3c6f0e6c9013", "comment": "Malware payload (Mirai)", "value": "734582769b106db0b72df458df4ca432ba9aad6fe0584b20015942feb3816507", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960885, "uuid": "373b7890-f06f-4a06-9be8-7b6d189a70ce", "comment": "Malware payload (Mirai)", "value": "8962684d5b731a685ec077e8409fea97dd04fdc4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960885, "uuid": "dc64ed29-3f5a-4ba7-89a4-6fd8ff1134b7", "comment": "Malware payload (Mirai)", "value": "fa1b2cdebc3b94d3a5ab2d3b16136030289a4421f6a8aa5f909f3ea19640a0d3a02ad9f085809f08e1792bad9b718210", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960885, "uuid": "9034b113-9d42-40b5-937b-2e4e0eed6bb9", "value": "T170F2F1BB13AF3DB4D6718A71D93447852973792590BB303AAC148518C1938191EFF79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960885, "uuid": "1fd24e42-8859-4456-a97a-32a6a091ba06", "value": "768:IrTDP2SXcpwPwbkZdwHLVoeNa+HAa9HM0mFyKYs3UozA:wOSXcpjHHgalxvEzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960885, "uuid": "0406375e-847e-4dfc-af56-ac6b98c98d4c", "value": 35260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960885, "uuid": "9151d6db-00de-4ba6-847f-c7457d971e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960885, "uuid": "7b9e6b5d-d2d6-4c71-90c6-69ffce3649b4", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ede863-4079-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748955035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955035, "uuid": "aab1dccc-4bb8-4a15-bbc3-a8230b050bfd", "comment": "Malware payload (ValleyRAT)", "value": "9b87050bd4a3c3debc455d5a8f464318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955035, "uuid": "a20b6ca1-1b89-4668-ab76-34c32fa86427", "comment": "Malware payload (ValleyRAT)", "value": "7387b8befb827e766dc8eb0efa0642fb9817b759f48886eab217c438b58c19a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955035, "uuid": "4a6a48a9-5ff1-4df3-9e5b-d261e21e39d9", "comment": "Malware payload (ValleyRAT)", "value": "a366f998b6bca440629cd137841701f50cf0964b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955035, "uuid": "ea85a4c6-9fbd-48c4-bd1f-4cff6fbdf3f4", "comment": "Malware payload (ValleyRAT)", "value": "1411beaa370e47fc028841d7399a1e3472168dc7deabdaf10ac4784f17cce935c380653c2a457dbed54e6d4c3b29526a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955035, "uuid": "275cb5b6-97f0-4d42-b0ba-b46a069a26ca", "value": "T1B384AE167AD1C973D66701310EF0CB7CBA79BCC40E32DB8B63E88B2D9D71A914625762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955035, "uuid": "fa541b9f-ab63-4b7a-89d1-e85d410ae197", "value": "1bc71e520f018bab1ed4ed22f2f6cd13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955035, "uuid": "3e7105d3-69c0-4013-af0f-1d0e38ab4a62", "value": "6144:CuT6ng+xyDZaoIET4PAYA7UA5wCR4gjKRVtyScN5bbjzlBkjvNwfnoAz8H4:CuT6nzyDEoFT4PAYAwts7KRVtyzDbbd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955035, "uuid": "d9f9b68a-9965-452c-86fc-c8ba6931ff0f", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955035, "uuid": "edb06e1e-f4bf-4c36-8c15-992af88e17c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955035, "uuid": "84d8dd8d-f967-4fd3-8913-a6f3cec87b6e", "value": "9b87050bd4a3c3debc455d5a8f464318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d92f70f-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748995069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995069, "uuid": "9a8dfbad-c8dd-4d8f-8c25-b55985eca93c", "comment": "Malware payload", "value": "c3a2b937ea884b0bcbe0de64b3db8c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995069, "uuid": "d0d90366-f285-415c-99ff-5a756435be17", "comment": "Malware payload", "value": "73d855d8aef7bd008a1a257f0af3934b71d5268191cbf1ee44adf0fc9bcc3da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995069, "uuid": "7a5aa8e0-597c-4e03-84be-4a00ed1bff2f", "comment": "Malware payload", "value": "404052f5e5d3f4bf955e998975d51128b2301805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995069, "uuid": "1f0c6355-6405-4d81-9967-a636c45b1690", "comment": "Malware payload", "value": "aac352fc07bdc832c3b348e2a069105afedc0d87e93a9faa2999a09ba946db58b49c74b5c1c11a6144c3e824bd9162dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995069, "uuid": "16a2f490-3fb6-4d9f-a8c0-4df26293ed89", "value": "T1F19319023BE9196BEABA8AF94972551007B27D271822D6D97CDD31CD1FF1B040BA0F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995069, "uuid": "33fd5da2-a4fe-4ddd-86b6-56a5e63e8a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995069, "uuid": "339a123a-a76a-45ff-8bbd-907d8959e5b4", "value": "1536:PUmJR7otImwGBbHFzQ925SRSuamsoxiMao:PUkKtImXBbHFzk25SRSuamsoxic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995069, "uuid": "9869c82f-f100-4bec-830d-82565224b701", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995069, "uuid": "989f9437-fcf4-433f-be83-f9256521ef10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995069, "uuid": "25f1f0d1-5afa-4687-8efc-186a0c91c39e", "value": "SecuriteInfo.com.Trojan.PWS.GrowtopiaNET.13.29249.24024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835e960b-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942653, "uuid": "f723391d-f133-456a-b2a3-cd20662481ba", "comment": "Malware payload", "value": "2cc42f22337c889b48c2e66914a467c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942653, "uuid": "fb5c4ea1-6697-43cf-b0b5-45779241011b", "comment": "Malware payload", "value": "748149df038a771986691e3f54afea609ceb9fbfcbec92145beb586bec039e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942653, "uuid": "c2a8f743-b070-460b-bdfa-7eb020a2f2f0", "comment": "Malware payload", "value": "e88d4e87d63c2ea59686e2766c66e9f5f1a6b43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942653, "uuid": "3a218d77-c91c-431d-bb54-fbf163b6c81a", "comment": "Malware payload", "value": "def8c5f5bc3607fd0cb2615383840055cc27145cb5553e3f5ca40ee57c7a587f35d92d7c6bbb78e8d50213558fc67416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942653, "uuid": "5e45954e-035a-495e-917a-96337362ba67", "value": "T1EA26AF1A366481F9D077D17CCA4B8B86E6B274064F328BCF12A4435E2F67AE54D7E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942653, "uuid": "1b5541c0-1c43-4303-879a-72cd76c411b9", "value": "9e23016739c13c78b6d189b7c35f49b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942653, "uuid": "f06f3934-908e-4793-8a87-ae5377bdf08f", "value": "49152:N4SJILZII3negY0JNv36BWu3mXzHkxnKrqIt54HtCyDcTeui4xtm+SzO1n+OIvC8:lMpnegYyBttM7sH1+O4CfbhU2Ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942653, "uuid": "3cbfde36-afb3-4407-a1df-41f27f6ad866", "value": 4434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942653, "uuid": "4c4f81f2-520b-44df-b1a1-96270f4cd419", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942653, "uuid": "0a8ce948-061e-423c-91ca-9deae93e429f", "value": "748149df038a771986691e3f54afea609ceb9fbfcbec92145beb586bec039e6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc766a6b-4019-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748913999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913999, "uuid": "9a39683a-2cc1-4f99-a151-fd7225373930", "comment": "Malware payload", "value": "27ae400f60c2850f18178976841c5278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913999, "uuid": "c3f8391f-1f9c-46ce-b9fc-bb9ddf0d3f57", "comment": "Malware payload", "value": "74adbff887ff9849339a33472e0df0cbb3d87af145e78cdc5b7cc263550faf4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913999, "uuid": "6bf1be62-8851-40a0-b3cb-04c9566a772c", "comment": "Malware payload", "value": "6da43eae03ea2459ee4235fb4e45adae13aab769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913999, "uuid": "014f17bd-e0f0-400a-a670-ecccba2d7225", "comment": "Malware payload", "value": "dc1db341b447a0e65fab3361f3fab6014200ca0dee075f088d343d3f99adf428b307e3669bd666f733f13e7721b62fd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913999, "uuid": "91eab857-ecbf-4fe5-867f-86b748b514db", "value": "T1B3F39585AFA13FBFD81ECD3341959B0A029C4A1A53A97F7B6A34E404F64614F49E3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913999, "uuid": "167d3265-d7de-4f04-87f4-ae66db0a1c64", "value": "1536:vxX/u4NkV+J/HcPvS/87eo+jVWjfTAqOY/G69AsElA/rsbDr59n:vB/xksdcPSUAYjfFOY/G6hr6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913999, "uuid": "8a0dc6c0-fc81-42f4-9252-e7f38392485b", "value": 161648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913999, "uuid": "59c38ce2-e875-4b9e-9d96-be6da6a05582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913999, "uuid": "6cb4da7c-2301-4bd3-be55-ab693c69a283", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5558f168-403b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928402, "uuid": "e33bd728-9388-42a7-bd9e-071592df4eef", "comment": "Malware payload (Mirai)", "value": "c21dd3673369091f43857d0027190a72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928402, "uuid": "8381661e-34ee-4d0d-8d85-70b77998745f", "comment": "Malware payload (Mirai)", "value": "75efeee0bff52f6c582639fecc81973aadee3cf342b9654703f7bea30eda5db7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928402, "uuid": "ae71e879-c6f4-4c36-af51-0a2e1800a25c", "comment": "Malware payload (Mirai)", "value": "cde2023718ba1ef3892e89fda71c3dc7ac1addfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928402, "uuid": "55b4da54-25f0-495b-8555-d0bc590efc3e", "comment": "Malware payload (Mirai)", "value": "604ee54deb9a3b1abaa8351ede4525b9865ed42db279b8cdcc50c8c75eec65a50fb34302746bb849764246f25456ff33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928402, "uuid": "836c95a9-1a8f-4c09-af3c-d2010f24cb91", "value": "T1E783F696B8819F12C6D066BAFE1E41CD33231FB8E2EE32039D156B2477DB9590E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928402, "uuid": "e68cd7a3-8a61-4add-a212-b789f7920d56", "value": "1536:eDn8shd3inlb/AE33MXqkQWIY0e35O2496JNDM+J54YzGYhQmZG2n:9shCl3O1i2m6p4qDM2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928402, "uuid": "f61f2452-ca04-45fc-8885-ce92817633cb", "value": 83140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928402, "uuid": "ca66a432-e5a8-40b2-85fd-3dad2516697c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928402, "uuid": "fbc93bef-02fd-4fec-a80f-7bb10edceee7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c4ac44-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748931299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931299, "uuid": "581d0a79-d39d-4b4f-b225-0b83d45f88a6", "comment": "Malware payload (MassLogger)", "value": "100df50eec0c7d4471cb94c2f46df1d5", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931299, "uuid": "de13a730-ba95-4f7a-9105-6f2a14b8e4ab", "comment": "Malware payload (MassLogger)", "value": "76ce7bc5ec0d94a61f8613b44ce0450f71e1085d48e5e8175b50b7925f45d733", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931299, "uuid": "84f0abf9-d50b-474c-8cc7-c817f9e1a99a", "comment": "Malware payload (MassLogger)", "value": "7d0bbca55f58c45f344a6d78cb6da8b6d1083fd9", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931299, "uuid": "a536c4ed-d7a7-4427-9da0-a36f90ddf55d", "comment": "Malware payload (MassLogger)", "value": "c2b03537d8b6c653669607202dbbd8fec6bfce63fe2eeb7ad8502e89d7782cedbc674012150af85d95ce71a02f45e813", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931299, "uuid": "c9ace9ee-2c93-4802-83cf-c36da5a00400", "value": "T11135B35D907069D2A014FEF4F551AF97CCDB239416278A021FD5A1AD23268C3FFAB2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931299, "uuid": "796a42d7-f64c-49cf-b503-e38eb74e1402", "value": "6144:ePV4j3/OHcI3AcKRLvcpxNzLlu219Sm1XyyH97bSXZtFu/ScszVm9V4Co6ZM7SQZ:2VJgTEE2D9IChVm8L+RP5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931299, "uuid": "5e90781f-b1d4-49f6-94b1-1d51271c6204", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931299, "uuid": "bc4e7f13-09b7-45e5-b090-f7795ff8366b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931299, "uuid": "e3dc9df6-4bdc-483f-87e6-04069cb25851", "value": "to66500213.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f4e072a-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928714, "uuid": "b36f492e-446b-4e95-8b74-152211d55c89", "comment": "Malware payload (Mirai)", "value": "4981328621134552be6f21bf22853c44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928714, "uuid": "1388e21d-0679-48ed-91d7-c22031b60966", "comment": "Malware payload (Mirai)", "value": "771ae6fed7e2189398e3120af61235f4bed7909e51a6a888109598ba16ac3c85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928714, "uuid": "2bc4bcf6-8d26-412f-9682-01c54500a9ac", "comment": "Malware payload (Mirai)", "value": "4dc590cd796a161f7e579638f62ce45e993aaf75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928714, "uuid": "45114d17-702d-48b7-b4d8-8f1490d462ad", "comment": "Malware payload (Mirai)", "value": "a00eb4e04737e7dd2005963734eaaa0cacf9edaffb405102418e00667f6d21d618ad2c2a0d970ec8b5fb2891325c7c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928714, "uuid": "3704ef0a-0bd8-4852-90df-58b342fbc15a", "value": "T12CE2E171A285FDD3C170667EE57A0C4573A24BB998A13E389F6017F27D8720925E0DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928714, "uuid": "43a8caa7-1d2b-4bba-b9fe-3b627eb38ed7", "value": "768:Cg9+j56yl5l72ZGzYjmntf8NUeX3bs3UozF:DS6yx72ZzynyNUgGzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928714, "uuid": "4e900baa-5364-49f0-8679-bbd57b33540e", "value": 33644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928714, "uuid": "b2d9b30a-2551-4de6-8efe-9a3f2186281e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928714, "uuid": "3e428c01-5dc9-4352-b858-c194d11b9f11", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9edfa9d-4062-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748945348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945348, "uuid": "4d024d75-ba8d-4df0-a3a3-7d05e841b0aa", "comment": "Malware payload (LummaStealer)", "value": "e9b4da25e40f6c51c6b10b859d670deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945348, "uuid": "13debf83-35ed-464b-b8fa-eafe24e5ccb7", "comment": "Malware payload (LummaStealer)", "value": "7731b30073fcad7d3af24a1e36afd28959504bc656c8374d0cc8cf50b70c4318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945348, "uuid": "1e11e18f-c91f-4335-b4f5-7b38bb6c6557", "comment": "Malware payload (LummaStealer)", "value": "c55747103162e040f9727ad8f5356cd2961650bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945348, "uuid": "371e2692-63b2-43a4-b09f-05f68cc4e215", "comment": "Malware payload (LummaStealer)", "value": "754905dd28b3a5550f891b98fd3e51d427ecc8e1e91a870bb89ec0833aeac07428bbac1b94308c64b8b53c2a25ade6f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945348, "uuid": "5c8cc13d-46d2-480a-86da-a9b30bf78491", "value": "T1F4853360FA8A8D64D2CD49371C9FC156F3B9FE8F35ED8D629A3BB117985210E164A0C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945348, "uuid": "25a0e527-c009-4298-b8a7-253a7b1e0caa", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945348, "uuid": "cea51ff9-2974-4580-b1d2-b0174bce3ba8", "value": "49152:jDsv9xtSS/FzP5jlGMKelEuzk+dvqhUswQvusArQ:jIYS/LlEck2CWj+uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748945348, "uuid": "1f558209-a37f-4556-a63d-3b8c0bae40f6", "value": 1846784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748945348, "uuid": "0fc1da28-09ce-40b2-ad78-47385bb1d8ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945348, "uuid": "8268fe45-0370-4be1-9159-cf3e498ae7fc", "value": "e9b4da25e40f6c51c6b10b859d670deb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2bea0c-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748934831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934831, "uuid": "8d97e09f-e98c-4e12-a02e-6a4373aae7de", "comment": "Malware payload", "value": "f1334a148dce307118eaa5ef20320f5c", "object_relation": "md5", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934831, "uuid": "47a7f351-2e3c-4185-a1c0-60fab859ae30", "comment": "Malware payload", "value": "7771165ec4443d21b87217f615de309ecc2c21938bf198ef18385e5360e2e8ce", "object_relation": "sha256", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934831, "uuid": "a7fcebf7-a688-4976-853b-4f1be745552b", "comment": "Malware payload", "value": "14eae30a5f5a1839bc81cda72908e0b2db8336b7", "object_relation": "sha1", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934831, "uuid": "430b71df-48a1-49ef-bbef-182cac2d8d73", "comment": "Malware payload", "value": "23a1610be84d1e58c21bf0172419a416dafc6fecfc2c592147514e4526c1fb33b87038ff9022aa0054a3c64a058ff097", "object_relation": "sha3-384", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934831, "uuid": "ba913364-32e2-42ea-bfec-e7030749805c", "value": "T17BF020B67641F69078FAB1069C40668A231CE0C12743F9EC591CE34B34ACC6FF0CD454", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934831, "uuid": "982f6e72-d208-4e2d-bb6e-5a429335223e", "value": "12:bnPddM9XNW79a3T4roQv/Ck3RSzcYVJ69+hyJjCP0bFYmmfd8wCYhV4lhyt3mAXL:bPzM9Xw79eT4U2/lhSzt69umOeFYmm1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934831, "uuid": "9d0538d2-c13d-4d8c-b9da-40c8a814ab6f", "value": 586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934831, "uuid": "52c5fdf6-d684-44c5-9065-a8d75e0c7c1e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934831, "uuid": "8e09ed22-5a98-44d9-91a9-fc1d835c8ab3", "value": "1tronbat.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2598990d-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956669, "uuid": "3f9c07d8-8f4b-4a84-b5cb-3c2769ef0eea", "comment": "Malware payload (Mirai)", "value": "93b13c78f6b776567b7d801da7599f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956669, "uuid": "77edd625-bbc3-40f8-86b0-3aadbc46d5cd", "comment": "Malware payload (Mirai)", "value": "77895de7162ea9b53596ecc0b2efdf671440a510406d49e9a2149f8e331b2140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956669, "uuid": "ffd9564e-0ab4-40b5-97df-c6d2c96a6d61", "comment": "Malware payload (Mirai)", "value": "ee4b6a451c76319c961ecc32dd68bc4ee3e11671", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956669, "uuid": "2319ec53-9057-4025-84d0-717c7284d73a", "comment": "Malware payload (Mirai)", "value": "53c2e8e30d07bb19e8bceff97060ed3fe5be0571a136687ca62fee1356ad3ebf90a1320e886c2d1a196755fedb861db9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956669, "uuid": "403e18f3-afc3-4506-849b-ab2b39cf176c", "value": "T1D8D2D0B91B0A4B9EDE9EC8F6C3E413A019660E029903FD4674ECC747675B9C0A147ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956669, "uuid": "dc8b0ff7-c51b-4a75-9f9c-6341c020c242", "value": "768:/xMWBhAHuLegF1aF4NscfOl8liVNOJgGlzDpbuR1Jo:/xdBGuLea19acfjliH6VJuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956669, "uuid": "16556e61-f46f-4097-b35c-af280b77459f", "value": 29412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956669, "uuid": "f8a8cad6-6fe2-410d-a9c4-6e51aa85aaff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956669, "uuid": "0d17d8d5-e484-4d1f-b92a-c5b7e1925fa7", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadcb2cd-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1748934612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934612, "uuid": "6439b9d7-ed33-411f-9fa5-be4a24642a03", "comment": "Malware payload (njrat)", "value": "2196bd21daa7869985a2ae611d0cfd98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934612, "uuid": "55240a13-838a-4a5b-9bb6-b338ff5a744f", "comment": "Malware payload (njrat)", "value": "79012a5b5aa4bc96460ca4927c0142d7c2ccac1abb9b90648007a90635f01a9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934612, "uuid": "f97b1ede-9a64-49d2-8e95-274d6e44f797", "comment": "Malware payload (njrat)", "value": "00a0336e564a34fe7a851c1da4379252bf504c5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934612, "uuid": "8da09014-5478-4a4b-a0b6-4dc258645653", "comment": "Malware payload (njrat)", "value": "0e87f2cf6b0ce28c1fe7b4db8396c95dd3301d8ca2d55d9de40de7a8b9a2822bb20669aeb971f6dbdf66e1f48c092fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934612, "uuid": "4bf33d48-2304-4768-9dc4-4b0d4f706468", "value": "T10BB22A4E3FA98856C5BC17748AA5965003B091870423EE2FCDC550DBAFB3AD91D8CAFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934612, "uuid": "a4c29ca2-8581-4426-8c2d-59eca7c7429e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934612, "uuid": "8422d0c6-b0b3-4dd8-b8c8-d7cfd8fee2c9", "value": "384:CQ+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZqW/:9OaxVULRpcnug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934612, "uuid": "5a8a6dce-9b0c-4c2a-b7d0-fb432f7db844", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934612, "uuid": "41baa61b-07c4-4fd1-a56b-49b31d4836f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934612, "uuid": "82f5c700-2c59-4f55-a648-8a94fd43ee91", "value": "79012a5b5aa4bc96460ca4927c0142d7c2ccac1abb9b90648007a90635f01a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1eaf0f-40a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975393, "uuid": "ba81ae6e-b495-4ab3-af46-6bc2641538ed", "comment": "Malware payload", "value": "bf46c9169ce2d600b0670af8c7deae6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975393, "uuid": "08c06d38-45e7-42c2-a291-81ecfc0a2896", "comment": "Malware payload", "value": "792d2872a5fb4791b718d9832b8e0491dd06804706d3be8085eacb27cac3cc83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975393, "uuid": "a850d57b-9ce5-498c-9385-08fd3a072e40", "comment": "Malware payload", "value": "0b932268131840727831d486581d74a3d267ec8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975393, "uuid": "0895201c-2b2b-41c9-87a4-fe7f1ab7e901", "comment": "Malware payload", "value": "a8ca19a349431193c7c54fc1ce9122e6840f6a5ada48313972c52683d1bb60cb0dc6c87711ab3ca77dc43fbf550d4160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975393, "uuid": "e6a0320c-dc63-4b13-822a-d445de8bed4c", "value": "T1BC85AE399152A2C6FC2A40B601B1A6D93462B733C62D2FFF4290F233AD17BD11E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975393, "uuid": "098c6fc8-f8da-499c-a40a-0d34b10f15d1", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975393, "uuid": "445503fa-73e0-4353-bf3c-9fd868f28ab1", "value": "49152:FLA3ibXDk1re61S7pGczY8my2zLZ3f4Evey2zLZ3f4Ev/:FLA3ibXgTS7s5P3ZwP3Z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975393, "uuid": "bbe9e01a-8bb9-4b7c-ad69-faafbf446d60", "value": 1768960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975393, "uuid": "53a88a07-8ba1-457e-82dd-f1def5c6ccac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975393, "uuid": "b673c000-9cc7-4753-8d04-8e2bb857cfeb", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2d3f74-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932093, "uuid": "49198ccb-99fb-4f10-a423-17e0d267f019", "comment": "Malware payload (LummaStealer)", "value": "c022769c4bf04469907bacda26571ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932093, "uuid": "c00d108b-3b65-4c37-9c7f-55c3e1114a7e", "comment": "Malware payload (LummaStealer)", "value": "79604990a9e4c7cbb53a91775a5ecaf9dd3af1793e73d0aff34195ec0bc21aff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932093, "uuid": "9f1387ed-6655-441e-a1bc-9cc0c4b7716e", "comment": "Malware payload (LummaStealer)", "value": "3f205504cc6f074858a33d07b28c42c81d5cdb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932093, "uuid": "eafe8622-e0b5-463a-b44f-304c8fb024b1", "comment": "Malware payload (LummaStealer)", "value": "c565985624c318574f548c1a10a3735c8b0c138c8fc1aca3ede33e7c25b55b21747c37234e5081e9a3929443f26e7614", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932093, "uuid": "57930ed1-6b87-40c6-96b6-abd0f618806e", "value": "T12D853322763740D6C2441A3B9EB321DC75772C712DBBE29627A2A4B39737757B0CC885", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932093, "uuid": "814ddf1c-2a0a-4f45-b776-5410dd02268b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932093, "uuid": "5cdc4f63-c757-485d-91cd-b151134b3ef6", "value": "49152:bJZYmM2csQnLcIPSKqklMamixiSCWGI/q12rMisY9:7Yt2ctn9P1OixiSCs/qI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932093, "uuid": "7a5cec25-5434-4f99-a6cb-b188633a8207", "value": 1831936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932093, "uuid": "b327a315-fa49-4cf0-8cd7-28d015436e1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932093, "uuid": "510f0430-2bc1-4ad9-b322-2a8e31581992", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e891702d-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957855, "uuid": "65c9e254-3963-43ba-a682-38173c4a3133", "comment": "Malware payload (Mirai)", "value": "8d355d6cb3b828847567cab63f55f694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957855, "uuid": "12ea293f-ea20-46f7-b315-020728590106", "comment": "Malware payload (Mirai)", "value": "797b5b348ca9b2798b77f88836be1c076fb1208be554104ab7775c569212ca74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957855, "uuid": "a8f6bab8-8d55-402a-80ee-062356543a21", "comment": "Malware payload (Mirai)", "value": "654321de8d66510a1c3078186682b3bc86095237", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957855, "uuid": "fa6af317-bad7-4fef-bd51-8beca34d0755", "comment": "Malware payload (Mirai)", "value": "7e633d407b133b9e9936ca352d143eb02d9a45394707b86e3fcea4b1128f935aa1f49d1f8186dd573010b9f58c3cb4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957855, "uuid": "8f7b2b99-4a9b-43a5-b11f-778c64591738", "value": "T1CC431956B8818A15C5D413BAFE2E01CE33136768E3DFB2129D106F247BCA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957855, "uuid": "998bb897-76e7-4fc4-b539-45542617e825", "value": "1536:IhnrpffaOR0h5Ca6hKL6mVKGBiJ4NLKIViTJgwKWh:O3aFGaCKLr3BMJgwKWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957855, "uuid": "50ab2b9b-5f93-48bd-9a6f-672b9fc481c4", "value": 60036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957855, "uuid": "15e4c423-66e9-4425-a20c-3f1463651966", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957855, "uuid": "ffaf4755-1820-47a2-abf9-ad45a063d4ac", "value": "hoho.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7116b78d-4018-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748913416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913416, "uuid": "854fa714-cb86-4e0c-995b-6c024a28aac3", "comment": "Malware payload (Mirai)", "value": "a772d3b21f3d772131c6933a3bd8d6a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913416, "uuid": "b7b6db8a-67ad-413f-8bce-58c9c3f53d20", "comment": "Malware payload (Mirai)", "value": "79f6f50e3db4c73aec1ee4f782cd5fc55c6c5a8c2b37fcd33c6bfff58e187393", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913416, "uuid": "cdb54372-0baa-4c02-9fe5-ac358364ea49", "comment": "Malware payload (Mirai)", "value": "9b88bc3475474905db162c472fee542b44ad984c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913416, "uuid": "e2fff7cc-5cbe-4044-9ddb-f6a7af6e71b5", "comment": "Malware payload (Mirai)", "value": "c305b91f9c868e4923949bbb6364d838130ee43b946d2a86557edf1620ccaac8a1486b00f528013dedf324dc48c24fae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913416, "uuid": "e39751e3-282e-4ae2-87d8-87db78da0b6d", "value": "T1CAA2C0BAD1944B9DF6E7B8F4A808E3E737540EDA5E9BCE411A815F501612A33A5023F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913416, "uuid": "0e6e9dd8-0f1e-4cd5-98b2-0d2dcfeed692", "value": "384:8oFoPx0D9yyeMMafGafP2bq9F28phS1OkTDwH1gM4uVcqgw0Og724kmW0:8oFWeDUjMMa+an2G9Q8TS13Yp4uVcqgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913416, "uuid": "3174c7dd-c0e3-473b-b3ec-0690b217a5ff", "value": 22364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913416, "uuid": "3aaa6d64-3df3-48aa-803c-310f5ebc288a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913416, "uuid": "509e73a0-cd57-412d-a78c-5a59493bc715", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbca1470-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748931151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931151, "uuid": "25e02414-8c44-4965-a89b-868042bb032b", "comment": "Malware payload (LummaStealer)", "value": "edccae55ac54391ec79a660932003e3b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931151, "uuid": "7f9693e8-b727-4a22-9a7d-938a9071e8b1", "comment": "Malware payload (LummaStealer)", "value": "7a89a9385c255dd9416624225cc1526bb8aca5b7bf92b95f498088cb43d960e9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931151, "uuid": "61df64d4-835f-4311-93b1-d4ff2bfa75c3", "comment": "Malware payload (LummaStealer)", "value": "3837c4079d435c5e1a0a58ff1ef878b36e8b392d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931151, "uuid": "40f8cc4f-ada1-41f9-8f98-ab808cf6c330", "comment": "Malware payload (LummaStealer)", "value": "065f50970cdb5d9097130d2104fa62aa6d791a7dcf312310673af1a8fa66e211db6664b807639a6216c6207fac2bb582", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931151, "uuid": "6ed5c548-4bfe-4e9c-aaa7-8f272c80b875", "value": "T1103128340DF102FAF633C7B9ABF5B3B38521FAD2DD2546BD114162845621110F4A7E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931151, "uuid": "303b5328-a443-4a05-890b-c1f9389e2672", "value": "24:8y/BHYVKVWO+/CWylzOXqHUt7HEEihpcBGlsMbLYmvqarab/BiT:8+5aazOQUtwfhpLaMbLYmvq4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931151, "uuid": "13c3f199-7c1e-4440-bffa-ea56071f9429", "value": 1566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931151, "uuid": "c94b7834-294d-4585-b6e2-f63fec1fc4dd", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931151, "uuid": "556bab62-c03c-45df-aed6-4f914349b68a", "value": "UltraViewer_setup_6.6.113.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f79ed4-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989115, "uuid": "fa2e5594-7b52-409f-ad6a-3d388f79d5c1", "comment": "Malware payload (RustyStealer)", "value": "958c61fda427f766b68eef24628045ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989115, "uuid": "30ca0642-68d1-4de2-be69-f93e47c85ea8", "comment": "Malware payload (RustyStealer)", "value": "7c392cf78c58cfd2495757e147d61d56bff2fdd5ec7251f575ff3b3e7058ee1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989115, "uuid": "a1a02f2b-106d-46f1-a463-3166512fa008", "comment": "Malware payload (RustyStealer)", "value": "e634e35420cde773adde70e5d1b0d21689f8236e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989115, "uuid": "744b8189-f2b0-438b-8bd0-3b52c2a4ac29", "comment": "Malware payload (RustyStealer)", "value": "2202b68b263596e9d05b1b3d4d31283b622a94c3ec5588061e1e793c7d37ee2b207552f3d3d5f9ad332cdde32856ee12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989115, "uuid": "ac820e32-8cc3-4c62-b26a-696840ade2ad", "value": "T110D44867E2C01496C56ED075C71E41AB232EF4274F0B6BBA401562603D73EECAA6EF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989115, "uuid": "5a11df22-d5bf-4128-97ea-14501b76d92c", "value": "d16ddcb565c3e1ad6a5628add3fd21e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989115, "uuid": "ace9050e-9227-4f72-83c5-59b3e12d9605", "value": "12288:Uinpvyq2ZBg/oLDWOqbTqbAVNH7uO1GEzJ09LgnlP0M+T:UipvyqOBg/ofW7bTqEVNH7ZGEF0lu8MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989115, "uuid": "6690ab96-9b2e-49cd-b694-5bc458355c18", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989115, "uuid": "4a822c6b-7fde-4f12-993d-f115b9209f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989115, "uuid": "e04c9a2e-1a04-431b-8dbe-549b034e561d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.3735.11318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e08d64f-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748994210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994210, "uuid": "c5b92c75-b05f-4890-8df7-ad7af5dc883e", "comment": "Malware payload (Gafgyt)", "value": "074dd5166cc0d1aeab4876b1e47a079e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994210, "uuid": "55c84fe6-1447-405e-9889-079124b5e304", "comment": "Malware payload (Gafgyt)", "value": "7c9122ee1055970afc6f801c8e79dcf0172204964dcf8b653bbcfa124e80c6c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994210, "uuid": "6dad6d2e-b732-49ad-be4d-d8796a233479", "comment": "Malware payload (Gafgyt)", "value": "1e3c315c01ad7fbfd1f8413c03a98ce8459b13ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994210, "uuid": "8109b466-323b-481f-9a21-d98eb13276b0", "comment": "Malware payload (Gafgyt)", "value": "02a2968618ada3679e094811b27808401fcdd879173b9750f653f201ff2a855373a0903618a9950f6e839d004ee9f586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994210, "uuid": "3e2f51ad-ae62-40ee-b194-c7c64f7d81a3", "value": "T149933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994210, "uuid": "942d1fe2-ee0b-47c6-b3fc-f97a59c2e933", "value": "1536:mzqmXTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emOGMUNLe5um7WAgcVjmZIcBI:mz52UVUtBUI8GwPfHkk8rgeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994210, "uuid": "6cd1cb31-6313-4618-8e3a-b84a41e62977", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994210, "uuid": "8ee43bb2-abc2-41d5-b22b-5c7408524816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994210, "uuid": "ac3e2430-7f5a-49c1-b340-a2b755112369", "value": "586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e07521-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944534, "uuid": "d048e7d1-ee95-4b36-b083-db744b1c505e", "comment": "Malware payload", "value": "4ddb21b9089a75c3909ac2cd549fcfd3", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944534, "uuid": "05c6b784-c6c8-4a8e-aaa2-e4d33c9aa6f5", "comment": "Malware payload", "value": "7cbba42c5e092793534f98a262d411406f1cbb622f2e442040b7aecf8e2e18a5", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944534, "uuid": "708dfab7-944c-484e-8f0a-82c4c7f57cc4", "comment": "Malware payload", "value": "6707101f9bf53ba2c9608d39bcfe87e8323ca8f2", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944534, "uuid": "43ac7206-6ac2-4d0c-b7e9-f5beaff34153", "comment": "Malware payload", "value": "a52765603ab1d7820a1dcf818f5d8649dfd8e7abda00efef6dec0b72246390ad10c6529703498786d478780c1bdaede1", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944534, "uuid": "9a2b1f07-b899-4848-9877-d948209e8627", "value": "T1525523097D92C920C16722B846C7D1A336255C4D3FAEC09B3A59B3596C3C7B239EBDC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944534, "uuid": "fbac880a-baf8-4af7-89af-9e99067291a2", "value": "24576:Qr6mDiqxfRMay1ck2PQztFureGRQxqvc/cOl1jL:2tDhR2dHzyiRUhOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944534, "uuid": "3d1b5188-2046-4ea0-82df-722f5c1aeff8", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944534, "uuid": "df434836-d808-4909-93b8-5be0796920b8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944534, "uuid": "b9b847e9-a4a8-42ab-971c-5b80c481c369", "value": "Proof of purchase.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff81d48-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942620, "uuid": "f79602d3-8bea-470f-a49d-cbe3ba454cbc", "comment": "Malware payload", "value": "999d87b114731426431787edcf436f86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942620, "uuid": "9808f445-f0c1-424b-ae58-19c6fa4970cd", "comment": "Malware payload", "value": "7d0c9855167e7c19a67f800892e974c4387e1004b40efb25a2a1d25a99b03a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942620, "uuid": "ad2853d4-8ed0-486d-b0aa-7ac0a7905b50", "comment": "Malware payload", "value": "c30885508542da9ad73a0bd7e11434ed74b9617c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942620, "uuid": "07bb2857-368a-478a-adb3-36ffc25b7c4a", "comment": "Malware payload", "value": "568710ee7d90399cef95d7f1dfc7facea6c83f40aca3f902adcc11ed25a8f9ec470d612e53797a2ad434a838904760e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942620, "uuid": "1baaca38-2d9c-432b-83ce-52ce1cc82b99", "value": "T150B6500DEF7A81CACF6B5172B97D8C6BB92D3CE04B90C1BF3243762999329701725619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942620, "uuid": "a500ed9f-2a6a-49d8-a276-bb7ebbe89adb", "value": "073f991a85ba354ebef79c71b2c2f41e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942620, "uuid": "7679a43a-a2ed-42ef-94c4-d6b424514279", "value": "98304:psviB42XjqP9AxudWDay312/oO0YnVeAl:O+GuxYB/dnVey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942620, "uuid": "d9cfd864-7f0b-495b-821e-8a42aaaa68b5", "value": 10722560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942620, "uuid": "09db379e-d2f3-48e3-a72c-14583af3a244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942620, "uuid": "24ce7e2c-303a-49cc-8197-780047d600fa", "value": "7d0c9855167e7c19a67f800892e974c4387e1004b40efb25a2a1d25a99b03a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8916a92-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989208, "uuid": "fd26511b-939d-4c40-b1c7-0fe20f794fa0", "comment": "Malware payload (RustyStealer)", "value": "f96f634cf19073447d026f199886cf80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989208, "uuid": "5612ebc4-b87c-47b1-8ea3-67ec55bfe59d", "comment": "Malware payload (RustyStealer)", "value": "7d816780258bd7f0a038ed7c55f8d7ee5f12c87c57b8373cf2ddbb0d0acee7da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989208, "uuid": "e74e8c6e-5123-4a0d-b1a8-f9bb1b150881", "comment": "Malware payload (RustyStealer)", "value": "0eca130c2abd50b00ea54edade7a063a0f625d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989208, "uuid": "4057f6fb-21da-4fbf-83c6-8a9907fa7c37", "comment": "Malware payload (RustyStealer)", "value": "17fda5039a62974e0b0203b9d0dd29d34999b4f2965e75431e565d8382fe1ae1999a5c9c6ce5daecaa969c2ca0821a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989208, "uuid": "f41cc86b-d4fe-4d46-ad9b-559f5df3433b", "value": "T172C49C8579A0C095D14E2E7FEDEFAFAC9F641112C7C18FCE9AB077A40611B82B118D6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989208, "uuid": "453b1a76-7469-4fbe-9a80-88c53e7b4989", "value": "ddec375ba06350d1d4f99f542ec22104", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989208, "uuid": "731d318d-5bfc-4016-bfeb-a1e1d22b37a1", "value": "12288:/y2rEphCsjv6Xj+C6EPn+uoP8pq/75YYTM3KVADAgVl1FVl1FVlstCQ:/y2psjv66Czn+iq/75YAVll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989208, "uuid": "d3c3c9e3-7e92-42f6-918f-97ff75cc5018", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989208, "uuid": "7b21996c-5adf-4a68-a18c-5d4589478a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989208, "uuid": "77b70bc5-4f85-483f-97dc-5607da59478d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.9227.8897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf12e50-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1748929462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929462, "uuid": "463bd762-44e8-427e-aed1-26b4d914b172", "comment": "Malware payload (RedLineStealer)", "value": "89655fd82d3554e01f50610f63bbcf4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929462, "uuid": "825fa5a1-a47b-400d-a94e-03f83ba221a0", "comment": "Malware payload (RedLineStealer)", "value": "7daaa50dce4b8ea998b897b515d6eb7d3bd0c8efb0dcbd21e386b8e9e8aba09f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929462, "uuid": "9b8f01f4-2693-4204-bd89-4ca34cc2ef0a", "comment": "Malware payload (RedLineStealer)", "value": "e393fd6ec7fdd5a7a03c4c1b9a0b59400487176d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929462, "uuid": "196e8eac-8c41-43e4-bbc4-57cf8b73834a", "comment": "Malware payload (RedLineStealer)", "value": "9fdd62fad4cdf080795e698aad929fe3fccdfad4aeeca3f29edcdfb194d3759d66ce279123eed7b900f827492da7e3e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929462, "uuid": "aa05d06d-9d1a-4395-8d81-2e10eb5546b7", "value": "T1D545CF1227DD8370C372A9737B55B721EE7B7C2506A0FA5B2F94093EA9600A1770F663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929462, "uuid": "441cd142-67cc-4273-b976-56c1980bc0bd", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929462, "uuid": "a208a38b-1af1-4962-87ea-acb2d6b365d1", "value": "24576:ftb20pkaCqT5TBWgNQ7aO4H444tLPpUSlbnu/2o6A:cVg5tQ7aO4H444tLBdlzu/75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929462, "uuid": "3f4989f0-2025-42af-b8f8-8ea7b6354618", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929462, "uuid": "c6a0c829-afc2-487a-a899-64acf687fded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929462, "uuid": "a384933e-2427-4dc3-8847-d280dd235516", "value": "DATASHEET.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848b573a-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748929340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929340, "uuid": "76313221-b9e6-4787-b08c-adc8bae216c3", "comment": "Malware payload (Formbook)", "value": "2f2a3944741c3c0c18520b3a883c8adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929340, "uuid": "0829304c-4f02-4891-adda-13a292b0bb4a", "comment": "Malware payload (Formbook)", "value": "7e58dcee3885cb1d7561fcc9aebdcb8b74bf0d876116a88ac4fbf107ab86559a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929340, "uuid": "4d5969ec-eb71-4863-a3c7-c4aefdace8e2", "comment": "Malware payload (Formbook)", "value": "f9b831d36cb50dc5b146ebc9a2507fb952ecc85f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929340, "uuid": "71b9419e-1bc4-4f0f-81a8-4ca13e214b1f", "comment": "Malware payload (Formbook)", "value": "b8f0f3f3c73cd67de92e3caeebe94d85a0006256bf124b75819b7c2f64439871925b879d835114d522bbe6218d3cde4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929340, "uuid": "2c174edc-62b4-4198-a19f-829a5be7016c", "value": "T19165CF2227EDC266C3B211737DA5F325AE7F6D241DA5F5132F942C7CBD30A60264A263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929340, "uuid": "33373afe-5853-416b-8a30-46e0038d5b10", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929340, "uuid": "7dcd70da-a472-4289-9aa9-2d13f5cb1411", "value": "24576:ztb20pkaCqT5TBWgNQ7a8thtWsusSyt2pITjj0PXjkI6A:wVg5tQ7ay4IBjiXjh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929340, "uuid": "d368145f-a996-4386-be55-52f627b1c218", "value": 1536512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929340, "uuid": "2d952458-9b8b-469f-a737-7a299dfcead3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929340, "uuid": "9420b38e-5f06-4dd2-b8bf-235274a494a8", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81bae45-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989154, "uuid": "5bf818f0-05c1-41b1-9314-7eb47835f634", "comment": "Malware payload (RustyStealer)", "value": "878ff6ebfbb42cf54bbaf022f843bc91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989154, "uuid": "321c9302-f729-42ab-939e-feb6a28d4df4", "comment": "Malware payload (RustyStealer)", "value": "7ed941a3a4f02038b35f9ada6c8d8edf841299d8340b0670364de169c4b9df6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989154, "uuid": "176d3cee-8099-49eb-af1e-a38282e075c3", "comment": "Malware payload (RustyStealer)", "value": "6fbac8b42c4f51ac1e716667a301c0a0fd26033b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989154, "uuid": "b352f8bd-9cc8-4079-8107-725af9ec6625", "comment": "Malware payload (RustyStealer)", "value": "559b9475ac5877f94804d15c71861ffbbec54397cfb7f3ddc9f0a53d0c7087f09d4cd5fd3c17300a64e0bb616b5e5d4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989154, "uuid": "f04ba1e0-e7b4-439a-b272-da45bb970d91", "value": "T1733412B4718C0F48F6A20677C33EA65FE5709DCB0A93DBB984878CA90A237F729514C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989154, "uuid": "3f842386-795c-4b57-97cd-5caa37bde78f", "value": "b4425ca00d20a616c3daafc30cf1e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989154, "uuid": "d0de035e-89d5-464c-a372-6acae957f783", "value": "3072:4N/6zKvXX5JDqMVHQHe4vWgexK8IsiHyyjCGUnbYNY434Xl3iIw/M/5oyz8Nwsoj:4BaKvH5JeM6xv3dSBbYNYRl3KU/5o6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989154, "uuid": "41a30ea7-f6d9-4a5a-8a09-19e8d382d126", "value": 241056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989154, "uuid": "7609cd81-a809-4a9e-af57-dec3a36633d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989154, "uuid": "1896768b-c83b-430e-ba1f-d5eb13b23efd", "value": "SecuriteInfo.com.FileRepMalware.29010.29272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbad2025-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748934694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934694, "uuid": "0f067a05-58a9-4b6d-93f2-6ccd97f7222b", "comment": "Malware payload", "value": "2989d4b471693b527d3549ce88a41ae3", "object_relation": "md5", "Tag": [ { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934694, "uuid": "89dda101-f340-42f5-b8f1-98c9796a334e", "comment": "Malware payload", "value": "7ee7eb27e516694683c45027bea7e5cb01199813c81f55e4a62bc71727c4983a", "object_relation": "sha256", "Tag": [ { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934694, "uuid": "26fb9dc5-1fe7-4cc0-8940-97d4ed901e2d", "comment": "Malware payload", "value": "38e0c9f3a5e6f98aa23ec34dae7d051fe471d8a0", "object_relation": "sha1", "Tag": [ { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934694, "uuid": "76ee61e5-fe04-4742-aece-f7c06077b04b", "comment": "Malware payload", "value": "ee6caac44112bdaf2092c0249767e859f1589df6624ed738da16a505facbd81527f74fda5bea5a71bbb1cb546b9ecde8", "object_relation": "sha3-384", "Tag": [ { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934694, "uuid": "430de554-2f77-4f91-9a86-f3a7695d1648", "value": "T1AD513362384A57879005655801162F46CC0431753437C9F3A3DEEDEB6EEE17EDC7668B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934694, "uuid": "78030ef1-9d2e-45e9-bbdb-dc64d181255f", "value": "48:RAikd7pSSSWWCwjjCBnWFEFFjuDjxQjH6dAHjkklKrlUt8n:RAYtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934694, "uuid": "3775e49b-b27c-4a9f-8d11-e6ceb8bda223", "value": 2486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934694, "uuid": "9e9e29b8-a81f-4309-b395-fcf7cd010134", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934694, "uuid": "8fc7eaa1-dc18-4bc0-a5dc-0c9c9bd09282", "value": "CV_Diego (1).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329cee13-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1748931350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931350, "uuid": "5cdf91a5-6032-4ca4-827f-228b01ebe740", "comment": "Malware payload (GuLoader)", "value": "ffde37df35cb5e74bc7ffc8372728e3f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931350, "uuid": "4bdd9954-c953-48bb-8f74-474d3db5c2ae", "comment": "Malware payload (GuLoader)", "value": "7f5869ca7cc12161197d2ba5bfab6fc4f79a6ca88b1a2bebed1e88adb1bf3338", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931350, "uuid": "5d435fce-2101-42a3-b885-3133ab583f39", "comment": "Malware payload (GuLoader)", "value": "74304c05b3095edc9243045ccc5955f907d9fe0b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931350, "uuid": "423a6445-389b-4ede-934b-05a97284fadb", "comment": "Malware payload (GuLoader)", "value": "cdfd6f8ae3aff2bebaf323df93e5efd6d7b420b7d7e288df12db915c734d0394aa59f0511a53b37c0efca1130695ef57", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931350, "uuid": "e34dcd6b-0aff-4a39-8c7d-7ae36b9c2b6a", "value": "T1D6925CB5CD150196CE0B77A3EC480BB1C678815A5813087E7EED7B5A09453BCB37DA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931350, "uuid": "0dcdc824-d258-4657-b11c-011b8361ca60", "value": "384:Jj9DO+w+Ba3t+fQOBabFnn+coGJKOfUpQexyvD59e/ZX3Ru/3/i+G:JjBOl+A3tqfann+xiDfUqexyvDX2X3w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931350, "uuid": "cae0c1a7-a408-4343-8cef-53084a587d0b", "value": 20422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931350, "uuid": "1ac76aa4-afa4-4c2f-8fd5-302b33329644", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931350, "uuid": "aebbffa0-6529-4d23-98c9-895844da6a51", "value": "INVO_OPC098782928778568.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a23fac8-4044-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932142, "uuid": "144456e5-c117-4a31-b4e1-7b3cd5bfb55a", "comment": "Malware payload (LummaStealer)", "value": "be09a12ee4c6af0b7c7704fe434194a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932142, "uuid": "1906b27f-990c-4ac9-8fd4-5d80a09900cb", "comment": "Malware payload (LummaStealer)", "value": "7fcf9b9104318400d45489afd0e9a6c0beaa6ea81c0eab163e9ff4a257e2334d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932142, "uuid": "27b6900a-87ef-4518-90e3-6ee3d86354dd", "comment": "Malware payload (LummaStealer)", "value": "86c25474ff56da0ce691a2166721d20f8f22192e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932142, "uuid": "63a7aa75-bc0c-4d6c-b26f-044842e76973", "comment": "Malware payload (LummaStealer)", "value": "a88ae4da35f6b547a62c4b4cc6bd23bee2d2ee5f554c7b2e6dcc7ca2fb0eac2341904ef72d73781edda8b2a4af5b36c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932142, "uuid": "7d1f8396-00a1-4a7e-86bf-bf1ac24e4358", "value": "T12785AE399152A2C6FC2A40B601A1A5D93462B733C63D2FFF4290F333AD07AD15E6A75D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932142, "uuid": "53179065-e23e-4153-a19f-3469fe50e525", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932142, "uuid": "9706907d-4724-41e6-ab89-d5256495eb54", "value": "24576:B9LATjgcql9XDP81Xbe6A5kS/FHBpzJ+PczY8TZ+Q7U6YcegrlV+Q7U6YcegrlP:XLA3ibXDk1re61S7pGczY8tHbH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932142, "uuid": "e2008956-61e2-48d1-b7e8-a9959feff3d6", "value": 1790464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932142, "uuid": "ae06f2b7-ef81-4d2f-bc4b-865e15a0a216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932142, "uuid": "e9b3dc3e-4bbb-4423-9b1f-8c029f93391b", "value": "Bwwn8Qr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8797a11d-4013-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748911307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911307, "uuid": "226565f6-09f0-4e4b-860e-5349cae879e2", "comment": "Malware payload (Mirai)", "value": "6b9a7ab0ab3261a8dda6d22aa3b25871", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911307, "uuid": "07de9005-463e-485c-88f1-b79e2512d223", "comment": "Malware payload (Mirai)", "value": "82d51476d5a9c7accf0e6d4f96273f83db8c63b34f1dbd3362c76c6c42d52d0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911307, "uuid": "e7cd5c26-455f-49ff-a284-ff6d26b9c372", "comment": "Malware payload (Mirai)", "value": "38dd3112c7001db519a696f2d9f0c92dc46faf6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748911307, "uuid": "46948086-ca38-4e51-91b0-518485c8c09f", "comment": "Malware payload (Mirai)", "value": "10d1a1d11b8fadde8ea2ce8402e842504136f76609d0b3f90f0b50ad1d1a19ce27070a66c915a0f2d1f7d62d6300348a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911307, "uuid": "1a9a6f54-eb8c-46d7-918e-0ab753191d5d", "value": "T1AAC2E1A1A571C839C6F13876643A0A4DD2CB5E3891BE7159B16850DD3DFB842A2FC3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911307, "uuid": "8ce318e6-43b7-4e52-b877-49619e5011da", "value": "768:SK/BqYHlekvnKCR5HkE1TDdVq3Jr+3Oq3UirZD:vA0lFvjR5HkE1TD+5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748911307, "uuid": "a98a8c5a-aaa3-4b36-b3a9-4378915e92c3", "value": 27404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748911307, "uuid": "0daaa70f-d860-419f-a9d9-c6fb9d133e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748911307, "uuid": "9de77255-c6be-4f49-aad3-844b800e3c46", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c929c59-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748931367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931367, "uuid": "045fcfb5-f20d-4b04-9035-a51a8f275062", "comment": "Malware payload (RemcosRAT)", "value": "8a9f75eabe3bee90448b2ffb5d512e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931367, "uuid": "e408ed3a-e895-4b94-b38e-7b07ad8698ff", "comment": "Malware payload (RemcosRAT)", "value": "83885d6469d809b0709f82c75605005fed02c3cbdde2a8d8e74589608d45b40b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931367, "uuid": "474e4a9a-e96b-45be-9f36-c7b88fd703db", "comment": "Malware payload (RemcosRAT)", "value": "cc41c0ec6564d4bacc41e918dae2a9835e773fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931367, "uuid": "4dd98210-8d9e-41e1-a705-f77817746ea4", "comment": "Malware payload (RemcosRAT)", "value": "331eb089900d2d274bd5af2b60b798e02f339e0a5c11b4fa635667545c7f15237163d8bbd907f90aa3034ed476a6fd55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931367, "uuid": "2a6e32b4-cc22-4970-9633-9d9c6ca710ab", "value": "T17825F0543936BF02C6B64BF84965D17827B84EDE642EE21A4EF6BCDF71A6F110480E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931367, "uuid": "2cf7087e-839d-405f-9c20-a1321dd95c47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931367, "uuid": "ca8ce4f4-845c-4da9-9e97-f8c9293f9b5f", "value": "24576:KiOh3MWzEWsiFbnt2Cp+q7XVH5QkFhO9aFW3zkrw0twRgB:ny8Wj1bngCp+qgke9PYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931367, "uuid": "d398b7c1-e8ca-463f-88db-cf104fedba6b", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931367, "uuid": "a85dc07b-26a8-48c0-8222-ed4fc59bd7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931367, "uuid": "f25a433b-0795-4668-a3e2-854ede227f59", "value": "Teklif 09052022-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "525d4854-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748944718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944718, "uuid": "34b99eea-99ba-44c8-a635-2ea6766b05ed", "comment": "Malware payload (RemcosRAT)", "value": "ef9cc8c339a48744993dd8195e13e10d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944718, "uuid": "4419971a-49e2-4ff0-9441-f76c6f298a7c", "comment": "Malware payload (RemcosRAT)", "value": "83a6d48cbf00a988db88b12054ea9b2d7473886fa4721a53c43f7d126fd606d1", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944718, "uuid": "a5ee4ad3-b18a-4612-be5e-8e1ef8fae62a", "comment": "Malware payload (RemcosRAT)", "value": "62fdce40339e51b201072b8fd5f44ba8a900860d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944718, "uuid": "0b292d61-63d0-4da7-b9b6-5902a816674e", "comment": "Malware payload (RemcosRAT)", "value": "41e7c92843057dbd455fa111f3448b817a1812c83a8140a6428806ea15e838ed61e83bd01166ad87c35be0c5a9e335e5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944718, "uuid": "24fb59c8-3e28-4427-bd6c-c44076df60f3", "value": "T1503275886DA0ECF82B82EA5D16DCC8F1AD1CDB0E08A08506F45D58555768E64BCED7C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944718, "uuid": "8912977f-364c-44ee-9d8c-3ee108035706", "value": "48:3bW3t2Cko3Sp2CkO4r3J9O5woMbttV+uWRvRuaGk3b3N2Ckt3bG:rUw+SMjr3HO5woMbtr+1RvXjQ1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944718, "uuid": "d442a904-a73d-4707-adf5-607988831fc7", "value": 11987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944718, "uuid": "f9cdd1f8-a53b-4d46-8589-1922dfdd7133", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944718, "uuid": "9bc3a62b-c89b-4973-aa28-1efa5e35e7db", "value": "emicrotechindustrygivenbestchoiceofgoods.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc43cdcf-4048-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748934212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934212, "uuid": "c82ad7c6-c189-49c5-87a8-afd47955fbc3", "comment": "Malware payload (Formbook)", "value": "ec3c47287f6c4b7b7f67a8e3e33554c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934212, "uuid": "76b840d3-2a0d-4ff5-b616-8709217ea9b7", "comment": "Malware payload (Formbook)", "value": "83aca3eedf69640af7707090177d6194b4f0ece7feb76ddf84fa459cea018a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934212, "uuid": "74631714-64d1-4fbc-b766-cbe9b2871eda", "comment": "Malware payload (Formbook)", "value": "cdebf68f82628e3da587acd5326a6a77fe2789f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934212, "uuid": "ee3e2063-ad6f-41d6-9f36-9a4374544168", "comment": "Malware payload (Formbook)", "value": "c6cb7a71e46832943a291af5f8640d9f92cf4e3857cc664f45d9a251ea5709568f6ce183388ed36058c8acc02f579838", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934212, "uuid": "8f0da3d2-3058-4879-b632-4f967b27f8a0", "value": "T183E4129823BAEB03D0B20BF90832C1B557B86CDCE910D6574FE6ACDF746AB10569474B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934212, "uuid": "b8320098-2911-4ecb-9775-d6bb63bd5b83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934212, "uuid": "f9008ac2-f01d-49b0-833d-119d1285950a", "value": "12288:Eq8VcuqFVfhw+oIUFYL3Wz0zHjZUiHWn1MovBCCwuzBobKlYozJJqhVa3jvlN9:Ecw0zDZtW1jBbwitlzzHCVa3jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934212, "uuid": "8f44a014-88ad-411e-9818-166ced8e8d71", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934212, "uuid": "23feb167-72dd-4575-9eff-afe6b19d2244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934212, "uuid": "4fa96811-7637-4d17-943e-b3f5014b9e34", "value": "INV #009991267..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d21b3c-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (StealeriumStealer)", "timestamp": 1748960832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960832, "uuid": "ba2cb5bb-741c-4bd9-a7ea-9bcdf5f27526", "comment": "Malware payload (StealeriumStealer)", "value": "1fce2dd8700a03f40d4924820b77dfed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960832, "uuid": "a6fd926a-7a5a-48ec-a887-4526b8f9d930", "comment": "Malware payload (StealeriumStealer)", "value": "83dfe38b7b7b5e4f720a22d588efaeba41e95641f1b3a69532d7c8d4c6cbaa0a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960832, "uuid": "55b7e0a4-92d7-4ea3-aba0-34657b336fb4", "comment": "Malware payload (StealeriumStealer)", "value": "8375f1d9cfa0cf6783e4deaac0c39e990f90a815", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960832, "uuid": "c80df12f-c086-4dd9-b0aa-cb29ba21bc2c", "comment": "Malware payload (StealeriumStealer)", "value": "422a010f5e4a23477fe6130ba532fc86f55906467719cb224051fc8ea9be3ac3ebceb9cdcee6828d4c8ff9a2daa2df5d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960832, "uuid": "96d8761d-2066-4665-b474-44f01cfec58b", "value": "T1073153CD3A80B099834213B76C2E4957D67AEE35341ED081E221F0D43E2C67AB97B758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960832, "uuid": "71160383-4131-4fb3-b722-067eabc8db59", "value": "48:qj8igkvug1l78GvZsXEqOEIwxpABOnrflS3Rkz5BKo3S2N:e1vv1BBRwxGEnr03RkzfHCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960832, "uuid": "88020dc2-0259-4403-917a-121447719784", "value": 1860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960832, "uuid": "2f7ae891-fd99-4196-af07-f73bbd5f6ec8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960832, "uuid": "52f83f3a-4f70-4ccf-9213-396e00b511a9", "value": "Transaction_receipt_001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b1c018-4088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748961558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961558, "uuid": "a2d27bb5-e1bc-4516-a745-965dd6329645", "comment": "Malware payload (Prometei)", "value": "2f775a8f991900041945d5ff8a033c4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961558, "uuid": "50ad018b-5d81-4a2d-ac72-6af464e68ab1", "comment": "Malware payload (Prometei)", "value": "84a9e8d3c9f6beb761a6e95a6b226c7b27f8a3be4ba4d5aedf96cc3813600203", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961558, "uuid": "bd0f2e17-5eb7-4448-a951-36c128150d5a", "comment": "Malware payload (Prometei)", "value": "bdd8992ebb33bfbbafa900948f317a1ec16e838b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961558, "uuid": "ac5ab2a5-d82a-45a1-a164-aa48727e9551", "comment": "Malware payload (Prometei)", "value": "794940d89d01c6ae84eb1f2ed46220d5805f1af4f1136d5ab67948672ce08d8a49451b66743f3e3b035c39171a6893e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961558, "uuid": "bde655f0-26b6-40b6-af4d-5d4e77fb2dd9", "value": "T1E39423F8C83D2E30D8169F3CBB5A826CF0A15772D9562B6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961558, "uuid": "41f516d9-e5bd-4518-a1b5-8559fdf9a46d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgu:25WOSACZSV6eKRH5EPiamb4DsDwwc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961558, "uuid": "3961034a-75b0-4bf6-bc91-d6c0b74fd7ec", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961558, "uuid": "1cc256fc-0256-42e8-ae7b-4b96e4b22bb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961558, "uuid": "edb20539-d2e7-428d-a193-2825b8dba23c", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78731c3-4083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748959491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959491, "uuid": "47a7147f-06c0-449c-a564-66da22506e98", "comment": "Malware payload (Mirai)", "value": "a8e1de3877704d44c78ae58ed99c6f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959491, "uuid": "00c465ee-a635-46ec-844c-1cc436cbf5b6", "comment": "Malware payload (Mirai)", "value": "8597cc90f275b2bf55e6a2b359e8391dab9fd155e28bba46b6809205c41e5c20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959491, "uuid": "5cadd082-cd17-4406-b4d9-5af0ba0da442", "comment": "Malware payload (Mirai)", "value": "3b79d292f03e2a318fe59d9b036ade33e9264b4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959491, "uuid": "4cb3dafa-d88f-47de-86a4-5ab48ec2403e", "comment": "Malware payload (Mirai)", "value": "7fa81e738f0f7043f6401be87f8d4078492cd57fa596f49d63cf19edd366e7d0d365a2ddf48df55e5c0ef0082cdbcf1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959491, "uuid": "53073a11-4bda-45b2-adc2-aaaff49e4901", "value": "T17E332A91B8919A12C5D4637BFA6E41CD332623E8D1DF33079D252F513BCA82F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959491, "uuid": "792fc762-04ef-40ac-a443-c6a230293edf", "value": "768:oWYoL+lZSLtSThFZ+9h4TCPwFivBFd0mPUWTSrzKSNPH3vYPlh/hfb3yzCpPNOXF:aoeELtW7wrFdZSNP3Ilh5sht2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748959491, "uuid": "1fcd7634-abf3-41bb-891b-98990ee00364", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748959491, "uuid": "4f6794e5-4363-42b5-920f-e7d654030ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959491, "uuid": "2b296f6d-7ddb-4158-b839-290678a89e92", "value": "hoho.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff614bf-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748935426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935426, "uuid": "58014f07-ad02-45cc-b427-ef5e124e53d4", "comment": "Malware payload (Mirai)", "value": "3074111cb4b747949a881f2f71dcd1fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935426, "uuid": "6cac9e4a-8484-407a-a8f7-9d6cb381f2da", "comment": "Malware payload (Mirai)", "value": "8636b33750c8a027ad3afa353c23a11b66a85c03a503af36c41b26b2e78bcd1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935426, "uuid": "4b85aec0-20e8-4d3f-8130-bafb84d12984", "comment": "Malware payload (Mirai)", "value": "4e94835efc19fbb1af2a897f99a304b81bc1a833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935426, "uuid": "21411243-2501-4c80-a214-c488dafbc08e", "comment": "Malware payload (Mirai)", "value": "f55951e12fe49e8de4f1864b484b2895d8a616b22790e3c3bc57d4e46aedd8710e25a0f7fdc6ea6471f75a91f2341c25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935426, "uuid": "b7fa221f-101b-430c-aa36-c7467b52609a", "value": "T11E134953AE5ADF46E90AA2F062F29E388B43F8259D331DF5A521FDF045439C8B4097B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935426, "uuid": "b85d4dc3-bd52-4f7c-9aa8-cc0f4c5971a0", "value": "768:5KoKm9d3VTOCirYX7hvv4g5qaeiDqCw3gc5iCojcl7voP5XCjHQZid:hd3VTOCir0HJ+BiCojcl7ABXCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935426, "uuid": "fae4f6c8-11da-40f5-bad6-cc2b01459f2b", "value": 44896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935426, "uuid": "aad475cb-df11-4598-897f-fa2303bd4045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935426, "uuid": "b101078c-27fa-4303-a410-c1eeab65a059", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298c093f-409f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748971278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971278, "uuid": "1f99a594-4584-4832-9c31-279c37a94e48", "comment": "Malware payload (LummaStealer)", "value": "65e98a0a6b29fe51c38a25b202c39458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971278, "uuid": "fb4f3241-a9dc-43d1-8a82-fb9d082100d7", "comment": "Malware payload (LummaStealer)", "value": "86413e60a64d3965f72d137eb195c7c1913c5d4bdc19c8b14e9e857109d7cebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971278, "uuid": "f40d3e32-80b4-4ca4-bd07-8d46b9cbcd10", "comment": "Malware payload (LummaStealer)", "value": "85e6c9b7215dd30148de0ca1799c71e2861f69b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971278, "uuid": "a23d448f-8ab8-49ef-a15b-cdcc9c0066fa", "comment": "Malware payload (LummaStealer)", "value": "fa5bcab3f4def9d1621b0d5ca29642a9fefcbc0fcee7e81243922c26dbbb818dbc1c22263aeec9f1b7152e33d6d9414b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971278, "uuid": "dda60be8-63b0-49a8-add4-192c589c7987", "value": "T104969E137299943AE0970F3A487FEA719C79BB212B12C9477BF41E4C0E35B827E25257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971278, "uuid": "a6cdce93-5199-460a-a12c-74f2fb47ac51", "value": "91bc2a38656dd8e958714f4a374cb4c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971278, "uuid": "9f27ced0-6b78-47b4-a327-61d776ba02b7", "value": "98304:5xj0B4wHtArXp+69N7CAHj20TuE58H+2dyOqAfGM2FI+zoVr9EH6:kB40tKh520aACxEOHG3IAs9Ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971278, "uuid": "6379d6dc-5ca3-408d-9c71-f628eca26b3b", "value": 8910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971278, "uuid": "4e913d04-3180-4116-85e9-5823c9aafcfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971278, "uuid": "e801deb1-3372-4ba4-be7a-b4b67c8b2236", "value": "\ud835\udc7a\ud835\udc86\ud835\udc95\ud835\udc96\ud835\udc91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "480c1f66-40a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973477, "uuid": "a47bd622-35dd-47da-8267-660735452ad2", "comment": "Malware payload", "value": "0e0fd1bc86ba1bb0a868ec2143d9767e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973477, "uuid": "a1f4dcc3-4ee3-4c6a-852c-ad759a45604e", "comment": "Malware payload", "value": "879261d19e4103359c07f9f84e40638aad310a08c69d179cb9ae658435e1ff2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973477, "uuid": "40cf8405-c3c9-415d-852a-4d28aea938c8", "comment": "Malware payload", "value": "46eaf78653254773333ae664ed3dab3759f136b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973477, "uuid": "8de357db-93ce-46bc-b6b7-03538673dad4", "comment": "Malware payload", "value": "2d74856ab8a2779f1c025219d5c8772c1689f8360d0dfd8df20202417e8adfb59225add9919ec80b262c59e68287ca5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973477, "uuid": "9c8cec17-c5aa-4e88-a540-efac520c0a02", "value": "T1C4A41212E290D8FEC4CAC170469FD27BFD7A7C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973477, "uuid": "94ca6dcc-ae63-49a0-80ab-9fb7a8ad19f8", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973477, "uuid": "a29f4cdc-b95d-4ea8-98e2-06e003e66ab3", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973477, "uuid": "0e53ead2-db09-4569-bc47-d4093c120f24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973477, "uuid": "2c8fa6f9-ae50-4e95-a8ee-6af3fe665730", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29330d6c-407c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748956245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956245, "uuid": "2da7d06e-c825-4d99-a105-88781dbafadb", "comment": "Malware payload", "value": "f572765c5d5a9b789b8f77278b745e1e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956245, "uuid": "a1c5df74-5df0-43eb-bdc2-977dd46ac9a5", "comment": "Malware payload", "value": "8818efa4c6b1882f10dc99a450b4304ba84902d8b7a04efaaed1324097f25725", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956245, "uuid": "935f8d69-6d6e-4b93-8d9d-ab5ff8051c13", "comment": "Malware payload", "value": "0716a875ff6bd01dfc28baa60226981a373f0a88", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956245, "uuid": "9c2117b5-aae7-454a-9d41-759be56e8f83", "comment": "Malware payload", "value": "ba02177a82505e84500bda8319bafba4fc2084e073652e45fedab6eac4037bdf4673de8ba81061fc58f9db135417c1f0", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956245, "uuid": "d88e4575-36b2-461b-b578-d08a31bac40c", "value": "T16F083369BEB39910E44F90352161A183D0285F7E9908F1BFAB7474583EEDCD49603EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956245, "uuid": "823f3d90-a0fa-4955-85d1-567d169dc859", "value": "1572864:W+uWhHum0FL836BHRyJV1iltFsSq3afQ66ztklVpCBPG4wAkTnwTv:WpWhHcFL83ca1iYqY66zqlLC4hvwTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956245, "uuid": "1ad2a1cb-baa7-42e6-88c3-2c8d1265c24d", "value": 84516707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956245, "uuid": "f8b5ac68-3fbb-408c-a575-39cdbbb9a71b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956245, "uuid": "51701cfc-1d40-4c34-814c-5fa6fc65c67c", "value": "resources.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8c12ab-4095-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748967208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967208, "uuid": "5155a968-dcd2-4f68-9d9c-a77e5ca367d0", "comment": "Malware payload", "value": "3d05d058fe28c3c6c10fc3859a633c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967208, "uuid": "01ae8d72-c47f-41f0-9266-ae26220869c3", "comment": "Malware payload", "value": "881c4114430cc546a1d2976a92eb6569625d4d49b110c76fd60dcce217eca213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967208, "uuid": "1eb838aa-e9ba-4590-ab39-9877cf67a452", "comment": "Malware payload", "value": "bfc338247b1e2798b30f6f3a94881811daa05c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967208, "uuid": "27374978-0131-4aab-b13d-d6788c873511", "comment": "Malware payload", "value": "fcb622ac35ee8c7b069ff153d5c9c5b65ad68d984acd9c2a1eefde8c357e56a8bcba0f3f5cf897d071e6f0f0141b7ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967208, "uuid": "703f11c9-a52d-4fd2-b8ee-94762fb04de0", "value": "T1EEE633A897BC0898DEE76039C5D1C51ADD61BCAA23A0C64F23F4865B0F179D92D3EF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967208, "uuid": "28749831-9aed-4c73-8966-66ea07dc730f", "value": "a06f302f71edd380da3d5bf4a6d94ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967208, "uuid": "3918e308-d64e-4152-bcf8-5b0a5150cd42", "value": "196608:w1RbFN/DiJZIK63UtauZijJDwGcsAgectcGfcY3gtAAyi9+ON7STRbeu2tCwum8f:8tbD+63hucVk3meWcGfd0yi9IIu2MmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748967208, "uuid": "d54b0077-e49f-4d8a-8285-505f39080018", "value": 14671344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748967208, "uuid": "cf514616-940e-4ef4-8240-9c6967a56c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967208, "uuid": "2fec9e54-9bc9-421f-8d6a-11a3dd57dd7c", "value": "Cloner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0ae39f-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748931443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931443, "uuid": "e4764b7d-384b-4574-8f86-974add5d67e3", "comment": "Malware payload (SnakeKeylogger)", "value": "b4b4b6c2f32965bd0b0bf56ef89231d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931443, "uuid": "c0bfc92a-25bc-4f22-968c-c8a0bf615976", "comment": "Malware payload (SnakeKeylogger)", "value": "888c4181de3f7c5aff258d1caa107979d1729ee148127aeb3d9fdd969ca4fd79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931443, "uuid": "b4015fac-93d2-4ace-9ea5-88b0f4dd2203", "comment": "Malware payload (SnakeKeylogger)", "value": "0737cfad3dfe9845b0d17a5754c30b4d9d0021ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931443, "uuid": "f9d211bd-e7b2-4330-9f08-b75bfbf2f416", "comment": "Malware payload (SnakeKeylogger)", "value": "ad9671b3fcf1f2e1086cff269981cb7df0ffbcca1efaf6b1e2d35a0494900bdb523ecb29bbca331622fd61cea5a47a0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931443, "uuid": "16869d15-c51d-4afa-af35-558a24680017", "value": "T1D725BF1373DD8361C7B25273BA257B01BEBF782506A5F96B2FD4093DE820162521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931443, "uuid": "a335dda3-62fa-449e-ba4d-0d26dc3ee623", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931443, "uuid": "c8ef276a-4ae0-4623-ae7a-9ff6668b8c9a", "value": "12288:Htb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaO7XRqrsbOe6A:Htb20pkaCqT5TBWgNQ7aeXRq4bOe6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931443, "uuid": "3dc61143-8685-49d7-aa05-3775b82aa798", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931443, "uuid": "811c8b74-caf6-4be8-989f-40d79cbc68e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931443, "uuid": "266e1df4-4c00-413b-bb85-c083ad3a1107", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bf355f-40bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748983781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983781, "uuid": "f00b9209-bb99-4684-aab2-67b7ac20410e", "comment": "Malware payload (Prometei)", "value": "984635b1bdd31350f761c2ff4930b25c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983781, "uuid": "81530a8e-438c-4183-9335-4e412b0c6ab9", "comment": "Malware payload (Prometei)", "value": "8a7302efc2cebfed7e4cdbea461e789f52c17cc7e663eb2f075c5695cfcd00ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983781, "uuid": "99e1720d-a5c8-4372-bb28-7f99db51dde7", "comment": "Malware payload (Prometei)", "value": "f1018f06c0a773623a7afdd45d3365b1b53b5fa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983781, "uuid": "5d83cf97-4537-451d-babc-8980867757a6", "comment": "Malware payload (Prometei)", "value": "63857b1230206c1476828be1afd35425bf38ed115395f550def40e2e7df1fca94c14693440309894b014173ad5e278f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983781, "uuid": "d6acc2b0-2477-41d3-b5db-5338df908181", "value": "T1AF9423F8C83D2E3098169F3CBB5A8268F0A15772D9562F6AB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983781, "uuid": "bb53ba41-1e91-4972-9fdc-d87bc3b65530", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg2:25WOSACZSV6eKRH5EPiamb4DsDwwcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748983781, "uuid": "0973fe05-5762-4d47-a696-8a64e732ced3", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748983781, "uuid": "15478897-904c-49c8-90a2-f1e778e81055", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983781, "uuid": "f2c09760-f60f-4243-b225-82d00fe5c99b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374276eb-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748935224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935224, "uuid": "041e0239-4cea-4911-9ebc-7cae28b63247", "comment": "Malware payload (Amadey)", "value": "d52532ecc821a289f4556c1242bea587", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935224, "uuid": "5336c3db-ae8a-414f-b196-8c985cbbf172", "comment": "Malware payload (Amadey)", "value": "8a737222b87d1ba3e145c099feddd38893e9bd3864e0d505477347872d108941", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935224, "uuid": "a6fde262-a3c1-4580-9037-9651e86a1be3", "comment": "Malware payload (Amadey)", "value": "5b9001b03dd7c351caa3e18a1081155fa2978fba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935224, "uuid": "59b97ed2-660d-48fc-ba17-ae1806147e4e", "comment": "Malware payload (Amadey)", "value": "3cf53ab9118071dac29530af430252deedbb10b815b21e20fda07fe8646cee1cd9da209a5e5224a69f883e7523de3d2b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935224, "uuid": "011e456b-9af5-496c-8276-c23654b0b353", "value": "T175159E0273D1C062FF9B92334B5AF6515BBC69260123E61F13A81DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935224, "uuid": "e20172ab-e73c-4677-a9b5-db498a9bc241", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935224, "uuid": "abbddd13-e235-4bb4-8364-ab3937a7ca80", "value": "24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8aP/Z:ATvC/MTQYxsWR7aP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935224, "uuid": "c41205c2-92d2-4e20-bc36-ad757a13e83a", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935224, "uuid": "82d2c97f-7e66-474e-b31e-2ae7bf134ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935224, "uuid": "254184ba-4ed9-4080-a6a7-9f09a71ffa8b", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b5cf1b-4055-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748939842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748939842, "uuid": "786d19a5-e7b6-400f-97f4-eebaa66b60bc", "comment": "Malware payload", "value": "270d9026249c7f83a8ee5ce7d5d23234", "object_relation": "md5", "Tag": [ { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "WinVNC", "colour": "#07A2C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748939842, "uuid": "97104002-b750-4b47-b059-8ef7afb37914", "comment": "Malware payload", "value": "8a7860493c76ef4f318b266c9802fee5868dd942501e966664c77f5a2ef3a02c", "object_relation": "sha256", "Tag": [ { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "WinVNC", "colour": "#07A2C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748939842, "uuid": "9c50b447-a935-4035-9bf6-de14d02dd14d", "comment": "Malware payload", "value": "47501d4ce9934ce33190715977a4a8e26d3aa915", "object_relation": "sha1", "Tag": [ { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "WinVNC", "colour": "#07A2C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748939842, "uuid": "b018ff97-c5c8-44b0-8a79-44e22e88400f", "comment": "Malware payload", "value": "1140fbd8570291d71b40b3ce0a1f80bfa0ddca8e345c3bac34cc13aa5d7f3617a436416c942df890d80585a6e21648ba", "object_relation": "sha3-384", "Tag": [ { "name": "TrojanDropper", "colour": "#48F501", "exportable": true, "hide_tag": false }, { "name": "WinVNC", "colour": "#07A2C5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748939842, "uuid": "f12e1d57-cc16-4356-b861-21abb7dfb423", "value": "T1775533A5185B0CD29E420F999E045276E6159937A9CFBCCEC523F667B0233CAFD04BD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748939842, "uuid": "63b3fb2f-c8da-49aa-9be6-54cce81f005c", "value": "24576:XzUi4OhQ5ogyisQzbRNFLmCQ0zaVqWBGqoZuwOaziwMLWrzbZdE93xLxOxxMqN7h:Xzh4OhQqgHRNZ1Vz8fsq+PziwWabf6tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748939842, "uuid": "e5a50532-2aab-4b38-9e6c-5691cb6ec511", "value": 1366522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748939842, "uuid": "11d7de1e-4f3c-4415-a060-be8105546391", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748939842, "uuid": "56622646-504e-45cd-b380-a23289db27ed", "value": "RAT_UltraVNC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5d5e4a-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748935130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935130, "uuid": "f4f31b00-09d9-4a00-a86b-82bac7f46ad7", "comment": "Malware payload (Mirai)", "value": "84f8fb2e84a5da825bb31dbc5ba4f5d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935130, "uuid": "9e8ae716-2794-48c0-80a3-68e6442cf49f", "comment": "Malware payload (Mirai)", "value": "8a91d209f1246755556b51b4ded0e15fb3abbcc59ff813b81d61393c3c95815c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935130, "uuid": "8a8ac4ed-6b99-425e-acb9-4454cabbc8a4", "comment": "Malware payload (Mirai)", "value": "1656b5151593eb10d6c75ad4360586b9a66ba2b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935130, "uuid": "568bff69-ce9a-4406-bdef-a1fff185d76c", "comment": "Malware payload (Mirai)", "value": "e5cf04e4666db5ad368af83f8f6aa89c4a34266e48a33c572b8dfdf43365ceb638713086387ac313aa84dac8c6164006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935130, "uuid": "473d8870-6405-42c6-9c91-c9ffd97a4e9c", "value": "T165231A46B982CF03C5C262F6BAAF46AD371177EDD5EB3207D811BFA03B824D61D26650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935130, "uuid": "65ed436f-90cd-4ace-a027-dde3a592aa05", "value": "768:pXWUk9tH0heIrgj2psNnM3ul+wNxtrWTqYd2P7JOs+fvV+xqZ2s7puQZi5dS:tWUk4TrgjWsNM+lbtCqYdkAs+0RsAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935130, "uuid": "f94ff2ea-f026-4d8e-bec2-279dbec4515e", "value": 48020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935130, "uuid": "f64a3577-ed29-4fc5-90f2-9fa0fca79aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935130, "uuid": "49bb7218-9c65-4538-a906-d27b78b1bebb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb72dfc-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748929545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929545, "uuid": "4e90ee03-2492-4279-915b-4d8a0f39c64a", "comment": "Malware payload (SnakeKeylogger)", "value": "2264abdde66f951b6dced5f2c6e3fb7a", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929545, "uuid": "54b50134-fc1b-4100-a2f5-dc7f729cad1e", "comment": "Malware payload (SnakeKeylogger)", "value": "8af38fba5ad4b22872157e68ee0224da0ebabaaa1ee9f859d245769d4f758c91", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929545, "uuid": "cf36cfea-c3ad-45b6-906e-57e27fa75908", "comment": "Malware payload (SnakeKeylogger)", "value": "f6baac749b2cb46beee0b43762aa19b79431d2cf", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929545, "uuid": "05d74bce-981c-4b82-86da-ece9a66272b0", "comment": "Malware payload (SnakeKeylogger)", "value": "0745b0125427f9b6a13f2de73d49406ffb87bca4823d60eeef68a15e7d3631fbf826dce17835f8efb0391fa4bacae3a4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929545, "uuid": "075ce32d-6fce-4594-b3ae-88ed4c98f000", "value": "T16345236B3E4532AAE804053E55E69088B6C5AD41607B2F7C7B3EF8040976BD7C7BD4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929545, "uuid": "244ae26e-7b44-47dc-858b-6ff809b45a00", "value": "24576:IakSl8GtAg5o5ROy+kakSl8GtAg5o5ROy+U:ZkY8yFobIFkY8yFobIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929545, "uuid": "5e0e4aa8-8cd4-4a13-be71-29e69a225167", "value": 1204880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929545, "uuid": "f7c41034-fe2a-475f-b5c0-792dfc3f580e", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929545, "uuid": "660581ba-49d1-414b-8f23-3493a58e2b5b", "value": "QUOTE_REQUEST_EI2025-6002_DOCUMENT.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6cfe4a-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989109, "uuid": "8b539609-5a45-49a3-a8ca-9461e6e00d10", "comment": "Malware payload (RustyStealer)", "value": "24bbf60060b269cb4e4e6ed62e41c1bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989109, "uuid": "76d70ec2-eaa2-45a7-ae7b-16fe49649ea5", "comment": "Malware payload (RustyStealer)", "value": "8b6eef79a9ead026158412c29eb44b44485717f708f05534c9e37bfa7e6dc464", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989109, "uuid": "a5780187-8694-4e8f-9ed6-3345edf29a8a", "comment": "Malware payload (RustyStealer)", "value": "c4de893bbdf8bb0489e1c040fa186e5ff5600adb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989109, "uuid": "82797b55-4664-4d65-bfe3-66cb46384cfe", "comment": "Malware payload (RustyStealer)", "value": "fa182f7672e76880f44b779044f234ae8e3a2e5047038f15d49ccdb1a00a590597a9ed074d04ef0021a8c6ad4ba9a808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989109, "uuid": "66178013-8270-4481-aefc-70fa55af8d9a", "value": "T1B834126459480D8CC7CF5AF1FBBED4AF7E60DC5807B39CB3A0550588E8A02767AEA50C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989109, "uuid": "e3858f6b-ff38-42c2-8db9-31f08b495cc3", "value": "b4425ca00d20a616c3daafc30cf1e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989109, "uuid": "652f2f9e-5628-48d9-9a72-896663330e27", "value": "3072:OkCPnA+bp2woBGuQidjfgnM4J9XgIoegsQsbOGPg2tiaYN0SNUVOr00tdDSCuAi2:OkAnxbp2woBqR/QIxbjg2wNU8g0diO7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989109, "uuid": "63023c3c-ce3d-4233-9d11-947dc0cc81f9", "value": 247704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989109, "uuid": "4c8b3c99-5a8b-461a-9a13-a3eacddd4767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989109, "uuid": "c43c1a6b-c448-40bb-aa3b-3a8f166b25fd", "value": "SecuriteInfo.com.FileRepMalware.22751.28682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1addad5b-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1748930881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930881, "uuid": "3286de6e-3b05-439d-9c7c-12e09547d1d8", "comment": "Malware payload (GuLoader)", "value": "5adb20d0b8b31bcc748b0a49373a68df", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930881, "uuid": "3ae7f6ce-5b19-4b9e-95fd-2643fc2a5adb", "comment": "Malware payload (GuLoader)", "value": "8b7d071b0950a3531557bde8fa25ad9435a29f6778a50a0e9b67733c72cf0202", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930881, "uuid": "4733c590-a76e-456a-92db-a15d8b66b1e9", "comment": "Malware payload (GuLoader)", "value": "70f8eed611b7fb8b817acdbc78bc136f6921db5d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930881, "uuid": "e17d37ea-1105-4472-b2f5-2ea93d0334d6", "comment": "Malware payload (GuLoader)", "value": "33a493e9fa5da1b476b98beb12d3455b4efe4103c1177d42d8ecf8e5fe02a31f7d40d342a43f1a90f261122d0561acf4", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930881, "uuid": "4df83565-f06b-4da1-8258-62609439131f", "value": "T1A085F147FB818AAADA5C237849F3476D0721DCC1BF13060F3748F31978F6E64AA96259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930881, "uuid": "eab36178-6720-4f8c-a8f8-e48f5084fa19", "value": "24576:d9Bb+pxtVYSbOmDeJgO3xcZdQKSPft5njSRK4CMSB3TcZTUqWd3yI4t6cj:d91gxtVYSb/D3OBcZdK5nrkZT8d3RY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930881, "uuid": "2d6a8866-82a7-4e8f-a524-4fc22fd77300", "value": 1790464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930881, "uuid": "921eadc5-afe3-472e-97c7-5f98d81cd2be", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930881, "uuid": "cf67cde9-06a8-49ff-946f-73def55b53a4", "value": "purchase order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3d0f9f-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989104, "uuid": "a355fd24-8756-48b5-9769-e78abd2fbe88", "comment": "Malware payload (RustyStealer)", "value": "c75fa477591c1c12299500d01df90a90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989104, "uuid": "873100c3-f790-4ef5-8005-f141379d465a", "comment": "Malware payload (RustyStealer)", "value": "8c1077c2447be29e996c6ea3f0e4da5fa01408b3ace3833387390c3a41cb358d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989104, "uuid": "035e6c5a-40c5-49c7-97f4-626d7d61a524", "comment": "Malware payload (RustyStealer)", "value": "46c410a9cdd7d2a9d80f2af6cd50addf1b3c2107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989104, "uuid": "eec40571-4489-46e5-af9b-bc689c7415e5", "comment": "Malware payload (RustyStealer)", "value": "3dfec60e8e87a90f694b108c88a2cf1212049e45cbb158827a842a3242dc19b3b65308bc986237c8a6ff43a8c13a8c2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989104, "uuid": "8a9451d2-9f39-4cd6-af85-bc157cafa703", "value": "T14BD4492BE36004A7C53EC07AC30E54685F6EFE070618BBBE0D7752713DA2EA46A55B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989104, "uuid": "8760fc72-64ae-4e12-9ff8-35f6c4ad5682", "value": "d16ddcb565c3e1ad6a5628add3fd21e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989104, "uuid": "1810c5e2-ae89-41c4-a8dd-4b54b6c95d75", "value": "12288:t5r3T50ypgi5QlKgn1KqGMJhLLXEcaXkC0bRf3Z4Gs481kvPZyXKApsR9WsYsnec:t5rDKypgi5QlKgn1KqGMJhfXEcaXkC0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989104, "uuid": "c23a5404-94fa-4c78-abe9-0229cf3b80b9", "value": 647584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989104, "uuid": "ec371eb5-23c9-4559-89cb-99c2f311a3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989104, "uuid": "e9b7fbd7-f9f3-4211-86f4-30fe74c41529", "value": "SecuriteInfo.com.Win64.MalwareX-gen.3190.20098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d389d267-4089-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748962115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962115, "uuid": "63b4e564-2e7b-4da3-baee-959b045be170", "comment": "Malware payload (Mirai)", "value": "fec2968a4dbfc30299b26d192c665f56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962115, "uuid": "3d3a4c4d-ab53-4788-a45d-533946869e79", "comment": "Malware payload (Mirai)", "value": "8d11b153185ad2d679ec02d4a7d2ac12b48484f4cca4eb626b0ef417ef2f0388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962115, "uuid": "34172f0b-5e01-4dda-a347-f4cd13fe1eb9", "comment": "Malware payload (Mirai)", "value": "688410e1d62c032f619ac4561a6727b87f07f3d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962115, "uuid": "2c64fe93-0497-478a-9d6e-553fa33fcdd3", "comment": "Malware payload (Mirai)", "value": "6cafae6d3eefb13b26300ce47b2a1416f0b730bc685995a577d0af900180fba5b0219a4820a3f0fe73b5205c1805690a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962115, "uuid": "26b60638-98e5-4e2f-abb7-71d5fb1cef23", "value": "T16943025A488A7C74DF2128FAFD238246D60306F8B7E1B05097790B646C76D0862FDECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962115, "uuid": "6aa8da15-f337-4465-98e8-8689bc9c1c25", "value": "768:iQ7DCOI+BNn//gCegU1ZdGFMfcj+IR2kydcylwtU668njgcb480b9q3UEL+/C+9U:i0gT1ZdGafcj+y29uURc2qL6G3GseA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962115, "uuid": "771e90af-7bbf-45ed-a640-62cd7f27ea66", "value": 59788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962115, "uuid": "72e556e8-23ea-45f5-a072-22e0f45cccd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962115, "uuid": "b4865717-1c8e-475a-b7ec-1de2c3118e05", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20bae16-4048-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748934195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934195, "uuid": "33538796-abb5-4bd1-9eb3-d5197d3c5c46", "comment": "Malware payload (ResolverRAT)", "value": "f41b6918d30d03e3e0ac499605a3eb44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934195, "uuid": "9fbdbaab-8827-46ec-a67f-b9d0448013f4", "comment": "Malware payload (ResolverRAT)", "value": "8d6808e8f2e345b51b5326d5c6aeb98ea0a79dc2ddcc243f6857371f89666600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934195, "uuid": "fe4aa0c2-aa87-4365-93f0-e25f7818a8aa", "comment": "Malware payload (ResolverRAT)", "value": "ffbf4c1a792c684d2dab677bfed36eb58882c87e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934195, "uuid": "41bb3344-a01d-4b85-bcb1-37bb52ec5b27", "comment": "Malware payload (ResolverRAT)", "value": "ba0b9c40c7dd4f3c6816546f2a13d94e9c6af3f5b6ae3b7ede7f7bb87d05a3a2abdedf9447c90a0385feeac7a36b7158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934195, "uuid": "257913c7-2392-44a8-90f5-b909fa409d55", "value": "T1DAD44B34B596C0E7C312673C4F1CE6561229E8665BB427CB33C52A5B0FE62E78B1790B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934195, "uuid": "bbc95b6a-4e65-4c97-91b4-9e2fcaeb16ae", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934195, "uuid": "80e7f834-ae9d-4208-a85d-f320295d29ce", "value": "6144:RE2budcL391kxodgF/7KXNvo5MQg4i02g12cgj:K0Ui39aodgB7Ksdrl1Lgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934195, "uuid": "3336cd86-7e79-495c-9015-2540758e5bac", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934195, "uuid": "802c4ace-dd92-4bb8-be03-fc29b3c4ce4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934195, "uuid": "12aac725-e577-41fb-885f-a25f44a38905", "value": "Filejccccs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108f6d7e-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748928716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928716, "uuid": "804d4d6b-989d-49b3-be4d-bc80d284bd29", "comment": "Malware payload (Prometei)", "value": "4e7d7f4b11f8a52f0202eb7517a62edf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928716, "uuid": "27287685-84c9-4ad2-bcc6-eba436efc3d1", "comment": "Malware payload (Prometei)", "value": "8d71f81dbf0e9eac12a92ddd9773ca03295cd7ed52cdc1df00eabf2edaa1b6ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928716, "uuid": "6f8a7eb0-1745-491f-a644-71c5be672552", "comment": "Malware payload (Prometei)", "value": "70205ce067eb5c0e05f057f36eacdd81ea3a8854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928716, "uuid": "b73c8cb4-4acb-4241-a216-14fba42b381c", "comment": "Malware payload (Prometei)", "value": "45994e40d933d2ed28f077ba07b4287eb79b3a26d038be695611d19966d2bae799bf53f8ab194f618d57cf0a8c00e848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928716, "uuid": "62ddc038-0486-4654-ae04-2d044c51e6ee", "value": "T1839423F8C83D2E3098169B3CBB1A826CF0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928716, "uuid": "bbce1ece-5df9-4c27-b6cc-ad057e0feb34", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitggD:25WOSACZSV6eKRH5EPiamb4DsDwwcwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928716, "uuid": "c53707dc-5d82-42d8-ac12-b7acf49921be", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928716, "uuid": "756c1f7a-0b83-4466-b6a2-e167d6f0381b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928716, "uuid": "e29556fb-e31d-435c-afc8-df8573d33db5", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa16f954-408c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1748963334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963334, "uuid": "0d291001-e287-47b4-8240-fccf9f3694e2", "comment": "Malware payload (SSHdKit)", "value": "409057abb23a9195661b636f605384e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963334, "uuid": "ebe71485-a9bf-417f-bc22-81db2d7c8fc6", "comment": "Malware payload (SSHdKit)", "value": "8db1015e32fef251db876a5a70feeed58a6e10fb56e6a5ace30350a338e6f636", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963334, "uuid": "cfc85325-8b14-4da3-9938-4a4299c949cd", "comment": "Malware payload (SSHdKit)", "value": "09c8ca3be8db2fd7d16fe43131f0194be2025713", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963334, "uuid": "4c8f4262-e5f1-4840-a334-3986a0cf0cb0", "comment": "Malware payload (SSHdKit)", "value": "f33e127357aa63bf14981e2062739eadfd98c52a9b6b477830ab7fb1f1cd3a30ecd2793a873b53b50fe062fe367975e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963334, "uuid": "3485df85-3219-40f3-a56e-3393c31752fa", "value": "T1B8356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963334, "uuid": "fa77f69c-d962-4f28-b39c-a266fda345c9", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVF4Gl9eLtRajZa6ZTxIVD7bLv:E8dbbsO38+T3gRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963334, "uuid": "725d7fc0-86f8-49c2-b815-618444b490f3", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963334, "uuid": "e84994c7-c57f-44ef-815e-1c4b5f03d6e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963334, "uuid": "3eb59379-74e1-474b-a1e8-bcaadcb62a7a", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535fe5f3-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957605, "uuid": "81db0df4-484f-4437-9166-8921975b8f30", "comment": "Malware payload (Mirai)", "value": "5337a2bf5237615e557f811954f3dc7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957605, "uuid": "19d6beaa-6263-4500-9485-0036ef0e161e", "comment": "Malware payload (Mirai)", "value": "8dc244f1a5f271c211d5a8a8d73f3ad077b76ec30f16374fc12ec3703fc8e4f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957605, "uuid": "0c62d495-4564-4c94-b654-127f5646df49", "comment": "Malware payload (Mirai)", "value": "7566852dc6aacf71b4f5e9d1563a4549f9216826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957605, "uuid": "6dd4ee2f-e5d9-4aac-af81-c92d7ad751e9", "comment": "Malware payload (Mirai)", "value": "c35f9667c4ad5570743ee08d6ebdb4c7ee5952a8683f41e375f76955081d1dc8a7877cb9b32014142b83008938cdc1cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957605, "uuid": "80774994-8e95-4d79-b530-e7ac2af8d80d", "value": "T159B2D1A49B956706C1B07439D37C8F93663715A0CAF639362B2093BCDA4245633FCAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957605, "uuid": "f80311dc-922e-4e11-afd6-970e25e45882", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+B+z6xIwhymdGUop5hu7Q:4GaKQFH0rs3zWoDDRsjt7LB9U+Bc6xRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957605, "uuid": "ebf36d52-8ff6-44cf-80dc-7e5a2c9d9271", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957605, "uuid": "0bd4a59e-9077-4e8d-9c37-5267800e55a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957605, "uuid": "753d6823-99cc-48eb-8c27-2ca6eefc7475", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea660b2-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957865, "uuid": "66d9b944-06de-443f-a779-99fd55cb567b", "comment": "Malware payload (Mirai)", "value": "c290c782993c9d1d2909c5099e61a82f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957865, "uuid": "37639de8-45c3-4282-a496-fe7246e784e2", "comment": "Malware payload (Mirai)", "value": "8dd7036a4f1af65f804090988a70c8199d28aa89d9cc2ed337be1296f3975f7c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957865, "uuid": "4b1defc5-0b02-46e0-b1b8-7f0d75efa0da", "comment": "Malware payload (Mirai)", "value": "a476a1ea4f19e63e218e8d5f5581a65dabf45f39", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957865, "uuid": "3155e7f2-cf60-44b7-90e1-3764c0d16c24", "comment": "Malware payload (Mirai)", "value": "7ce7d286aa8d0216f4268e845a9880466c4aae2f933f2aeb0764ae0c2660d7e18b4fba2926287f51f25c9121aff07638", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957865, "uuid": "3283b69d-e3c6-4dac-b4a8-745ef147c533", "value": "T13531BBE4B36121B27CE589FAB5B98848F198A045F8FC2B44DBDC74EDC05DF0C66526E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957865, "uuid": "23d3d894-118e-4a37-a804-b54abdac394a", "value": "24:wbynaWGhQwNzuPBq59cpPyNtWHqdVPhDjkA6K:wbyZVgyg59cpPrKdVPhDQvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957865, "uuid": "d439a1dd-9ac0-4696-bc1e-3620b1922535", "value": 1874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957865, "uuid": "818df80d-0825-4460-bb2e-95385ca505c2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957865, "uuid": "b91edef4-0ebb-4cf1-8f0e-699aa67f78a6", "value": "tplink.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a355f8b1-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994246, "uuid": "d805426e-ee06-4ff5-8252-24e186543907", "comment": "Malware payload (Mirai)", "value": "de74863cfc71cbdf51e7cd6a4f739163", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994246, "uuid": "745746f7-5350-4dfe-90d6-b3fdf7b6da28", "comment": "Malware payload (Mirai)", "value": "8dd90c96d088c2f4c44bb009cc0d42934ca8958493cee718d98f6fbf741b73b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994246, "uuid": "8b4559d5-30dd-4761-95e9-f559404612d7", "comment": "Malware payload (Mirai)", "value": "17444a6736f92497819d0cc295d978f13393a164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994246, "uuid": "8b477a8c-ed76-466d-b310-4bc71d7ab8da", "comment": "Malware payload (Mirai)", "value": "3a7060fc395bd57f47da817d519578b83cede709ab2cd76642d4398715418c2ecb98260612f6f5b0201ce8791ba3319b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994246, "uuid": "fc9d9be3-c068-4b60-a063-ba23e701f3ed", "value": "T1B6A31A32A641C673D04306B1129B9F161D32FEFB1A9A9A16F36C7CB49E350C5B521FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994246, "uuid": "33233d13-4eb7-4d1c-9d31-4ed889717865", "value": "3072:he7EqeQUHfPyjRJ9rBFKqngF1QmqoVcqq6GnQOT:heZyo5KqngPQmqoVcqq6GnQOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994246, "uuid": "65c62bf5-d73a-4b21-8f67-ccc7541d0e2a", "value": 100607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994246, "uuid": "1dd281b9-bf13-4e9d-9a07-ce36bcd0a8af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994246, "uuid": "50639fae-71b4-46b4-8284-4ce9be47d69b", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7efe98f-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963867, "uuid": "b5d82ee8-4fa8-4a60-9284-d8b823a19f9e", "comment": "Malware payload (Grandoreiro)", "value": "c305caa438d47baf284bdc5439c95368", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963867, "uuid": "2a054890-bb39-4466-827c-4a37f8cb557a", "comment": "Malware payload (Grandoreiro)", "value": "8e17e9738e4887e2f70f285a060577d608bb56fc709c36226430863d6d6d951f", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963867, "uuid": "351bcf67-5997-43c3-934d-84f96d84f57f", "comment": "Malware payload (Grandoreiro)", "value": "d635cc03f2d5c3e972205205816f5dd30cbd190d", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963867, "uuid": "0d89a41c-f75b-4558-8900-143159106688", "comment": "Malware payload (Grandoreiro)", "value": "15a90e5147437c7ee8f5906cfb844b36f53854e8cccf661063cf61f18cbd3e9371c5ac2e11588f2383ee6012b17d55e4", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963867, "uuid": "0cc38652-a2ab-45a5-ae7d-2b2600a0edda", "value": "T17F0623B205547DB796930A15205F3F994E6C7DEB8828B5ED37CC18C671EAB608C4F836", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963867, "uuid": "87929680-c2cc-4cf6-a623-7f603e4687f1", "value": "49152:qpOB4IWBWjr/qd5SgWgkkmpE7izb4JAqX9jEukIcUKRVUHtCzKY3:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963867, "uuid": "7ed91356-91ee-4a10-ae1e-2985eb211bed", "value": 3943309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963867, "uuid": "a312eea4-432e-4ec9-a013-df9fdc2b85c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963867, "uuid": "29b3f283-8d9f-4348-a217-8c8de150272d", "value": "8e17e9738e4887e2f70f285a060577d608bb56fc709c36226430863d6d6d951f.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b21c51c-407c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956356, "uuid": "5fec0788-3090-4aff-a54f-dfa3fa147bf7", "comment": "Malware payload (Mirai)", "value": "51317e60fbe1d8531b2a9207b17de4d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956356, "uuid": "971bc66f-487a-4e5d-b769-7e80a9199ce7", "comment": "Malware payload (Mirai)", "value": "8f0201448ea4890fe175e53e4d2d8dd5a0d89e4a319805c56f19bb941e846ebc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956356, "uuid": "d0c733f7-2cf5-4c78-ade4-763d63643981", "comment": "Malware payload (Mirai)", "value": "9c7d48c7424751718681efb9e92dde64c536dc28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956356, "uuid": "4d815e2d-68ea-4182-9a22-dc3ccca26768", "comment": "Malware payload (Mirai)", "value": "250b14491152c3fb5b3f7a5c03f81cb3856b59b7fe4321454d63b888aa045f2762d3a108b969affddc05425d5ddc7878", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956356, "uuid": "d3c1563d-ca0a-423d-adbe-552c7dd8642f", "value": "T1F5735A22B9351937C4D4947B62F74B32F5F643CA25A8861E3EB10E9DBF20A403647EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956356, "uuid": "eb5786bf-684a-4a56-9d14-32d6fc4d9d0b", "value": "1536:jQywkl6wfG+cCTGt1FsY65bhb1AEPct0ndK:ECfMVsYKbHJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956356, "uuid": "f33cd84d-5baf-4ff2-b0ba-5f66c30e927b", "value": 75472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956356, "uuid": "4d2e579e-68b2-404e-bf49-ac9eba5cb24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956356, "uuid": "ae128fc1-dafe-4522-b045-da25910cae50", "value": "neon.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36b1f55-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928104, "uuid": "54313cba-ad10-458b-9d7a-756d497c3423", "comment": "Malware payload (Mirai)", "value": "6e75e7e95e4c88c130681886618904f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928104, "uuid": "69390914-0849-4a99-94c9-c8332e6e4962", "comment": "Malware payload (Mirai)", "value": "911674283109e5689322ef735402c2707cc8ad1eaacc641e6b147922780e1ac6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928104, "uuid": "6cfc82e9-dc50-429c-837e-f990a6afb8a7", "comment": "Malware payload (Mirai)", "value": "3572210407c251a4edd69a1fcc946082b3d55aad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928104, "uuid": "ddea24ce-0bc4-48e3-b8b6-f200a5031295", "comment": "Malware payload (Mirai)", "value": "4a66daec01a716244f8ef0b37648a0d00dc5978570f28fcd48c857c2ff4c0b6de40062b34ebd52eb00a574af3e117413", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928104, "uuid": "545b53dd-dde9-4df0-945e-4d81b92eaba2", "value": "T13C43028A9037D073C9329C72632F45C23B0B487D704B3AE512E616BC30ED7636AAD5A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928104, "uuid": "d7f6ccb4-01e0-4ea1-b783-a32ad4f4f0f9", "value": "768:ghnKtEZrlGF8BCwdPoSjpqLHdJ0ogkyjXB49q3UELHnVxfTchz30bOSFU3EQnDD:Gn6EZnJQ0AdJAkoBhLHVCEzFU0O3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928104, "uuid": "166fe3cf-8c11-4214-a2f6-6493c33c1618", "value": 58156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928104, "uuid": "4f6caf4f-2001-490f-b0aa-a66c07010a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928104, "uuid": "16adf8e2-929f-4063-87f1-7ddfd8e26105", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b85760f-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956706, "uuid": "f4b7dcc9-9ab6-476c-a569-10c114400d7c", "comment": "Malware payload (Mirai)", "value": "3bb26a0add0eb7989834cf127e196c21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956706, "uuid": "98e3be17-7cb0-465f-b743-f396c3c8bb9c", "comment": "Malware payload (Mirai)", "value": "9135518a22fb2562389d0661774c08f65c29983dd69a3c3a3af5c57f3a60ea86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956706, "uuid": "94ce6e89-22e1-4a3e-b474-f47cd2f04139", "comment": "Malware payload (Mirai)", "value": "b53325343db52f15b1bbedf8e5e7461ce4a8d2e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956706, "uuid": "775e32f5-2e9a-4774-a989-199b9c36abdf", "comment": "Malware payload (Mirai)", "value": "d1b6cfd3e85bde8d4081e10e6d0f83f0df800d73c64d9b42417ea33393dd1b0cf7dfe665ead43c7323f408d409eff50d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956706, "uuid": "0c71b1f9-2627-44df-9dd3-8bec0dae093d", "value": "T1B283A44D6F319F7DFBA8C73857B79A506608338A22E1D485D1ACEB060E6024E741FFA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956706, "uuid": "9c0d53ae-046b-4797-92d3-30622b4229a7", "value": "1536:NYxbiIEXLbY+rWU87fvZH0vKJJ56BbFNl1LGKjMiXzG+6:N0bY7lmZH0iL5iNl5GKjVXz36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956706, "uuid": "31ce9e24-7648-4bc0-888e-0fc52428ee16", "value": 88720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956706, "uuid": "8457d79a-b84f-4852-8fc4-22a4e333d32f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956706, "uuid": "2d407de2-e2b1-45b9-bfb7-ac6e6bba95d3", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c926305d-40c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748987438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987438, "uuid": "745ced63-fe46-4a88-bd41-b9c2f96f0cb4", "comment": "Malware payload (DCRat)", "value": "d4c8f87af0d29a964d3776eb0d36486c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987438, "uuid": "777ada2c-fb8f-4ce7-9e9e-9f2b1482195e", "comment": "Malware payload (DCRat)", "value": "914e7d380d031d92b71d5aabed2ef9686efa2079e482fff93869f4cbe27b8fc5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987438, "uuid": "79d422b9-a07e-4eee-9888-526a410e97a0", "comment": "Malware payload (DCRat)", "value": "ac8338e82a727c6f5068d76a45c54e73565b2075", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748987438, "uuid": "896938e0-3e13-4094-8118-29ec2e92e911", "comment": "Malware payload (DCRat)", "value": "fd51e97382d846c325df64dc386df7309ed1605b733a133c1db95ee1cfc92ab4c87a1e94e56f0d9a34a4b10e261e2306", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987438, "uuid": "1080c46c-6469-4cc2-9042-a198945e51e1", "value": "T1CA06F15669E24E32C27167318597213D92D0D7263622FF1B361F20D2AD0BBF58B722B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987438, "uuid": "07e392ec-c876-48a8-8c64-fbee96e34446", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987438, "uuid": "34fa0476-530e-495d-a347-e017fd781c23", "value": "98304:qOl96JGoi4ak2H2qC3rcfvXQl/0kVWZe:qObBo13Cgl/0yWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748987438, "uuid": "e8a32179-5a32-4a1f-87e1-7a712c7fa318", "value": 3668480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748987438, "uuid": "d00e078c-a677-4e60-a3c0-d1a4de99126b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748987438, "uuid": "ddc22595-af4e-42dc-bed1-f71893888372", "value": "D4C8F87AF0D29A964D3776EB0D36486C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1518ebf-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989196, "uuid": "89ec22ac-fe0c-4d8e-b2a6-a45c5f76d5cb", "comment": "Malware payload (RustyStealer)", "value": "f262d272ffbeeb1e2d41a18cb457a1dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989196, "uuid": "0d564942-46dd-41a1-a267-e4e97881143f", "comment": "Malware payload (RustyStealer)", "value": "917ccdc2d3ad53fb5fd43e5f45e2ab6359e931f23110220213c74d096b1dabca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989196, "uuid": "a15036bc-d381-4a00-a47f-ec04941c525b", "comment": "Malware payload (RustyStealer)", "value": "64458c9f9a6c09fce205207c1c20207f493627ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989196, "uuid": "dbaaac25-d422-498e-9aa4-7a90feb52c48", "comment": "Malware payload (RustyStealer)", "value": "607ea731b330a4456b6e52218e2976287a965845abd63dfa7da8f5702e4a8597f52d81b7addc356e1ef064473caec8cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989196, "uuid": "eeb6a10c-0d25-4604-9de7-c96ffc1d129f", "value": "T11C34124B19480C1DD4695ABFF3FF8C1FB52824668DB499BFA8524405FC62B3A3C9B58C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989196, "uuid": "099fb3e6-6488-4264-91f3-c3cb56cdc6d5", "value": "b4425ca00d20a616c3daafc30cf1e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989196, "uuid": "1c994b87-4b6e-41c9-9e03-46e50b1702a0", "value": "6144:IxL1jJSkD4TrtkxFrdMumVPPU6N+Icctl4JG9Bh+Kd7:Ixh74NkxJdKi6N+Icctl4uk87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989196, "uuid": "3148d456-727f-419e-9ed6-ab92d3ca414c", "value": 247704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989196, "uuid": "6afc0b12-0d94-4a23-9815-10ba0d32d1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989196, "uuid": "7f21d999-a298-456f-8ff5-cac109356a01", "value": "SecuriteInfo.com.FileRepMalware.3052.2126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd980594-4078-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748954884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954884, "uuid": "98c99af6-9ae0-47cd-8aa4-b12dd6096ea5", "comment": "Malware payload", "value": "782b59ab3c8ec417abefad8691f0d2f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954884, "uuid": "3d961d6b-ab6d-4d8b-b6f4-b36c911ac352", "comment": "Malware payload", "value": "91a35fedae587961a09410f55ad87ab20f938a2d4a0de199754fd39824818795", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954884, "uuid": "5e60e2ac-3c50-4ea4-a06a-c57d0f4ceb69", "comment": "Malware payload", "value": "bb5c665e4fda93292431043989a4145890a301ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748954884, "uuid": "48326ff2-877a-4f8f-ad01-3bc87d94ee67", "comment": "Malware payload", "value": "78e31afaeda62d2bef78739264e3c1e1595e462625af83a8d249f8dd929aab13c7c9cd968115d5f599da8acc32e4ec3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954884, "uuid": "18b36394-7551-4c90-9833-d0217b265186", "value": "T193A41212E290D8FEC4DAC0B0469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954884, "uuid": "d79c5c36-ba3f-4233-a18b-68f42d9a6653", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748954884, "uuid": "135b864e-a1b9-4a1a-bec8-054c761b71d4", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748954884, "uuid": "7d29480a-f33f-42c0-832a-06e95d9bc7d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748954884, "uuid": "4455b595-c4e7-4645-ad4f-8ddb2dee25c2", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a58e19-4044-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932137, "uuid": "40cff980-a761-4375-9b1b-a3260f025f56", "comment": "Malware payload (LummaStealer)", "value": "6a80a473e7cd4b0b492719044f7dfc54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932137, "uuid": "a667a03c-8591-4d6e-a7be-40795d50d24b", "comment": "Malware payload (LummaStealer)", "value": "920d3af8c02d5dff19a9a5c3493eac391b71fc6efa4adc6a70306de455afe042", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932137, "uuid": "3e407d50-d012-4bf6-b91f-d71a28e6f682", "comment": "Malware payload (LummaStealer)", "value": "bb43b08de1a9f2c37b67e075978afc4790d21fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932137, "uuid": "d20ec980-022d-442d-9cde-2c9d457ed6c3", "comment": "Malware payload (LummaStealer)", "value": "363155894a027ddbbba66ee10ab826f83299b434fb5dbead0cd436785c86dab5199d360c01b9178b63d2b56e88acb426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932137, "uuid": "b1180552-ce06-4e40-b77f-a996beda996d", "value": "T11F85AE399152A2C6FC2A00B641A1A5E93462B733C63D2FFF4290F233AE077D15E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932137, "uuid": "0dc35165-5889-4676-95f8-11d7a9256456", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932137, "uuid": "1b05cc74-64ba-4443-91f8-d698efd1510f", "value": "24576:59LATjgcql9XDP81Xbe6A5kS/FHBpzJ+PczY8T4IfzgJPAZU4zdIfzgJPAZU4z4:vLA3ibXDk1re61S7pGczY8iWfhWfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932137, "uuid": "4dc4cdce-dd93-489f-9a9f-f89b40522845", "value": 1769984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932137, "uuid": "0045e31e-03c0-4224-95fb-71d46a76d32d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932137, "uuid": "cc7d479d-c381-4271-bf38-789232b8f5b2", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083971a5-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748930850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930850, "uuid": "b7697c47-c9e9-46b4-902d-87c66242a7bb", "comment": "Malware payload (RemcosRAT)", "value": "a52ca9ebe4ccd07bd2608f9e606bb594", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930850, "uuid": "4c776bc0-4fd3-43a0-81f9-54ce1a228c84", "comment": "Malware payload (RemcosRAT)", "value": "92113ddcf43de58bf61ec22a669d16143c09072f8a0bc2443c77a6d3b4fcb848", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930850, "uuid": "86b55de5-d334-4e51-b6e4-cf698f7b0b20", "comment": "Malware payload (RemcosRAT)", "value": "0ee7248b0e96416e74b0a91ce0bdcc7271f7b6b6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930850, "uuid": "288af2cc-8d05-4223-9ea6-8ff4a01eaabe", "comment": "Malware payload (RemcosRAT)", "value": "dd6a2ea210a78be47632fdcfd25fabc7aa9eb5db833bcaf22c3436642f775775b178fb1291fa15c44ddee33d8e5a70c4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930850, "uuid": "e355056d-482d-4276-9161-4576c8f7900f", "value": "T1B3559D05BFE0FE13D524037B89EB57653271EC82AB13470B1658B71A2DB17D81B8B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930850, "uuid": "6f6fc010-f1d3-45ba-840b-98c122a73b41", "value": "24576:y1j7sxqAi4C2eU7uMYrTnV4S/Giax5XP3V:Aj73Ai4JZGnV4S/kP3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930850, "uuid": "1a835351-581e-40e1-8836-888a45989857", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930850, "uuid": "5c3fdee2-8204-4e72-8a5d-ac83764a4950", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930850, "uuid": "deb1bd76-7d4b-40fa-afe8-f5888a6076f5", "value": "New Order PO.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c18c55f-4084-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748959740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959740, "uuid": "bf459162-3160-4953-bca1-032028c83626", "comment": "Malware payload (Mirai)", "value": "b8a78332377aaec791fb426bd40b8bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959740, "uuid": "afb2cfe8-7e5f-47eb-a775-954491f8be3a", "comment": "Malware payload (Mirai)", "value": "92a0d013f2a861e7cd1b4c933aaf4bc160cb4f80bbba93acc7c058903e5f0958", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959740, "uuid": "edacea90-8267-4686-b445-04d12bd56ea1", "comment": "Malware payload (Mirai)", "value": "fa573be02475fcc5fe0353c217021b8d32b166b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959740, "uuid": "b2c82e95-eb81-416c-a2e2-6f06b1f12af7", "comment": "Malware payload (Mirai)", "value": "a3cc34739c8e5ff497d629c30e1fbaf7f3e9174be6d4f0d80cb980ef89a2a1a95a911994516551f04741c39ca64db74d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959740, "uuid": "2f150f6b-3dd2-40f9-8a45-36ab918efd73", "value": "T1A7233B42322C0A47D5A25EB0393F0BE093FFE99120F4F5886A5F9B468675F371586E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959740, "uuid": "8e66708f-d0af-4b26-9254-64fcce88e75b", "value": "768:4I/Ls6WF/1IZavM0G02MRWE1rf3+ayCHLSBnHBVZVzoZZYXBRua:/3WF/1IZj0zDxYvKmXTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748959740, "uuid": "465a5f8c-9dd7-49e0-bda4-7f4e593897a3", "value": 47636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748959740, "uuid": "db5a4dd6-1dfb-4c6f-a1f9-4de4a771b09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959740, "uuid": "a46d9a52-b2a0-4440-a88d-fc8d186f2e71", "value": "hoho.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e07ef13-40a0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748971796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971796, "uuid": "ad285bb6-a191-4e13-9aef-72ea4f1de8b7", "comment": "Malware payload (LummaStealer)", "value": "cf78a605eac522e47a073eb45c9e55c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971796, "uuid": "004839ef-b02b-440e-89fe-00169f43da2f", "comment": "Malware payload (LummaStealer)", "value": "92a99d882b645f394537538bbbdbedd9a648ae00477cf564474aa77ab1ec1599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971796, "uuid": "f42ee87e-36b5-47a5-a15b-6c50089453b2", "comment": "Malware payload (LummaStealer)", "value": "9c6113237637ba53ae47a9a7e74031b5bee96676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971796, "uuid": "de8c4f16-869f-4a92-b8a2-c024770fd75a", "comment": "Malware payload (LummaStealer)", "value": "ec232b74559a7b740f825ade3a99663c99b0289a37c0625da0f20ab638098079893d765ff8fa20addd2de7cc2aa77076", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971796, "uuid": "09516eb9-70eb-454e-ab71-62c0b837478e", "value": "T19F85AE399152A2C6FC6A40B60171A5E83462B733C63D2FFF8290F233AD07AD15E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971796, "uuid": "c692ebd8-07dc-46d9-96cd-23d33bd21952", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971796, "uuid": "83f36a0a-621f-4500-b017-46d449e39117", "value": "49152:PLA3ibXDk1re61S7pGczY8tb3Hitb3HiH:PLA3ibXgTS7s4SK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971796, "uuid": "755d8c98-a9f4-47ac-9169-401a61ca1c6f", "value": 1778176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971796, "uuid": "d6ba6bf8-f127-42f1-821f-001682e8621e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971796, "uuid": "339890a5-b2bb-4aea-8d8e-8c29e17efc74", "value": "Updated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17955dfa-4091-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748965235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965235, "uuid": "0035b9ec-268f-43a6-8a23-0616057cc197", "comment": "Malware payload", "value": "d72714251abca41437952fa1c69606e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965235, "uuid": "56842ae8-9b7c-4212-83df-220e8f91bfc1", "comment": "Malware payload", "value": "92bf5c61bcefa13a20a2a49c3d9ecc59451e665df15446f55109e94440fd7cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965235, "uuid": "7b525c8d-d6fc-4b87-a401-6719d79ac006", "comment": "Malware payload", "value": "3e4f57bf2aff18f572062049b8f0cc29b43398f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965235, "uuid": "626c248b-2b21-4a87-b6cb-9c91be12b04d", "comment": "Malware payload", "value": "420c2aecca61211993241eaad6c076244746c464e35d900d0fa8614c47db6e0f1a4ac975765f7f2495b6f78238c509d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965235, "uuid": "4f4cb1ae-c846-4374-a1d1-165dd3b2a0e3", "value": "T1090833B2FBD0D0BEF1545B3381F15A144BA63ACA07F0A202774DE2C9057AB58F5399A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965235, "uuid": "8d6c69b9-d46d-4b07-9321-a9d91b07357f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965235, "uuid": "59a80b22-c90a-446f-9268-7044bf4b3aa0", "value": "1572864:tg+e4h7TL9BHmXWLwCXvYmaBcSrufGanp7GgtcQ3AsERyqmN:txe4N2XqwCQmaBcSruZkUElc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748965235, "uuid": "83d49413-efc2-47e2-a5bb-6d33cac4030e", "value": 81813917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748965235, "uuid": "7c5cf216-65ab-48eb-9eb2-bb743997122c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965235, "uuid": "c3d8766a-6956-477c-af63-30f8320e289b", "value": "DiscordImageLogger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d06443-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748960936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960936, "uuid": "9a4c5f59-f27c-4392-83c8-079bd88b59d3", "comment": "Malware payload", "value": "9c748d2fc6afab316124cf7e4cce67b7", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960936, "uuid": "bb74c084-ec51-4016-bc48-cca5f52bbac6", "comment": "Malware payload", "value": "93970e7711a4655a535bbdd5ec5539f73fc13760caf1a1d6f488b4f6e1e76481", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960936, "uuid": "9756d270-dc35-4cc4-8483-fd46a3224044", "comment": "Malware payload", "value": "ece9d0abe518249aa6e4e19af29e4b134b36fb74", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960936, "uuid": "f9e14a46-88f7-49b7-8f2e-3c8731b7b988", "comment": "Malware payload", "value": "dd7ea1f3963cfb4419358e923a81849f99d1cb7abb6ec858ceb1571dd8e75a09590e88e8bdb6c6e784cd308e40a36437", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960936, "uuid": "d819a76b-0710-4bdd-b363-68cd23844185", "value": "T18363B6EB6939A0350F622B829932540FBFE05525DE4870D83B6DC8500705B2EDBFE69F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960936, "uuid": "584a0e79-a928-4028-a4f7-5e39b9b0dc7a", "value": "768:o1s63TIBQAVrYtewvYoqAm4u1Gy7/k40WygKoy5K6H4HCbB2Kqd4zJS0YRhzYkGE:Cs2T2tTOgm59H9zJBPVLIFynCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960936, "uuid": "b363088f-99aa-4d83-b30d-980035713eca", "value": 71969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960936, "uuid": "e5c34efb-c9a0-4731-a2b7-33f0bdadcd29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960936, "uuid": "cf3bd760-4222-4c76-bb3f-0ae30e18233e", "value": "restartedentireprocessfromthestartingwithnewgen.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce1d732-40a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748972492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972492, "uuid": "0b61eb23-64ff-4b95-abc1-e3f5e26f8926", "comment": "Malware payload (Mirai)", "value": "ab75850926247092b457c2d75b92baf6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972492, "uuid": "85305b7f-d9f3-46e8-82c1-40eb0dbcc3a3", "comment": "Malware payload (Mirai)", "value": "93fa921ca2089cca636931a68674f0a95288af397fc9ca71ea80f8729771d83e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972492, "uuid": "7bf7ee0d-7abf-4a98-9da7-823d1c71d878", "comment": "Malware payload (Mirai)", "value": "3151d91f0ffbcbbf3844cdd7155a78d5b6aefeab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972492, "uuid": "b1a47206-7024-49b5-b7df-d99eec1218a1", "comment": "Malware payload (Mirai)", "value": "8046e9620b38b33a42e36369021ce83940d5e5d86549a5d51bb42a2add04c32bc9c6c40a26d2364e04e3322ef424b9ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972492, "uuid": "4f697f52-1f70-4cbc-bc3c-7417048ed9f7", "value": "T172634B42B3580E1BF59709B0243F5FE18BBFECC212E0B685694FAB554972E332449E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972492, "uuid": "5b405d95-46b5-47d2-95df-65d594dc005f", "value": "1536:N1DYxRgDUGBeocWuf1ga8M4B1+56Ms46hHKyg9:N1wGALz1gaOM6MAhx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972492, "uuid": "21f17f11-1528-4d13-8d62-d4c140a9fa65", "value": 72352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972492, "uuid": "656dafee-2131-4ecb-b69e-14e53db90fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972492, "uuid": "5db59ad5-21b4-4a61-802b-a20a1bccee97", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dece03a6-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956980, "uuid": "457057df-9f26-440b-9e8b-636f68a94069", "comment": "Malware payload (Mirai)", "value": "e4c8c93c9d81fc6f48df262fc5c1690b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956980, "uuid": "32aa331a-fb69-4eff-8f59-04d5ae291793", "comment": "Malware payload (Mirai)", "value": "94070d9fba3e46f69c03c9fa7dcc4319d0dcba115c5d1ebbe3e4834956099e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956980, "uuid": "fb0b2893-5d02-4d54-acac-cf9ffca849e6", "comment": "Malware payload (Mirai)", "value": "fc9eb4ae1087adfd5339fec65d0a8461f06f57af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956980, "uuid": "753aee21-4259-440c-a5d0-a9ad5e55fb30", "comment": "Malware payload (Mirai)", "value": "78e1163e7cd11566a76ea89b0f7870b7989516aa1f0a42e402c678fc407b811aaa33ece9e1c51690d54bcab531051659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956980, "uuid": "f6477c58-acde-4e8a-b1c3-59ca13caa21e", "value": "T11CE20221A368090BD4DF403ED59A2CD76567E284B3468BFB271CFC5EE65F5A80126D12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956980, "uuid": "78a51f60-3198-4960-8b30-03352738cc3e", "value": "768:Pjy4bGvf5WwCQe2VAEadiQZ/Uy8z83dmif5hPkGSRY30plUtO:by4bGpacpahZg834iDjxYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956980, "uuid": "15c4993c-0624-4b89-837d-cc66ac6cae6b", "value": 33680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956980, "uuid": "4ddc036b-d638-4edb-9bad-710842155375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956980, "uuid": "301e30a7-e602-464d-a06e-c196716dd378", "value": "neon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fde9be9-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748930541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930541, "uuid": "cd01a8e3-4343-4c93-929f-ccd486d3a52f", "comment": "Malware payload (Mirai)", "value": "7ef91e1012cd51e0e15c9c3abb72da58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930541, "uuid": "9178f362-1356-490f-8305-59597817e02c", "comment": "Malware payload (Mirai)", "value": "9416b4433040e71f35e13d292ef76d5a9dff3cd3e8872988f39b614eca3402b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930541, "uuid": "d01e8ecd-6731-4d30-b92a-49fb1cee4015", "comment": "Malware payload (Mirai)", "value": "751ab2050ac1a7e46961875640824d3962cbc6a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930541, "uuid": "932e138a-1c22-4d03-9987-76c948b3104e", "comment": "Malware payload (Mirai)", "value": "fbc004018ec67b4187319dd23c9efb030e329be1ff978e3d95d4c970c848803e07dbc7b7c962d413b1a47ef698ab66b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930541, "uuid": "779620da-9032-4812-baf7-a43f4b8f6fd0", "value": "T1C4F2F894F8968A1BC1D51379BB6E5A4E3730F3C8D3CE3207E9782B312A8650B1D76E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930541, "uuid": "12b270a8-8fc2-4d7b-81b1-2fdf518cc9e5", "value": "768:InG9/4lnIaDioss5YNcCcWjnXPTuA7EUToDL7scdwd:ylI4UcCcWnucEU2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930541, "uuid": "753457a9-141b-4bc8-bd22-8dae4406b2f2", "value": 34404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930541, "uuid": "310e59e8-1274-497f-99e4-3f1a565d00b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930541, "uuid": "3977a3aa-b742-4bfd-a5d4-01bb415016aa", "value": "neon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a531f0-407e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957263, "uuid": "fe4bd852-257c-42c0-bd7f-e69931afa362", "comment": "Malware payload (Mirai)", "value": "ac31577ee8a8f9cba2e09578c5cdc3f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957263, "uuid": "60114c05-f008-4c88-8cd0-e3daf150f000", "comment": "Malware payload (Mirai)", "value": "94538ea83797f88b31b784e75aa9463c818b6187c872748b835ea39320238c75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957263, "uuid": "cbe02594-0f17-45dd-add7-ee70dec17c1e", "comment": "Malware payload (Mirai)", "value": "ccd36d0f952f737e81c460c0d35ba9162028bfe6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957263, "uuid": "b168b854-6eb8-4d43-94c9-e02f61bd31d9", "comment": "Malware payload (Mirai)", "value": "583c6300987ad2834a519a0eff72650ba6c143aaa75b96f0414ef63916bfedb5b3fb0590b1aefae58a262e6cbfeea627", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957263, "uuid": "961a8669-1cd7-49a4-a897-737228bad8a6", "value": "T1EFC2F1BF76995A67FA28233DF435811F03A4F51CAB9D6B9723404432E95E42D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957263, "uuid": "6d9703a5-4f00-4a50-935c-5fb545542f6c", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHsDN3ww:RMwxdyoEUnDz+Y8tqHWXmMDxRV0NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957263, "uuid": "6c99b178-bd5f-4b5c-b8e9-74049168e7ec", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957263, "uuid": "c1daed7a-81b9-4a8d-b4cf-52c6be5cf5aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957263, "uuid": "b913cfe1-6055-400d-a0c2-55dcfd60cef7", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145ae835-4048-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748933877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933877, "uuid": "546219b3-b847-4fa7-ac00-fc0c228573b0", "comment": "Malware payload", "value": "756e93e1b0bf1592937512e4be108a3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933877, "uuid": "8e99e565-8d6b-4569-9f81-bb7efbefcefd", "comment": "Malware payload", "value": "94e4d621605c4bf98d1ecea36da8f78b7212e8c49242e9be540baaa406d5d52f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933877, "uuid": "167b2c68-b96e-45b4-a876-82a454d511d9", "comment": "Malware payload", "value": "e677988d9680230a6751c8088abacbd7fca04085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933877, "uuid": "c35c22ad-345e-4f8d-a194-4e20c3e35de2", "comment": "Malware payload", "value": "09e1c725a8c812a4302ce307919377cd8e566b1fd30c1350916c317fff70f0fc1fc13d9c513c9e0de59eff0ef176ff6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933877, "uuid": "f207de59-a168-4554-bcf0-f64a9c51ed0d", "value": "T1CFA41212E290D8FEC4DAC0B0469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933877, "uuid": "190772db-e254-4b95-90af-51972ee15fac", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933877, "uuid": "73301670-1bb2-4d73-89dd-dc6125fee76e", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933877, "uuid": "4519e2fd-d30d-4a8c-b7ed-9e3c98baf0c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933877, "uuid": "831e8aea-7bce-4189-897c-c2247f10351d", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0df74583-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Arechclient2)", "timestamp": 1748944603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944603, "uuid": "2e3dc1c7-5c0f-4b41-bbfc-185cfd064dd0", "comment": "Malware payload (Arechclient2)", "value": "f8219a9e0a93353651c0357fb1152b81", "object_relation": "md5", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944603, "uuid": "537b638b-d80a-4246-899c-432e2eb2f2a0", "comment": "Malware payload (Arechclient2)", "value": "954c77d9f00e58e27703ba1ec0ad741275e5ce635234a7f8ec4cf521b81c59fc", "object_relation": "sha256", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944603, "uuid": "30970dd9-4a56-494b-a4e0-25fdd77dd8ea", "comment": "Malware payload (Arechclient2)", "value": "57ed11dd60cb090f567f6d5bbca38c4c9864ea0a", "object_relation": "sha1", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944603, "uuid": "9c34252a-c495-4802-b1f3-a7fb4e3b765d", "comment": "Malware payload (Arechclient2)", "value": "978d18bd65b99ef5d345242fe30b7ab03e0b335b1b1b205e7fa73641df9d9bfc864f1fc4b9ffc502adbabffd7f3d0a23", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944603, "uuid": "d98863ee-ad40-453c-b494-26a261909708", "value": "T1A8D53385BBD464F0C1F58971CE4CE767A7B3E29D2B815D8B9ECA1E040CD7164A20B8DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944603, "uuid": "08b24157-3aa6-4f4d-bb6f-661d78f7a4a7", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944603, "uuid": "21746b45-aae3-4849-a45c-a2ca210d9e54", "value": "49152:+pz3kSpqX9P+DstGAihdkquuBg1Cx+j2Q9nBixceWWN1VI1SzgB1vFb+7wIu2p7I:+pBpY0DsVihyqu+gsq2MnKOc1e1SO9bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944603, "uuid": "febd1d91-1a6d-4f77-84c8-7a9f2cfe0ed1", "value": 3016841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944603, "uuid": "6bce6723-50b0-43d6-b0db-68f591a45535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944603, "uuid": "baf04e67-6929-467d-aafd-46098c7ba0e1", "value": "954c77d9f00e58e27703ba1ec0ad741275e5ce635234a7f8ec4cf521b81c59fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94ed856-4089-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1748962124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962124, "uuid": "233facd6-ad88-4cd1-a135-92a10ffc9903", "comment": "Malware payload (Hajime)", "value": "43e98d7199e32d315a0552b6a4cb7d5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962124, "uuid": "11007471-5587-487c-9a58-9322f3a07a49", "comment": "Malware payload (Hajime)", "value": "955bcc69b70942f6bac6fe37c191e604e34876b0fcc42a8bf0e09a9a7c3a1a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962124, "uuid": "925d8a98-d599-493e-8ba1-0a77ca99c417", "comment": "Malware payload (Hajime)", "value": "7bb9b1e9f9c7b0f40b18e3eae6a6e4fa1101b3e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962124, "uuid": "ce70133e-2537-4acb-afe9-b9f6249e8061", "comment": "Malware payload (Hajime)", "value": "d620a8023c8da1b95132dbc8f6e03b9b03af2da2ba6ef80d5bd01bb11f62544bbe1f44fef1fb98f07948e90c49d991e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962124, "uuid": "d8a0f763-bd71-4d0f-b583-9c7ebb087ee6", "value": "T134E2F24632803763E16255F8E3FDAFCB201A3D649FEE202BA441366270B325C658D82B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962124, "uuid": "4e6f89ff-9e87-4e94-864f-c9b3c68f903f", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8P:yYI0ARqw1qAEW67UIWi7M8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962124, "uuid": "d0f4e80e-8669-4a65-be7a-83e579dc4915", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962124, "uuid": "7a2024d3-a270-4171-83b7-3d515eefe062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962124, "uuid": "aa924ae5-cb3d-4bc8-823c-04fd01ba61f9", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7201dab-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748931197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931197, "uuid": "103fee2e-3099-495e-a00f-5af30a8c26e0", "comment": "Malware payload (Formbook)", "value": "35c3272166911cbd5bfee28acc3b2ddf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931197, "uuid": "0c94a273-68c6-4d2f-a6b7-7588e9749966", "comment": "Malware payload (Formbook)", "value": "95acc0fb595e7b575d10c7a9d4ed83717b1ad1a449e2dc51117eb031cd6381b6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931197, "uuid": "5e5e6540-f9ee-454a-aa44-e8a51ac63828", "comment": "Malware payload (Formbook)", "value": "d8d5f8f0a5e6b3babc7f4288d986aa9ad2c09331", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931197, "uuid": "b3246ebe-be1d-479c-aa54-85061200dab8", "comment": "Malware payload (Formbook)", "value": "eebccb3b4495dd61ece4a6144a39b7f043c80e0bbded021eeb034a4aec262d24e8dccdf0f4dfff3c6033a001ec63d0a9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931197, "uuid": "f8ceb83b-e4be-4563-a313-81719d742d71", "value": "T19EE2A3918D03CDF21936B6A09FE87572FE99010356A4D091B4DFFB311F24BA15CA6ACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931197, "uuid": "0dea7585-3691-4b6d-addf-30218d4dccc4", "value": "768:jSS4CZhlegcSzrrQNllyqOWf4LDM/jRyw+qGt:jSSlZhledy4NBOWI8y9Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931197, "uuid": "ae2961df-5cb3-486e-976c-08321aa4b089", "value": 31903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931197, "uuid": "7f7e71d7-6cfd-4cd3-870e-7a42c4c34be7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931197, "uuid": "bcf1c872-aae2-42f6-a327-81be18457e60", "value": "New instruction.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7529d487-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748931462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931462, "uuid": "a859148f-f7ab-4f25-ba06-0a1114a31579", "comment": "Malware payload (SnakeKeylogger)", "value": "ad718dce7b0ff3b816213dffd83f3213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931462, "uuid": "f3edab53-5908-48ed-9739-c56cc3b0fd7b", "comment": "Malware payload (SnakeKeylogger)", "value": "96249220a24822fbd05234250b8a758270f394bdc2002275b7b23ebfa2aec3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931462, "uuid": "e0af1869-102d-46be-aa5d-acc5b70532e2", "comment": "Malware payload (SnakeKeylogger)", "value": "5d67c0b1bf4011763d35d1d1cb5bc32341f01a58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931462, "uuid": "386fddcb-f6c2-43fb-bb48-e1bb7a097a88", "comment": "Malware payload (SnakeKeylogger)", "value": "2a974858e570f707d2baee67b2247ec9d49baea96c18b1f1bd448e9d5c6e5343cd45828a3c3491c7f48f6a3e93f6522d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931462, "uuid": "fef1f460-b96d-4957-a8a1-07b412e3c4c3", "value": "T15B25BF1373DE8361C3B26273BA257701BEBF782506B5F96B2FD4093DA920122525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931462, "uuid": "360607d7-204b-4461-96a8-610d74ed6500", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931462, "uuid": "e9172142-e643-4c80-8a7e-0e7fba1f22a2", "value": "24576:3tb20pkaCqT5TBWgNQ7adZtNxmiBtWe6A:0Vg5tQ7adFxmath5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931462, "uuid": "22ae67d7-1925-4b48-b82b-75b640e683ba", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931462, "uuid": "ea749ae3-0f73-4039-8dc4-873376ee30be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931462, "uuid": "4ec3b44d-07b7-40df-bd86-d10ce1892f29", "value": "\u00d6deme kopyas\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb39eba4-4017-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748913111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913111, "uuid": "1738d854-3b69-4926-98f8-b1eba4f3917b", "comment": "Malware payload (Prometei)", "value": "a210020fecd3fc58bb993ddc425c5ea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913111, "uuid": "8560bd1c-5f7d-4111-b4df-1eaaa5cf756a", "comment": "Malware payload (Prometei)", "value": "962dfc99b80c99b8279792454d9813c79dab23ff7ce4f8a745c64c80804e1ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913111, "uuid": "8fc69912-6d85-4a1d-bb94-6dd97dfd0ebd", "comment": "Malware payload (Prometei)", "value": "b96d5acdabbcbe576283ccc69a38028132874f8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913111, "uuid": "537c69f8-1a44-4f8e-8fe3-548002a74d6b", "comment": "Malware payload (Prometei)", "value": "61079091bc652928f3db212c74fd66fdd9ab2d815f06e12461efbebf17acbbc323b71a2b56d71c6fcd1151010501427f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913111, "uuid": "4848e3ee-22da-4b3a-9271-a293330686bc", "value": "T1A19423F8C87D2E3098169B3CBB1A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913111, "uuid": "bee4871a-380a-44b3-b657-9295b2a051d7", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgU:25WOSACZSV6eKRH5EPiamb4DsDwwcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913111, "uuid": "1ba1725c-9520-4842-911e-70c2e5d177ed", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913111, "uuid": "27834cea-1252-49fa-8258-ad1915ee5a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913111, "uuid": "4d165b1b-224e-46f5-858b-070fa0066756", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787b2275-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748960673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960673, "uuid": "945200d0-97c1-428f-a329-145e438ca643", "comment": "Malware payload (MassLogger)", "value": "f19a67cec0e7d93a8a408bf8a8ff8b18", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960673, "uuid": "2415b5f6-050a-4b55-ae89-76e3003f48f2", "comment": "Malware payload (MassLogger)", "value": "967db69dddb1d3ba4bb787127f561b2a3aabc6b0c4909a787a85205ed9f7f8ec", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960673, "uuid": "2635a519-502b-41fb-a3c7-6db8db4b10c8", "comment": "Malware payload (MassLogger)", "value": "da6afdfb4bb20d29cc84389427b35445ce610677", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960673, "uuid": "0be0f146-135d-436c-aa84-9a21e80d5a89", "comment": "Malware payload (MassLogger)", "value": "56ef03eff41720c88cf5da77f0dd62a01fcf89af7586fcbf265d39d8dd584a077f0f2409d9f51edafbb66e687862a780", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960673, "uuid": "6e1a7248-7c8b-4c02-9d9c-d477b86dc158", "value": "T12435B25D9060ADD3A054FEF4F551AF97CCDB239416278A011FD1A1AD23268C3FFAA2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960673, "uuid": "05dbd2e0-4670-4fb6-bb67-14e3557ed1b5", "value": "12288:mVJgTEE2YDj5UClald4QaDy/fRWxWNBs/FaKV:EJcEVYn5ZQaDSfqvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960673, "uuid": "235aeb78-ddeb-4962-a5a7-34cf51cd8bbf", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960673, "uuid": "0ac4fc2b-3f73-4e7c-942c-25fe9e8549be", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960673, "uuid": "e0037d18-ccfe-4e76-9b11-31530ffb7ed3", "value": "ttt665432cerr.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ec17c8-40be-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748984778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984778, "uuid": "62ba1ebf-b3d4-42c9-8710-a89936f9b23b", "comment": "Malware payload", "value": "3ad7768e9cefedd525208813ac8f1d07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984778, "uuid": "0a8d3560-49a0-4a05-9e43-bb8d2e624d5e", "comment": "Malware payload", "value": "96df9e894300af9e2a5093959123dc9b1f6f3c79aecdcabb68e90b4da5e3904f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984778, "uuid": "a110a36d-e9cc-4edb-bf7d-23263e96bb1d", "comment": "Malware payload", "value": "bc63d55f7548c30d0e79ddfef9de880789a237d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984778, "uuid": "252f8a2d-5c36-4cee-860b-ea6951e44462", "comment": "Malware payload", "value": "31c9704b044dd6af12b985889780b5818c5a4ea3200f09e94e14a81a72dd8cf4ec1d6ebab0407b6434a871bc589e680e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748984778, "uuid": "c8d5cdc2-55de-4d54-aaf3-bd24ee66ca42", "value": "T193A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748984778, "uuid": "d8245e01-d92c-433e-8062-dac53e7a114c", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748984778, "uuid": "f9a1c318-c661-47d3-9fa8-d71b506996cb", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748984778, "uuid": "ae68bf46-f45c-4307-a51f-4f77499a69c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748984778, "uuid": "b48ffe17-3384-4850-bf50-3609b26cd3f7", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc959c93-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932119, "uuid": "bdb93f81-94d6-4de1-9d18-bae1c540fe26", "comment": "Malware payload (LummaStealer)", "value": "216e59568861e2c4c01e0efbcc9c529e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932119, "uuid": "02f69d1b-0e63-4423-a4b2-c6397f2dcd9f", "comment": "Malware payload (LummaStealer)", "value": "98487faac4ceaf0e2dcaef11ed2426d9512facb4dc5f37395f9298582634f56d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932119, "uuid": "58003db9-f13d-4275-a02b-1c4769ed8b02", "comment": "Malware payload (LummaStealer)", "value": "384fc9c7bb1a2664a68179fa6ac153ab309034e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932119, "uuid": "e583f171-7ff4-4ebd-ab4a-614ffc53c502", "comment": "Malware payload (LummaStealer)", "value": "e2b455a18b0f93f37b697f5d28c582ea95305316008ebf4c81c44ab0b8b18900b2a2c3073faecbafc064cfcc7142bc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932119, "uuid": "888460f3-5b34-485d-914b-6fd4e74669eb", "value": "T17A85AE399246A2D6FD6600F641A1A1947422B333C62D2FFF8690F333AE07BC15F69759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932119, "uuid": "6334674e-f8cd-4fbd-9bd1-99cf8dfd80ac", "value": "bb36df4412e03dad091fc4f040871a65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932119, "uuid": "92bd436c-2a90-46e7-8032-19ba75b47068", "value": "24576:xaQ649e+1rXkItGc1NhQD6KdAScPIEbiqIX+jCOWMsyRjioIfzgJPAZU4mdIfzgv:Xe+5X7t/gdAScP/IX+jmyR7Wf2Wf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932119, "uuid": "3b58e82d-5973-499b-bede-6af07d9675c1", "value": 1717800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932119, "uuid": "557c5edd-70dd-4ff5-80bf-d61d411b0468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932119, "uuid": "869f976a-99f8-4822-b5b5-8fb7f4fa3c7e", "value": "sGe7ljJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e720d93e-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944538, "uuid": "90e5df3c-1d47-49ca-8f0a-1e5475af8e2b", "comment": "Malware payload", "value": "19ceee89b018cd4f112afbf80098d16a", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944538, "uuid": "1636fa6b-ce28-4d39-b381-f9c2ac365a5c", "comment": "Malware payload", "value": "986475246725b3912766ed2e8494090e410870cfce30758d8d793bdbaa7f7825", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944538, "uuid": "1fa096ba-740a-4038-b1db-b0f00368e9f7", "comment": "Malware payload", "value": "b3d4e46ee6ab9bd2da5c42a7c3141b9f59f98133", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944538, "uuid": "eebb1436-73ba-43fa-bdc6-c8185607baa1", "comment": "Malware payload", "value": "99861b4bd894504747e3df07eb6ab4366f3852ba47760153583b85fb4babe75d10f62cb060386a18b2a5ffaefe34bd72", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944538, "uuid": "4bee189b-2371-4a8e-afd7-9b181f80c436", "value": "T128558D01BFE1FE13C524037B89EB57653271EC82AB13470B1658B71A2DB17D81B9B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944538, "uuid": "57724792-4691-43f2-bcf3-c9eb7bd3b844", "value": "24576:81j7sxqAiQu2eU7uMjY9O8gx069pJMCz:uj73AiQdZw6+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944538, "uuid": "13fbef14-eb41-4355-ad2d-f633e15c29d5", "value": 1396736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944538, "uuid": "f915f138-9ed3-4e36-ace5-db3d3bed2e56", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944538, "uuid": "7925e9e2-f949-41d1-b0e5-db6b78abb86e", "value": "New Order PO.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82a6a5e-4035-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1748926072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926072, "uuid": "be70311c-86e3-4710-937b-a7064d752d55", "comment": "Malware payload (RedLineStealer)", "value": "4ab096eb513eed62b9206fb8ab273aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926072, "uuid": "fc83444e-1d83-45bf-a024-63449fdd2a56", "comment": "Malware payload (RedLineStealer)", "value": "989db46562126cd83b6148da103cb17d770ed14c5a09b899bd225e77ff1b054d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926072, "uuid": "dcde5f01-fb29-4119-9f69-1c2fa2299b17", "comment": "Malware payload (RedLineStealer)", "value": "15ca16c266031c2c03a050d53841410dc5476e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926072, "uuid": "8ea2febf-0246-4262-8961-a2186e709e9e", "comment": "Malware payload (RedLineStealer)", "value": "55495e68c9143aaf1ef55d992265ac809439f63abd8847274bb457218df1311d5c1476318894e5314e25e5d76265189e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SectopRAT", "colour": "#1930F1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926072, "uuid": "b0ebac39-5057-49e7-a6f5-887612f655f7", "value": "T132C4028A3355C103E07B0B7856A1D2B557BBDDDE9852C71B6FC83E8F392734866B0298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926072, "uuid": "fa532ce8-23a2-4b43-88b5-6dbdcf62da9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926072, "uuid": "8aa6ec83-7372-4775-9c14-b6a55dcc1a60", "value": "6144:rG2T04L5eQZzk/7lzvxsw4a84z6USDFHwiP3GgUUkawWa5vpJeB70HXBRAlrFcAF:+NzlLqwNpLSJHFE/B5rTNARRBRq+ZKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748926072, "uuid": "e7803768-9bdb-4e01-bffd-0f24c27e3364", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748926072, "uuid": "a49d812c-cf1f-47cf-b9c9-4336835dac68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926072, "uuid": "163b2a9a-6ae4-463c-8936-b967fb1e1492", "value": "SPECIFICATIONS SAMPLE & QUANTITY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3e1312-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AteraAgent)", "timestamp": 1748960626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960626, "uuid": "2d19ce05-2335-4cfe-ad15-2d69a32ec465", "comment": "Malware payload (AteraAgent)", "value": "ea1405cae9416506b8bef0a4608d9306", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960626, "uuid": "61a29451-44f9-4828-bb0d-6b106f88b591", "comment": "Malware payload (AteraAgent)", "value": "98f00576455e554b3dce191c3eae0a775de3a58ea9210aef4faae975588a522f", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960626, "uuid": "ffb42f23-9c52-4ebb-8b90-885fc1dc3407", "comment": "Malware payload (AteraAgent)", "value": "da31e13e3c6ee888a3a74e80002772da08bab35a", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960626, "uuid": "9e098416-d6ac-40db-8698-93dc1ed53bed", "comment": "Malware payload (AteraAgent)", "value": "198a8c1523f6d641bd5248ab798e31d81f2fb4e256d66d94179e13acfc3fa77191d6878e2eb842f797f9366ab2260361", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960626, "uuid": "feb1c4f8-05fb-4c88-be15-342a5c90ce4f", "value": "T127D523127584483AE37B0A358D7AD6A05E7DFE605B70CA8E9308741E2D705C1AB76FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960626, "uuid": "3e6c99ca-3947-409c-ae82-ba0bdc77aa7e", "value": "49152:B+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:B+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960626, "uuid": "a785c58d-7332-434f-b059-efa95d36a916", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960626, "uuid": "282d5025-f883-4b8e-950f-067ad0b123a6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960626, "uuid": "c3c8efcf-9570-43a3-9b3f-efadf33bcbd9", "value": "Factura.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c706d27-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748944628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944628, "uuid": "9eaf3bc5-315e-40ff-8cfd-fb3f4216905a", "comment": "Malware payload (Vidar)", "value": "658aa69b1541385b8e2091563c7b40f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944628, "uuid": "c78156db-fda7-47bc-8116-3e7279edf068", "comment": "Malware payload (Vidar)", "value": "98f49160a46ef3976ec83c7a2cddeae134cddfbe4f3ca00ebc0e5da7374b9953", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944628, "uuid": "f7c87885-2c0c-44ab-9bdf-d765e4473d34", "comment": "Malware payload (Vidar)", "value": "70b54cbc0c36e301261b72b1405f4ade61c9d62f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944628, "uuid": "af106f52-2347-450d-8ec4-ea8b4a7a76ce", "comment": "Malware payload (Vidar)", "value": "1249f86c48062694ae24fa53c17edf9e0252aae2e196fd760dac8099a5b7847026f4877d176bf4b86c8638f1427c9aba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944628, "uuid": "dd7513cf-0af0-4418-8234-97bacfcd749a", "value": "T1B125230E053C5833F2725EB524B4EAAF68B54EA049DDB25F7291073E39A1B4AC71C3B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944628, "uuid": "4626a4c6-3328-4141-9715-6fd3758ede10", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944628, "uuid": "f71e1471-9cdc-4fd8-82c8-46912dabc21a", "value": "24576:60a7uGv3p9bdrkMOE52nbGmudCQe9/dBfF1YkNvt/4Ae2260FTLFJ:6RZx9BIMd8b8z4BfnH4gZ07J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944628, "uuid": "47764694-1bb6-428e-8fa7-380b73f2c901", "value": 989336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944628, "uuid": "3988ce7f-913e-4575-b031-99f80267918e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944628, "uuid": "7f6a32c4-7157-489d-9298-8323fd0c0619", "value": "ExtKm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fed3624-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748931453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931453, "uuid": "7ea5d1f2-7910-4fc5-b51d-7603421c063f", "comment": "Malware payload (Formbook)", "value": "9cd39dd0356e1c4965e4f2685f38be79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931453, "uuid": "2fc4cf05-b67b-48e4-ac17-4a134bed288f", "comment": "Malware payload (Formbook)", "value": "9a52ad8f0cc07fb74049ca1e54813734f457e17b10cb6123442ffa20c3f8513e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931453, "uuid": "8956bf7c-16a5-4ccf-be24-354fd5668d59", "comment": "Malware payload (Formbook)", "value": "1ebe799cbc2b6bbf56fb8903f31cbb5632302f30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931453, "uuid": "a4aaca3c-1395-41f0-ada6-5b521af6ae61", "comment": "Malware payload (Formbook)", "value": "1363c194f8bdd8653b11bfb46b049b535fe7a4d8db234ef6810e82bcf414d23d38c426b21a67aae5f930b30739699d8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931453, "uuid": "245289a8-0aab-455f-ab19-7615f7235c96", "value": "T1C145CF3273FE8361C7B251737A157701AEFF7C258AA1F46B6F98093CA9201A1521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931453, "uuid": "6b4f6e94-7a72-486e-9d32-75cc14ec7d85", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931453, "uuid": "facc3318-019e-4c8e-9477-9bdf604c44c7", "value": "24576:stb20pkaCqT5TBWgNQ7aVYMzGc7SHB5JtB8FkVxakgAk86A:VVg5tQ7aVYxWaBHtBRckgK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931453, "uuid": "0c7f43b4-cc41-4704-995e-c84ea1660c69", "value": 1171968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931453, "uuid": "8ecba42a-8515-4c89-a9ff-196b683e150e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931453, "uuid": "1ea35eeb-b752-43f2-a347-1c37b2ec63d6", "value": "\u00d6deme dekontu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1997179c-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748931308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931308, "uuid": "a8e15a9f-110a-48ec-8065-cf6127491600", "comment": "Malware payload (MassLogger)", "value": "d059d27d981261e5785f932149b3ab2a", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931308, "uuid": "534ea1ba-ec22-48b3-b7a3-601311a064a3", "comment": "Malware payload (MassLogger)", "value": "9adc2bf9f05d647d5117204e1cf73e4348574d0583af824d8503921de03c24ea", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931308, "uuid": "70bba78d-f18a-4562-85d0-322f77e11209", "comment": "Malware payload (MassLogger)", "value": "f39aeac94ee32a67a5b49d8fabe011ec0da20021", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931308, "uuid": "1f53b06f-1a51-42e0-893f-709719294b61", "comment": "Malware payload (MassLogger)", "value": "4798427bfa301873136d1d7c698b4ba90dc05497609e0f6f1db5c7ee13f3ffd58f0cb1e51a526d97c6f5321f64a991a9", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931308, "uuid": "c069b6e0-7291-48c4-aeaf-78810e3d656e", "value": "T1B735B55D9060ADD3A054FEF0F551AF97CCDB239416278A411FD1A1AD23268C3FFAA2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931308, "uuid": "aaaf53f7-d385-4b02-ba1f-25ca614dacf9", "value": "12288:aE4Zv3bMPlnWZGJ6EEmLRfd58/kJAO+eZbo7sipuK2+a3A1:aE29GBEmLRCneZbnipL2+aw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931308, "uuid": "d3cb4e4a-6ce2-4aed-bbfa-f40d70bf2903", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931308, "uuid": "ec4f6f41-77c2-4dc7-978f-d7dc68dc82f5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931308, "uuid": "21b0c177-c883-4d9d-a3f4-b73ddc504f86", "value": "lly6675543.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469e660f-404c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748935679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935679, "uuid": "0984c2d4-b2e4-4e7e-aa96-a04eb3deb00a", "comment": "Malware payload (Mirai)", "value": "5dd415308a4a266394f66f5aa7bbd372", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935679, "uuid": "e621245a-15ba-4ee5-9ab4-60a8ae3126fe", "comment": "Malware payload (Mirai)", "value": "9b3af5d230756118543fd997758f790ba0269eac4f4f501d3494371e56677267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935679, "uuid": "47defb8d-2ce4-4797-801e-875fa8a944c5", "comment": "Malware payload (Mirai)", "value": "a033ce2bb0c92ce130076dd26643218e97cef638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935679, "uuid": "715ef23c-7cb5-4300-af58-33bfcf626392", "comment": "Malware payload (Mirai)", "value": "8aa4b578b1a2c6522a99d14d673b1652d9807e091d76c8cc41eedc9cab523b764e3ec6f7353cdee5b0336c07a7e5da1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935679, "uuid": "2141a682-9eca-48d2-b82e-0904b39b711b", "value": "T1F2231A46B982CF03C5C262F6BAAF82AD371177EDD5EB3207E815BFA03B814D61D26550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935679, "uuid": "eb7cbc89-5ead-4258-a577-39d23148df55", "value": "768:/tsIWI+R7kWmfYisNnZ743S6N6trWTiYMF1wflVWZ2LoatNKQZi5dS:FsO+R7kWmfHsNZ0i6UCiYIwGZaOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935679, "uuid": "46df8230-3076-4447-b6fc-a3d8003e2349", "value": 48020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935679, "uuid": "5867e5ae-6130-4fc8-85e0-18baeabd8e78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935679, "uuid": "1c8960db-98ae-4335-bcf5-44e63a153682", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de3a1cae-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989191, "uuid": "495db56b-7039-4e6d-99e5-f9ff3bacdbd5", "comment": "Malware payload", "value": "28cc1fec9556a7eabc54326edf6762f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989191, "uuid": "73ed8469-d318-4052-b745-fafb3e2754ea", "comment": "Malware payload", "value": "9bba769ad5a9076dd020a60431a69a406ea8c5286994bcd8da425d5df060765e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989191, "uuid": "8b9bead8-bff2-4720-9c80-790ea111409e", "comment": "Malware payload", "value": "2a4b2b92aa5b0d73028f475b40eb14daa128e378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989191, "uuid": "0626fc65-5774-41eb-a64b-95574f50790b", "comment": "Malware payload", "value": "8ab18b22421962d14857d9bea4e78e9f26c42e8d5f7f94049647e076eaf349e594be0b1339a31b2a6151b3046f60404b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989191, "uuid": "0782344f-56a4-4016-823b-04ad174a2f75", "value": "T1CBD533D42825F2BA994344BD750EABD058F90381ADAC9FF2071DAF53B8B4BF02C44A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989191, "uuid": "8de1ae9f-d220-431b-85df-4d64687d1616", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989191, "uuid": "31276f74-1dc7-475c-b7eb-955f4d4f2e55", "value": "49152:b27aabiM/KO8SV2VYwUr4gjqniRW/rWSzEl+bIgfGsvvsI0BLli7Fiy0CcEJnu7O:ybGSkVCr4gjqnfr1zG+Eg17XiyLnu7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989191, "uuid": "61716dc9-9618-409c-b410-ede86acb1b5b", "value": 2944000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989191, "uuid": "52773957-ffdc-434e-82b5-89f5ef7c6e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989191, "uuid": "eb549e51-5c45-46ee-9fc2-f90cde06d52b", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.34927.2545.16232", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b0ba27-4044-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748932134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932134, "uuid": "fdace904-5ec0-43cd-9287-a5217c4c2982", "comment": "Malware payload", "value": "ab74f1e459bc0ced5fdb04f3a4964580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932134, "uuid": "261574ff-71f5-492c-889d-ed3325cdedc8", "comment": "Malware payload", "value": "9c545a317839d66b308c4aa79331ff80145db49ba894af216fc2381525436f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932134, "uuid": "857dc278-e8ae-4abc-8104-7693f0669124", "comment": "Malware payload", "value": "82fa8374f92127aa0f080d3b73dbf7e56a11d270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932134, "uuid": "270388f8-01ae-48a4-afd4-96ac4ba727f4", "comment": "Malware payload", "value": "4591e08f7ab9b97bc57dcc98bbd48fb15edf00dbf6dc45bc31ccb40abe3d05855a40873a0d53ebdf06b6cff7794553d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932134, "uuid": "eb42ebde-15b5-458d-a6bd-c40acc7ec64d", "value": "T1BA3533548AD49013E86A05304CF1A939B2F91722E1D84E0B3E59F91B7B923C77B1E7BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932134, "uuid": "d8444d89-3bf7-427c-ad9a-9ddca432bd8c", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932134, "uuid": "703726a3-5318-46f5-baba-4a540bad471c", "value": "24576:g0a4AEkzC1SsJfI9kIBGfd0nxbSaLZE9/Yzb//RYdjwa97BdRFf1kLHlF:gGyzC1SsJ/q/ZE9/Yzz65n9NdRFf1qlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932134, "uuid": "fad8b14b-b1cb-4f02-97b7-71bc601c19bd", "value": 1151687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932134, "uuid": "72dac8a1-c5ad-4d31-bee2-4dc8b0478270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932134, "uuid": "e69485aa-755d-4669-9fa0-a73163b0676d", "value": "sGe7ljJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9253227b-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748973172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973172, "uuid": "083a8bc1-f6e0-4616-83aa-7487b9580921", "comment": "Malware payload (Mirai)", "value": "df92d548c8a437fc210feb9ab1dd70f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973172, "uuid": "cc966cf0-e1fd-4718-a091-3e7bbb5c8dd9", "comment": "Malware payload (Mirai)", "value": "9de452d190da354fa9801e3797b4d349c0c884207ea87fee72452edd5a5f14b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973172, "uuid": "47365ee8-4b83-4a89-943c-7fe4144a7c66", "comment": "Malware payload (Mirai)", "value": "279bd5a285d8afd09cb8ac2f92d3070e740736fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973172, "uuid": "ef2e2a64-ce8f-457b-bab0-476f434a3c1a", "comment": "Malware payload (Mirai)", "value": "bc3ecd46360a42b1cfa456ad982d523173032e7556e76ea13b8eee653a128093f38a20d150e8f1eef707362fd46bd3a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973172, "uuid": "734e4cb9-0ed7-40ae-ab1e-544dbac4a85a", "value": "T16B730785B8816A36C6D1137BFAAF058D3714A3D8D2DB33078D251FA07ACA85B1C67F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973172, "uuid": "4d9a5e2f-be0d-46b5-890b-bfa9cb8fcd2b", "value": "1536:Cu34IMl0xR1RXSF0h2AfvPfYY+qCz1GlhWU5y0eLvbp7a0U:Cu3nrXPAY+Vz4bV5ls1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973172, "uuid": "4038caa9-4c0f-4e37-838a-ea9b42d7f456", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973172, "uuid": "888e4b9b-6054-463f-bd6d-c64b5cb6db29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973172, "uuid": "fae57f74-4184-455f-86e0-e06a766f4349", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d725eea-406c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1748949327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748949327, "uuid": "e229a5e9-49d6-4cc9-998f-eeb10eeff70d", "comment": "Malware payload (Amadey)", "value": "916eec4e23123e3a1d63ea2daf0c2c14", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748949327, "uuid": "a6ad5d98-703b-4ee8-b612-5a3758c02eb1", "comment": "Malware payload (Amadey)", "value": "9e112e2a8ca34f215042f5d331b4f79eca8003fe825594fcbf8936d32e9d2d7c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748949327, "uuid": "df44a653-4b00-41b0-bd00-bbed4ce8ec1f", "comment": "Malware payload (Amadey)", "value": "509450e86b22bd823df5d680efc5531b0a9d2a88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748949327, "uuid": "6f7cf2b2-3383-4112-b48e-7ac57422d766", "comment": "Malware payload (Amadey)", "value": "700e13210fdb2f40512b51923b5f85999fa4a6350efcff1e9e786f04530f4a7891e960e324c9e160c6098a34b6026c31", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748949327, "uuid": "2614a23b-aa2f-44ba-a2fb-c88cf296d647", "value": "T1001633A7F3EE5814F3B4A7703A7901D33A21FC70A171474F26966A0A58D2E713A607B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748949327, "uuid": "cf6cd878-d91e-4681-82d5-3e744336217e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748949327, "uuid": "68c3bfca-f8f8-4af2-a809-f310eb9cab6d", "value": "98304:QGXvbV6OQA31eaVfDDipRsefZwxpFFoyGMZEpZvL6RLk:xXvJhhfvqspT9BSZeRLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748949327, "uuid": "31fddd4b-3251-4dfa-8dd8-0ca7163c96d7", "value": 4367360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748949327, "uuid": "28446131-a68d-47c2-9cfd-d54b484d3b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748949327, "uuid": "75511146-5810-4d1c-8fb5-238d5036e723", "value": "916eec4e23123e3a1d63ea2daf0c2c14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f044a298-403f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748930380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930380, "uuid": "16c7215e-a764-4303-95f0-0a900f33bda8", "comment": "Malware payload (LummaStealer)", "value": "07955595126469c79ea36ec105f9b290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930380, "uuid": "a9c6c337-ff11-4316-959a-f78e2b2d4d0d", "comment": "Malware payload (LummaStealer)", "value": "9e15917208c426cdceef113456ddb48a2f55857dafc226f3ce5925e626075aed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930380, "uuid": "0be57cda-fa86-4f77-85c7-270ba401e1e4", "comment": "Malware payload (LummaStealer)", "value": "f6ad98206f3f4e886616bfaaa739a1f4a5da4c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930380, "uuid": "47f9ff06-fae8-4c31-818a-4fc770c444f0", "comment": "Malware payload (LummaStealer)", "value": "8e2c67c1b8d7c26e91937750053ad981f496d74b3fc9dfc2d3c23546885e4ac05e6350f4635121e0663f7f726a7f9d02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930380, "uuid": "b18d4dd2-45ca-44b6-aaa0-c59013e2d049", "value": "T1BA3533E3033C1423C186077827BA5F0F379BAD90E9E14AD79F4C6B552764C57AA2A371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930380, "uuid": "fd732f5d-2abb-424a-8647-c74598aa2232", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930380, "uuid": "14075808-191b-4547-84ec-698284eb80cd", "value": "24576:f0acK/BqbT0vnd5dwPsUe0aw00reOF9EjTaYm1YfXrBUPI:fOiIv0FruE0reSAm1+rBUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930380, "uuid": "185e1b78-74f1-44a3-a700-21819683b9e2", "value": 1154857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930380, "uuid": "9628fb3d-5387-417c-86e3-ace75da4b884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930380, "uuid": "93b0cf65-92f3-4e00-8d93-da331bebb04c", "value": "07955595126469c79ea36ec105f9b290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95639657-40bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748983485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983485, "uuid": "01893748-eb36-4742-8bf1-54bdcbdc62f0", "comment": "Malware payload (Mirai)", "value": "df1604c9a03ed420e01c8619d9768170", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983485, "uuid": "0ee14b83-53a4-44d8-bde8-6940334ac58d", "comment": "Malware payload (Mirai)", "value": "9e2207583a555e052572b26d105f58caacf8e65793b501caa064569d32aaffec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983485, "uuid": "4d6143f3-f4bd-492c-9427-c84f0bdd27bd", "comment": "Malware payload (Mirai)", "value": "82eb9a0df997f56c9e51d8c4b65836e2f061b913", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983485, "uuid": "e244f3d5-c537-4d16-90f1-91bb1f3a997c", "comment": "Malware payload (Mirai)", "value": "e0c1fbf5c1dfa6b3a6a44fb2fe09f3a79ccc17b9e2c8934e44bca986b6395b80453f582a8810cb777044741eb831d35b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983485, "uuid": "9840e13f-c982-41fe-b17d-dce0ce69a079", "value": "T19A43D882FC4789FBD84399B05497F33FA630E9541131E26DEF49ABBDD923246162224D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983485, "uuid": "3ac73257-c23d-4c6a-9773-f5d39e76bc67", "value": "1536:iCi0Q812wWi+cQTz07FhnIgy+0s460smWsqifG:iPi37bIgL0sl0smWsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748983485, "uuid": "3bd0b964-55c1-4a23-800c-0e89b8762fb2", "value": 58288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748983485, "uuid": "e3519650-8d89-4d52-aecc-8d227ba87b40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983485, "uuid": "0e11432c-c689-4a43-b196-d2475fa4f187", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c87b38-4062-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748945039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945039, "uuid": "3df1873c-d3f0-404b-b3e9-2cc4261ffd5f", "comment": "Malware payload", "value": "bef5444e80373119aa536b46407c838b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945039, "uuid": "7d30000b-ff98-4aa2-b389-28f5b1b39adc", "comment": "Malware payload", "value": "9e6dc6d6224998d443cf3d35edde301250e6617edd73da06a5fdba1bed25b35f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945039, "uuid": "a6c393fc-542a-441e-8acb-30cafdcb6e92", "comment": "Malware payload", "value": "72524260b62296edacada47ec573db4353a1761b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945039, "uuid": "0f281f67-6644-4acb-81eb-3d4c0dfc0df4", "comment": "Malware payload", "value": "47028dc40808f8af41d74d35c5072819b055e413392faadc00e879bc5e668479ddba40bb0d1dd2680d0ec66ae403bc1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945039, "uuid": "7f0ca77c-cfb2-4b64-94ac-8a9c6929176a", "value": "T1CFF733B8BF709D85F040F5D6D133AB800AD60062C16E0E1BB7955A85CE9742C666FFDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945039, "uuid": "69a5d2f3-9c15-43ed-b9e5-cd9e8dd6f4e7", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945039, "uuid": "e125640b-1d52-4b29-853e-7e025485a7f1", "value": "1572864:LCIK8n0j4cLwSlcqt73HngahqLGF6AR+y6JaNSNMbMKZv+IH1r:LClAC4c8SlF3Hgk6A96AN0MbMKl+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748945039, "uuid": "6d5d6962-bcce-4eba-ac72-513fc8b4f702", "value": 74741863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748945039, "uuid": "f94060b6-2bd7-4daa-bba9-90970327e5e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945039, "uuid": "7f835a86-7d4b-4d21-b4eb-6c1a43527f21", "value": "9e6dc6d6224998d443cf3d35edde301250e6617edd73da06a5fdba1bed25b35f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721b976f-4018-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748913418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913418, "uuid": "6b9c5818-b6c0-4513-985c-88316cede6c7", "comment": "Malware payload (Mirai)", "value": "e6232618bcb4d8197b4297dea575112c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913418, "uuid": "6bc239d3-303a-46f4-9f41-d54ffa7b6377", "comment": "Malware payload (Mirai)", "value": "9e8b1c514ac7db90ae766c6d859a79437a537fd0883d1ef80e2a76697193e372", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913418, "uuid": "af2c183f-b283-4698-88cf-5c78e9d30cca", "comment": "Malware payload (Mirai)", "value": "a80da292f78b5ea4b4bb1b2e5172ea20d3bc9bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913418, "uuid": "89f6e0d2-a58a-492c-89a9-f5ed5cf00203", "comment": "Malware payload (Mirai)", "value": "949641aa22ff00632ac73d27bdd79978ffa3505b228b417c54d5ed9bda7f92189d84d412e89206b6933d4cce02e1707d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913418, "uuid": "26972f99-ded6-447d-bbb3-802ab14fc562", "value": "T1E1B2DF3E008301A5FA2150FA41E803932FBC0AFBA196DC54395EA1FBCC91952F567BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913418, "uuid": "3354eadb-8382-407b-bb28-5ef5c20917f9", "value": "384:TogOJXzGZJr4iPbRnKJYdxlGwAH6CN9oGRLLy8t5jhAeJgGlzDpHOw23a+mr:T8JXs1V1nddPGwAH6I6Gs8tHAeJgGlzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913418, "uuid": "e42baef6-dbff-442a-81b0-a50e7e6ab765", "value": 23976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913418, "uuid": "2b8ebac4-adb1-4dc4-a99b-1066c718993a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913418, "uuid": "fe5d50bd-2176-4109-af7c-9a7ccdc6aab1", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5d9f5b-403f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748930265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930265, "uuid": "770a973f-2a40-47b9-ba32-a9dfd42d9530", "comment": "Malware payload (RemcosRAT)", "value": "42a43c4f6b2efd95bf6e284242946ff7", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930265, "uuid": "49e588ca-6266-4e3f-ba52-7b4a7598b751", "comment": "Malware payload (RemcosRAT)", "value": "9ee1660a2b4fd2ce798897f8f8496d314a0abe4bd6d286bf37952f40bff492c0", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930265, "uuid": "fb1309d9-34c9-4c39-a3df-6699143a96fe", "comment": "Malware payload (RemcosRAT)", "value": "bd512b338b72ae40b157a31841be38e3326067b3", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930265, "uuid": "b8dc8c37-aff6-4dba-b9d3-0362e2b46517", "comment": "Malware payload (RemcosRAT)", "value": "e17d1b018b1cef8ed79cc78ad7b28bef357761ea96ea3f11feaec699501d897e0261c7bccc5ce5b138078af40b3d983c", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930265, "uuid": "2f947b7d-4f0f-4b35-a682-397a343beb51", "value": "T150E25A67FF240047495F1261AD780F36C965DA6680233D727EEA778EC1066BCB7BC90A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930265, "uuid": "b841bd13-c5f7-45c3-be37-3f124f907e8c", "value": "768:qurE6lE54u4DBp8H2SV2erm6MvQpapY/M3lVeDF1NnEZYt:xlI4TDBpufMvQjOAuZYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930265, "uuid": "a074730e-6e2b-404b-878c-8c7d18847669", "value": 34094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930265, "uuid": "f2ae9ff0-c3cb-4ae6-bd72-ea44a0ba883a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930265, "uuid": "2ba5f009-db70-4194-a101-6d31562e5f77", "value": "IMGGLSSIBandbullen2343242423423423423577.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b750eef9-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989126, "uuid": "ffd13c32-8ce9-4cac-96f9-bc1f808ed5fc", "comment": "Malware payload", "value": "7ed3746e93b0b43be76f4d5b96c8e0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989126, "uuid": "e355042a-022f-4e4f-9c43-e1f18db6e365", "comment": "Malware payload", "value": "9eef0d15ca0554e116c50a4e8a988f9d5cdc802ff6fcff0f642830979c3b1f73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989126, "uuid": "3c21c074-9116-4ba8-99e2-fe3fc793ae01", "comment": "Malware payload", "value": "62a429732492c164ea457e00729cdcf8845ab26e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989126, "uuid": "a8dbd75a-c64a-43c4-8618-bc2a34257755", "comment": "Malware payload", "value": "a67b09f947a547f6ad5e68cd60d226ee1ffd2d1c8611575637aa5169e8cb6b31b18660a2c85779b6dbdd65c7279a3304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989126, "uuid": "c45fcf03-125a-4937-b030-72438c612b05", "value": "T1D4D40266EC05EED8DC2762B729B7C49199223EB1B17538A713D9322B4C64C71817FA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989126, "uuid": "0d93c231-a043-445a-bf5c-c0017d263a28", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989126, "uuid": "92eab8bd-f04c-4bd4-bdea-0c85979c53bd", "value": "12288:BgILLBpQUz3/p6RskaTh7nvQhdjXvLmyyW+pppppppppUpppppppHLwskttttxtp:+IPBpQg3/MOLvQhdjXvLH5RsszIx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989126, "uuid": "0c2b1fd6-e96a-420e-8ff3-592c821d2d15", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989126, "uuid": "8a3180d2-e6c4-43f4-9165-f7fe89ef4a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989126, "uuid": "6bcafab6-c87d-47eb-a198-d09c736b2493", "value": "SecuriteInfo.com.Win32.Evo-gen.28103.7274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98afc7d0-404c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1748935817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935817, "uuid": "3fa9f184-fcd5-4de2-badf-bfd053ad86c0", "comment": "Malware payload (AgentTesla)", "value": "4fda7bbe8e446401dde112d5c9decc08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935817, "uuid": "eac957b2-4363-42ad-8392-4e2c6bfc5d03", "comment": "Malware payload (AgentTesla)", "value": "9f7c7caad3796f0319f2ac6e3bdddfaaed09794657a33a447628bebbfa555f6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935817, "uuid": "aa875971-b623-4ce7-be51-fd538b88e006", "comment": "Malware payload (AgentTesla)", "value": "f7d68a45d1098d367f6aee03688f8ed41a8294f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935817, "uuid": "ca3c56ee-042d-4659-89ef-3a31104cf082", "comment": "Malware payload (AgentTesla)", "value": "41b3caf56c5cf7166bb99c5b71ea208fe74e0a34877994e09eacdb6310b9bcd1c3cbaeac7da067820f5442f6beb4756a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935817, "uuid": "82a8b3f3-ab40-4be0-91cf-477e316b203c", "value": "T1A326AAEB2F5BC90F2747567A224B9C058B9FDC3657C11EEC80C72288489E15B7AC4F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935817, "uuid": "976827ef-09f3-4ea1-a674-e8cc16b6b9f2", "value": "49152:v9d1Y/XFYrqfrAa9nPbvbcOQD6BYpYle4bgm3Y/f1U1Zq3JipcUaiyetS4:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935817, "uuid": "0298d7fc-1b60-465d-a4d5-63b4ac94035a", "value": 4457465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935817, "uuid": "4d755f3a-4a22-4e52-86d7-22fa1ec9e9ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935817, "uuid": "882bb39a-edc9-4ec8-81e6-145d93d683c5", "value": "rPO.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab5367a-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1748935230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935230, "uuid": "2f3fe116-3a11-4b8c-ac51-795bea31b5f5", "comment": "Malware payload (QuasarRAT)", "value": "3e36e03c34b535ce9a3fd4ae694f56c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935230, "uuid": "b7e068c2-ea8a-4d21-8590-c369f2f5da05", "comment": "Malware payload (QuasarRAT)", "value": "9fc1d4fb44649a4732c3ec7b8d155e66969305daa9f961dd15601d82b0e2e076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935230, "uuid": "11196922-21ac-42cb-a14f-eac7e625c91a", "comment": "Malware payload (QuasarRAT)", "value": "71da49bf6655afdb516124b5ff06decc6ef3d9df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935230, "uuid": "4d820b05-e1cf-4d5d-bca0-589c3860a5b4", "comment": "Malware payload (QuasarRAT)", "value": "3ee8e4212b4756e5f651c1667e33f3f303c38760f0feb42cd7004f4f5da42e218a200c2c29208329a14f3ef4bd3d5a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935230, "uuid": "1818287f-84be-411a-9a12-53f4fcbc1346", "value": "T122E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935230, "uuid": "699e1834-1e8c-495f-a52f-a79281b41708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935230, "uuid": "2fb62df4-16a4-4957-abae-934113715b25", "value": "49152:DviI22SsaNYfdPBldt698dBcjHbGRJ60bR3LoGdITHHB72eh2NT:Dvv22SsaNYfdPBldt6+dBcjHbGRJ6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935230, "uuid": "6b5c0457-01f7-4e4e-8a4d-88774cd41802", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935230, "uuid": "23493d00-6693-46ad-a7dc-7ab6e940ff77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935230, "uuid": "3e1916b1-3103-41f6-8b0f-127b746c5c58", "value": "9fc1d4fb44649a4732c3ec7b8d155e66969305daa9f96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49608ccb-407a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955440, "uuid": "49a2c28c-eb09-4c97-97e8-4a2ccec1f7fa", "comment": "Malware payload (Mirai)", "value": "70e0346b8952474c3c189771f12d29b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955440, "uuid": "9690b33c-cc2e-4802-9187-8703a461ca47", "comment": "Malware payload (Mirai)", "value": "a065eecd641e718c55a2d30a747879d2c840ce745c6a6848a266f36c332a691b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955440, "uuid": "7e6c34be-8623-4bb8-abe5-279d7a04f924", "comment": "Malware payload (Mirai)", "value": "3228036aa783a99bb8c24d3b5128635d9cf5811e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955440, "uuid": "ccdaa9c2-dfdf-4aba-8b4e-53fbb9c62216", "comment": "Malware payload (Mirai)", "value": "59773ec5040885bcda61163346a56f9165c65569119c976ab55432f7d9ad021bbe397ca5de8b4c89d9d6e7513ec7ef40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955440, "uuid": "806de952-bd04-4198-a350-a57422116bf9", "value": "T155C2D170A2AE1CB1C3500632E7B856CDBA830FBDF9EE3890114087BB7D4194529EE9D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955440, "uuid": "f63cdeab-42c5-4648-985f-e4d103b03c36", "value": "768:A7soTAZ3alkXLvFh8nNEiqA8XV58s3Uozu:A7s2uKlqZh8nNWHz5zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955440, "uuid": "2918b34b-67b6-4cb9-96d3-449a06d56c78", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955440, "uuid": "9c7fa9c7-861f-49de-bbb7-a8a37ea80a09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955440, "uuid": "176d54c7-9804-4ad1-9a9e-c4041a81d748", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c1fa17-40b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748980773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980773, "uuid": "9726ebe6-7ae8-4ae7-a455-e19ad42d840f", "comment": "Malware payload", "value": "cb849cacf4c6fe18ab7cc9ea4c6e1755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980773, "uuid": "0f4d1fbc-0dc7-49bf-a5a5-15b9d71705a5", "comment": "Malware payload", "value": "a11f831c4c513422fdebad4ee9e5a5064c6fc7a66dc8cd12835b95421d640543", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980773, "uuid": "ea24d2e4-e745-41d5-8d3c-0f0d95dc9480", "comment": "Malware payload", "value": "ffe01654ac643faa4284c469409d56699d0bcf28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980773, "uuid": "acf6aaf2-92a9-448a-a64b-5086e2b944d1", "comment": "Malware payload", "value": "193bf41597e13dd2028498953c9605f5b02b341dff9e6e4fc7d671591609c4b110a05aca600a0d28106703ed7dfb51a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980773, "uuid": "0a142dad-3713-489c-9653-8716c4c3c112", "value": "T1D5A7330AF5EC84F8C0535A708C59CA96E67B789C9695F6C313BAC9210F13768DF24B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980773, "uuid": "c2f29f25-d08f-4f79-b6db-3a8a23ea96fe", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980773, "uuid": "65e35845-b744-430f-90fe-ae0ba49d3387", "value": "786432:DPM+AqFyCn8xgbg02kLy/YlUkpbcT7WHbfw9Mu896Oa1VG51KeO/O0C7oV:DBAS/n8uZU/ipHH6vOUVJO0soV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748980773, "uuid": "e5260bf5-3a3c-4adf-9b0a-bf707594a8c7", "value": 43980637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748980773, "uuid": "97a309ef-ead0-4736-90d6-e74a94b00ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980773, "uuid": "4a3fb3fc-27d1-45ed-9ae6-c2f765767bdd", "value": "Predator Systems.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f72d8c-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748932079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932079, "uuid": "498c473e-b7fe-46b9-a8f8-6b95df533f65", "comment": "Malware payload (LummaStealer)", "value": "6c55d0495023ce5093f71bd6b73ac77b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932079, "uuid": "4e89ca80-23d2-46c0-9c0c-c9ad71bfa3f9", "comment": "Malware payload (LummaStealer)", "value": "a121d88b3095057f1392f0c1a5e71519f638752b19f7701087e49e11a4c19278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932079, "uuid": "1bfa9590-7e83-4e0a-9b81-e50abf18d5bd", "comment": "Malware payload (LummaStealer)", "value": "6ca32f3db167beda33d8b9903a91ff2c1b51aec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932079, "uuid": "9db8a092-854b-488f-a24c-3c19d8dc69c1", "comment": "Malware payload (LummaStealer)", "value": "225bec922b738a2853aea703b38f9f895a5cc3912a4f851d55845861446b0c816a1cb054658aa16d9165b8aa37453ef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932079, "uuid": "873aace9-8d88-46c9-a469-4c24e534c0c8", "value": "T1A595335A0EB70B6DDC22197E9CCEE60177693214250F263CBD287D332DBF1A189DCA64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932079, "uuid": "1a741184-ed16-4209-89d9-5dc670626983", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932079, "uuid": "34086be2-0c53-491f-a20e-fe8fcc9a6996", "value": "49152:UZPcFVhrYcUGzjuRstHdXNP1S/ojYMZwkpGYDy:+PcdYcHtHE/oBZwkQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932079, "uuid": "98abb36a-36ad-431b-8089-b15c958aa33f", "value": 1895424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932079, "uuid": "b72aef24-20a0-478e-8eac-26a65fcf35e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932079, "uuid": "660f7a25-540d-4069-b752-2e53bb99960d", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e612570f-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748957851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957851, "uuid": "21b6c97b-e576-4ad1-8eb5-6951d093b8b6", "comment": "Malware payload", "value": "4f765509afdd9d1fe106cb8cb4d12d6c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957851, "uuid": "9bfd364c-3c88-476c-b270-578d9a18f975", "comment": "Malware payload", "value": "a136c0ab7bef63793a0e2514e8edbf3b5963f3111e69c51c3a1166305e167500", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957851, "uuid": "ebaf7145-80be-488f-8810-6c72087f2d44", "comment": "Malware payload", "value": "e180d186e7990593552c4c1df3c90cf302018aee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957851, "uuid": "1ec3a655-9641-4fc3-bac0-1b0b63596c77", "comment": "Malware payload", "value": "f6d1cc703f927c890fa1dd635702262fad094572d81434246963e9b79e88f7d06a479ae2e0ca72aa85eb868f24ab566f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957851, "uuid": "46f3c9ca-ef57-41cd-8905-c5add9336696", "value": "T1B211A8DDB2A13163AF24DF21F466D0189169A4C033A03B17EDE908F4C4E9A007A65EF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957851, "uuid": "3203a0f6-0def-46cf-9a6b-ab8d800ebc9d", "value": "12:3J3OJeSOpYF6pOuNIl5kYFOz0LKY3SOj+ODzOsjcOcTNSORO8tKGSOt5OKDSOG6y:3J3fYUfNI7kwKO+Y9j4TTtbNyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957851, "uuid": "6bcaad68-53f2-48ed-a7dc-53829ee05dc0", "value": 870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957851, "uuid": "885936ae-5961-4abe-9ec3-9d1f9d82d9b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957851, "uuid": "6d39960e-4903-484c-a3b7-f39f1175c770", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5133fd-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748930748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930748, "uuid": "1157f43c-f1b7-418c-b16c-ae68ff238694", "comment": "Malware payload", "value": "5cf358274df8914fff1d000669355b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930748, "uuid": "b683d4ee-41ff-4103-af02-86e3e88b7344", "comment": "Malware payload", "value": "a1bf661beb4d7e2065c5994ca1120b41475418558f3dc02037af432e0801b65f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930748, "uuid": "05c26721-72d5-4dcd-8776-410a8ab34bd4", "comment": "Malware payload", "value": "dac42c14a6492b4e859d8a797b2d67a61d5b0c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930748, "uuid": "adfd2152-1b4a-447d-b663-f378aeb9bc34", "comment": "Malware payload", "value": "0663855373b11d5c09b3c0da265d731b6e4742e9c0b93f01cbeb9b27aa8966f1335353c187535ee38784ad7183321019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930748, "uuid": "c6b84f9b-b445-4ffc-94ac-63749c19b1b9", "value": "T12A145C1973A450F5E067D238CDA68A86F7B2785A1771534E036443BE9F37760AE2E332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930748, "uuid": "6955adc5-899e-4ebe-b2a1-dd2c2af1841e", "value": "237e391ecbd07a5b623b05d5666def8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930748, "uuid": "39d9d302-cfa5-42dc-a1d3-b07bb2225fcc", "value": "6144:mI2fxHcrKmYaHTklax52A/JdIk+jleGtM:mI2ZHtZ228L3+IGt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930748, "uuid": "0d9c6a42-6800-4f74-b143-65f2597ab1fe", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930748, "uuid": "5f0d3f8e-a8f3-457c-b8a7-54c9eaf287e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930748, "uuid": "0d212050-0916-4eb2-a459-476ec453e92e", "value": "5cf358274df8914fff1d000669355b3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae72399-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989212, "uuid": "d8175fd5-fa60-4efa-897d-3c427ecb475d", "comment": "Malware payload (RustyStealer)", "value": "2b16eae928cca31e9194a3ad5f05b2a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989212, "uuid": "201e6d29-2960-4081-9248-9f3b645ea4fb", "comment": "Malware payload (RustyStealer)", "value": "a23e49ca423c4c2d3632399b5ecbcd73ae831608b66459929ded8b3682e9a76e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989212, "uuid": "1cdff59a-a4d7-410c-ab90-ffa6b88ae885", "comment": "Malware payload (RustyStealer)", "value": "f01d909007e011c27deef45fe572ca8b457f0446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989212, "uuid": "b1e98ea3-3a5b-42ec-9211-1ff8848a3465", "comment": "Malware payload (RustyStealer)", "value": "8ad73e1751b7ea4b570013d32f3cae0acaf8f5927ea45cb5803265a113dd07cf71677d6e2afa1588a5a554c27dd68ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989212, "uuid": "fbd30fd7-7faa-4353-8ebc-edddd5cebfc3", "value": "T121B41713EA000993C66DC079CB1E9266536DFBFD4F30F7BA584962613CB2D147A2ED98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989212, "uuid": "a4a6f36f-ae83-4b0e-bf4f-5782e025aeff", "value": "a8e772fb4810a3d8507cc8f937a90eab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989212, "uuid": "b2bf1810-d55f-4199-86f5-9aaa45e65a70", "value": "12288:RMM3YahG41CmgIy0IwQcPRBOobrg39p0G2:RMMIahG41CmZy0IwQcPRBOCEr0G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989212, "uuid": "7d9bfa17-3bcc-4b6e-a7c3-823cc7d76502", "value": 528800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989212, "uuid": "1add1ac5-7285-4018-b114-a4fb7eae8043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989212, "uuid": "d2f1c1c3-d808-4b8b-a9a3-96f248dc6282", "value": "SecuriteInfo.com.FileRepMalware.6303.32458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ff5987d-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748931480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931480, "uuid": "61199e9a-dbeb-4cde-8c98-4c84dcb43a29", "comment": "Malware payload (SnakeKeylogger)", "value": "8cacc9cd34a436715ce4d74dfbfb190b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931480, "uuid": "524f048c-ef72-4abe-8547-1cf5f9d6669a", "comment": "Malware payload (SnakeKeylogger)", "value": "a25babe3b53a98500ca1383be1a4633b9de7b94956a1b070b233826a1f476b7d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931480, "uuid": "837bac49-f4c4-4a14-bc9e-c120ed939656", "comment": "Malware payload (SnakeKeylogger)", "value": "f6e0f29e692d97f58fdf7c419ff20ed854f434a0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931480, "uuid": "bc119563-de6d-4770-bd45-016e50587a04", "comment": "Malware payload (SnakeKeylogger)", "value": "fd940c2ce894f8bb6e64bfb5f9d73f8e0790b1f6033acb69aad40eff0c1502c76f3d4e51030ff4c271332bbd7577c03e", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931480, "uuid": "8b1fdca3-cb5a-4260-aa36-a784725fe7b3", "value": "T19F25BF1373DDC361C7B26273BA257701AEBF782506A5F96B2FD4093DE920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931480, "uuid": "eba25889-3645-404b-8feb-1fc6108625d4", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931480, "uuid": "1e7e219a-dd27-4aa6-89a9-70617947b693", "value": "24576:6tb20pkaCqT5TBWgNQ7aQQ2L3iyd5jZ6A:nVg5tQ7aQeyF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931480, "uuid": "4bae46a3-5168-4a68-a778-09d85fc80c15", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931480, "uuid": "7d3f70ea-5028-4a14-8cf1-39a92b45278f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931480, "uuid": "552f8de9-1cba-4a3a-929a-0ef2dc315d6b", "value": "DHL_9638453DLGS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883554a5-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748934501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934501, "uuid": "4b5b6f9e-4c06-48af-9410-417e3bb490e6", "comment": "Malware payload (AsyncRAT)", "value": "4147e8f06244987a6a245cdf94abbbc3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934501, "uuid": "5ccf6131-0b1b-484a-bcd0-3fc509b53ecc", "comment": "Malware payload (AsyncRAT)", "value": "a305c211cb5d0bbbecaea9be47de960770f2b58708644d25dc05a34d2b033bbf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934501, "uuid": "2fda35a4-3e41-45f9-beed-0e861b812628", "comment": "Malware payload (AsyncRAT)", "value": "8be02f24b4a820af1723a9045ac3fb84260c9658", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934501, "uuid": "1d336710-4388-4fac-9c7d-ef3a03d3db61", "comment": "Malware payload (AsyncRAT)", "value": "90b6511c41fa0a2605e61eeab7591d75a9ee786e5a6552c2da9010ad37c31546395a9079fc793bd15c2937605553746d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934501, "uuid": "8e4e40ae-abed-4ed2-ab25-450fb09f2c99", "value": "T1B641817C32B2972F1DEDBD006D59F332648A0A3911EAB9152E057B6F71D4CC013B6EA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934501, "uuid": "47de1a32-3fcf-46d1-9149-419b2c765e54", "value": "48:0+HorH6HYH6/tqr2HeHwH6GS2H1H6HlH6VH6/p583QYHnjLR:pHorH6HYHkNHeHwHjS2H1HIHaHkp5cXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934501, "uuid": "c77bcf8d-168c-4deb-92c4-7072c13d9660", "value": 2413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934501, "uuid": "0112c352-1d3e-43e6-a9b5-708a617e3dd7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934501, "uuid": "cdb2898c-34d5-4526-8d73-b69ba6286640", "value": "a305c211cb5d0bbbecaea9be47de960770f2b58708644d25dc05a34d2b033bbf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d764008e-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748956967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956967, "uuid": "50c91ad8-94f7-4396-896f-11c50b1b1770", "comment": "Malware payload", "value": "676516ce3b6f05153d77f12b958b509a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956967, "uuid": "958e55ff-6d01-47a1-975e-5932128dd7d1", "comment": "Malware payload", "value": "a3b71dda40548231d8f48b3424efe6a2dfc4924fd0d71ffc9f1c89bc0e2f89ef", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956967, "uuid": "83e11bf6-5023-479e-ab5b-dfda2cc10055", "comment": "Malware payload", "value": "f6ac4189efb5ea13ef0886f22cc258674ad56f46", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956967, "uuid": "2d27eb1b-7390-4c5d-ba82-c946f0831d60", "comment": "Malware payload", "value": "01758e68f0c5864d18f54ec59940cde04e0bfff1fa66edadafe143b8be9f4bc362f581fe38f6b9342276a4c227bfa5cf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956967, "uuid": "ddb2dc6e-91c8-4d2e-a02e-5591dc75cf8e", "value": "T1CB4196DF13712632AD6A6E7A715B710CB2A0A0D976C79E467CCC35F8C88ED144213DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956967, "uuid": "87ceb75b-a8aa-43d5-aa3b-d6bb5b5df615", "value": "24:UAdZ21QjquFiTBTMSm0o51lQKbNC1NInLYmYgz:UAdZ9qGuFMSm9FQANCiLY9gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956967, "uuid": "cabad34d-eef5-4de3-bc15-8c60ce60cc06", "value": 2409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956967, "uuid": "bea27ad3-9c9c-48ac-9e33-4c87ccd6ab14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956967, "uuid": "9f392c5b-6980-49b6-a913-7a3707a479c0", "value": "systemcl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff50670-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748933359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933359, "uuid": "80f7d738-6835-4118-8422-a9f99ceb0848", "comment": "Malware payload (Prometei)", "value": "b42d9c06c1662e5f31bb23bfc2c4eb2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933359, "uuid": "02e5ed3c-112a-4465-bfa7-36e0ae1cd83e", "comment": "Malware payload (Prometei)", "value": "a47ba4aa86fedd5a1e2ab5e6a9772f6367e3c9dd1208b3ae1ae28dfa14a13e00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933359, "uuid": "24e19b95-dd28-456a-b141-736e58318b4b", "comment": "Malware payload (Prometei)", "value": "52d7f01c26b64a23c2b9bd16b49e3b973594bfc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933359, "uuid": "a70df26d-4614-4772-ac62-d532d8e99253", "comment": "Malware payload (Prometei)", "value": "a7a84c2d6e17abe0d1b84c10151240b9e372fe8875d21c7b660ef3b5898d0de061e011704752c8d735eaf1597f2cc938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933359, "uuid": "20229788-c66e-4503-8b1b-1443576a461e", "value": "T1029423F8C83D2E3098169B3CBB1A826CF0A15772D9562B6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933359, "uuid": "0dc34db1-c672-426e-bb5b-4dcc434d34b8", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgQ:25WOSACZSV6eKRH5EPiamb4DsDwwcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933359, "uuid": "67ab9117-e61a-4f0d-adec-8cf30d2ec780", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933359, "uuid": "22548538-6848-475d-ae40-d2337d4929ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933359, "uuid": "6a10e23e-7758-4a3b-ad05-a6492b584e38", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513c4802-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973063, "uuid": "20b6c762-77f2-4a8a-9c75-d05b468e9581", "comment": "Malware payload", "value": "105971387cff37c6b88d06835ee947dd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973063, "uuid": "fe24aa2a-c3f9-44e8-8490-04da9dacb0d9", "comment": "Malware payload", "value": "a5b7b44bdc61480f3b5f1a7c2d986307942fbbf58a038c7c9ea0a988aea550a3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973063, "uuid": "ab6f8ea1-e35e-4e5a-a641-58c1c407f4ea", "comment": "Malware payload", "value": "c4d44a4132fc16fdd4cc842b710bcf265f29fc11", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973063, "uuid": "df3df736-ffaa-41f0-8102-9522597f3a5f", "comment": "Malware payload", "value": "10613c462b5c61a277f5ca678d3cbebafca4cc1ad4939c7dfc4de3c7137bbfb85dc62515f21bd6bbe7659719265b5750", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973063, "uuid": "5d2013db-965a-4f4b-a5db-ba96ef10340d", "value": "T17572BF395024484DDD2BB674D9A2AF43BF6A8E95B4193E829A04C5370E4F1F4CC5BE2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973063, "uuid": "84e6b306-6b05-4c3d-beac-ee9c6523b766", "value": "384:3YOZnnta+aMBU6OPjR/NNX8qIgAEhbaldgay:IOZn9WT9NuBlex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973063, "uuid": "9b1fdb08-8690-4447-9dab-1950fe43f55f", "value": 15985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973063, "uuid": "099c7892-f882-4b89-9762-882cdd7ffafd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973063, "uuid": "0b55f918-5724-4e1a-83a4-3be6f0ee11c1", "value": "server-booster.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7860f653-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928891, "uuid": "7d96fecb-2316-4bec-89fa-413a78fe721e", "comment": "Malware payload (Mirai)", "value": "85bec6840e0e715b7a16f13ecdd725a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928891, "uuid": "c74e29c4-b23e-4c14-9107-a5a2bd00bfbc", "comment": "Malware payload (Mirai)", "value": "a5d943744cefa52f8e65d6bb414853d5feb07d97a4958980ad99bcd86aa6b576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928891, "uuid": "65d99887-953e-4c9d-8ce5-71116edc5354", "comment": "Malware payload (Mirai)", "value": "8d0f82f66a7792d019b669cf3a7aac0f96bce2d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928891, "uuid": "5ff98491-fae3-4d50-8c39-723d6e7f1d68", "comment": "Malware payload (Mirai)", "value": "aeca8d2e8e04d6bf5b82b5bd9717c924018b2e2c34cc13c67221f67beb302303e9c6b63d8bdcd525fef313ba1238d4fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928891, "uuid": "5055c934-4a9c-4eec-9555-4c0a6b63c290", "value": "T118632994F8819A12C6C612BBFB5E468E3B2613D4D3DA3203AE295F3137C751B0E6BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928891, "uuid": "60513201-7155-423f-b855-beacbec438cf", "value": "1536:B5Lrxj82/L/d0imMFqNTQoDfrKaEeEvT:B5x82TF0WqNrb6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928891, "uuid": "36ddfcdc-263f-49e8-a2c1-e95a5c278b1e", "value": 71012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928891, "uuid": "bca76797-2c3d-47cf-96d3-459d108f05da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928891, "uuid": "d6c1027c-7530-4d47-b545-37bfd2b57cb0", "value": "neon.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebc5c4f-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1748960872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960872, "uuid": "689b3034-723b-4a7d-88c3-a85f7b312748", "comment": "Malware payload (SSHdKit)", "value": "909a57fbf2ca543b02746e90b01c804e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960872, "uuid": "023d30e7-a90f-44c9-b761-11775a0320fa", "comment": "Malware payload (SSHdKit)", "value": "a5f27766016fb1ed4bf0ca44919f8ac8d7ff03a87dee202312da8ace30cab100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960872, "uuid": "5fd46a98-42ea-4f18-92c7-c3e3e07a6a8c", "comment": "Malware payload (SSHdKit)", "value": "959e0f5293d4aa06d8431c120022641667ee8e89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960872, "uuid": "ef034438-bd34-4d2c-a10f-f7f4d57ef159", "comment": "Malware payload (SSHdKit)", "value": "88e66362051fdb8b12e6367e4386e1250b7d11f96cf00a211e479b1b6241180220d1ffb1ab03a35c6d45b46d91465fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960872, "uuid": "8a7e84c9-d735-4cfa-a2b2-0ea8bd2e31bc", "value": "T1DA255C66F9508EA2C6D41B7BBB5DC75833530B78D7DE7002CD08672477AB84A0E7B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960872, "uuid": "8d3cf80d-5fc6-407e-a409-6d58448e302c", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4/:00BnRED/TwOjX0a5x/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960872, "uuid": "bc834af2-2fea-49ee-aef7-37b5f2698e19", "value": 999131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960872, "uuid": "f6dbadb7-5d55-49fc-ab2d-1fb30e1f8069", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960872, "uuid": "e834140d-0e65-4d4a-a244-9d2b04ca7a56", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fbf553-40d6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748995079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995079, "uuid": "da4f5e0b-a59c-4259-bf05-9887243315c9", "comment": "Malware payload (RustyStealer)", "value": "a2f90a63a7f389de6489d033bc284ecd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995079, "uuid": "3f914048-75c5-4787-b6cf-9256f4a2a2ea", "comment": "Malware payload (RustyStealer)", "value": "a6683b54dbc16e2b8eab5d77895b65f64b05704d37957526fa46be372245766e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995079, "uuid": "e1955597-039c-494e-8133-895f87a3f6e9", "comment": "Malware payload (RustyStealer)", "value": "c06601ba0874f11340d93efcdb957ca42ecc2a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748995079, "uuid": "02cc0e97-0898-49ae-b468-93f8bd1bb2de", "comment": "Malware payload (RustyStealer)", "value": "c89dda7184bbcd740206483f4f62f2199024c13e12965055d6c6401b8cf593363ce505b8fa3295161ede94bf124944e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995079, "uuid": "bf06e9f5-1366-4069-ad0d-c97e9a478dbf", "value": "T1A8955A43E6B2D4FDC65AC0B8935AA232FA71BC8D05357ABB17D49B313E66B406B0D704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995079, "uuid": "23badc99-99de-465b-93d8-1de1cc5fcac5", "value": "6380e1a78053016344ac18621e1edef6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995079, "uuid": "41c541e5-6ffc-4b6d-a0ac-585caa782d3f", "value": "49152:yj2T+yb8NgLpkHHMQ6UIZhwwb+bz9qytcaZaHUHf7gK7ESuBVsyKQzUb:Dka+d7gK7ESuU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748995079, "uuid": "153afa89-4508-4960-94fc-f73594f54aea", "value": 2041936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748995079, "uuid": "abe03489-eb66-40ff-811d-bca79b47a483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748995079, "uuid": "307f6b64-15b7-473c-a481-7b7c63a3aaa1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.6972.14132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8c1dd5-4074-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Metasploit)", "timestamp": 1748952897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952897, "uuid": "159fc1fc-415b-4790-ad5a-a3d5854a8d95", "comment": "Malware payload (Metasploit)", "value": "bd7bb4190d3fa070cc113a35012599fc", "object_relation": "md5", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952897, "uuid": "6e37dec0-121d-4ff2-9230-12814d79d36d", "comment": "Malware payload (Metasploit)", "value": "a683c512a93fbe77846ea9292f6d8c12c2ff7e748d5725055d4ddde365bba9fc", "object_relation": "sha256", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952897, "uuid": "8cebae79-0947-4cd9-9b67-1a9e0bec6714", "comment": "Malware payload (Metasploit)", "value": "ec9a4d70f0427f81598d7a43dbc10c609e76fa95", "object_relation": "sha1", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952897, "uuid": "bb344242-4f31-47f3-9e42-bd0eafcf82b0", "comment": "Malware payload (Metasploit)", "value": "f4941d41bbaac5b454c9de9dc5b2ca9aaef21d4088686f352f8673a7fa1c7e53e64a835187fc7a214fc63f8787420660", "object_relation": "sha3-384", "Tag": [ { "name": "HsHarada", "colour": "#BD1E9B", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952897, "uuid": "da50f356-76b1-4640-a314-404529f2358b", "value": "T1B971297D3269D7A10BB95037B9624A6FAE6943FB6380C444F097D758D10681D42FE1CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952897, "uuid": "80f6ce7d-6e56-4f2a-8dc0-073f78b1faea", "value": "96:AULSewb7ZP7NUe5iw5BiEtph3MVY2zFiP:Aneve5tBtt73llP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748952897, "uuid": "d9203c26-dd0a-4880-bab3-fd7bd3ee6ffa", "value": 3730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748952897, "uuid": "a6cfa0ca-91a4-444d-81d7-5a42d969e0f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952897, "uuid": "cc5f29fe-ffec-4a2c-984e-f1e48dff72de", "value": "!.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829678b5-407c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956395, "uuid": "5b710a1b-6b22-4ad8-85bf-f9b02c109d43", "comment": "Malware payload (Mirai)", "value": "322da6bb6c8aff2b77158355ecf463d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956395, "uuid": "0f498aac-8598-48b9-86d5-2b9acc4e2a45", "comment": "Malware payload (Mirai)", "value": "a8121a633b1edc28ed587dca82bdf5f99d37aa2e33642ceddcd2f908c8879a61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956395, "uuid": "aaaac0ad-b57f-4b39-ab9f-89cef6799a2d", "comment": "Malware payload (Mirai)", "value": "04ea0347d70b3f719749143c71891fa577fe83d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956395, "uuid": "e3a7b307-2e07-4307-9800-4d7d73a108f0", "comment": "Malware payload (Mirai)", "value": "b2385a622589b5874f9fc88c1fbde6768295cf21e40f1c9705c5c4d9aeca4f47b2d533a28dd2fdaf694182b58051f2e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956395, "uuid": "670abd1a-596c-4d2d-9b34-919f4af03c26", "value": "T1A8732985B8809F14C6C5177BFA2F108E330297ACE2DEB3539D145B6477CAD2B0E36A59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956395, "uuid": "b09b02e3-652a-4b25-8526-515d57231fa8", "value": "1536:NkniCvLhqvSs6w2SiEyEtRCqq/BsoLmpMguHcUNVUHalw7WuuH0hsfC2ermQ4Wmr:+LhkSfwXXTCqjoLmpMguHcUNVUHalw7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956395, "uuid": "52fc7464-b49a-413f-8ada-fa728c8fa96b", "value": 79896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956395, "uuid": "e52536cb-cab4-48ff-9151-c6652dad6225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956395, "uuid": "6d33ab71-2caf-4717-8356-eaa5730d3936", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9ca22a-405e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943339, "uuid": "fa6b5777-57a4-4fec-a003-627fee735966", "comment": "Malware payload", "value": "7394d9ccebf8a2f66f89d6da93dd4540", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943339, "uuid": "d9cfce0a-cebe-439f-b3cf-3e7fe0698c36", "comment": "Malware payload", "value": "a8ebb824ad3d527b8390dca284c53c3d1379995cf4c6e857a9f5b44c7665296f", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943339, "uuid": "614b602e-1c8e-4861-bdce-9cdb0f072b17", "comment": "Malware payload", "value": "6020127a1e3a06fe2e91c6adf9da5c147828cd17", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943339, "uuid": "c02090ce-1253-4db0-b9f7-258e58dbfd0d", "comment": "Malware payload", "value": "045eb10cd55602e5bb0316be616d2e80f50c51175f02102a46b58ac2680ed4d860ebd77a7c613319d48f152d4b12bb31", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943339, "uuid": "51a4885c-15c4-4718-93d4-bd87d6276664", "value": "T12472E13CDAF1FDD0436F70D09A5D3B46108D5B63BBB51B6CF9C205AA5818689DB3A24C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943339, "uuid": "1ccffed4-f5d9-4aa3-8f00-802878f7e9f4", "value": "384:GvK+SWpijmhiihwuBZ28j0F48VhoEh4rirCZ2n7Ehzh9qKrh9Xw4t5vymAOUdeP:EJi4wwglwiuLlkKduD+P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943339, "uuid": "f28f8978-abb7-444f-86c3-b0964b2b7249", "value": 16938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943339, "uuid": "556ed586-9f68-4a2b-9190-847f405ed6d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943339, "uuid": "9a23cb13-2017-46c8-8315-e285b25effd0", "value": "a8ebb824ad3d527b8390dca284c53c3d1379995cf4c6e857a9f5b44c7665296f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd524b73-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748931154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931154, "uuid": "ffba1e76-9c14-4d94-8530-17479399ed99", "comment": "Malware payload (LummaStealer)", "value": "4fc52e2c73f6b6d5048aae12184c1504", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931154, "uuid": "8061cdcf-d6bd-4af5-8428-f4ef5e21ee3e", "comment": "Malware payload (LummaStealer)", "value": "a9065134982c498022ab86d3b5ff519ce9716975063043b19174f81956d2acbd", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931154, "uuid": "b0bc1438-9a3e-48bc-8d93-c2bc65f7fbb1", "comment": "Malware payload (LummaStealer)", "value": "0241a6ee673564ed62ef0e5eb2090a54ca3a2320", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931154, "uuid": "c53c9441-3701-4e6d-9208-cfde1a5dc54a", "comment": "Malware payload (LummaStealer)", "value": "66cf6c829419680b7f00350033e90a489df0311570d4b01e43f202589f55db8a1482b1848e1badd4771c4422513b53f1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931154, "uuid": "fda37113-0aef-4870-a027-f04dd21a87b6", "value": "T1D23137240DF202FAE677C7B9ABF973B28425FA93DD654ABC014053415621110F8B3E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931154, "uuid": "376de532-da63-4f8b-a12f-0e3e1b029355", "value": "24:8y/BHYVKVWO+/CWGO08aJXNSZHdkzJm0sHCEJZarab/BiT:8+5aKTnJ9SDYJUiuZ4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931154, "uuid": "5f1efd37-345e-485b-aa0c-4026cc16a5a7", "value": 1558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931154, "uuid": "4bee5190-a67b-4b39-a785-d2e1ce6ef2e4", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931154, "uuid": "6b5f22d4-fe4a-4a40-9a24-406a90519418", "value": "SharenVpn_Setup.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71e59cf-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748994252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994252, "uuid": "c7255aea-cca6-43fa-ab21-605a40e9fdac", "comment": "Malware payload (Gafgyt)", "value": "72148e7563914f26b0419992ebd4fa14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994252, "uuid": "8b1cbd8b-aa8e-4ceb-b000-9430db3a122a", "comment": "Malware payload (Gafgyt)", "value": "a91b470e1ac4f7fbe761e06c22a4538e4ae71b1864a5e52db8bb5b7e140fea5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994252, "uuid": "1d540cec-67f4-446e-a34c-7f85cdc35f29", "comment": "Malware payload (Gafgyt)", "value": "0a183a5b250a7df34d515df76a3e149dd75b86e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994252, "uuid": "e1defb30-21b0-4e3a-85fe-800c0e1bfd5f", "comment": "Malware payload (Gafgyt)", "value": "4164483c45dee44822a9fee388d0db4f2cb037a6385f22088c53a56a3fdf8612a507f8356e64cbb345465f7ae3c4c3fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994252, "uuid": "ce5f1a35-bd1d-4cd0-90f1-102c737bfe5a", "value": "T1EAD31905F460875BC2D217BAB64A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994252, "uuid": "17aa80b3-44cf-44d3-81eb-80354b9c3f5e", "value": "3072:Sdf+fvEqa9FazYA7IboRhle391CErktmCQA9FX9aH:ifWEqa9FaNhle3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994252, "uuid": "0228526b-8db9-4a9b-9441-d7a47981ad54", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994252, "uuid": "d0e28d65-feeb-4942-bab7-26ae633928b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994252, "uuid": "f6c863ce-0bdf-47b0-b19f-65da095bc368", "value": "arm61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1fb974-4092-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748965914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965914, "uuid": "69d587b5-881d-4a47-91e5-b262b1a5c28e", "comment": "Malware payload (ValleyRAT)", "value": "ae69a69f29ac7bcfcfbc52f7af42ea30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965914, "uuid": "974d472c-e138-49ee-9c8b-9d5275407282", "comment": "Malware payload (ValleyRAT)", "value": "a9239e60f962cc3e1cdae5b471890a091f9f6329898125fb7baaf5e8a89f0177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965914, "uuid": "948f9ed9-d254-4d3d-94e9-c16d18d6889c", "comment": "Malware payload (ValleyRAT)", "value": "4e5f800e57da3bebab87783e1da283abcdb2e230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965914, "uuid": "f0c6207d-2d71-4190-a19d-508fad5e9669", "comment": "Malware payload (ValleyRAT)", "value": "7ccd6626eb20bbbe46fae4b9d1a9772f2bca265d7a0173084ba80841e0f915b11953dd77f436608fa5748f96ab875df3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965914, "uuid": "69caecea-7c29-4c4d-8456-623cc82d743d", "value": "T16C433B157261C032F8951934487592735AAA7C3253BF81CBBFD81BBE5FA12C06A7837B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965914, "uuid": "ceb25438-ec6a-49a2-93b3-27fa20572274", "value": "91763ff381e8b06c220aee8acbca4a89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965914, "uuid": "93899a82-8d73-4496-b5b7-5446f84d78fd", "value": "768:flx1lZY1xTM3D00ZPA00x6cD+Nxiwf0jc9hjj/n2MEDCd3ImQciex+:llUTMTXANxzMiwcjonWfe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748965914, "uuid": "831a38d6-a153-4899-ac3b-93e6302c5f3b", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748965914, "uuid": "372f0a6a-0177-4e86-87e0-743ef1155655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965914, "uuid": "e7c31ac1-58a3-41b9-b379-39651c1b088e", "value": "ae69a69f29ac7bcfcfbc52f7af42ea30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d576cc7-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748935180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935180, "uuid": "1bff8bf0-d64a-4525-ae7e-8922190c8a5f", "comment": "Malware payload", "value": "e0aa7d372a9abe057293957c99161acd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935180, "uuid": "e30dbc6c-5e49-468b-abb1-8f2a29b5a92a", "comment": "Malware payload", "value": "a96a1737301cd29184919a0934a01ea644e319bfc3df6a4062cc70c52fa2e269", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935180, "uuid": "f84b11c5-6c9c-4dff-941b-31d96331598c", "comment": "Malware payload", "value": "1484d39195c23d5c3e7f5d458fd8a0267a7c0083", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935180, "uuid": "e3a5b068-eb6e-4ded-9a60-d37832c67908", "comment": "Malware payload", "value": "deaddb1164073d0d9eb96d68275dc1b371af0ddd72640bc09bc31f412ec69d2cdb49dbb23c0bbdb4469c2a01f85cdf22", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935180, "uuid": "aa458f7a-2825-4247-956e-09cba5b7aa55", "value": "T105F4C4753686866546B3027EEE63E400FE35102702EE9438BA9DD1C52FB4725C2B6BDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935180, "uuid": "325f20f9-9d0f-49e9-8a15-02d5aa48f3ca", "value": "12288:xvLWBgED+cSKF+UBS4qw4FIxYUP1BFHQRVVDzJFUsr+gcm/I++3hCJVICjq2DxWS:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935180, "uuid": "21e0a371-86ab-475a-b039-5627ac9ad098", "value": 767407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935180, "uuid": "46c3fc33-8b2e-4e0a-ba91-d206afefb359", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935180, "uuid": "d701db3c-f882-49a2-8c90-aaffd9e5d062", "value": "ADACLScan.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d75e455-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748960655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960655, "uuid": "1b43a575-266e-44b2-a718-0a5a1367510d", "comment": "Malware payload (MassLogger)", "value": "09ff39b264b0592c2eb2d52b81f4af7e", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960655, "uuid": "dd8831bd-5b39-43fc-a646-50528a81f494", "comment": "Malware payload (MassLogger)", "value": "aa41091036c915963cf834ebd354d52ef591582fa2fc26099af6fba62d2098bb", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960655, "uuid": "722e7c2a-095d-444b-b8aa-af03689fd6fa", "comment": "Malware payload (MassLogger)", "value": "c80014e5a5f7f85787a46bb577492fa05c64a1c9", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960655, "uuid": "6e9949c0-a09c-457f-9bc7-84927a14a26d", "comment": "Malware payload (MassLogger)", "value": "db91bfe3cd034d62c9b90cb4c3bf5d36a9661d20e8c0742b705f07a0d070910b97decf9fed7ee0ade95ffaaf5dd98fa8", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960655, "uuid": "2228cb33-01e5-4342-9da1-3ce9cab8dd02", "value": "T1EC35A15D9060A9D3A054FDF0F551AF97CCDB239416278A421FD1A1AD23268C3FFAE2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960655, "uuid": "a54104a4-ec08-4b25-bc78-0a0c3f1b01a6", "value": "24576:G90IOCyGeLkohQISDx3rykD7vXa5fRIYUCX6izr5Z/eFvOCAL857:Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960655, "uuid": "bf710c1f-7b8b-42c9-8246-e445155738fc", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960655, "uuid": "8b4e4cd4-dd9d-4b78-af35-1a11ebf75761", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960655, "uuid": "73ea85a3-dda4-4407-b405-49c4e37ab177", "value": "mmo00977b.pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d715a53d-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989179, "uuid": "31071b7a-ba84-4648-934e-53404778edec", "comment": "Malware payload", "value": "a8b2f85a1d6a5e7e859159128a9e4557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989179, "uuid": "8da7b774-2f47-4dd5-ac29-364569285d5e", "comment": "Malware payload", "value": "aabd85b5827bbf9b25af84d5c4ee08aaa44fa0e20eead10558ff9673fd11ad35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989179, "uuid": "183b2ded-409a-462a-b033-ae38e580deb7", "comment": "Malware payload", "value": "e219425ca4bb477c8fc0f9a12607f91e1b11e6e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989179, "uuid": "b3de8a07-9026-40cc-8474-627ed5c8ed57", "comment": "Malware payload", "value": "227c4d4b533814d912c2023dff7270caf5e9276b25716e828e9fbae78018915e7f24997976756b640ef36379995cbea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989179, "uuid": "fc7b0672-8783-4608-bfdd-a42fd2e581e0", "value": "T1C625D152F745E8A0C46906718823DA2406A3FD1689344A3B31EEBB5E3E723D36277D5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989179, "uuid": "6cf7debd-00e6-4bd1-ac09-16ef152f25ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989179, "uuid": "271bcb60-78b2-4b34-b559-694520856a05", "value": "24576:YHz0O0fobPGLpGLMMMHMMMvMMZMMMKzbKXOMMHMMMvMMZMMMKzbKX7GLMMMHMMMv:YHzD0uOMMHMMMvMMZMMMFOMMHMMMvMMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989179, "uuid": "05f0a8af-88a7-4969-b3dd-d0b4b2b266ef", "value": 973824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989179, "uuid": "3f004a2c-f86e-4c72-960e-59d164b8709e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989179, "uuid": "61d0377b-fc2c-4947-8987-ad1938c1e043", "value": "SecuriteInfo.com.Trojan.PWS.StealerNET.125.15750.11945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8953a4-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956976, "uuid": "9d8ed1ce-596c-4243-8681-831af3d15f9d", "comment": "Malware payload (Mirai)", "value": "72333528dfd70fe27c64ed186ea4048d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956976, "uuid": "7767a472-c201-44f4-9b18-9eda0907427d", "comment": "Malware payload (Mirai)", "value": "aad06d81ca2b22e20b21122ec9b4ed6b83222e8f961651160d8c9cc5044b6520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956976, "uuid": "fa976525-ad00-4928-a90d-eaedb439040a", "comment": "Malware payload (Mirai)", "value": "3102aae6ab39b4a8af1e7f44d03aa294e529b754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956976, "uuid": "6104a5e9-a0f3-42cf-b9a6-8a955773663d", "comment": "Malware payload (Mirai)", "value": "5ed9a9b38a2621e332459f4ce720e4c429449442dcb587aeecc8511c805e79331210d95f8521eca4caa13160f8f715b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956976, "uuid": "35ab2bd4-d37e-4299-a152-c79fec06ab05", "value": "T1D6539D22E8291D64D19944B4B428CF366B23E5C0434B6FF70766CB75A453DAEF808BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956976, "uuid": "aa46a8db-9491-4f21-b105-da4ef65bd215", "value": "768:ziYaDqEfWr38jUzGsICjMIKbG/10j7caoovB3joCiuWlOH0tdMfmb4q/k6hI:zNaOvkOKbG/1w7/HvpoCiEH+8q/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956976, "uuid": "95864d66-94e8-4d3f-9715-a4ecf5706c4f", "value": 63556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956976, "uuid": "a25efa63-1657-4cc9-8ca2-63617fd0fd67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956976, "uuid": "8f0c6b40-40cb-4713-95d1-991502de8eb2", "value": "neon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1be9c0-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748934834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934834, "uuid": "0d7d1db9-1b8c-4fc3-b4f3-4177fae71197", "comment": "Malware payload", "value": "132dc7970467c12f8afbd21b077031bf", "object_relation": "md5", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934834, "uuid": "fc7f889f-a01b-4a37-983d-f80206b318b5", "comment": "Malware payload", "value": "aadd5da3374ab9d9201c4e6ffd13f921c94bd23328a4fd185134fea0d4fbabfb", "object_relation": "sha256", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934834, "uuid": "4d4e884e-f594-49e3-9662-a9816020abe0", "comment": "Malware payload", "value": "207ae3c568a142a98e7eeafa206dd2712b07ca2b", "object_relation": "sha1", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934834, "uuid": "ab197fe5-b162-4ed5-bf38-33fea2a6b0ba", "comment": "Malware payload", "value": "f9c10918a9566367d967a82912efbd44affdc3b1a171a78a87f071a04c53d0b874328c361238a254a9cb05ed2d3aa9ca", "object_relation": "sha3-384", "Tag": [ { "name": "bart2003-ddns-net", "colour": "#0DD2F2", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934834, "uuid": "24b898fd-f90c-4b5b-b2c4-9a43cffc3766", "value": "T17CA37812FE2948E2BBBEA6752D23395B5D31B8F345B4E040237B749949C1FDB8D006B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934834, "uuid": "ec844bd5-9164-481d-b6c7-20f30adf46c0", "value": "96:1fWWxkF1VLKQ0nKW4HnBXds9KyMXds99IOkgP7elINfWEF1VLKQ0nI:JWWsV2tWqV24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934834, "uuid": "e0b211a1-8064-4287-83f6-aa1ecc12d69d", "value": 106490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934834, "uuid": "6e3c607f-1a3a-497c-8af2-1779a3f4e6dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934834, "uuid": "2527b02c-ca45-45f3-b640-b440c806a199", "value": "1tronps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62d0d92-40a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748974950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974950, "uuid": "f757a739-f8a9-4581-bd02-64dd73efbc93", "comment": "Malware payload", "value": "5bfb096d6306c314ca01f69c5268d244", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974950, "uuid": "04c788bd-ebb5-488c-a921-2a999b2c2a6f", "comment": "Malware payload", "value": "ab0d8f5ad4d81f61122571fd8aa71ac0bbcf94fdac7524ee975541c2ab3b9a0f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974950, "uuid": "24603fab-a1d9-4c06-b6f5-a62e437557f7", "comment": "Malware payload", "value": "c46da22463811576f92b6dc5b774366e1cf2b830", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974950, "uuid": "c7a8d163-dda2-4cb4-8ad0-40e3ce1ab063", "comment": "Malware payload", "value": "f5d8ae16afd85986860bbc026de13ae81de43172e0c824040e80b3171e5e6bfd399a80be0d29925dfdbcfa7c38793595", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748974950, "uuid": "a9abdd3f-9804-4a47-a63d-5592395e0038", "value": "T1695633492BC60068FEB69C7B93A40F28B850248E57C59907FAC990729CD45FF5FCDD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748974950, "uuid": "5169e012-0c93-4b96-9dda-d42ffe090728", "value": "98304:e7aX43Di0IDJQ6b3UUYX1dlTAMhqWxJp7nmfcUiW6pMgUnihfjqYlHDJhlrVN+dY:YfO0eQ0kUYdlTvUOmfcfpIgfDjJLVmqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748974950, "uuid": "d4476a56-47ca-41b1-85e2-d0879ffce2e4", "value": 5905473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748974950, "uuid": "6d7eb65c-72bf-45a0-9439-58b5786735a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748974950, "uuid": "17539b89-70e2-45d0-8d97-a9ad4e6d8cf7", "value": "Xeno-v1.2.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fe6e9d-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989204, "uuid": "ab21962c-c1d3-410d-840c-da048dd515d8", "comment": "Malware payload (RustyStealer)", "value": "2cc92a2c646ca3f3e64efd2d79979fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989204, "uuid": "68afeb51-0954-408c-92f1-dfd8ae4c1344", "comment": "Malware payload (RustyStealer)", "value": "ab354df12922d65b2541a7fb2aa1aff9954bdc5824f545d6b97a841f34fba7f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989204, "uuid": "66f31167-152f-4943-974a-3f0dc33fe2c7", "comment": "Malware payload (RustyStealer)", "value": "99e050a47801eeb50fa5ba2b7decbba7badefe2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989204, "uuid": "cf79cbe0-4741-434d-b32b-ffa1bc2da1a9", "comment": "Malware payload (RustyStealer)", "value": "a12b3ee9330754d3ee403db09b6f6be27de6499a9985262e906b544da1bbef59a36c93a6f970f46a5b94a3272e4f9030", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989204, "uuid": "c21bb204-4208-402f-b053-c050d751e9ff", "value": "T155D44967E2C01496C59ED075C71E41A7232EF4274F0B6BBA4115A2603C73EECAA6EF17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989204, "uuid": "b6ce50b7-756f-4c35-9354-73d540e2e438", "value": "d16ddcb565c3e1ad6a5628add3fd21e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989204, "uuid": "3218a763-b5ea-4e14-809c-9a9c5189c4bc", "value": "12288:Ainpvyq2cOefzKBtxit3ayAHbSUf+Q7uFEaOgBtY97/fk:AipvyqDOAzmDit3ayAHbSK+Q7YE7HN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989204, "uuid": "716f8305-2468-459f-a946-fdc18ff3427b", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989204, "uuid": "928f3b28-545d-435f-aa0c-d995bde4a8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989204, "uuid": "842d9fd2-f59e-42cc-a760-0d110f23e0a2", "value": "SecuriteInfo.com.Win64.MalwareX-gen.22492.15213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f938f1-40a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Hajime)", "timestamp": 1748973474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973474, "uuid": "c30f226a-a1de-420e-9374-ec7773009a51", "comment": "Malware payload (Hajime)", "value": "063344372d67024ba4939e00398963b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973474, "uuid": "e6a80628-fa96-4827-a0ae-b485eeab5e3e", "comment": "Malware payload (Hajime)", "value": "aba1ba56bef1f4c7516bd32cab8cc39baac2613621df4dfea796d5506e6b2d03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973474, "uuid": "b72c29ed-7984-4417-9f27-3b8238719524", "comment": "Malware payload (Hajime)", "value": "7291b0b9a364d226bc18e4913177869d0e178ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973474, "uuid": "4df5df44-76fb-4038-a13f-01c3c331a049", "comment": "Malware payload (Hajime)", "value": "5bc8d2731eaf2715d077989ed28c84bf5279687408e110e8316c1b664ee85021fcf3b994133c5a86855d5f9957102fd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973474, "uuid": "661f13de-69cc-4523-b6c7-1f303e6b244a", "value": "T1F1F2024732953B33E56249F4D3FCAF87615A7C24DFEE142BA4513A6170B321D24CE81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973474, "uuid": "71f30198-9b85-48d9-b8e8-b1a0a3930fbe", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFh:yYI0ARqw1qAEW67UIWi7M8g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973474, "uuid": "5225dc09-eebc-4285-bda1-ccf4455d5582", "value": 36608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973474, "uuid": "8179b1f0-b89a-4b65-ba89-d5bc3952d239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973474, "uuid": "37b4ed2d-a7ef-48db-a44c-e42cb3179d1d", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbb2907-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748931128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931128, "uuid": "473f5b1a-31bd-4c02-9254-c1f7edec5cd3", "comment": "Malware payload", "value": "088db9d3e663a4f40594a15ee6a35659", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931128, "uuid": "36eb3e5b-3cc5-446a-b288-9ed4cfca491d", "comment": "Malware payload", "value": "abb1b8de6751d06818d392feeb1c67905ff80bef6864421b33acf538601903b2", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931128, "uuid": "4c572fc9-c8bc-4d64-b39c-a3ee0499ad78", "comment": "Malware payload", "value": "315d677b10dbc808fec008e1e6ff6370a5c072c8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931128, "uuid": "25eca614-08d5-40ab-8b1d-6d2769643197", "comment": "Malware payload", "value": "eb25810fd4c9b291547a11da1bea295201b11b7902433610ae59bdb20052107834e65c4262d0db99dc1bfd7aace91724", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931128, "uuid": "9e8fb5d6-6c2f-45d5-a0d2-b925291e0014", "value": "T1D75134281AF101FAF673C7B5ABF5B3B38566FBA2CD214A7D108013451722504B4A3F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931128, "uuid": "fbe434e2-4a5f-4120-a41a-2c6f44b0d1bb", "value": "24:8AywtnHYVKVWue/CWWwCO0uxa1q+Awsrsysh6FtmVdd79dsHW:8YHaqRTd17ADQVh6FtmVdJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931128, "uuid": "dfb00295-5ad2-481d-8f16-e4e271cc5e10", "value": 2572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931128, "uuid": "0b3f47d2-ee45-4ee5-b2d3-e246972990aa", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931128, "uuid": "7b435a50-caba-449a-a4bd-43ea2b04a052", "value": "putty.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0604384-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748960848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960848, "uuid": "28111ee9-77c7-4dcf-a259-746f9799dd39", "comment": "Malware payload (SnakeKeylogger)", "value": "df7c0833924cc9fb18701073f0d1ba69", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960848, "uuid": "73c13dcd-1b21-4c0a-a801-2f4b4de590b0", "comment": "Malware payload (SnakeKeylogger)", "value": "abc359d027099da2516be2ee75fc8e6e0486a787570b658d355758ece7cbcc28", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960848, "uuid": "0e335370-2327-4deb-8713-d77cd466ca57", "comment": "Malware payload (SnakeKeylogger)", "value": "83f0e3d7fa39499b0066dd0de040d400ec028070", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960848, "uuid": "942fb17e-677d-48b8-8b87-ca40fcb3a667", "comment": "Malware payload (SnakeKeylogger)", "value": "301e82437c4c264f8245a55ff64c3d00ae1637a720dd39bb66b7e3a75e896a9f415f71f4d2d44c4697e3468e1c2e0387", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960848, "uuid": "cf80acf1-1650-425d-b010-9b74b044e873", "value": "T10125BF1373DDC361C7B25273BA65B701AEBF782506A1F56B2FD8093DE920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960848, "uuid": "1797e9de-cbfe-4184-9479-e0d0fffb18c4", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960848, "uuid": "77221dc1-4ded-46f4-a01c-412c6c8c254e", "value": "24576:Ztb20pkaCqT5TBWgNQ7a4hBP8lm+kF6A:qVg5tQ7a4hBYc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960848, "uuid": "501fbd4b-a41e-44bd-9e4d-78627f9eef2c", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960848, "uuid": "bf9461b7-e841-42ab-89a4-b92ee99b64bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960848, "uuid": "2834d9df-0276-42e8-b28c-f861d6ed53d8", "value": "DHL_9638453DL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7aa3d80-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1748934607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934607, "uuid": "13125216-c914-412a-a9f0-21465536ff39", "comment": "Malware payload (njrat)", "value": "0b0c60e67a22da494a2058edbc9d926b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934607, "uuid": "e54cde2e-9ee6-45b2-b12a-a2948af0f942", "comment": "Malware payload (njrat)", "value": "abd3f79dc07055164344209ddc32cbe7420790842ad27dc77cf88f530afaf7ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934607, "uuid": "df041bfb-c91f-4652-b72c-e14896f928d0", "comment": "Malware payload (njrat)", "value": "04319948e0bb4c26e6343e99546acbeeb1dfdf9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934607, "uuid": "34a2fb19-79af-4df6-afbe-be7cde28d8b7", "comment": "Malware payload (njrat)", "value": "fdbf46cef2d7de9652b3676b0feee134c2cf144fcc17b3abbfef7bfcc8b0aadc292c76d5f7011c7839d996137b914d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934607, "uuid": "6bcc7dbd-538f-4922-ab05-2ac4a78a8fbe", "value": "T168054A8636408597D438367499AAFB243222AFF86C53CB07F5903E6FFD72F851D92246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934607, "uuid": "5061fe15-ee2f-4e8e-8b2d-8c0e7742b3d2", "value": "cd74c16e19de02339ba1d593de4c426e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934607, "uuid": "7c179460-be25-4f43-aba1-0347c8396802", "value": "6144:GdzVkKjb+UBCjlKUpfn0tyZJ4AQHsnUVneTrVVVosz6dxiUBCjlKUpfn0tyZJ4AJ:Gdz7GUBySHNendNUBySHNendt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934607, "uuid": "b0a6048d-2021-4140-8e6f-5bb4c20558ab", "value": 842859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934607, "uuid": "43665fdb-afaa-4bb3-bab6-99a0dc94ef7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934607, "uuid": "680d9fd5-d2c3-4f6a-bd16-3f448d20a71d", "value": "abd3f79dc07055164344209ddc32cbe7420790842ad27dc77cf88f530afaf7ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af13b3d0-408c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748963342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963342, "uuid": "a9132bd3-9e22-4c50-a659-986779ff5a46", "comment": "Malware payload (Prometei)", "value": "b4f99592239438128594a13aa86b5f0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963342, "uuid": "0c8ff439-0653-4840-bf56-8eaf7a30d148", "comment": "Malware payload (Prometei)", "value": "ac92afcaf293a574f90247498b31d677afbbfe12a5b2dfdcda6018763d35fecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963342, "uuid": "6e3e9ebf-c1ca-439d-ae3c-dfd8e932d90e", "comment": "Malware payload (Prometei)", "value": "8d2f8c1a981511a8bf870bc2caff272bdf452d96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963342, "uuid": "9b44b109-7934-4245-bb3b-36c7f93346a4", "comment": "Malware payload (Prometei)", "value": "39719ac4435ac2ac12ee8652417949a964005dbe4cad195d443a696433557116dcc65c61b6e8306689c77095cdc7c82c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963342, "uuid": "8e7589c8-6d1c-4863-a2d4-db292e0cad85", "value": "T1E19423F8C83D2E30D8169B3CBB5A8268F0E15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963342, "uuid": "b4403054-bf5c-4a8e-b1ab-c65a60314fc9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitge:25WOSACZSV6eKRH5EPiamb4DsDwwcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963342, "uuid": "5f0e347b-2bca-4088-b135-2cef06ec306a", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963342, "uuid": "bebf7a7a-e6fc-48fd-97af-31ba0ff89c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963342, "uuid": "426cfdba-fd89-4df7-af74-52f2fea079fa", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73627588-4018-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748913420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913420, "uuid": "35d2ef43-837d-4d92-9118-0f03cf9bf5cf", "comment": "Malware payload", "value": "f18ef73997d66e13af89d24a61d8d808", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913420, "uuid": "9e5e0e38-6fe7-4d87-8a65-231782211ee1", "comment": "Malware payload", "value": "acbd7ebbf9d2d76173e07ffb10ac4f37efd76e5dffcc5e644c8285170b864ae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913420, "uuid": "9aade2e7-bbf3-4944-9acd-ee1cf50a188a", "comment": "Malware payload", "value": "8c78fc391ec3929dbe62e8962151d2321a4b0d1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913420, "uuid": "0e48fc63-ac55-43ac-b825-e702fa0a2d01", "comment": "Malware payload", "value": "6ebbd9ff8743929547d8078c057dbddb4aca7ec2bc25807bca20a3aa34d8774547cb1b9d2961560a9463dcdf7b8d3fcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913420, "uuid": "77ecba83-5016-4d1f-a080-9054c6e1a766", "value": "T15EA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913420, "uuid": "e90fe037-9bd6-4483-aa8c-34ebbf9f72e9", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913420, "uuid": "f91408a6-8702-4dd4-b915-bf7db9adafab", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913420, "uuid": "c883baac-2a42-4c28-a597-88196811aad9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913420, "uuid": "49b98de4-c3bc-4d43-9718-c315ae4ab739", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3398ec92-4096-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1748967430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967430, "uuid": "c5f5aefd-3615-4a3c-93b1-358a587f0e79", "comment": "Malware payload (AgentTesla)", "value": "9051a84d2d124fa185752b25d5c03280", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967430, "uuid": "048231d9-0970-42ce-9b90-2dd29cc12123", "comment": "Malware payload (AgentTesla)", "value": "ae49dd5b3efc9cdc77f28b12d804fcbe88ae910d815288ab55547369aae9bd3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967430, "uuid": "547a5004-dfff-4c88-a341-34ac229ae25e", "comment": "Malware payload (AgentTesla)", "value": "e9e8ffe7a4a556bc73f2db0811f74cf407f4f7f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748967430, "uuid": "02425bc1-4f4c-440b-b06e-a8734fa3c7a2", "comment": "Malware payload (AgentTesla)", "value": "d17d69934ebd1e45b31395f4b3c39bf3dac8b9f21b700fd3a0b889030f0a8cdcf3568b3e129e07c4b7ec85ce5c9d4fc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967430, "uuid": "b355eedf-a365-4c76-93f3-dedf5df08ac3", "value": "T189C423B87B1A23ED62744796B5CDFB441F86ABFB7C24842042438C15B1BC0C6EDA9DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967430, "uuid": "f17bdde6-d740-4e63-886b-a0b41d716921", "value": "12288:FSdv9n4qT7MohItrm3EHr+8x6kO6+/A19PqvG6gKOS+74V:FmT7Mrt+EaoOfVgKOSC4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748967430, "uuid": "a9da22ab-3a2d-49fe-a5fd-7fa9d16a10e0", "value": 547480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748967430, "uuid": "1d93ca92-d236-412e-8708-ddfd632a08e0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748967430, "uuid": "5c74167f-b89c-4632-b74b-98d77c8d8716", "value": "RFQ Mei 2025.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e8ad5b-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956666, "uuid": "18a99802-845b-40c3-9ff2-740de4c5dee7", "comment": "Malware payload (Mirai)", "value": "94d22340ba8691dd78346475f8310366", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956666, "uuid": "9de650e4-0956-4fdf-986c-062f7a3b22ee", "comment": "Malware payload (Mirai)", "value": "afd51132e529b1d18136492f2818c2c136c22241939ea1b6be91063d6afe9e3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956666, "uuid": "b0f58447-c5ea-410d-af32-3d5c6adebd59", "comment": "Malware payload (Mirai)", "value": "46024609cd72a4cffdff3777662e0527b72a2acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956666, "uuid": "91b1946f-c9d4-43cf-95bb-faed3a03b845", "comment": "Malware payload (Mirai)", "value": "db52929408518ba01fd8e46aba21b8a4c34fb474a89138373a780371dd61b83b1c33221ef392af24d70dea8c068feb9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956666, "uuid": "10bdd2d7-ffa5-47f4-98f6-5508d751a45f", "value": "T121539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956666, "uuid": "3a33b12c-69ba-44f0-b14e-60efc2e71c53", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956666, "uuid": "a1ecb48d-f1cf-4c1e-b987-464d9c86a22e", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956666, "uuid": "a65b0bba-03bf-4a9d-9cb4-820a7fa0406f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956666, "uuid": "5cc425b0-00ee-49f8-ab0d-2f26fbbcfaeb", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f6f961-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748927923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927923, "uuid": "50206f08-961c-406e-91e0-cf3f15ce5a0a", "comment": "Malware payload (Formbook)", "value": "1a134d876fba6a68d811cdc1092fb19c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927923, "uuid": "c5ea4f96-eb4f-4597-8fd0-8afd60d0fbf4", "comment": "Malware payload (Formbook)", "value": "afda0bdacfc598667d22a2f3c87ddb6baf822c8fe7521d3e7b46cae3349d541e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927923, "uuid": "d260fe99-a070-4173-8302-d73fad7e6d9a", "comment": "Malware payload (Formbook)", "value": "831dcd45d4378c260f75d4a59591538cb3799d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927923, "uuid": "5ed83178-11d5-4492-b95e-61f4d3200ca5", "comment": "Malware payload (Formbook)", "value": "935e426d0bbe9c11fcddf0d767e8a3ffd21e3e23d59ef4d887ba33172412ecc90abb56709e9ebf73be4adabd56bb5c06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927923, "uuid": "cd75cea1-e394-4f1c-97b5-a3d901328288", "value": "T1D7F4128E27A5C523E0B70B7846A1D17947BAADCEA982D31B4FD83C8F7D1374865B0394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927923, "uuid": "56cbda1b-82af-4fc4-95d8-529adbb46d95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927923, "uuid": "0017202b-9893-42eb-b12b-295d21ef17e7", "value": "12288:KWDJs5RuwvEdbJeOTMHzhqwXDRJnbcNPlhb6BdAmVui2Dy9PW:x9snu5dbR5wXlklJ6XAmoi2S+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748927923, "uuid": "f6747060-71cc-4f07-a216-0114b0088b0e", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748927923, "uuid": "4d104220-97a2-467e-91f5-4d0a3acb03bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927923, "uuid": "2f1be067-11d7-4bba-a872-9d7c713cbc91", "value": "SecuriteInfo.com.Trojan.PackedNET.3345.18668.2798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fd5d3b-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748930873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930873, "uuid": "d820a2d8-b851-434c-a703-bbc0f0226e0f", "comment": "Malware payload (RemcosRAT)", "value": "43d8ca57c12ad5de012223ef3f2ec8fc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930873, "uuid": "f5fcc535-13f4-4d1b-9a83-421b91cb7505", "comment": "Malware payload (RemcosRAT)", "value": "b0d821395d99080e21269644b85dbc71397a15be735b07b28ea63bb19bd83ac9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930873, "uuid": "7a8978df-0cc9-48a9-9bf2-6faab1e7c25b", "comment": "Malware payload (RemcosRAT)", "value": "91a2951559ca98974b10f5de5b06a1ccc93f69a2", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930873, "uuid": "54a4a7f2-f1fd-4a4e-af74-a9147064b989", "comment": "Malware payload (RemcosRAT)", "value": "a9fa912a69e01f3deb7bddcfe2574199ebae1f4b69502dfa267e121a675acbe253c2564242f8c099bca5564fdef28971", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930873, "uuid": "fb629bd8-275c-416c-81b7-f1a7681ce20e", "value": "T15B45BE47E69489AEDA59223D42F31B6D2351EC81BF13020F2B48F31C79F7EA15A9235D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930873, "uuid": "6bb3e103-2870-4ddc-89c3-130ef455c329", "value": "24576:AzgGNMmFhU4zVAJqFvlNvd0msJqxix3DIk:Ak6MmFCAAJqFN1dVSqQak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930873, "uuid": "6bbfa69d-744a-45e0-aa3a-e96ac5534c1a", "value": 1226752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930873, "uuid": "79b974c5-ee5e-4b11-9f02-58d41badaa7f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930873, "uuid": "405f3bf0-513e-49bf-ba61-5b91be146dce", "value": "ReviseNewOrder000000012.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ea458d-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929618, "uuid": "f38e8f02-d5b5-4559-aaa4-8a8b675a3ed5", "comment": "Malware payload (Mirai)", "value": "2cad8390590633e872062f08113840db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929618, "uuid": "be9bcbbb-813d-4ea7-ada6-81244fd00f45", "comment": "Malware payload (Mirai)", "value": "b155cd49e8bd62f51e4ac3df1d01ef97c5e87105da7039d72527c1046bb72e63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929618, "uuid": "017850a3-a75f-4f67-86fd-52e3ae8b2694", "comment": "Malware payload (Mirai)", "value": "d7058d475b768382589d7fe12665ab0640f52ba5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929618, "uuid": "e742dc9f-8055-4558-aa15-bd0caa97e0da", "comment": "Malware payload (Mirai)", "value": "d233f471d7a302ecf269f3870cb4b352b96feeceb0611025687a6335f913bf5dfc3c38a82849ee674ec65da931bc2cad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929618, "uuid": "b83f7de8-27c8-4bea-8e01-016a81aa2b4b", "value": "T147E2E25845C4D8DDE8A6D138167EACAE3CB628D19B6D40BB370261825FAB5721370CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929618, "uuid": "6ce9cfb1-02df-4f47-b8be-1074e5a84983", "value": "768:jWDoe0OojPkw8R32StLbeMGByngTTTfZavR/qgOXwbir:cNoDP8R3htLyMGUqzZ9Dw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929618, "uuid": "3cab68af-825a-4290-a6af-543c42977ab0", "value": 33456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929618, "uuid": "84720af6-da20-4a6c-95f8-02fdb8d116e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929618, "uuid": "80e25560-0c54-4815-8581-0f66f6147b7d", "value": "neon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad8399c-40b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748980676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980676, "uuid": "ef9de608-d7f0-4313-8115-c1f1d93344fd", "comment": "Malware payload", "value": "93de85f3b0183aa9a4c03d1d141bbdee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980676, "uuid": "fd565f8c-3434-45da-9c23-4fe39016f156", "comment": "Malware payload", "value": "b27bdb7be90ea946509f6e31c12f59933baff91b21684800ce04bc4bcd43aae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980676, "uuid": "f33cdd25-68d2-4319-bc99-838e8b621c60", "comment": "Malware payload", "value": "f2be32320a97fdf6682cd9283ab26b2790b6cda6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980676, "uuid": "b42aefa6-63c7-4188-8b10-e9e4b2018256", "comment": "Malware payload", "value": "45c32a9ded151efba09f93fa706fe9a49320e54377050f6c8587f1e48faba89763698a6b56d2369ee1729c86b7718c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980676, "uuid": "3524fa3c-45d6-4fe0-aad2-a2d24ad7e1a7", "value": "T11285AD399152A2C6FC2A40B601A1A5E93462B733C63D2FFF4290F233AD07BD15E6975D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980676, "uuid": "1e98a309-cb21-4805-b38a-11ae3bdffa0a", "value": "f9f160ce0f0c454ba71d5ad40cc375c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980676, "uuid": "3dcab3fa-92d2-410b-be67-2fc30b168a8c", "value": "49152:lLA3ibXDk1re61S7pGczY8Kg88ioq3O3Dg88ioq3O3E:lLA3ibXgTS7svYDYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748980676, "uuid": "494d9c4b-a1b2-4d16-9622-362da2c086e2", "value": 1777152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748980676, "uuid": "9e36ab1f-d214-4081-846e-41146898c276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980676, "uuid": "2e2d0051-e897-4416-a539-03a55e2b5556", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982e874a-40bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748983490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983490, "uuid": "06ab0b61-c435-44e0-a729-b35c3c567519", "comment": "Malware payload (Prometei)", "value": "ad013336bba23f196dc8c6386624bc9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983490, "uuid": "05bb5614-3717-472b-89a7-d83e027e284a", "comment": "Malware payload (Prometei)", "value": "b37942255f55a7a0b03b94f3e6e533fdd09bcc9e02b6233132fdc1123dd60977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983490, "uuid": "e5ce0c15-c840-4b7e-96b0-bb9e4c16307b", "comment": "Malware payload (Prometei)", "value": "7bccf6bcef46476469253ef7468ab2e666a041c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983490, "uuid": "16e66e6c-3618-4c61-808e-e2cff297fe61", "comment": "Malware payload (Prometei)", "value": "90ba1055e9bdab65dc3d085e1faad6f1d60250195dce08de6b678f3e693cf17d7b950acec7e10cfefdb3a1277cc400c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983490, "uuid": "8d54596f-6e1e-44e0-88d1-9ef365f3cdd4", "value": "T1A8155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983490, "uuid": "cd7af408-44ff-4dcd-bb68-56a17f42358e", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpli:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748983490, "uuid": "69a16b14-7238-4628-8cad-5fb02a6435ec", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748983490, "uuid": "54dfa232-7f52-4e86-acda-bedaf46b29cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983490, "uuid": "cacd5a0e-89fb-4b8d-9c2c-d94f67398cfb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "939fe729-40be-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748984771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984771, "uuid": "ec7b007b-15aa-4d10-9020-3a95857594c7", "comment": "Malware payload (Prometei)", "value": "49824f2fe21b98c7d8607b66ee2b0fcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984771, "uuid": "53e72abd-0f43-482a-a965-03611ebee29e", "comment": "Malware payload (Prometei)", "value": "b38a80683c5ef4a579faddea93cf2d06b58f1ff988d5ede60679ce2b64086365", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984771, "uuid": "ea132cef-a05c-4158-ada8-8fe18053e1dd", "comment": "Malware payload (Prometei)", "value": "9eebd57d75af58e7dbb4a987a501815789215c5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748984771, "uuid": "795429a3-b9da-4fec-8a9a-9ebf6870131e", "comment": "Malware payload (Prometei)", "value": "61b5aade38dd038be5a5792f9708e63fa69baa5f7d8bc287b5edeab5d0f0cc74e823f1735efe8ecb8afccbedacbf7cce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748984771, "uuid": "f9935fde-3acb-4ef2-8ac1-99458b052bbb", "value": "T18D9423F8C83D2E3098169F3CBB5A826CF0A15772D9562F6AB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748984771, "uuid": "6d81a1df-24de-40f8-93fd-d4add0b48ea9", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgV:25WOSACZSV6eKRH5EPiamb4DsDwwcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748984771, "uuid": "b3ede192-50ac-4f6e-b0c2-f3f12e7ed4ac", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748984771, "uuid": "d70e9215-dc90-4398-8301-1d1e0ef14bc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748984771, "uuid": "23bcdcf9-fc0d-4111-8ce9-188bcb9b7977", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c36f7b-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942648, "uuid": "b2d50b86-6d77-45a5-afec-87b53f62bc72", "comment": "Malware payload", "value": "2e7696c5529032ac6015c239124b8ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942648, "uuid": "a6b6ce22-d493-43af-91ba-77c0a125ab88", "comment": "Malware payload", "value": "b3e93bfef12678294d9944e61d90ca4aa03b7e3dae5e909c3b2166f122a14dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942648, "uuid": "9032f3d2-c3d9-43fc-b3c4-75cc636cd4e9", "comment": "Malware payload", "value": "4c1f77c0367f58880af607cf069564c94ade2885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942648, "uuid": "fef12477-9f4c-4047-ac5c-c248a55466fd", "comment": "Malware payload", "value": "e0af16880c75bad7e794a30352c9962295b56b26760c59e50f5e32a4d3122f8894eb5e79f38ba65623a10de811393c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942648, "uuid": "3a1f30d2-e6d1-4e08-8856-bbba9397d3bd", "value": "T1D726AE1A766481FCE077917CC9468A86EAB274054B328BDF02A5436E1F377F14E7EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942648, "uuid": "1c5f90d0-1433-4d21-82df-f39f0151425f", "value": "9e23016739c13c78b6d189b7c35f49b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942648, "uuid": "c9b48dde-39e9-4ada-8bd8-c163e28587b2", "value": "49152:M4SJkLZII3negY0JNv36BWu3mXdHkxnKrqIt54HtCyDcTeui4xtm+gM55PgIvIx+:EIpnegYyLttM7s4nEHFGhXFeSn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942648, "uuid": "4a0c9de1-f1fd-4650-8922-3598dc013345", "value": 4435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942648, "uuid": "a1bb477a-0e62-4767-83de-977a255c6cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942648, "uuid": "01375ffc-7868-4387-841d-ca5d0df73f00", "value": "b3e93bfef12678294d9944e61d90ca4aa03b7e3dae5e909c3b2166f122a14dad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab28448b-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956034, "uuid": "cad2105e-986f-4c38-8a03-fc167f9ce507", "comment": "Malware payload (Mirai)", "value": "dd1f6bf69b07af2fee87e62dc221c555", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956034, "uuid": "f6ff84f4-2c1e-4d45-a4c4-3809fcc94382", "comment": "Malware payload (Mirai)", "value": "b4c3bd02b77f3f48596c83d9fcaccc8e3df06f03c2fd0ee97f2da8aa7dc0f7fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956034, "uuid": "1a0ca7e6-5336-4169-b2d8-847834e32945", "comment": "Malware payload (Mirai)", "value": "3f829ec351912c4404757f0b4a135433eb79eb91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956034, "uuid": "1e351e11-d74e-419a-9563-1218b9bd4728", "comment": "Malware payload (Mirai)", "value": "08a5934b449864d69a18d4268146db99be8d68689c2b0f7c8248ae7aa720a8558e8d36c485c321db7af3d3879e82d229", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956034, "uuid": "90865db1-1e58-4f6e-aca4-b66f6026972f", "value": "T109535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956034, "uuid": "a9e0f6d0-78c1-49b3-8011-589872c3b1d6", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8I:N1GjR8EVGOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956034, "uuid": "3ad25606-8c66-45b4-a338-ffeeda35b734", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956034, "uuid": "0994349d-dd07-49ce-8f8d-dbf89ca1ca46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956034, "uuid": "6809e998-c476-47be-b228-aa10ebe8df76", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a03928e-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748944811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944811, "uuid": "16e2df1b-091d-47d7-b1fc-58a2911bda03", "comment": "Malware payload (RemcosRAT)", "value": "f9f8d1dfc5bfc0febf14e6ef02f613e4", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944811, "uuid": "4b89122c-ff83-4bfa-a92e-ad903c7e4887", "comment": "Malware payload (RemcosRAT)", "value": "b4eb0ec4e0fe176bd6cf6d58ca86fb536aed76a5981ce4cff14ee8316569fdb4", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944811, "uuid": "8e4d7ee2-0874-436f-bf93-4f9388ec095d", "comment": "Malware payload (RemcosRAT)", "value": "72f4b5a2681c1ecc5ce06405a8f81cb37627ad04", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944811, "uuid": "9753c09b-cf44-4be3-bd38-1a37e0cd47df", "comment": "Malware payload (RemcosRAT)", "value": "286f7c6a71e13507bc06a4d1d606311f7d8f23e5db752de77c32d68301e8de236f3d7e5cb219ebddc67aa3b6c6b36d76", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944811, "uuid": "d79303dd-a4a5-4b1a-99c0-3807629e2009", "value": "T160D14D5F77A7B5FE1D9C828B163524692F4881BCEC0C96A053D9FC7504527CB09CDAB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944811, "uuid": "754c80f2-3118-4ada-a204-4a416d2db709", "value": "96:gfrGmdAOj8D4f/xC1Wdpbwi3IY143AIZ/rxyL/+oRUMpAE6XS9ZaZPuqVNZ5nvq:VArRfZC1WHuH9sCKUMX+rZGqbS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944811, "uuid": "8ad4377c-ed1c-4702-9407-a5c7dfbb93c4", "value": 6546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944811, "uuid": "0f40f17f-ebb0-41d2-8b7c-cdb3f9ad115c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944811, "uuid": "5bd4f2a1-e4a3-4022-bc9c-5925eb7609d9", "value": "rPO11108_pdf.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8af414-4048-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Nitrogen)", "timestamp": 1748934102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934102, "uuid": "ca661994-240a-49bc-adb8-7b5711aebf36", "comment": "Malware payload (Nitrogen)", "value": "b58538519a98938aace17451f14007f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitrogen", "colour": "#0731C4", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934102, "uuid": "ff44ad21-ee4f-4547-bc0f-f4033bd1cd5f", "comment": "Malware payload (Nitrogen)", "value": "b5189876dfdbe889bba43f7702d1e61e61d48803c78ff78eab3f43b4fb0b3a22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitrogen", "colour": "#0731C4", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934102, "uuid": "9c90c685-697c-4ffa-99eb-a524ec79efbd", "comment": "Malware payload (Nitrogen)", "value": "d7ee34b63eeb18cfbefd2c80b4aa1c4113fabb06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitrogen", "colour": "#0731C4", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934102, "uuid": "33eec627-e1f3-4c3e-9b9d-dcd584a1e7c2", "comment": "Malware payload (Nitrogen)", "value": "b44784eed8334592178fa4348be13bc751cb2fa21e65ec65b64266f65dff00071d8f6dcbd69ba62ac62b08360202f4e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitrogen", "colour": "#0731C4", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934102, "uuid": "2e81d046-6cdb-46b4-8fa8-30a6a460a80e", "value": "T175452A07E2B341ECC16AD97442A39776AD347C18013C7E2E5FE8D7216F60F505AAFA29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934102, "uuid": "13248965-9a00-4dac-85b5-f2580ca695df", "value": "f7e43e0de1643f36b9466c5cecaec952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934102, "uuid": "92fd7ba7-e896-4590-aa79-2ba4dc9acd33", "value": "24576:7oH8mrWFlCQxphVe1MIRTqerVYhn2yTrAlm1dfo3VDb41RRRRRRRnRRRRR3RHRO:7oow1M6TqerVSn2yTrAlmnftRRRRRRRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934102, "uuid": "606c174d-51ca-449c-b3be-79e15b204b32", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934102, "uuid": "ac0a61cd-068b-4017-92b6-2733b5911fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934102, "uuid": "69ac0195-701a-4e31-bbb0-7422f98ab9d3", "value": "b5189876dfdbe889bba43f7702d1e61e61d48803c78ff78eab3f43b4fb0b3a22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5902c461-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748929267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929267, "uuid": "97ce8e9d-5e2e-415e-87a3-272f91597bfc", "comment": "Malware payload (Rhadamanthys)", "value": "a3f04be45f613b887a6cac1bc330a87d", "object_relation": "md5", "Tag": [ { "name": "185-156-72-2", "colour": "#DACC03", "exportable": true, "hide_tag": false }, { "name": "66-63-187-190", "colour": "#FC34D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929267, "uuid": "d85cbc00-3d30-4a07-adf2-ea38eb1e15f2", "comment": "Malware payload (Rhadamanthys)", "value": "b5798e17eb20f0bdefe9c2130db95a600de1729545bf83725d73329adab49ce6", "object_relation": "sha256", "Tag": [ { "name": "185-156-72-2", "colour": "#DACC03", "exportable": true, "hide_tag": false }, { "name": "66-63-187-190", "colour": "#FC34D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929267, "uuid": "7b28644e-ba61-4eb1-9c12-f9df016b9e38", "comment": "Malware payload (Rhadamanthys)", "value": "aba029d3bd06f1b5f2fb62268b97abddf4ddd38a", "object_relation": "sha1", "Tag": [ { "name": "185-156-72-2", "colour": "#DACC03", "exportable": true, "hide_tag": false }, { "name": "66-63-187-190", "colour": "#FC34D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929267, "uuid": "993449ad-1611-46b5-bf68-046918273705", "comment": "Malware payload (Rhadamanthys)", "value": "fef123c427760c1cd0748360aeb96ce5572b8922b76ac1d662a6c7bdfdc8f9473e46654bd8dc1a9742b9d37be8f37b60", "object_relation": "sha3-384", "Tag": [ { "name": "185-156-72-2", "colour": "#DACC03", "exportable": true, "hide_tag": false }, { "name": "66-63-187-190", "colour": "#FC34D3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929267, "uuid": "ff71aa6c-cb73-462e-85e0-c2171f10d05c", "value": "T1E8065CF1374DF5DFC58A25BDA417FF87989C27B786284A09E59E28296A07CC232CC474", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929267, "uuid": "e287e284-5ec9-4242-bd12-0261bce1a857", "value": "f811af01ac6c2789aa091e7bc9b7b43a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929267, "uuid": "41800dd4-760a-4755-8a2d-a575756da04f", "value": "49152:U+4ncVG7lhbjT+Gj1b5p8hqKR2MYoTg3Mk/sYW9chdr:V4nWwlhblp83RYoMEYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929267, "uuid": "10747715-25b1-4d5b-97de-4baf05d64394", "value": 3824640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929267, "uuid": "0935d24e-280d-4e76-87e0-688598ee84a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929267, "uuid": "494573ef-d242-4f86-bc7c-148572a84a97", "value": "l0HQo2j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716827b5-40a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748974405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974405, "uuid": "efee5907-98f0-4b5a-9c37-759e76f045a8", "comment": "Malware payload (Mirai)", "value": "cb95e85a9c3a7702323a400060e236df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974405, "uuid": "e0dbc7b5-798a-461c-a69e-e4665b343556", "comment": "Malware payload (Mirai)", "value": "b61a5caeb6e97b9cedd6f84cf901b9d9332f6d60cc1185336283028373443790", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974405, "uuid": "d921fe17-e3a4-4bc5-a9f0-63f3e01edd97", "comment": "Malware payload (Mirai)", "value": "fa287f6f8bffaa50a062fa6abb449f838415ad90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748974405, "uuid": "42668831-8d7a-422d-847b-65fbcf947b50", "comment": "Malware payload (Mirai)", "value": "ce5d6b196452c468fde3f77987bf24566de674fe507591fecdd74bea2922aa1a5ffce82f0d5e6102e8fd001aa8c926ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748974405, "uuid": "18f3ac5f-5d3b-48ab-b7d6-dcca3bd343d6", "value": "T1C5831A86B9814A25C2D502BBF92F018E331657E9E3DF73128D241F607BCA85F0D67E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748974405, "uuid": "1df103e4-bd7f-4cc8-9c44-6406bb654ff9", "value": "1536:0NnYC+VreXGM72H42A6YRvUBrEIMy8UAMEq1XyMKKB/dVDzGIHig+ry:sqr8G/Hz1MUrVHXEq9yvA/dR+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748974405, "uuid": "6e75f121-cb12-4923-8330-4f49e46a49a1", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748974405, "uuid": "f3d2fe15-0a5a-467d-95dc-a3197c2576c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748974405, "uuid": "322be09d-7fc3-454c-b706-81f1ee54c7dd", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd7361b-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1748994207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994207, "uuid": "eadf4c6d-13a9-46fe-8cf9-a0832f27189c", "comment": "Malware payload (Gafgyt)", "value": "dd5e3eb74bfb99576a74df497ddbc6a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994207, "uuid": "7aea2ab6-8fcc-46c5-aecd-78c2e58f5038", "comment": "Malware payload (Gafgyt)", "value": "b730bd9e138ebd9a324e38c9646009bc4890e7300e43f2b0f6530accabaaeb0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994207, "uuid": "009e4626-ac37-4557-8760-cb4326a8af0e", "comment": "Malware payload (Gafgyt)", "value": "b3fd1e721703418fb590893ea2078f88a0154983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994207, "uuid": "46d0d6c1-c986-4533-87a3-cfa151982ced", "comment": "Malware payload (Gafgyt)", "value": "2435ad90f223ba96d01c22131449b89ef66125e6c3783dea0422ab5eae6dbe2d366f012aac89388a0e949d5bb38656d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994207, "uuid": "30be7d66-20d9-48a4-8e74-e973852eaf9c", "value": "T1C1C30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994207, "uuid": "66746f6c-4485-41be-bd43-1b66023b8355", "value": "3072:H63VpNeuWDGeQf8sRCIt3DxkS2YmyVUQuiXfQd6W:OSuWQEcCIt3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994207, "uuid": "e7e96b32-ed55-466f-8db7-44c7a9132f5f", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994207, "uuid": "74c21fde-836f-4649-a2ca-570799dc5b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994207, "uuid": "165df2f5-e3f0-4fe5-92f1-c4e44e19347e", "value": "dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42be39e0-408b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748962731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962731, "uuid": "4083d9a2-3b62-4bf5-adf4-cbf87796895e", "comment": "Malware payload (MassLogger)", "value": "423e9ad8ceaf4ff5e6c5d08d022c58bb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962731, "uuid": "e2ce252e-2689-4bf5-a35a-be5a09977256", "comment": "Malware payload (MassLogger)", "value": "b8373fea2c5155a89422132909719c981bd4ec94e29158b4301001fb66953fa0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962731, "uuid": "6c9295b6-c8b9-49fb-ae65-dcfe565ff414", "comment": "Malware payload (MassLogger)", "value": "35177c4aba1276436417495f9e1b74c64bc06de9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962731, "uuid": "5197a61f-ebe1-4443-8439-2ef75762a697", "comment": "Malware payload (MassLogger)", "value": "643427fd7e9053dfe4094127b1e643ad55ef8705c49de3d5695b94d2a2422ab8c9dab6e48a2a3b0b1d3c34bfa0b68cfb", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962731, "uuid": "e1a57d44-1891-44aa-96a8-035349007b31", "value": "T1BA42200D4C74FE0D4790A07D01DC48D478DC2F36A4B5E691B95C954F0B666CC4DEA2C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962731, "uuid": "05d0cf7f-1cdd-4ceb-9786-5f760b7a113a", "value": "48:3nF6uXL67EbHYn/L/UYnsQt8jbqtkjJJSs6+LgGG:3F6ub6IrYn/bHsQt8npP6G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962731, "uuid": "14d9733c-b0cb-4a0e-a807-589635ca2bcb", "value": 12103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962731, "uuid": "de0c6d44-2abb-4d20-8782-83165c49e243", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962731, "uuid": "9857efc0-5944-4c6c-8738-4087dc09eac4", "value": "givemebestdaytodaywithgreatness.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3859351e-40ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748982900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982900, "uuid": "47a191bb-d342-4fa7-afe5-af74f1fa18e1", "comment": "Malware payload", "value": "5a30713a71d2a419f04a1d8014c11e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982900, "uuid": "3ba7b72d-635e-4476-987d-e1b783077288", "comment": "Malware payload", "value": "b957e8257f28903cfe7e38861adf53319938fde44a2cd0d68ad6dd343d87ae5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982900, "uuid": "6a020252-29dd-4c83-9a97-3042d29cb6dc", "comment": "Malware payload", "value": "af956645c3d23b933dc7967ee95afc670b6c3b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982900, "uuid": "5144e6f5-b5ad-4127-85e6-a9225f871ced", "comment": "Malware payload", "value": "80a274df0a3be19e4ed21cd8d0f6cef670791d122cdc2ede3467c050d9d2e0bc25e6082df06d1c857f6439795b72f2b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982900, "uuid": "add7c78a-9e12-43ce-a307-3746617f927a", "value": "T1D8960786F7A220C2E47EC1B9A1271636BC357C99532D53E31A485E8E0B35BD99D3CF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982900, "uuid": "f87f010c-65a9-4f6d-b7d6-0c248ccedb0e", "value": "1bc5ec3fdbe4f94ce0e4896f41c9664a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982900, "uuid": "3e0a4f4f-e629-438f-9220-0405b1e15087", "value": "24576:NeTd4moMl2BUgEg7v8FiWVZWrnrbHSjEpajBejwrHI0T2jrQkp2p:tk878Fi4CSgaPirQk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982900, "uuid": "ab4c5f4d-53c0-437c-beba-0f024fd2d330", "value": 9004335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982900, "uuid": "a739ba56-144d-4e83-b823-98f8df8ea8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982900, "uuid": "1026c359-15e9-4524-96a5-bb2fc0e44b4a", "value": "python310.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6960ccdf-40a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748975251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975251, "uuid": "96c8fa02-847a-4db1-aad2-21db60dafb0c", "comment": "Malware payload (Prometei)", "value": "8e51932378eb625446e8a6349e0be21c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975251, "uuid": "24ddfd8e-f3ec-4c9c-a13e-63a684de955b", "comment": "Malware payload (Prometei)", "value": "b99009f2b161b8df888ad9891325ea73e963cd52485518876319882448a90ff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975251, "uuid": "20c99c39-5169-4d77-b9ed-c10cb6fcc2dc", "comment": "Malware payload (Prometei)", "value": "6328721f49a92e6f036701cf9aa144e22ea699b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975251, "uuid": "5e2f82be-d663-4c39-9b6a-93ee497205f2", "comment": "Malware payload (Prometei)", "value": "21b7eb17a71997c661afd17d111e389b4aa65d577c1ed94e2f23788acf084d6bdbe1316765622eb7e683a755f764a310", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975251, "uuid": "c84cdddd-b549-4443-83a0-48e46b6c66fd", "value": "T1AF9423F8C87D2E3098169B3CBB1A8268F0A15772D9562F6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975251, "uuid": "e3ee5ef4-e87a-4f06-a2c6-677b50bdd401", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgj:25WOSACZSV6eKRH5EPiamb4DsDwwcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975251, "uuid": "0e9380c7-b969-4125-b871-bd93508c83f8", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975251, "uuid": "677daf51-ab6e-44a3-bc73-d518a7667c57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975251, "uuid": "b1061f43-2c58-40f6-8955-fe13d97f0748", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3af470-402b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1748921755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921755, "uuid": "89dc5e03-661e-4df1-b647-029ae85d7348", "comment": "Malware payload (ValleyRAT)", "value": "651b6ec59e828f88e7e45f62d77f8cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921755, "uuid": "e5d3f5b0-dc7d-42e2-b5a0-02c91763c7ab", "comment": "Malware payload (ValleyRAT)", "value": "ba244b056e26c1325cad35ebf255cbe3aadd0053a2769329febce477a5b5db82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921755, "uuid": "396eb8dc-a4db-4e00-a3ff-0d641091abeb", "comment": "Malware payload (ValleyRAT)", "value": "e21bad81555572a86b58eddfcdce6da80431eb7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921755, "uuid": "caafcda5-5aa4-4bbc-a683-ad9c8ae37f4c", "comment": "Malware payload (ValleyRAT)", "value": "ac83069120676424bc82a1bcb66db403d39ba42ff713ae41cec4699095b8ba857af56a6c72045844535f6852ebbb6f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921755, "uuid": "c4549a25-9184-47dd-a6ef-c211671bef50", "value": "T10308337A460F9DC7E2E36CBD44E3A7A5B91E7D01A06C20D7BA833A2455B3F674811336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921755, "uuid": "db6e0c2a-6781-4456-b7bd-1e7628e7f222", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921755, "uuid": "7acb460d-c9dc-4ee0-8dbc-7f13067a9b08", "value": "1572864:gxaCYpge7CxKg3yTnHopEwbdDEE0dC7Bvoa4pxobAFsfcpTNMQl1K:gUCYq6Vg3yL4EwbdDEzC7eaBbYTiQl1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748921755, "uuid": "699bf2f4-22ad-4bc8-86b4-5fa59e707d06", "value": 83205516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748921755, "uuid": "d193f3a1-90ca-41da-8545-25534af814ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921755, "uuid": "24a11c1e-4729-49ea-8075-637ef1debdc5", "value": "651B6EC59E828F88E7E45F62D77F8CF7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7a760a-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748932038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932038, "uuid": "b41c8fd2-8ac8-4465-b2f5-1240e412b66b", "comment": "Malware payload (Prometei)", "value": "269e16e16c9e22bba5c03acafada6cfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932038, "uuid": "64fb514f-872e-4353-a71d-974b3b1b8369", "comment": "Malware payload (Prometei)", "value": "ba7c1baef3c558fc4d861c59c60f146976059f0bd440f8d062a373c3003a961d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932038, "uuid": "40399055-9b30-4e53-a4d8-307a29282206", "comment": "Malware payload (Prometei)", "value": "c8a33aad16a7c27060b44f31f5bf129e6504b971", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932038, "uuid": "f14518e0-00d0-4cdc-aee7-0ff9cf9a4b71", "comment": "Malware payload (Prometei)", "value": "184efeb4b5bae6a3617121880b608bbf32c91e0ddd4c6857f2a996b36ea48b28eca62545eb630468796afa0bdfeea70f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932038, "uuid": "81a88940-7690-4e31-987f-8edead4ea6b9", "value": "T1BB155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932038, "uuid": "6f79046a-7216-4fb3-a383-ce174b1018b9", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplm:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932038, "uuid": "74aadd40-c112-428a-beea-7ba568dda1c8", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932038, "uuid": "08ee6e05-32b8-4ee5-a00b-1527a64c8882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932038, "uuid": "c4a456dc-049e-4937-8532-d6ec4bb46f24", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4777e0f-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963834, "uuid": "0d0f53be-504b-4f63-9518-b92c76c7245b", "comment": "Malware payload (Grandoreiro)", "value": "ef63d9d7fc66c3176f8a81e6cb8a525d", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963834, "uuid": "e7cb50f1-e8e4-4cec-8f9f-b25a96857612", "comment": "Malware payload (Grandoreiro)", "value": "bb03db3c71814d27150a1349a042d4a24e9105964fe16b7b29bcc801312d2745", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963834, "uuid": "a85fed1d-b7cb-49f0-8185-035d4856475f", "comment": "Malware payload (Grandoreiro)", "value": "2ebf51ab1ac168d0c8b75186b8d7b436aac9411b", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963834, "uuid": "87e4073c-0e45-4b0b-a03a-fe3ad05e6f34", "comment": "Malware payload (Grandoreiro)", "value": "219b968109f2a592a92695d3832d069278be8f02edbae8aacf30aed68f3359ee9cf74d6ef3ea796a36f33f46fc013bac", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963834, "uuid": "fd165c70-5961-41dd-b918-427a39376714", "value": "T14F0623F01D1A7DF95A7A0B51601F3FCB4DBC2CDF9978A49C358C25CA70A97808C6A879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963834, "uuid": "3694a2ed-400e-40fd-be76-95d213064fca", "value": "49152:NUYLLv2DkJJe0hd6UdtS0JmkDv/c29iknnCago+BfXXYLao:z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963834, "uuid": "ed48f5a1-1fa8-497a-9b03-43ae9a41f53e", "value": 3907415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963834, "uuid": "532a6a9b-6b29-4a19-b5cc-312c69f3c74b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963834, "uuid": "212631e9-309f-4293-9e0a-e802c8a40076", "value": "Foli605878btdg-TULO#GB7K4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a2fe98-40a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1748972131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972131, "uuid": "611340a7-75fc-4ffb-a17f-5cef32030652", "comment": "Malware payload (AurotunStealer)", "value": "b8c8d99033913e309145421f6be3ae01", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972131, "uuid": "c5774721-ea74-44e3-99de-053b77bf4b4e", "comment": "Malware payload (AurotunStealer)", "value": "bc6e1524162fa212f0e5f9593f3f3ac497c6264cbf62f413f12288e8a2f48ace", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972131, "uuid": "d63a26ec-53ef-415b-b710-96bef85ee212", "comment": "Malware payload (AurotunStealer)", "value": "d0b9c4bfecec0d341a4b606fd1e30710db867ec4", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972131, "uuid": "51517096-02b2-4812-9699-73acd9116f23", "comment": "Malware payload (AurotunStealer)", "value": "573d5fd085f9d6c07e551da16a7c9dc30ec8d3cd09beaa7d8c1bcbe3b6e9df356b9240c0e2f7d3a4c2b5a354d44444a6", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972131, "uuid": "3b8764eb-3cf4-4853-b7cb-e2b832e46c5c", "value": "T171F6BF6AF2B800D9D47BC178C9A69617E772741913F047DB26A456E92F23BE03E3B740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972131, "uuid": "2558487d-8642-4141-a753-861a95bf4d18", "value": "89d69ee60e55dee42074de52767a98bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972131, "uuid": "2829ec37-a0bb-44b9-8076-5958f8152158", "value": "393216:kRYyuEzCdkhomtsE+XywYS7Xp+ZnZ9osWOy6:qzZnZ9iOy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972131, "uuid": "2c74dd18-c4cd-4e9d-8285-797c03505f94", "value": 15795064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972131, "uuid": "b3af4a40-7dbb-40b9-bb4e-79c261fee0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972131, "uuid": "ad13f55e-f82c-420e-a7cf-e0402344e0c9", "value": "b8c8d99033913e309145421f6be3ae01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efc897a-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956712, "uuid": "d1588815-c012-4460-86b6-01306a0cb8db", "comment": "Malware payload (Mirai)", "value": "694f7252d30792790fc8de8477846cf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956712, "uuid": "49595a43-fc71-422f-8df7-2ced9164bed3", "comment": "Malware payload (Mirai)", "value": "bc9ebc98da87052e3c7609a5a4d03d90a679b1781862290ed331613fe8a3e5e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956712, "uuid": "df864a82-eb28-43eb-abbf-731f4c75e2d7", "comment": "Malware payload (Mirai)", "value": "df21d7b0eedc3a90e4d05ae9bbc7645971aec2f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956712, "uuid": "845c4a90-7329-4327-9eeb-cdef6228c761", "comment": "Malware payload (Mirai)", "value": "d564f6e0611d0b5c83be5f204480126c4f94e8a472d7b1d55950d2ca949657fa1a277eab93dda0c0aad6214449ba35b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956712, "uuid": "92554f3f-8e90-4ca1-9b71-964ad969e96a", "value": "T12C93E709FF610EB7D85FCC3709A90B0129CD59A722B97B367530D928B65B24F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956712, "uuid": "df4a29e4-1fa4-49d4-ae80-9f3681b373ff", "value": "1536:wFprBvFddy+Yrr5ei8sbY19cBTsRM1/B9ZUV9ZYB7RBzsOhxd:wFp7ddy+YrrhsRM1/rDDThxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956712, "uuid": "95eb6e16-ce24-43f8-a245-6506b51db8f7", "value": 97304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956712, "uuid": "3bf5f98e-b9ba-4130-912a-43c58eaff59c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956712, "uuid": "a1bc9dc8-3b6e-4e8e-8161-b38ab4ec2fae", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f72c60-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957661, "uuid": "abf1c459-5e93-4e07-9514-135dedab7893", "comment": "Malware payload (Mirai)", "value": "e22318047283ebbe8efc225e6fad74de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957661, "uuid": "f8bbe33e-7867-4d70-9332-da80aaf77af7", "comment": "Malware payload (Mirai)", "value": "bd135c15233f806a69f2b3ccbb2cb0a53ffa537de007052e3db92e52a066a0df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957661, "uuid": "0ae62159-aadf-4fb6-9fcb-8a6960e72b50", "comment": "Malware payload (Mirai)", "value": "e1b2db754c06f5b7ab21a002f800de7922a3e5c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957661, "uuid": "a24c2ba2-651c-464a-8c12-cff8c59b5605", "comment": "Malware payload (Mirai)", "value": "b559da754cd6db138adfa5e514a45d50188f88c4bdc09d44719c05e0cff0438df7563e6c7721329f774564b74b4051a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957661, "uuid": "566e5129-ff70-4ab2-a886-ef39d0cdbc02", "value": "T16243F7817881AA39C7C0577BEAAF104E3314A7DCE0DA7747CC180FA176DA91B0D67B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957661, "uuid": "62179c15-40ae-4519-a17c-328c09a296fb", "value": "1536:bmXou1DAd2Gmj+4jbZ92qK0zlKpg7MEhWm5uN:bm5jbZQ0z8pg7vD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957661, "uuid": "9875e3ee-fbfd-4b76-aa1b-d05276335d95", "value": 60304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957661, "uuid": "7899b60a-b86a-4023-b1d4-e78f3bf5511d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957661, "uuid": "789912cb-db44-4d52-9aef-b969277c29e7", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbe356c-4087-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748961325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961325, "uuid": "383f873f-d9ce-43ee-84be-cfb20a796bd4", "comment": "Malware payload", "value": "dd359a34ca37883f27149567074b2b05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961325, "uuid": "f6512217-1894-4630-aa9b-257128065e4e", "comment": "Malware payload", "value": "bd3d34f20e7017f275e2569ec357031e8d01f41fdcc4c7bd693340c86e426991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961325, "uuid": "5d4e6f0b-046b-433e-8950-9e776bb89479", "comment": "Malware payload", "value": "44886277f26d15182aedee6e926faff19c817b78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961325, "uuid": "89a37060-f5b8-43e8-a06b-41c340d09d6b", "comment": "Malware payload", "value": "a67694b51d18425712bae1e9607faa9a5878b772a84e7afe4e6fbfcd9c1d3367c3715a230d2ce76893b3acf19d672d95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961325, "uuid": "8b277c74-b048-447a-86fd-1c2cb76a2047", "value": "T1550633E523F56686F4B6437BA9F3417782B13B889BF544DF21D206BD8813AD58832313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961325, "uuid": "d4612e49-c66e-4aed-ab07-c63301f0c2fe", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961325, "uuid": "1274cafd-c3f7-4803-a80c-f2502e08a71b", "value": "98304:fNo9KZgs7YVKJVsbMpgrOfOIQu+IRFsWS/oDyEsWk4:1o9KCs0sV+egrOfOPuNRAo/+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961325, "uuid": "c69ec554-627c-44c3-aa0c-f5327652ff87", "value": 3755008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961325, "uuid": "e963990e-c77c-436e-af08-0d8fa534ec55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961325, "uuid": "99296322-a5d0-4265-980c-62b9f00c5e96", "value": "SecuriteInfo.com.W64.Agent.KHK.gen.Eldorado.26748.8304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e019f1-4048-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748934074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934074, "uuid": "ed53f478-02e1-4bcc-9bfd-7e2f2b1a2e32", "comment": "Malware payload (Formbook)", "value": "842d362d526cab4628633f7bea552669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934074, "uuid": "842ea962-280b-48e4-8a9b-b4d4523a3136", "comment": "Malware payload (Formbook)", "value": "bdb66a75e7f487e62353cea26369e753a982f2cd25df0609216a036089092dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934074, "uuid": "c81fa104-7e38-436d-a793-19014e69ab47", "comment": "Malware payload (Formbook)", "value": "332af24c2d1ef2fa6098f7bc0578ef9d0f4614f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934074, "uuid": "0097d558-9c5e-4f93-bed5-f3589e274fbd", "comment": "Malware payload (Formbook)", "value": "e8f20dd9c26dc4ee2b638f2b23e404af594d9e3d300d262dbe6783e786662e00664e8d33c74cf777779978ee0ef15a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934074, "uuid": "d1f4cd63-d677-4c42-87c6-89120d231f65", "value": "T186F4129E3790C153E0BA0B7896B1E2B44B7BADCE9921DB1B4FC42CCF391270955B4399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934074, "uuid": "c6c6282a-a8bc-40bb-8b44-da7386c7d8f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934074, "uuid": "c53c7877-0eb0-4248-9716-f095fb91ccc6", "value": "12288:aKDwsBXBBJHEASvCI9mHIXMw+bovvvBUIpjec2jJYiZ2:1rXPSrl9mHNw++JUkS3jT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934074, "uuid": "c3d5124d-2f2f-4aa1-8047-034936049a59", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934074, "uuid": "8a79830a-b4a2-4409-814e-3836454b941e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934074, "uuid": "7695810d-6b3f-4392-b291-78a5db116282", "value": "NEW PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682e5b00-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748960646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960646, "uuid": "bb93a1fa-f3f9-40ed-81e4-b8e373107c03", "comment": "Malware payload (MassLogger)", "value": "c0f0ebe21f82b5398f61df7db8e0013a", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960646, "uuid": "37153171-467f-425a-b87c-b6089253d2bb", "comment": "Malware payload (MassLogger)", "value": "bec6d372e9f098f07b910651f7da79e4a74a3e4849e67f5339553e9bffda49cc", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960646, "uuid": "12175f31-fcb6-45e2-9bee-26598ea0e382", "comment": "Malware payload (MassLogger)", "value": "91be46f903e5acfe8a0a505d1ebd7adccf8f5a70", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960646, "uuid": "b1317990-cc09-477f-8d30-89ea5d474176", "comment": "Malware payload (MassLogger)", "value": "ad85dbab4127720691fd83da6cd3e568250d505e63680ade0696e152c811429d0bf9f4e526d70ac67bc5da912d26d471", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960646, "uuid": "d8262fd2-daf7-4406-9a85-84f124ca74dd", "value": "T11535C45D906069D2A014FEF0F551AF97CCDB239416278A421FD5A1AD23268C3FFAF2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960646, "uuid": "59326fc9-233e-4930-b746-d58971755907", "value": "6144:aRlZCtehirDUlPf0LAzJ6Gc6AdgmzN1xcTNYQv8M5FfX1Xtd9AX1XyyH97bSXZtc:LYrT7aYmTGo9A+QHMGLo1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960646, "uuid": "7e1d48c6-4948-4468-a07b-f9d1abcff3a6", "value": 1101124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960646, "uuid": "e642dfcc-6ddd-4180-abce-6e7459c6046d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960646, "uuid": "06c407c2-c6a5-4db9-a646-e99f0c81dddb", "value": "lly7765.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfb0c98-4037-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748926912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926912, "uuid": "bd9d5fae-2804-4f10-a8ec-2c600cb5c378", "comment": "Malware payload (Mirai)", "value": "aca333dd9af5e3d2e4f8898d42024348", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926912, "uuid": "d20dc2c4-e342-4d5c-902e-a8041d77b845", "comment": "Malware payload (Mirai)", "value": "bf3b54d15a9670eb7db473f7aeb47c8ac450d6d618fae957cc0990b935550d27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926912, "uuid": "1f187e59-9d82-4293-a505-2b8aaf191a63", "comment": "Malware payload (Mirai)", "value": "607f37731149d5f6137a0d149afd8ea87f693f20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748926912, "uuid": "716c9a6f-b2cb-43ed-b69d-061f7f969734", "comment": "Malware payload (Mirai)", "value": "f080ef9dbaf2956f2013a4ebc52c0012d02c979f43eb3a7551f8a4a265c1df21bf180a3cefffed8a321ebe57f4bb7b18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926912, "uuid": "9b44815c-2dde-4b18-8740-5e509132e4c8", "value": "T1F0E2E15745B6CE01FBEEA03F28FF728508A1B54E652A8EF385683D3B49C4F476528247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926912, "uuid": "ac31b865-addb-4a08-96f9-7b8e50e3fd1a", "value": "768:8iKfHyMdHM78zHR6Ey3oNmu3N6oCGlXJ9uPpbDZxtnbcuyD7UHQRjW:iSM6NEyKmud6DGpJMpbDZxtnouy8HyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748926912, "uuid": "4a8d5d3a-d15a-4d09-aaeb-758553733866", "value": 33928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748926912, "uuid": "02427330-5f57-4983-8835-964adf1e44a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748926912, "uuid": "912bcf61-bb9d-4229-857b-4873795eafa3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b973482d-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748934583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934583, "uuid": "26b93056-3a69-44b5-9565-bfbf5818f067", "comment": "Malware payload (ResolverRAT)", "value": "de9a2d8302aa718a36e2548d25020dc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934583, "uuid": "e7ea6e2d-f24b-4322-bfae-60ba0bb3d4f0", "comment": "Malware payload (ResolverRAT)", "value": "bf5d6e4bce5493b675c1d0e97a9abb0436e7af593508af0b4a7dc75a3c81d245", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934583, "uuid": "5e0a2ac8-4a8c-46b1-bac2-992834c6b196", "comment": "Malware payload (ResolverRAT)", "value": "e95339cb2cea3608ce727bedf7eaa2d937a1349c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934583, "uuid": "cb2eda72-af44-4602-8fa0-40255a0270c6", "comment": "Malware payload (ResolverRAT)", "value": "e14099e2736866ef340d47b3cb86a4e29e89db499fbe6b0891075951b16bc99fa9a17a9835d51c76230c9181b1466d5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934583, "uuid": "7e2f591b-757b-45b7-9a1a-1cd8e0680f16", "value": "T148D45B34B497C0EBC202673C4F1CE6556229E8565BB427CB33D52A5A0FE62E7CB1790B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934583, "uuid": "cc7d45be-e726-44bf-b3a6-70932a7d9a1b", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934583, "uuid": "53505a34-6c7b-481c-8636-993d7bd52c0c", "value": "6144:bVoqJpHb/eOfWwFzxq45nXKvNVomKmGO8xX1wlU79ndG:Gqz7/eOecxq4NXKXsba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934583, "uuid": "a10f4c00-046c-4ba1-984a-6faea0a546f5", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934583, "uuid": "875e639b-d472-458d-be5a-54a601176a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934583, "uuid": "47657ded-e563-417a-a73b-04c2e1541912", "value": "cdcsdfvvvvf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f311e097-40a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975912, "uuid": "36863185-2df7-4339-a1c4-0916fb2040d8", "comment": "Malware payload", "value": "95491f5a6e7d4222664944c769408a1f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975912, "uuid": "5b75b326-a243-43eb-95db-18eb509d5892", "comment": "Malware payload", "value": "bff8e7924838d5ee46657a0444195c9abde68178e20ae9fc8a2ec09a35dd4e40", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975912, "uuid": "5963d6fc-c4d9-4971-aa2d-4994f39cf6c5", "comment": "Malware payload", "value": "876d396b00a83a3610c32b7367d70ba59be47e3c", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975912, "uuid": "c4ac7aee-dbf5-477a-9276-2ce7bb4f60df", "comment": "Malware payload", "value": "c36d0966f0957b8ef96e5a5ebd0a6e6fc6f972722641006b8faaccd3be20ddd77bea0547adea35cd84d62899f1f9017a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975912, "uuid": "bf35d230-6e3b-4235-82ee-bf35fe7416e8", "value": "T16CF733768FC67C69FC1887B7662B3AA39237E178D9C271DDC5E412F43C8A603A847191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975912, "uuid": "03b887ca-7af6-40f8-bf8f-f12ddcff0a3f", "value": "1572864:myaimC27gv5v1uMbNO8L6EMcA0dMI8B1gkDyBSM/GTMFPJS:myaim/wv1P48OZF0d6B/6/GwFPJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975912, "uuid": "5d70d846-c325-49e3-a88a-bb81db656446", "value": 72090187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975912, "uuid": "d1916df1-a6a0-43b2-a316-1a0e149a822f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975912, "uuid": "6e2c2229-a7f9-46cd-8f39-81c06b42f23a", "value": "SoftV10.18.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e319326f-4032-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748924775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748924775, "uuid": "a1a09f2c-46e3-4473-b619-8162082a458c", "comment": "Malware payload (SnakeKeylogger)", "value": "59f5f76a4981a43924fb32e8a9fbb47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748924775, "uuid": "65b0a4f8-ca20-4871-93fc-58280af3b920", "comment": "Malware payload (SnakeKeylogger)", "value": "c009b9fe595c0fedc30db2bdc3ff67277c458bf5ea92ae745667fa3ba2d0bb94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748924775, "uuid": "191541f4-733c-4f2c-a628-f1e42bfa0ce1", "comment": "Malware payload (SnakeKeylogger)", "value": "ce01c05a777c84209c0acbaf97ea97122137661e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748924775, "uuid": "5d44662f-ab30-49ae-8877-aa46b7277541", "comment": "Malware payload (SnakeKeylogger)", "value": "16c199493785041e8435023111ec690002f90efad3f0a15209d8aba641a83d1054d9288c6a1d109bb2bffa8413766b87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748924775, "uuid": "5dc9e299-8a45-41a4-87eb-5c6a0c331b9a", "value": "T14AD4018B3794D513F07B0F748AA1E17457BAADCDAA41E70B5ED82C9F391278862B03D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748924775, "uuid": "295456c0-8bd3-40bb-affa-187a29ffb1ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748924775, "uuid": "54b009b5-2f1c-4857-90a3-32f2fba696fe", "value": "12288:d3M5LzEMKmpwLndT4BUfyaU1h2n31ggoD:aLzEYo4whR1gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748924775, "uuid": "9f128555-7cb2-4459-9bfe-7ce6d436e1ba", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748924775, "uuid": "2fe29a66-9621-4a9b-9d7a-909505c76236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748924775, "uuid": "4c4da0dc-91e5-4cf9-8714-6e288701038d", "value": "SecuriteInfo.com.Trojan.PackedNET.3345.25135.17064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dec098a-4088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748961568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961568, "uuid": "d539aba7-00f5-4d64-a63e-07c7035b750e", "comment": "Malware payload (Prometei)", "value": "d8d068d59d422aeaf94f1bc61c45fbcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961568, "uuid": "c352528f-5bcc-4221-88cf-991a12edc640", "comment": "Malware payload (Prometei)", "value": "c0d881ac83aed35b4539d8973ff7b9895fa5542d92ebbe8aac242a99721ae0fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961568, "uuid": "ee902895-e9db-453a-8536-6196839e90c2", "comment": "Malware payload (Prometei)", "value": "6ae8ba43626f2e1494c3f1aeadf7aec107dd1722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961568, "uuid": "c38f3bf2-9e6f-4a62-9508-1e0a0f132fa6", "comment": "Malware payload (Prometei)", "value": "d220d014a91801470f023327aa7189522b3bc6f3326de55009178c8ffc7ccbdcff73ef92fd11aaad6a26ef7a89eccf38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961568, "uuid": "0d52efcc-c2c7-419f-bab5-5169714d6361", "value": "T12B9423F8C83D2E30D8169B3CBB5A826CF0A15772D9562B6EB51AF5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961568, "uuid": "48721cf4-0388-4a0c-bde8-4f1ca9453bf3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgN:25WOSACZSV6eKRH5EPiamb4DsDwwc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961568, "uuid": "f96d50d4-7b56-4c6c-9861-66a5a67bd434", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961568, "uuid": "c49925a7-c783-4fe6-a17f-af04729ba216", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961568, "uuid": "0721a239-0ee6-4f2c-a605-57e4bd3b5b37", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d645fb-40ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748977607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977607, "uuid": "224be9f0-d724-45d2-bc0e-186a79c53ee2", "comment": "Malware payload", "value": "0126726af3bd847a579507af3ccff85f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977607, "uuid": "067b86fb-783d-4469-89de-978fefe0de65", "comment": "Malware payload", "value": "c113ff119026abb69f4946bcd329c06e621e4d8f9ad88b3d1835d64d1ea5228c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977607, "uuid": "ce222f94-2dcc-4e50-a7a6-27f207afbfe1", "comment": "Malware payload", "value": "fd9603492e5342ecb81a6a9f4bfdef359cb92fe0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748977607, "uuid": "5fd076e2-4d42-4879-b036-08ec6b87dd53", "comment": "Malware payload", "value": "9fec4e31d5e9a0f444ed29ff5e3074d5ed425654cecc99c54e97687b7daa6eafd42334869f6b5b6d31ef06ba5c6d5b68", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977607, "uuid": "d2f940f0-7d2b-49c1-be75-fd552f2f2fcb", "value": "T1EFA1C3D2E302FABB8CA276BD3925BF3551253D35DDFCC1567912324A4CE06A805D268F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977607, "uuid": "e741156f-2d81-43c4-8e78-4c25c7819d9f", "value": "96:/3D0+B6OBFx7HD/TZK07qxKnR1oeghJJh/djTWpg8PFW:/QOt3bZKOQ5M9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748977607, "uuid": "1637874a-5782-47b8-a22a-667cf009deee", "value": 4664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748977607, "uuid": "abb7ea28-8734-4fc7-bc77-2c9f1c68faed", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748977607, "uuid": "0f7fedd2-4f32-402e-954d-645c0cf2ac24", "value": "seemybestpartofthesystemgood.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf1262b-404c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748935985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935985, "uuid": "fe9ffdf7-605e-4597-a780-8d73dbcbecf1", "comment": "Malware payload (ResolverRAT)", "value": "657aec20e632d4a19670b8a144c2e7a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935985, "uuid": "ac326ca5-6e64-452e-8ab5-1b0d4206daca", "comment": "Malware payload (ResolverRAT)", "value": "c1dca23a37750e7d9ed551b3529cbde04edbc84d066bc8074b1ccdef0c9ebc94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935985, "uuid": "7aa50d34-215b-4af3-8796-15eb20d8240d", "comment": "Malware payload (ResolverRAT)", "value": "628510ff06eaf82e5ec9ef9dbce943a22c7db8fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935985, "uuid": "e3315a02-5633-40c7-bc8e-6d5ce12e41e0", "comment": "Malware payload (ResolverRAT)", "value": "33c243016dd0b0af105046d8c0c609c253ba9ccbbedc4552dd264d3c50836dc6d74e96573ef11f8fabf1d27e6d2b73c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935985, "uuid": "4321229d-47f6-4908-9f08-2e3bedd51ada", "value": "T1B546335841DC6A1EF4311738C9D456275A337CA7C732A3FF2BC6AA3B6A3A4486071B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935985, "uuid": "4c7e38ea-bd9d-4711-8239-c831b64bbc95", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935985, "uuid": "57d1bac4-b15c-49a2-8e18-fa7c1aeec6e4", "value": "98304:lY+009+LJ+g7WZh32pcEMZzNx/M12tXgMUG7mEF5uc:e09d+iM7sBtX5UELy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935985, "uuid": "d5563b3f-7852-4782-a0a8-652bc4282d3c", "value": 5350912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935985, "uuid": "884db2df-61e1-4049-8844-8668e83fe5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935985, "uuid": "6c2c43bc-77cd-4edb-812d-92caf8b7c315", "value": "SecuriteInfo.com.Trojan.PackedNET.3332.21168.3649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9599ff75-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748973178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973178, "uuid": "7ec66f07-b12b-4fa4-94cc-a3559ab4ce45", "comment": "Malware payload (Prometei)", "value": "6b27b19500294e1414a6c3aa62a1fc0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973178, "uuid": "d58f6c2e-3818-48bf-b51e-fbdb089b3267", "comment": "Malware payload (Prometei)", "value": "c30d5836a35011724c219a0a66b9549e2729746a7d020c3e67a400e6cf109993", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973178, "uuid": "1ae9aa44-5a1c-4b8d-abcc-1f8f84762848", "comment": "Malware payload (Prometei)", "value": "f6df8590757e8de56f004b3218eb8418a0b39bd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973178, "uuid": "279cc3aa-d54f-4ffb-ba4d-ef231ba9012c", "comment": "Malware payload (Prometei)", "value": "8f47767aacb05a38ddbbe328ad004d507453fa41537cd98471557740e15304cdf4304e2805286719e7f88a0ae5622c7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973178, "uuid": "003c178d-ee35-45a3-8c10-4ad5819499ca", "value": "T1419423F8C87D2E30D8169B3CBB1A826CF0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973178, "uuid": "938c171f-cecf-4330-9d48-3224fc6611d3", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgd:25WOSACZSV6eKRH5EPiamb4DsDwwct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973178, "uuid": "8a874c50-1cbb-4705-807a-99eecd260b8d", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973178, "uuid": "c7519a69-e6d9-4f96-9883-6395f7327998", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973178, "uuid": "e9055f4b-53bc-4e7b-99e4-c4568a911c5a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce20c69-4039-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748927502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927502, "uuid": "db8f9c59-d919-4eac-8fff-a57f02c29e90", "comment": "Malware payload", "value": "5f786c827392d8cf90202af7330c8e37", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927502, "uuid": "c81d3a22-c487-4ba9-9be6-1dfc939a844c", "comment": "Malware payload", "value": "c328721211d377ca0e2b1e6d9f315fb720083656cb3ac4ba3252b4e66c158db1", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927502, "uuid": "d5d86562-fc46-42b4-baea-e68c122c7625", "comment": "Malware payload", "value": "758abd8592788c3edafe4803a86b7d2d86f8e2a7", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748927502, "uuid": "427e7e9d-c14d-4fba-9833-392b4552dd2c", "comment": "Malware payload", "value": "1a92d255d2f61a199434e3d6c1b8ec02120bc1a422230a9cb4bcb5cfab95cc0e03c7fc03961ca1f5addc8fd452aec8e3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927502, "uuid": "4d796093-ebd4-419c-a05e-3c9a21acd203", "value": "T1C30702BBB616CAACC0CBC9B43093D7E55B20BD1408A6134635CD271F6FB6E401DAD99E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927502, "uuid": "29cf92b3-d7bc-4ea1-8143-b86f83111ffe", "value": "d7d2d54829e8529f45ab5e50942f3027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927502, "uuid": "b323928b-6bba-4e0e-a8ed-af767ac48963", "value": "393216:hzx5zRD0yVVFL5601td3HeUjRlOW+MEr9WW/uFe1t79oCLCQ:hzxUcFNn1H7RrvEruFe1DuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748927502, "uuid": "4a27003b-5b78-439f-9fb0-3261da66c4c5", "value": 17173504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748927502, "uuid": "164902ca-9d2d-462a-8439-f354b32729f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748927502, "uuid": "bfd91b44-f8c2-48b8-90da-6458175fde9d", "value": "\u039a\u041c\u0405\u048e\u0406\u0421\u0555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21274777-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748933039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933039, "uuid": "d6bd71e0-b17f-4c1e-bcb3-907c7361a766", "comment": "Malware payload (LummaStealer)", "value": "a552cfd18a08ee9b2a6929ac84d0fe23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933039, "uuid": "bc808a5d-2df2-418e-bc3a-0fe98d2199e6", "comment": "Malware payload (LummaStealer)", "value": "c44044d9bc872c5cbab2e043fd1be8f4d331505eeb697c3617e042b3b34e66ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933039, "uuid": "845c8fbc-654f-4ad3-855e-5f9857ec7bb0", "comment": "Malware payload (LummaStealer)", "value": "e35100dc6a00e26fd0e9984dce69cd1c8a52002f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933039, "uuid": "c4c85262-3e9f-4b42-b34f-fd99e6384083", "comment": "Malware payload (LummaStealer)", "value": "a0f95f54317a67371ef51a6f9ad88011f0e498d0dacd2646c7517a1a8d6d0aad9a359994206989a58fb2f63d1c816bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933039, "uuid": "2d28b1b4-ffd8-4c1e-9c54-c3c4a46c3cc4", "value": "T18895331EC753F235C5077CB1452BF28A3B63A657188EEA04CE550AE3406B996BFF1829", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933039, "uuid": "5763f11f-5ca2-473d-abe6-fce8e0060d54", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933039, "uuid": "cf6b5076-d7c0-4c88-96b2-61d25d0d6858", "value": "49152:1K+7AU7dsh9GiCWk7dH25omctcJPm7hWF4A:1K+NseiCN7+3ctcJahMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933039, "uuid": "42173c6b-3435-41cf-8d4f-6d195ab3f876", "value": 1898496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933039, "uuid": "6b1fa390-0235-45d6-95d2-14468383be0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933039, "uuid": "16f9c7ed-f67d-49ce-9586-e84db7faca34", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361ab50c-405f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943812, "uuid": "e6c24952-3e22-42ff-a9df-ba8adf616515", "comment": "Malware payload", "value": "1903dfbc4f90409f8ab91927540dd57e", "object_relation": "md5", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943812, "uuid": "1a86e198-3d6a-4857-9d26-80e25d95deb6", "comment": "Malware payload", "value": "c456dabc102ae7ffc2744e4af987d82bd17a50110d89d8363254c52d6a96da11", "object_relation": "sha256", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943812, "uuid": "1c477c17-39e9-4482-95bb-b2b85f9008e0", "comment": "Malware payload", "value": "a843b156366ce888aa027b51f57f187931ea0e6d", "object_relation": "sha1", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943812, "uuid": "45213ab0-f76d-4839-bad7-684ff4f0c067", "comment": "Malware payload", "value": "d3ffb8a3e1357a99d0ddda925fc93ed68e3e0fe13306f150c23516eba33ffb79e71327a5aae51b081f4383dda6f4f244", "object_relation": "sha3-384", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943812, "uuid": "7e659ed3-0b8a-4e80-a482-128fab0bc7d0", "value": "T1DDE2961B36049331D44307358A2FE7E58B25EC589F67142275ABF39C2F729A066B7BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943812, "uuid": "ea500b19-8f31-4008-be58-1e5582aa7af7", "value": "384:LFZdfAR40/RMyy3M5BCfx5Pyy3M5BC0ioXtLevuI:N0WyWMDC/yWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943812, "uuid": "ef004488-3519-4f64-b490-5df49301e23c", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943812, "uuid": "0e6cb558-8ff7-46e0-8074-2eef37fa6039", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943812, "uuid": "b031a6af-98e4-46a6-a626-d3670e687aec", "value": "c456dabc102ae7ffc2744e4af987d82bd17a50110d89d8363254c52d6a96da11.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e244b7a2-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963857, "uuid": "c4d6806f-244c-42e9-98e8-64495c105839", "comment": "Malware payload (Grandoreiro)", "value": "70eea65ce9a39baa660fa3e03e91c5f4", "object_relation": "md5", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963857, "uuid": "1c9d0e7b-6061-4bad-b237-d79a7ba0e72f", "comment": "Malware payload (Grandoreiro)", "value": "c4d6c35a99ade61309ff223546704472d62b02f5cc7218e6d3f75fafeb6b9cd3", "object_relation": "sha256", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963857, "uuid": "485d1c42-017c-49c4-b1eb-bc0f95dd43e3", "comment": "Malware payload (Grandoreiro)", "value": "4099b2806f60ba6ddb3e2dc7449ce79b13e4de6e", "object_relation": "sha1", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963857, "uuid": "391c72f3-de0f-48f7-97e8-55e381ebd77f", "comment": "Malware payload (Grandoreiro)", "value": "9059b049da289742a4608a9283786cae3d4cc572109429c9db1c069d5c0845ffc9c8f5a13c7fee78acb9b3188d990b67", "object_relation": "sha3-384", "Tag": [ { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963857, "uuid": "af92f12a-b9f5-4ae6-9fad-b7e035710dc6", "value": "T12C0623B1205ABD7A17664608B05F3F895EAD2DDF8C5CF1ED3ACC15DA315AB208C1E835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963857, "uuid": "b7867a61-7cd0-4fa2-9e8e-bde496c54a7e", "value": "49152:uEISEePRagUHZR9avHcYutwMrIhvc9E4/zHEcIa+FR+LgrUINCCZ+Ye:ZBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963857, "uuid": "e9d53bd5-78aa-4373-89cd-918b370c5c95", "value": 3929198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963857, "uuid": "70a4ddf5-c670-47aa-9a89-4837d2cb7a5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963857, "uuid": "2207f8f4-7f3f-4c8a-90ac-646d8e3d655b", "value": "ACT6391_GH88F_142004DNJST.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2babde07-405e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943365, "uuid": "750fbe20-4273-4d65-97cb-d2fd05e77f73", "comment": "Malware payload", "value": "8e9e81d1b252d7fa99579e9cf2e4b4ba", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943365, "uuid": "00407c32-1d11-427c-a687-b264178778ae", "comment": "Malware payload", "value": "c4e194747d9a268ff56ac1f0708745cbcc164751dcaa24f1a5a15acbe9c4d998", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943365, "uuid": "624b40a6-65d3-4417-b733-bd29e4388e17", "comment": "Malware payload", "value": "43d9af0c411110905ab4ddf4e4f713101c74d9de", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943365, "uuid": "b5ea713d-75fa-4889-a3f1-fee0037e5089", "comment": "Malware payload", "value": "a9e3b183cc00f5e331a6e3c692448c36129c731b96ca2473699b4589eac05bf4034770d480f59088228b92e0cb00ae9f", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943365, "uuid": "74dafd94-5f86-4661-8014-071e5af8e9e9", "value": "T12D436B7D034B98FD9263ECC48AD99893EF74862A8B6CC7C49F70FEEA251457490E580D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943365, "uuid": "9a95f927-6382-4c9b-9b44-0feea423a20c", "value": "384:2BvfPXCa2gN2TUPdIajEV8rGrUOcSDakUsnEapQTQWe7VXPMr4Gr/vQGS2oWuUR6:M/CL7T0IfV8rQcSDQusnoICbPDKilPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943365, "uuid": "5910f11a-2928-42fd-88d5-ebeaaf8609f8", "value": 59598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943365, "uuid": "04658869-5df0-41ea-8be7-295ecefa3698", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943365, "uuid": "2f9d3af3-5c42-4d70-bd38-74dbfd4f7f20", "value": "c4e194747d9a268ff56ac1f0708745cbcc164751dcaa24f1a5a15acbe9c4d998.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29239cd0-40a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748975573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975573, "uuid": "d546eaab-cf73-49ff-8410-d23a51c53cbf", "comment": "Malware payload (LummaStealer)", "value": "5cd6cd1e4156e98724f44d3291ad086c", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975573, "uuid": "4400a1bc-351a-4f83-9b00-78d7bdd1a20a", "comment": "Malware payload (LummaStealer)", "value": "c5213b124ca5558e8ee4e883d780af42a312b181978b8b06d399bfe2071da88a", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975573, "uuid": "40f1d692-2720-4dda-b4f9-05ae372418d7", "comment": "Malware payload (LummaStealer)", "value": "a5184260df9b7017c46029964b79817cc36b68bc", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975573, "uuid": "5b9f8ee2-dcab-4835-8851-a7d83ee488a0", "comment": "Malware payload (LummaStealer)", "value": "fc89dac107f87d35be2075fedb52b1ec8586043166a0f2996316c767acc72fce30c021a6273560de0ea49835ffa2dfdd", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975573, "uuid": "7ecd46e4-2109-4de7-8744-c2b134960b3a", "value": "T1C93533A6DC1C88F7D9114B31B1E36738BE58068FA8D04857722419CE6F5BB884B5E2DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975573, "uuid": "f4caab24-b249-4782-bd6a-8433d4a75370", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975573, "uuid": "52671246-e173-4260-8b5b-49bbb4ebc342", "value": "24576:b0ajykyC6buaW+Xz1sO6v6Ek6FXK/YxQ5XlvhOyFb:bHmSVasO6SEk+6/RXVQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975573, "uuid": "1d422c5b-d81f-47e7-b067-3c4ec974bbfb", "value": 1156757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975573, "uuid": "98a7968f-0fb9-4073-8381-c93fef6bc27f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975573, "uuid": "44d545a0-eff2-4e2e-b57f-8399f4d73653", "value": "Elektrus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca124f0a-4090-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748965105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965105, "uuid": "e27569ad-1437-40f4-a55a-0ba7f0c27825", "comment": "Malware payload", "value": "2955e18273fbdcfa7c4ecc36d87369a2", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965105, "uuid": "fda20723-c202-4339-a0c8-1ed968b9ec74", "comment": "Malware payload", "value": "c5548defceff8b67cb5b120eb5ce33eb97ab0956c45d13e9783573c3deee2441", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965105, "uuid": "5ea3e13c-c3f9-41f2-b7c2-205797351af0", "comment": "Malware payload", "value": "21722a9717eb87ed989332a2e4e9aabbc165f804", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965105, "uuid": "9a3c84da-e4bd-4d6f-938e-a8d844811440", "comment": "Malware payload", "value": "1e094bce388921e2a1387899d2b279e8bd95418c08ac24e2273a2bd2da9d4bf1849d19e61000419076b4301b1550374f", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965105, "uuid": "3d5c013c-9db8-43cd-920b-bf560c37f7e0", "value": "T14965F113A9189742D02982B87E030DAD1F456E5C99C179EF345F6E8B7FB03720E9E52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965105, "uuid": "2e06bd37-f48a-4d04-acc7-a2e133e14aeb", "value": "24576:x+sYEv01gbzBts6AP8P9U8dYGWM+qBlfFIHBYUeErSylD6tBb:EsK1gvBOlK9U8eGWM+q/9G2UeryIzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748965105, "uuid": "241be959-e0fa-4215-817e-5a9513c42215", "value": 1437696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748965105, "uuid": "20778232-1166-4304-b7d9-9179ecb74d26", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965105, "uuid": "a36b2552-827c-4e68-b7f6-6ae850198be8", "value": "SecuriteInfo.com.Other.Malware-gen.8715.30517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c015da57-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1748960794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960794, "uuid": "2293e183-0fab-4197-8bf3-f6c0bfe212c5", "comment": "Malware payload (SnakeKeylogger)", "value": "8cfd0853ab1ad53bf5eee8c013d290f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960794, "uuid": "e79c278d-db8e-4ac8-93c0-25a90b68483e", "comment": "Malware payload (SnakeKeylogger)", "value": "c5cda31ca3369da6d1aa062f41c8cca45a7ec066b62a71750745d5789cc5c198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960794, "uuid": "106526ef-3f69-4eb4-a9b6-22f76e49a9ec", "comment": "Malware payload (SnakeKeylogger)", "value": "fafff62132037de56cc8c5fabfe06ee24620e66b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960794, "uuid": "1bb05e42-df26-482a-8585-c896a2d68d76", "comment": "Malware payload (SnakeKeylogger)", "value": "c10afd2cc06340635576b9e28090a5fca1a791d06da31bdfb64a108db0e5de73afadb64ff8b3435835b9a9947f803147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960794, "uuid": "f321379a-beb2-4866-a8a5-6701882acaf7", "value": "T1E9F4F01872BA8B47C5BA0BF42962D17047F92D9EA432D35A4ED2ADDF7572F000A51F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960794, "uuid": "e4040495-1400-42a6-a9c1-0bd7e05cc588", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960794, "uuid": "55228e44-bb77-4e6e-9e2c-5bc67612f9e1", "value": "12288:qq1coRr9VrWG89PGR7CAREsvv5E/rNZpITzkOwkmV:qqZr9VrWv9O7CA8LKzkO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960794, "uuid": "621f8dd4-1a4f-4aa3-bbc0-39c132db2736", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960794, "uuid": "7b63518b-b634-4dbd-9fdc-8374990a7007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960794, "uuid": "5d3cd0eb-d9fd-4f51-8308-690f3e542490", "value": "UPS INV.BL.PL 6243045074 Ref.0000000000 1Z70A8746770580360 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a746ea49-4092-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748965906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965906, "uuid": "723b22d9-16d8-4588-b61c-3a6c82d19579", "comment": "Malware payload", "value": "e188b3e771b2ce5e938ff794baa9ebca", "object_relation": "md5", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965906, "uuid": "e52760dd-b8f3-458a-abb1-56b6e6f82bd2", "comment": "Malware payload", "value": "c6036ea65554011840c3511fa1f6d4d4461c0a9833023a2d62a5f243a172cd61", "object_relation": "sha256", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965906, "uuid": "9ceda361-d4bd-4ddb-ba28-834d3d4c5c19", "comment": "Malware payload", "value": "14bdaf4e074f7d13d44bad44f0c03e7b588b928c", "object_relation": "sha1", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748965906, "uuid": "3c99f13b-c076-4b48-b868-85f28c097472", "comment": "Malware payload", "value": "aa7a3de6b82de14da09a7093fc94e0044e8cf196c0ea9d70abd0188a44dccfa6e6ba675d5bc0dd8fb23c4ea516f451dc", "object_relation": "sha3-384", "Tag": [ { "name": "185-82-73-108", "colour": "#827B8D", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965906, "uuid": "9fd84b82-8a97-4448-80af-ccb591352275", "value": "T15F44D9B443D0AAF6D11893D5D7B6B47D1E7FA1F174442EAA17D23EEE8C04D831AA084B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965906, "uuid": "14cba8e7-a9d3-4598-a398-13bfab3e0d1b", "value": "1536:siUyljqgn3w7i0AclnoEky/QeacVDde/o+WZ3jNlIt86DTh9mRVz:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748965906, "uuid": "d003d577-7ae3-4efc-98ca-72287d71baeb", "value": 265387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748965906, "uuid": "32be55b4-efc5-4d46-95ae-d95f8c0928be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748965906, "uuid": "46170440-1295-4203-9403-87f1153c0f51", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b80e3a3-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994233, "uuid": "8a1a351d-0efa-4eea-b264-270426c346f4", "comment": "Malware payload (Mirai)", "value": "ce5f97870c00c6b664aac8bd9d09861f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994233, "uuid": "10cfb499-e2e4-4c2a-9005-21ab5836fadd", "comment": "Malware payload (Mirai)", "value": "c681d7e84b6a2cf225b9114ca2fda3858b91aec20f7fbfed92f651eaec6bb019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994233, "uuid": "76726482-c690-4b6a-8aec-0d5ab04474ab", "comment": "Malware payload (Mirai)", "value": "09fa109596360900cd3deb1eca9b6a03a49665f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994233, "uuid": "09abe40a-7b26-4eed-98d0-aa2336d3e178", "comment": "Malware payload (Mirai)", "value": "4f3d55fee46dd21a49540a492b8d59c4d846cdf32efd0922739c43d44f29f598bcba0d282a3bcd08c53662b874031cc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994233, "uuid": "3076bc0b-079f-4851-9a30-5431b87d9834", "value": "T109F375397E11AFBEE278863107F66F70CF9529D326919341E26CF6185E7128C1C9EB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994233, "uuid": "27464259-119e-4976-84c0-cd0824e99568", "value": "3072:NMVhnf7YLx0Bedi1ebcRg/6NmUlGPaLEgvI6Nb:NonTqgO6NmUlGPaLEgvI6Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994233, "uuid": "62b92a90-0870-4ccc-9c2c-b22e3a2c2535", "value": 160201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994233, "uuid": "34834b60-3cb5-47e5-8dcf-ce3399aa79a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994233, "uuid": "2e616faf-fb7c-4db5-93de-c215cee2e3c8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b36e61-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942677, "uuid": "a5d3ea80-10bb-45f8-8598-19fc0174d041", "comment": "Malware payload", "value": "6ce2907c2e37921656280a4d97c54e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942677, "uuid": "d5bca14e-84ef-4b55-b20a-1bd1f32dd0fa", "comment": "Malware payload", "value": "c6a09aa45cf4a7fc1633bf5fd85ccff7d3becdc03d112efbd45e81b9104baed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942677, "uuid": "6288a5c4-762e-476b-a452-50c34732fe14", "comment": "Malware payload", "value": "351e7d9e0ef83a158dda44110401943cdd97b3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942677, "uuid": "6a1e433a-f79e-4c63-8418-43420f2cf4e5", "comment": "Malware payload", "value": "dace48ed8a68db46030e77861ce13ff0dd10d46dbf9461121efa28e09c9908cba0eca09e22a728fd8ad90948fbf48350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942677, "uuid": "db1014d4-7767-4011-9599-a63d031013e1", "value": "T14D035C552B2C5533CB4C0A7CA4D22B534A72B333B553E78FACECA5A458433DA56407EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942677, "uuid": "d6cdeceb-6b49-482a-97b4-6da14ce6af9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942677, "uuid": "28e28da0-978f-4238-a688-f3563dcea77c", "value": "768:JR0UaYEhaOeYsY811BFRIcYAMq0pP+XGxMVAmbLw9:JR0D9LhTyFRIcYAMJpPmGxMVV49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942677, "uuid": "b14418b6-00b3-4505-a76d-d78e4cde0723", "value": 38704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942677, "uuid": "209bfb17-23d8-42dd-9c70-7efd80b0c5e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942677, "uuid": "cae05fec-ec31-4abb-aaff-884052531023", "value": "c6a09aa45cf4a7fc1633bf5fd85ccff7d3becdc03d112efbd45e81b9104baed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2f7d43-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929008, "uuid": "1950e4ae-c5af-4882-91cc-66abd0f0fe26", "comment": "Malware payload (Mirai)", "value": "f3e1357a5164acbbd90defc8a1e93eb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929008, "uuid": "5bfae54a-4f3c-4cbb-b3b8-2c96d064ed31", "comment": "Malware payload (Mirai)", "value": "c6d1388f1fb3e6868f4463c27991abb7bce09cce671b42bbbc6ff8b98a0fe89e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929008, "uuid": "efa77659-d524-4ebd-aa6b-3d4d9b1ae01a", "comment": "Malware payload (Mirai)", "value": "62a085f4abd1dcfe6e1c3faae0139480f9938144", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929008, "uuid": "75b284e8-3f70-4cb6-9078-2d5f8cbfdb68", "comment": "Malware payload (Mirai)", "value": "291dbb805e30dc3c412b61f55feffa01ec695e67eefcae52cf3f12273184554c8623088100e1f045e5dcc5d7ea0c7ba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929008, "uuid": "12209c5b-810d-40c8-afd2-8f3d21ac0b22", "value": "T102F2D19EE1B57FCBEE89197349AC12B57890A0C0619CDF4CBB609884FF15A03F45D0E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929008, "uuid": "e86518d9-665c-43ba-9080-aaa87ad82771", "value": "768:F4gU5kdw+TVtkmFyFwFcC3QrilcMC4Zg7JNORWhdpAVKbWWa:eGdVHFyFwF/QrMYJtdKVK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929008, "uuid": "8688b38e-95b3-456f-8bf9-fac5d3cdd1f2", "value": 36040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929008, "uuid": "1e040b25-5dbc-4231-ad02-f4898e4ee552", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929008, "uuid": "ef062b64-fac9-4b1c-92f9-491e9f127f92", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5683a437-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973072, "uuid": "9a726eef-2f86-4c8a-a498-dc4ca9ef0035", "comment": "Malware payload", "value": "18bc9298391b7dedfc4f87c5567c35ea", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973072, "uuid": "a9adde83-bc5c-40f8-9094-cea720a4e3cd", "comment": "Malware payload", "value": "c6ec080b6a5cb7ae28f68d44cdf47a40b653b32a14149070a6c8ba8746b162e3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973072, "uuid": "38393761-9078-45ef-8691-971780e992c0", "comment": "Malware payload", "value": "ee922be1a868c1920f99adfe1107b4f5484dabd3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973072, "uuid": "b9dbf78c-8775-446d-93bb-5d5101acf513", "comment": "Malware payload", "value": "0b695b06844c42898a6bcf93a9c9d264a64e4ddc2bc20bec5f90cc1d5b90d67fe1374b702f6ec9bf3e4f49e72dbc0389", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973072, "uuid": "76b24449-be2a-4373-8121-037559d95992", "value": "T12751C4A1BCCC16BBCE9A2335A0AB4972FC4ACB816961B13F31C0851B4DC31C11B6C932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973072, "uuid": "e0659d45-206d-4506-a545-e02ac993c737", "value": "48:9Nk/zBLTjJkbh+nxD46YdMW1eN+CQUhcd0+BPE+/vmJDyIYtQyeOIxyyzUuADPHS:jelbJkd+nxM6YdngR5cTMAUotQXxyyzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973072, "uuid": "3829da8c-d9a7-424b-982a-9c5f5e3dd425", "value": 2918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973072, "uuid": "9776d6c5-b40a-469b-9b72-d7b330730e9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973072, "uuid": "df8aaee0-983f-4c29-8c9c-5f767724e93f", "value": "status-rotator.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86ac4f5-408c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748963358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963358, "uuid": "7d8e672f-0d7e-4297-b85d-70580e83c963", "comment": "Malware payload (Prometei)", "value": "c3deee61ffa827ce67dee03603b2e97e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963358, "uuid": "484dbbd6-4b0f-4d6b-a49a-d339a9b26766", "comment": "Malware payload (Prometei)", "value": "c8f1ec3a60d91c2db90880db9cc61ad02682854e8ccedc110ee6b867f7ad8e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963358, "uuid": "21a86bcb-4d00-4464-8578-5f6e646297a9", "comment": "Malware payload (Prometei)", "value": "876bcd795450eb46da9b23e1726140bf3dfe59e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963358, "uuid": "b07cde1f-7859-47a8-9c6e-c926088049c7", "comment": "Malware payload (Prometei)", "value": "9fa3de688fffce2c0956593017928481df072bc4dfb2620b00519da3a9e1a7bf6e41a139e5eb51239238185d09f7e3d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963358, "uuid": "f2f00073-9b0e-4d64-897b-e027ea9a3e17", "value": "T148155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963358, "uuid": "5dcc60e6-4ea8-4dd1-b8b2-a35a70bd6b57", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpli:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963358, "uuid": "15c3dd2f-0856-416b-bf55-d9c240cd2895", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963358, "uuid": "02c4f891-489b-48d0-a9fd-48d798411b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963358, "uuid": "03288f55-47f3-4878-9539-979c2fb53ac9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5656bd53-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748960616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960616, "uuid": "6c7f0b88-328b-4f88-9596-9ba72c6587c2", "comment": "Malware payload (Formbook)", "value": "7d16aa9929d9b6275d3ab34b0a437a22", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960616, "uuid": "4875b854-b1ae-444e-8b2c-91fbc017199f", "comment": "Malware payload (Formbook)", "value": "c99437eec0210f43d875f30193d3ee448cab64b2fe184308ca5f050816b3fc96", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960616, "uuid": "5ab4ebcb-53c7-414f-8cc4-691071bdf3ef", "comment": "Malware payload (Formbook)", "value": "1b73b1518f8419c611e275cb9adbd519e63a0769", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960616, "uuid": "02cffe9a-195b-4f16-ac3d-5c14647576e8", "comment": "Malware payload (Formbook)", "value": "441f30cc7b3ea704361b4d5ed68e9f098cbd7233b2a4d6213a448bf7992ead8d045a9eb13cbff973652f966bea7e6e54", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960616, "uuid": "6abd55b8-60f9-4b2a-805c-a5d34b35e865", "value": "T12B427D18B4B1947DE30B21B29004F246D3E974570B4B49177A70EB692ABBBD61F0EE37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960616, "uuid": "cc827ab3-c4ca-40df-8217-fc04740b0e7f", "value": "384:v5Lp1oXx08qme8J3XOdvdyhfkufJw+hx6Ty7:BLpa5qmjSv85kuxwTy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960616, "uuid": "7d25c252-73f2-46ad-9f4b-8b8ea291e511", "value": 12337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960616, "uuid": "30f8bb2e-247e-4071-893d-5cfb321e5eec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960616, "uuid": "e45ae885-7a79-4698-b3c0-d4c2c0c008d9", "value": "Booking.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cd8d9f-40bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748983775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983775, "uuid": "68a7cb7d-4980-4e1d-a81e-91d6ddcb8612", "comment": "Malware payload", "value": "24b27fd7e669a0f4680e042639b011f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983775, "uuid": "6bcf4fc3-c4a8-40e6-acd8-2537df075fe4", "comment": "Malware payload", "value": "ca36d583a63615a79abb30e9c2f41f8007def9cce8dc2ee180755b659713abd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983775, "uuid": "bdac13fe-f74b-4818-a130-43d61025e511", "comment": "Malware payload", "value": "9fb26294f37dc0ce071bfa670d2921a4db4cbe6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983775, "uuid": "d94ad07d-e9ba-4d18-b22a-eba867f493c4", "comment": "Malware payload", "value": "4f15a8aa0bc001239f4d66e0a42e32de23f8bf7ffc7b61366cd92c04374a99acf85e4d59b36b9d1398641cb394f16fff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983775, "uuid": "bd3fa96a-1684-498d-ba64-54ed49389c21", "value": "T181A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983775, "uuid": "8313aca6-ea79-4c39-a7fa-46c761ed59ce", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748983775, "uuid": "526117a4-fb06-4d95-a9fc-693a1606d04d", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748983775, "uuid": "b6b9207c-012a-4c67-bb49-21c4d5299e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983775, "uuid": "9ca61ab0-ab95-4a0e-af61-e2b7c98805c4", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009731d6-4073-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748952312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952312, "uuid": "9b7fa3ec-b2e9-40ad-b368-f73b805256cb", "comment": "Malware payload", "value": "9eadbf3d7b076b0029a326662a26001d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952312, "uuid": "60d87565-dc4e-44ba-99e3-542bdd0b9230", "comment": "Malware payload", "value": "ca763008280be877616288f51e18385398fe6009f4e4dbaf0528b86b37461e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952312, "uuid": "33ef0b8a-5e3e-49ba-9ffe-8645bd8e5195", "comment": "Malware payload", "value": "3d1ce61a14e8c3d01c3834765595e301b9ad4b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952312, "uuid": "f7f6ab28-18af-48ee-a154-993ea65e196d", "comment": "Malware payload", "value": "b2d86ec6de66d994bf76c314e5e66ffd8b5d57c30258e57c5892f9b6d7bf37b99b42a9f79838dda00eccd8e3ec249286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952312, "uuid": "82195a92-8beb-4aa6-846a-05691eac8eab", "value": "T120037D412A7C5613DB8D8E7CE4E653831AB1A333B852F74FEE9882551D833D106016EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952312, "uuid": "08820ee5-b642-477d-a5b9-828c174adc65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952312, "uuid": "cecec649-41b2-4d46-b385-8ba9227a1a9b", "value": "768:tkYrTvbbUrXgNklGkUNlrIhYONDNSr6ycbfjHnh2AmbL8z:tkYX3EXDlG7FIhYONDNRycbfDh2Vkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748952312, "uuid": "4be414ed-6f1d-4639-8f09-67f20d59e434", "value": 39776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748952312, "uuid": "14d3f593-bba9-49b1-9c85-b34088c12bae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952312, "uuid": "b755724b-8f7b-4497-872d-d4da5ddd3ac7", "value": "ca763008280be877616288f51e18385398fe6009f4e4dbaf0528b86b37461e70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e161a81b-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748933362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933362, "uuid": "d07d9dd7-6258-4474-90fc-bcdc57d08d11", "comment": "Malware payload (Mirai)", "value": "d1e6f5a15b2b0a8712574a585a2911f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933362, "uuid": "a3520e17-0794-4c4c-9348-001248272e12", "comment": "Malware payload (Mirai)", "value": "cb4eff67caab4c543020e21feaf50ab466d0d2cc8b77860d64b5d0ca2c0104f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933362, "uuid": "afb29ae4-4505-4927-b9e9-6d30764c8e49", "comment": "Malware payload (Mirai)", "value": "373a1adb8cb1b1b4ceaad11688f4c113d1856021", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933362, "uuid": "051a12d2-af91-439e-b6ab-038dabdcc43a", "comment": "Malware payload (Mirai)", "value": "2d984a150b3771d1db3239980c788186aeafccb1db355ccd8b6ac72571cc8c5be67643d1d2714f56a49d85f5561a30d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933362, "uuid": "6bcdb133-0099-4184-b10a-648311a0aee1", "value": "T17C73F94BBA91DF11D4D621F9FB9F514D33136BB9C3EE3202D920AFA437868DB0A66501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933362, "uuid": "d15c29c3-7145-430b-bb6d-891ef1e832c7", "value": "1536:1Bn9H20wmJ67cmTz+TF0+yQ6Xn73b5Ob3lg9lsgiBQPVQrfb/:JhEcmeTF0+y1n73b5ObzXQ92D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933362, "uuid": "328bd833-70b1-4b39-94d3-c8e51d1ac7d9", "value": 74132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933362, "uuid": "48522fa3-e1f6-4040-b841-ce532d3752ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933362, "uuid": "9143bdbd-194a-459b-9a17-dad9854f8dd4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9325f0-4075-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748953402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953402, "uuid": "6fe462c6-c4d9-4847-9967-1bea54039883", "comment": "Malware payload", "value": "d4bd42cc829aeb361e8a2adf05ba19a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953402, "uuid": "fad252b7-436f-416c-9f67-e1a671e179d3", "comment": "Malware payload", "value": "cbc5d2fe34590a855e647c980d763619da7ee3d832148f1d3d368d842c61b7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953402, "uuid": "ba36a776-5685-4a7f-990f-d32c471087cc", "comment": "Malware payload", "value": "f9f316128f386df72195af95fe47b62ef5f95129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953402, "uuid": "95e18c53-8b9f-4e49-94ac-5a405ec48e1a", "comment": "Malware payload", "value": "67255d590b2bae27f3b7557d042e9639c33514e64317f92889411be5f09d838a3e5578c1a222ed9ad2a484cdfce86ed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953402, "uuid": "0ce879f0-17c5-4ed5-9630-31396999ad0d", "value": "T181C53A59BFE54025E3BE1A30BB7B93610AB6FF786934C17F9240330D5979A81D924B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953402, "uuid": "b3229777-7024-4a18-8b86-975837386f1d", "value": "fae03fdf73bb62aeedd39d3cefe73292", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953402, "uuid": "e4425fad-c894-48e1-888a-80f4c3874354", "value": "49152:hx+AJxdPIfXs93C2bGaWpu0qYfx/VCXDZh21lBIQ3yvN7ovwm9TngBHUBIo+5dkr:hsAJxdP/34aWpuY+5iXa4zS3vv3jirrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748953402, "uuid": "3c2f632e-4dad-41bf-a0d0-3004f52952d2", "value": 2512720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748953402, "uuid": "24b209b2-2600-41f9-b488-9ed5f4669167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953402, "uuid": "922fd873-e8e4-43d3-bbfd-762617683d3e", "value": "d4bd42cc829aeb361e8a2adf05ba19a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16abe4a5-40ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GCleaner)", "timestamp": 1748982843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982843, "uuid": "415feb13-04b5-4d1a-a094-38cddce578a4", "comment": "Malware payload (GCleaner)", "value": "9814c9e4c274c78b9cfdb3bbde52e445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982843, "uuid": "d55da99e-5683-4944-8a16-92fb0a240234", "comment": "Malware payload (GCleaner)", "value": "cc37a6f995e4b9f1655475e6077b7ff68677d6fb18dd254c92db15949c8de465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982843, "uuid": "20035dc4-2e8a-48a7-9cb8-d6e687d91f63", "comment": "Malware payload (GCleaner)", "value": "163d37307b3ec1506d86934fb5d4c1413df9510d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748982843, "uuid": "110e39c0-d717-4548-9153-8f29e8f14c82", "comment": "Malware payload (GCleaner)", "value": "1844a011e18ec76d7798d8e81dcd7bce446c9221a5b8f13a99dac3ed300445a7be28dad33932757c26f19581c0bf21bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982843, "uuid": "521af0b3-2d6e-4f8b-b46d-e7fb5707d04f", "value": "T1B264C02176FAD1EAF7F34A7106B45E9999FBF8E36531005E22C05A2F2C712D18E61B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982843, "uuid": "f6539903-bbc5-48ce-acd8-86e3c0a749a0", "value": "9446a380bfc332bd58ce21045d5a6706", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982843, "uuid": "5029e038-7235-46ca-929e-2c0ad1dffa80", "value": "6144:ygLp7MJQdxXTxiSf+bBlQ92NHRpkAXe3tdSJkAXe3tdE:yg97MJQDl1YAAxpleqJlec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748982843, "uuid": "317f17ae-b0bc-4193-8583-9bd3c8028ccc", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748982843, "uuid": "7f7484a2-cc04-4374-8dfc-3aa300f3b7be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748982843, "uuid": "35d3e182-21b0-4d45-a268-57c00fa2c849", "value": "univ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eaf6875-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942672, "uuid": "a9f4d27e-6238-42ae-a329-e7282e2f6102", "comment": "Malware payload", "value": "81f152ef5dd4b373d11c30414b656d39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942672, "uuid": "3e18918c-b74e-4888-8791-29d8f11977cf", "comment": "Malware payload", "value": "ccd34de9ee3b6c4d02420a76a3625ddd9bfdee8cde0de5710726e6b2fe778cc6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942672, "uuid": "cd612dff-c877-49df-a0e1-9bf43748364c", "comment": "Malware payload", "value": "5f8de211dc88440829ddff1b9c6f2d3f4c887893", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942672, "uuid": "cc14f118-dee5-476b-accb-373c45653dfe", "comment": "Malware payload", "value": "1e75c3cbcec0474376f1ab59966a370f94666616feba4ae16fec32c3f734e564a619c62a661ee91ebba71daf7a284dab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942672, "uuid": "9cb91ceb-26b2-4ae5-9157-95423153bedc", "value": "T15B725C472D387462DE89CEB970C58B671C7063E4AEB354C22474519CEAD67B22B280BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942672, "uuid": "171429cf-5454-4fac-a8c2-38df9290cd8e", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942672, "uuid": "33076d70-30c8-4c13-b338-f58ab1e7a22e", "value": "384:JvvvvvvvvvTspwK33wH9q2GGxM9GDldei2WSx7bLjbyw:oXGxM3AmbLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942672, "uuid": "e4b6f558-db50-4dfb-857f-7086dc3d9a88", "value": 16688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942672, "uuid": "0d019a35-85b4-435a-8d24-773b92f9a155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942672, "uuid": "8d5b2327-8e69-4033-ae9a-5a785aafee3a", "value": "ccd34de9ee3b6c4d02420a76a3625ddd9bfdee8cde0de5710726e6b2fe778cc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b177698f-4064-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Braodo)", "timestamp": 1748946166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748946166, "uuid": "fbf7bf12-e475-4d74-9210-e9e30f11c02e", "comment": "Malware payload (Braodo)", "value": "56e90fde434ca928f69a4d4b4f94c53b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com-dcm-prog", "colour": "#AC52B3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748946166, "uuid": "6bc3965b-9c56-4fb5-924f-bc260502f991", "comment": "Malware payload (Braodo)", "value": "cd95a19bea3a4847ab0e9df8e112d1de951aa4a95a3f0435f5287043026f58cb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com-dcm-prog", "colour": "#AC52B3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748946166, "uuid": "c99b386e-6dc6-4a08-8ad2-119a4e10eaa0", "comment": "Malware payload (Braodo)", "value": "ed77d2430b28bf985e2b62175f2e1a5c7a1b1030", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com-dcm-prog", "colour": "#AC52B3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748946166, "uuid": "85adfdc3-df31-4bc8-9439-88dc565ed464", "comment": "Malware payload (Braodo)", "value": "a6b066e1c16d2370cc50fb7b2b493b4918a725266ed79809aa8d46a9f26bbd93939fda190fdb86c68a80fe586fa9a28e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Braodo", "colour": "#774500", "exportable": true, "hide_tag": false }, { "name": "github-com-dcm-prog", "colour": "#AC52B3", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748946166, "uuid": "504069bb-7eba-4077-97fd-ac3a02650684", "value": "T18CC45454B5D6FD0F99AE988CF49E28CE4E9850F5E3388D67D8CF1B00C020D56E63E829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748946166, "uuid": "0980daac-2ac7-4b5b-9c7e-e6c3288ea33f", "value": "192:ngggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg3:Ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748946166, "uuid": "6df717c9-be78-4b6c-a387-5b4e2aba2da7", "value": 573947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748946166, "uuid": "dd270748-c6b1-4155-a07e-71149a82e4b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748946166, "uuid": "f985bcd9-89ef-49db-ac67-f78b4e038cb7", "value": "x-ray-health-records-qdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e18ead-4045-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748932888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932888, "uuid": "6357148f-ecb4-4ef4-b738-63937f8fdb55", "comment": "Malware payload (Vidar)", "value": "35e56be94682a26ae1716b5a9a90e864", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932888, "uuid": "09e297a4-9118-44e6-b65c-66ca107ca9a8", "comment": "Malware payload (Vidar)", "value": "ce413076bd4212fe671fe3cd3da55f426bc4a8a198630f3f1a8aa51b973af62b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932888, "uuid": "ebf19d18-809c-42d4-b92b-eeb652a8a899", "comment": "Malware payload (Vidar)", "value": "0bf1829477a1f146177ca52e04d973056a43dccc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932888, "uuid": "c6866669-b6dd-47f2-985f-490f728a2cf2", "comment": "Malware payload (Vidar)", "value": "b5efc2e77d2bf4b06e73a9d5265d032df8e232a37a4632a9f437aeb6112967375af64adc7c0e88860c0068c575b5f77c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932888, "uuid": "495b8154-93d1-4955-9ee4-39c88013a8bf", "value": "T137A3FF876EE5F40721CF1F636F1B65F6F52E47E5359028079238BAC96864A02F2B0DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932888, "uuid": "e89c5e79-110f-492b-8dcd-ffc22108bcb8", "value": "1536:D+fYsBsIDjBL2ykEfUbl+d32aFd3ZaDVJwGsyIBI9qhb05Cede0yO:D+fYsvSESkme0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932888, "uuid": "c8e274c9-c415-4123-b670-6d90afb1c5bf", "value": 107081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932888, "uuid": "a2a2e867-edfb-4370-a170-b4732c60982c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932888, "uuid": "a895fbc2-60e4-44ba-a5a5-4f04de6755b3", "value": "lawlead.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f347daa9-407f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957873, "uuid": "f9f3c1f4-7031-4195-9c49-985b3354b18f", "comment": "Malware payload (Mirai)", "value": "db6a58641b7151b9450fab16c9660fd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957873, "uuid": "13335033-0b32-44d8-be41-c0d067faa48c", "comment": "Malware payload (Mirai)", "value": "cf5d4b3016d8c20d9ba74c9a9b36e84538e754c0a3860bd569451797889360d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957873, "uuid": "89f9b689-6607-427f-b2d4-81f407558c2c", "comment": "Malware payload (Mirai)", "value": "e9036039a74b82523c997afab7ca089632f03ae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957873, "uuid": "5c2f9c04-2fc1-46cc-aed0-427ced0d448c", "comment": "Malware payload (Mirai)", "value": "0ecaa4884a6b6e065c046080bcb9fb3dab5b2396125a113280ae5c9ce038cfc3a5b4dce814076d96e90e467ee90538b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957873, "uuid": "cc12aff8-952c-496f-8fe9-442ab71f42c1", "value": "T18153960A3E21CFBCFBAC873447B74E219658339526E1C585E15CEA015EB070E785FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957873, "uuid": "771e21bd-5e66-472d-a54d-4559184e2943", "value": "1536:P+NPq1Du6c/kE/BzTVDNzjgiDY/1yn2VrlqaSjVqhkh4:2NPED/spVhPgja2VrlqXjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957873, "uuid": "78977226-cfd5-4de2-9c7e-1bfab40924c6", "value": 64588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957873, "uuid": "ff647896-3317-417c-ac7e-23051c7aa5f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957873, "uuid": "d5890cc5-7b42-4a63-8b3a-86720b92e42d", "value": "hoho.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96f7fa1-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748931147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931147, "uuid": "f57d1a6e-17fc-4467-8f1c-f5f8cb1e0821", "comment": "Malware payload (LummaStealer)", "value": "45d7d2053d385262c0b325cffc082869", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931147, "uuid": "1b57d742-79a0-4a95-b01b-809ce7f7f861", "comment": "Malware payload (LummaStealer)", "value": "cfa5120e8bc48a6a016075695d8a02835b6a2b425e0dfdf791167122033b40dc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931147, "uuid": "3a339dff-5db4-4275-a6a9-473f842d47b8", "comment": "Malware payload (LummaStealer)", "value": "cd1f577c293aa129ef824008cebece7cc91d4e3c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931147, "uuid": "aed40c4b-c66b-46c5-9f23-1a6feafebd3b", "comment": "Malware payload (LummaStealer)", "value": "0f6034365859205c532967e168145bd38be5258dbfdf39ce550d9d838673d58c5a69570e64519acc621b03e5530f3fb0", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931147, "uuid": "56530fb3-0873-47a5-b6e0-e59087984bc3", "value": "T1A03149340DE202EEF273C778ABF873B38521FAD2DD694BBD018166845621110F4A7E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931147, "uuid": "b2b9003c-691f-4ad6-8014-d9c727f092e5", "value": "24:8y/BHYVKVWO+/CWCOAUv4wvUG5shpcBGlsMbLYmvqarab/BiT:8+5a+tUgwvUphpLaMbLYmvq4abBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931147, "uuid": "b06c2eed-9375-4fb6-b887-57ba0c50dcd5", "value": 1534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931147, "uuid": "21dd4b79-bb28-4c23-902b-7b14cea30507", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931147, "uuid": "d6362753-bfa5-4dc6-b0c5-4cdcd087bb04", "value": "UltraViewer_Setup.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1d211b-4075-11f0-8bd0-42010a9c0005", "comment": "Malware payload (888rat)", "timestamp": 1748953566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953566, "uuid": "7aba5262-4186-4303-a1e1-1a89cad3e644", "comment": "Malware payload (888rat)", "value": "43205be8a27aa2202d4f657d26c2e7cd", "object_relation": "md5", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953566, "uuid": "025e32ec-4526-4af2-abac-ea21bee9695a", "comment": "Malware payload (888rat)", "value": "d005f232dba733233480510687d2e1e7b3857347a8416ae82db9daa1404e6f38", "object_relation": "sha256", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953566, "uuid": "5ebc8a00-6342-492e-99db-a6b086ed41d4", "comment": "Malware payload (888rat)", "value": "cff6db665e57be2e626f2ea2786f266973c94dd2", "object_relation": "sha1", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748953566, "uuid": "ca049f2e-81cd-4062-a058-d73aadd6566b", "comment": "Malware payload (888rat)", "value": "684264be5ab7571fa89cb6afbb9fcfbb6ff9e8419169f4730aa6b160ee7f2302506e4591dbfa383ef7dd8bbe41b16d05", "object_relation": "sha3-384", "Tag": [ { "name": "888Rat", "colour": "#0E1493", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953566, "uuid": "4af07e4c-aee4-422d-ab77-0e1354bd3a45", "value": "T17FB5F186F7CAA85EEDF3C7368736465E56064C958743E7434A64B13C0DBB8C09E4AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953566, "uuid": "81459fc2-e7b7-41ac-8415-879ef0f5438d", "value": "49152:OyIeJkHSHgzywT0hRAAIbVFtxeHH3rcGX63B4SgeTaADNjyFq/fg9581:/IeJkyAzyZRS2rpX63KStaaGH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748953566, "uuid": "d9697e89-43ce-4c23-a930-81ce9eaac6f7", "value": 2414685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748953566, "uuid": "cad416a7-f424-4234-ac69-ae6bb29f8238", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748953566, "uuid": "830ea8c9-55a9-4bc3-adae-ceba7bfb8466", "value": "MGTGOE.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c4dcb2-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956676, "uuid": "8f022739-827c-471a-a4fc-60910bd3b334", "comment": "Malware payload (Mirai)", "value": "cb064562b166ea2ea40bd90db08d100d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956676, "uuid": "2a923fab-86c3-4be4-8a0b-60514719fecd", "comment": "Malware payload (Mirai)", "value": "d019a811b2ae20f466427eb15b42e1ae00338469e093441a233d5521436c704a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956676, "uuid": "67c23707-95a3-4bca-8ef1-395a0d297b7f", "comment": "Malware payload (Mirai)", "value": "a411e885eb445a771068c26d49345e09eb54bf90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956676, "uuid": "c2c15d03-8d02-45ef-a87a-de4a1d81bdc0", "comment": "Malware payload (Mirai)", "value": "c94459af22e2e5133543ef7a9c9ab6307f55ab3400476dcddf9f0ea99d32fa09243a519493edc03b61e9f82bf3b41164", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956676, "uuid": "f9398b9f-c81b-4f6d-876f-9e9b6f2e5e73", "value": "T1E703E1D836EA328DC8CF0EBD40EE03654B6870A0570E978913055DC8E68E6AFBC865E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956676, "uuid": "9ca75691-51f1-4ee0-b86b-da5dfd9f1a41", "value": "768:UeuCN+VlZdwP4mDC6SVRV1OgEPZQG5B6iRN9iYGG38Lj6tWFI:HNsUfD6RJ6TBBRiYGq8L2gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956676, "uuid": "e9a47e00-0c61-4341-a08f-e0fc384ea055", "value": 37744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956676, "uuid": "6f2a45ae-43e2-411d-bf4c-d5731dcea265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956676, "uuid": "fe0e75e7-2786-4010-a8b1-93297535bd8d", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ba8e3e-40b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748980833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980833, "uuid": "0c4f8bc6-f794-4b1c-95f0-2c1c9b5ac35a", "comment": "Malware payload", "value": "802d22186e216454d5d775b800823e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980833, "uuid": "49c9e6bd-9bb4-4461-bfa3-2681c25bdcf7", "comment": "Malware payload", "value": "d0295269e511a231128ddde1733b6b40528d4304d813be5cdb9531946446525d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980833, "uuid": "0b3882c4-4978-48bf-852f-69b277e3208e", "comment": "Malware payload", "value": "bcefc115209afab111632f7cae927794d9055d90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980833, "uuid": "e98e3bb9-1cf6-41a1-9ee4-eff9d149df76", "comment": "Malware payload", "value": "bd7d5b3e55b0a2a2403d50eb76056fad5e4e049c29ee6b2da2ee733659f7840d29f8a370b49cd1310c1901c85927166d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980833, "uuid": "5219b691-03da-4cb5-9df7-1763b157e2f4", "value": "T153E533CEC0AB8CBED0D169B39B41DD2694B063A7D559CD3D3D8DC97680C8FE16D0A988", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980833, "uuid": "3e563b4c-eb89-4ba3-a7de-5d8c8efaeff2", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980833, "uuid": "bdaea8fc-a3e4-4e82-8868-9a4bb29cc6ac", "value": "98304:DGHULgB0MmDlw4qN5diBrbpydCoZf7ZJ3sc:DGwg4w7YBrQfP3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748980833, "uuid": "7b00554d-4878-420e-b028-c2ce215414ff", "value": 3277312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748980833, "uuid": "b1d1a9ff-be25-42d9-91df-7260fcf233a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980833, "uuid": "e80c2eab-d480-485c-8852-78183ccac66d", "value": "Primordial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f720e491-40b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1748981502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981502, "uuid": "72c0714b-a35b-47d2-8c62-3ef0cdd6db46", "comment": "Malware payload (Formbook)", "value": "91a91799eb1e471298f49fdac76ac041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981502, "uuid": "a13537e5-12ae-4606-a276-4e7fa1cef061", "comment": "Malware payload (Formbook)", "value": "d32485557e69160290b5577019c93d8951014283830aabf2e76c6fb98c7a69b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981502, "uuid": "d5121346-4379-43ee-ba9a-5c75ca972f44", "comment": "Malware payload (Formbook)", "value": "2cb76270a0cc03cda90a8803782a9aa3fafa6a0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748981502, "uuid": "c66c1af8-323d-49f5-a96c-9d1ce070eec6", "comment": "Malware payload (Formbook)", "value": "9361f74e0d28baa75bf113f014aaa37f6f8570b3ecaa0c0a7160eb2dfc28db1fe8775894cb38eb53f31a137f04851c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981502, "uuid": "86732d70-3ea3-4c57-8bc0-c515c8683d01", "value": "T1B604AE36D601C071F2B201B5B6B91B7B883D0E343655A0EAA3E119A16FE05E9F57E31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981502, "uuid": "1fc0794f-d26c-438c-9d88-e6d8a2105f0b", "value": "3072:a0AF41FrDX5hNasQaAofzMmfbLkLFEHXhvNFypXm7rhRD:z5jX54SfzbfMLFEHXVNFyUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748981502, "uuid": "a24555d0-9df1-411a-a3f5-8cd4cb702137", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748981502, "uuid": "df373ffe-a9e8-4af8-acaf-1f1ee7e58c0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748981502, "uuid": "5bf425bf-3684-4027-b9a6-c7455f225dc2", "value": "nbin22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bae7b6c-402b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748921595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921595, "uuid": "4763738f-f98f-4ded-af95-d03aae2c562c", "comment": "Malware payload (LummaStealer)", "value": "8c56a03dc862a08ce694988b540008ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921595, "uuid": "69f1e8a0-a227-4bc5-82ea-c0385adcb389", "comment": "Malware payload (LummaStealer)", "value": "d37abc77fd4f0049a851bfd5fe24d78f1764937b710e7841a062566b2b61d337", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921595, "uuid": "8edd9b7c-c4fc-4321-8f51-039f2428f278", "comment": "Malware payload (LummaStealer)", "value": "3b5055f1e158f5802292dd8341293793f794bd4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748921595, "uuid": "f3ee6bab-851e-4afe-86d4-1bff500b9366", "comment": "Malware payload (LummaStealer)", "value": "c53b798c73495e8bca4dc12d665685a2b502fc198e5d4e3068105c7f9311f16f6bd181e086d6e2b3ee03e1580b16e075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921595, "uuid": "c055b85f-2387-4dc9-9e0a-d83c4656255d", "value": "T114C544F06B0CB2494E123CB11979B4FD927276914230B15773ACA810A67ACEFF7666CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921595, "uuid": "8fceeaef-a88a-42ff-a68c-5e63ba02d6e3", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921595, "uuid": "58ae0a5d-207b-4461-9ff4-6ccf9574bd62", "value": "24576:K0a1d/6FdBnh7Qp5Gc1uKBZpl0jtQEN5Lt4ccuVELh1ZN4S:KDYFdBnhO1uKHv0jtQq56c5VELhV4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748921595, "uuid": "92e53fb0-e349-4f54-afe1-b98e2d005156", "value": 2507023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748921595, "uuid": "fa9b7d05-2f50-4b93-9415-5985bbb54a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748921595, "uuid": "fa489db5-79d6-47c2-bd8c-e76f689785af", "value": "\ud835\udde6\ud835\uddf2\ud835\ude01\ud835\ude02\ud835\uddfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2884d06-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956959, "uuid": "ca10dc1c-d996-4cc0-9166-720f639baf38", "comment": "Malware payload (Mirai)", "value": "e105558a9a1a8e3d1fd6b05f32ff3cb7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956959, "uuid": "00a9ff0f-a79b-4522-a0f4-dbb4610023a0", "comment": "Malware payload (Mirai)", "value": "d3a400d811955b9595157131632f9df21d2802466f4a4549f81e5dd7e693d574", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956959, "uuid": "ef63ddec-0bc6-432f-9f89-dffa6cdb8049", "comment": "Malware payload (Mirai)", "value": "465ea090c95f37fb4fe577f07b727904eab15553", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956959, "uuid": "fd72e3e7-6ba0-4355-828c-6b35d4515d2f", "comment": "Malware payload (Mirai)", "value": "f190876b524069ead78e992dd7b43ab7b16943bc4c0c08f315b703271b6b7d8f164331573fc75edbdb72c50debc65f62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956959, "uuid": "cb18d84e-94b4-4ac5-a90a-30d22ebcdcae", "value": "T1B731A9E4B36261B37CD699FAB5A98848B094A045FCFC2B459BDC74EDC04DF0D35426A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956959, "uuid": "54d698aa-ca03-443d-907e-a79796bfcc44", "value": "24:vbbnaWGhVwNzuPBz59JpiyNtWHzd0PoDjxA6f:vbbZ0gyl59JpirTd0PoDVvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956959, "uuid": "8f079ca9-955f-4d7f-bd8f-323a420404d4", "value": 1873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956959, "uuid": "bfe896ed-5bb8-4882-90bc-fdb1828955d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956959, "uuid": "d32b1970-1806-4889-a70b-076926d9f2b3", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883d04c8-405c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748942661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942661, "uuid": "d60a2944-b8c7-46d0-a295-f8f1bdd1fba1", "comment": "Malware payload", "value": "dc9be6ca3411a015f6e902adf0112f5d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942661, "uuid": "049f28bb-72d2-46cb-8545-8402f1158730", "comment": "Malware payload", "value": "d3ffec0441a13e29b7cc65f1cef548a55d929fb94a677456bfcb6b011ef07b9e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942661, "uuid": "1a41cb91-3bd2-4977-8146-2b21c97e62b6", "comment": "Malware payload", "value": "759305d7c8d6c7ae236f1927ac5c8e75449eeb2d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748942661, "uuid": "90833828-f799-4040-ab6b-15bf0f96d093", "comment": "Malware payload", "value": "f4e8802283b375a7b1cccaa29ce7ab692d3b17fe59b044573714eb3450b7c29aa350455c05db3447fbaf8a2cc4f641d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Meizhou-Fisherman-Network-Technology-Co-Ltd", "colour": "#C70F8D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942661, "uuid": "9915fe1c-fbc4-4769-bdb9-91d4c92ed40e", "value": "T10EB54C16B648653FC46B0B3A49379668983F6BA27A06CD5E57F44C4CCF352403E3EA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942661, "uuid": "0334f3c8-c585-4fd2-b35e-486f46753d04", "value": "74b78c935eac41fe3ed032d70bbd9782", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942661, "uuid": "2551e246-3628-4b8c-9730-5b0e6b19393e", "value": "24576:0pooLM/J/G0JSNK5vn4jKx77ocnFJnhAInaM9xM5AZBmSFXP1WBS43ZNQpbuHlpi:UMVGyR4jer5bcqZ4SFXaS43mbMpGpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748942661, "uuid": "da782ba0-db94-4ef7-a985-4a4dcad6d157", "value": 2403120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748942661, "uuid": "90ee8aae-85de-4db6-b3ee-1082606657c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748942661, "uuid": "93e46049-29c7-441a-aa84-c32fae43f883", "value": "d3ffec0441a13e29b7cc65f1cef548a55d929fb94a677456bfcb6b011ef07b9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5768d79-403a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748928107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928107, "uuid": "b80c6318-72bc-4e45-9ebf-746e488f6283", "comment": "Malware payload (Mirai)", "value": "2207355969aeb0fc8cf109845b49a141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928107, "uuid": "20450036-903c-4206-b003-c972eb5f2d58", "comment": "Malware payload (Mirai)", "value": "d479fa18cc259ef1b6332ccc06a1ef6c231133e7a2ec0679a8ba7785c9206b98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928107, "uuid": "0cb8de1d-8ea4-4de5-b3df-a95c51b5f08d", "comment": "Malware payload (Mirai)", "value": "64044add7d90b49dc114385b185012c918e511bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748928107, "uuid": "0cd16b02-2da7-4d51-8dcb-3f931b984a77", "comment": "Malware payload (Mirai)", "value": "cdfe000ae2bb421ba81762aaf342d33921a44b6f03404a0dd9311b614b4c4f34f91682133ad41edad0eac6ec984ed62b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928107, "uuid": "5c167659-b108-41c6-97a8-ab0abea3cc74", "value": "T12DE2E1BBB0636174E96AB87A1C3D4414EC3AD82BE14107594AC4A8FF4EAF0D51E66F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928107, "uuid": "a4f48a92-25e0-42a8-9145-a0c8ff16a9a8", "value": "768:/hmM3pgYtQDV6ywV+ZJ6VcbrLrnXKs4SvllHTEx0sAr:pWYtqV6zWEVcbDXlHvrgtAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748928107, "uuid": "62c60124-01f1-4a06-b46b-4b5f80cd9875", "value": 33984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748928107, "uuid": "60e43b4a-e37c-4ed3-8fb6-eac997332e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748928107, "uuid": "c4f342e9-9422-4080-bd8f-5f7408a7ea51", "value": "neon.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b1eae7-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748971168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "11e6fb52-f53c-4792-99a2-16ee45c2019f", "comment": "Malware payload (LummaStealer)", "value": "9c884e8c766feb4aa64707ee4579f6a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "acb68bd4-75ad-4f5c-8e8c-13317307d4a2", "comment": "Malware payload (LummaStealer)", "value": "d4dd34abe23f001440ac0e23d6effb6fd22f9dd292a9b84541acbcf1dcb9f003", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "130ef8b0-4441-4b43-98b7-503401715c24", "comment": "Malware payload (LummaStealer)", "value": "56b3a09917bafbef2fe830eea7706b3a86d539f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971168, "uuid": "46959659-4ee2-40ab-86a9-c95d1f86c0ef", "comment": "Malware payload (LummaStealer)", "value": "38b4bb9a75d89e9f393950f740e54bbbf09d4193d22367df223f7db3d99207a49cb8bf2d56177fc4f1cb1fd76422223e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "8d081d9e-3f69-4a6a-81ae-9d5fdf3b3bcc", "value": "T14CD73372A28C49BFDF17143629D9FD180E28A128232449E7E6DCDD8E56721D723FEE50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "5bc6ffec-6b31-4b06-a37c-dcbca9727880", "value": "1a5cdbf711fee14b077e599d13fddab2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "c2dda31f-3e86-4548-8685-fa21a1adc9f5", "value": "1572864:hTIpttD7y0/V1l/s9pttD7y0/V1l/sJpttD7y0/V1l/sX:KDe0/V1lUXDe0/V1lU7De0/V1lUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971168, "uuid": "b0654aa1-0a19-46a2-aa97-186d44450e86", "value": 59697256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971168, "uuid": "ba0766cb-22ac-4040-9ac9-c766fa067a76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971168, "uuid": "58b21d8e-fa9a-4a1c-a1af-1ef2f1787841", "value": "\ud835\udc12\ud835\udc1e\ud835\udc2d\ud835\udc2e\ud835\udc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eebec7b-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994239, "uuid": "b6a9faa1-c4c6-4b29-96eb-963abfdd5908", "comment": "Malware payload (Mirai)", "value": "f8253063058539a980164bfe540e66a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994239, "uuid": "fc2d5049-8037-4e0b-8fd5-40f98d476bb8", "comment": "Malware payload (Mirai)", "value": "d5589651e2a2d410e3f031701b97d37290b19dbb6e240c0a3f6ac6258b0b70f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994239, "uuid": "5d0f60c9-7d2c-4539-b87b-03b6e62dc465", "comment": "Malware payload (Mirai)", "value": "c5964f5fe8244e2a0263ea5a308ac584bcaee779", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994239, "uuid": "511e78a2-e995-4c16-8c84-342bd2dc049b", "comment": "Malware payload (Mirai)", "value": "030cdc1adc340b37a7a46f1fdbe79a083c68df83e9ed94375e1cede5a6e453ea96bf56426185420e815c66ce2c764b60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994239, "uuid": "bee659d4-8ecd-4488-b30c-bbcc000b665f", "value": "T13EA34D72E607C1B3C44306B1029BAE5B5D31BEA74A2A5E4AF36C7CB4AF324C47515FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994239, "uuid": "5840cb7b-2d68-4897-ab9b-6c8786a0a79e", "value": "1536:1eLBA8EPuP+CFMgTW+K5gJsRVfgytdQV9OqsS1swmqHIVcqqWNGnQOT:EAVuaH5gJsRFgaCpswmqoVcqq6GnQOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994239, "uuid": "07ad6617-6038-4b55-9012-11f78bfe6204", "value": 104639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994239, "uuid": "aab038e3-039d-47b0-9df6-e70c11bbe024", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994239, "uuid": "375ca568-b6c0-4483-ae8f-afc55c4e19b6", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b282bc91-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989118, "uuid": "59795f58-f103-4ef1-a04d-6165d6fd7a42", "comment": "Malware payload", "value": "59a769d67cc90d8f4fdc9718cdcf7cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989118, "uuid": "297b8e47-90d3-47a6-906c-a9b639576f3d", "comment": "Malware payload", "value": "d56728f5bfe51be64298bc77f9a85991eb37b4a8cfc9d47c6e8d77051dc87e78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989118, "uuid": "e1d69460-92d1-42f2-bae0-24ab58a3e874", "comment": "Malware payload", "value": "7e1f78546b64eab54adb96dab90b6f1a6f3fba88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989118, "uuid": "b19778cb-a9ac-4c5a-912f-1e63e799fea2", "comment": "Malware payload", "value": "4fa1cc7bd47a4df2b0f971798693893de860b4b38c7728a00a5942b22af78e19801cdd250caa0350cdd442e6c9942fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989118, "uuid": "71fa6e4f-f7d7-48c7-8316-fda6aa1ab608", "value": "T15B03A4287AED801DF17F5FFA7BE139C1C976F2726906E6CA6845131A4922F40CD2127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989118, "uuid": "5d9ebbf5-56cb-4143-a5c6-11df2597c2b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989118, "uuid": "19ef6af3-c1b7-40d2-8501-5f9db757551c", "value": "768:eEHCMldarCufaVe2fc0yjgkXNsu5AsxFtiQyorM41v1tbVL5gm3HrQ+:eEH1lduClI20RjBXmu5J0oRB5X3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989118, "uuid": "97d506e3-bf61-4a71-9cfd-a6a5556206dc", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989118, "uuid": "8c5c19ff-1169-4a17-8715-af5b9a85f000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989118, "uuid": "4aa62a06-7dae-4b0a-8240-bbc2df2e739a", "value": "SecuriteInfo.com.FileRepMalware.2825.11446", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f416579b-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748934682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934682, "uuid": "e45de266-29f3-4712-9c15-45283ee2c0b8", "comment": "Malware payload", "value": "82b8d4cd679296c5ea62f583fe487bb4", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934682, "uuid": "473243c4-7fff-485b-8454-20ac64462501", "comment": "Malware payload", "value": "d5b125240d3d8cded2d0b29b3cec55f20e7b3c03b63c8bac1026ed0123e7522b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934682, "uuid": "9251ce42-3a06-4324-83d0-4c86398c6187", "comment": "Malware payload", "value": "c9639723414f198496b01abb78ca090fc3b934a5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934682, "uuid": "a3791afc-bdbe-4aa0-9ab2-58f9bfdbb8e7", "comment": "Malware payload", "value": "474f6d89065b54e22d6e1e0cb851ece26717289057caa35b6846dd200d5fceff9810470c04e802e14cf0de6576f878a2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "snowzin-ddns-net", "colour": "#466377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934682, "uuid": "dca7c0ef-e519-41e7-abfc-d95f9edde501", "value": "T168F09060B8F830B23BC2A2C6213377C8BE253F0B74CD6A12E20380A8B0F20071223894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934682, "uuid": "dd4984c9-2499-4bf5-a966-b00b0b43e7ea", "value": "12:oEOrn6MCFKKzr8Vb2DaSFXu+6fAneFHWrCYHu822QReAlxSsRHEHkJ9:ZOroYbmOGeqCYHu8L+RkHA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934682, "uuid": "a4e2c24c-605e-4722-a28b-6ae4c1a39f8d", "value": 533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934682, "uuid": "2d3bf89e-b201-405d-bea0-e811b236efec", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934682, "uuid": "48776c0a-e0f3-426a-80d2-c9390f3d3ef6", "value": "d5b125240d3d8cded2d0b29b3cec55f20e7b3c03b63c8bac1026ed0123e7522b.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34ce16c-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989092, "uuid": "a24c1675-1642-46f7-95ff-43b6484f7397", "comment": "Malware payload", "value": "76014be8576ea54e17f8634553d57d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989092, "uuid": "4a95b00e-fc96-40f3-9355-f84741dcb699", "comment": "Malware payload", "value": "d5ec919404700cccecce1ff7128540f818afb21a2433425a523773115815bb7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989092, "uuid": "42f890fc-5dd7-4e7b-9b43-cb23284f02b2", "comment": "Malware payload", "value": "22a4e3d340c92c0ce40f8411b778e4a9fc8b0ee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989092, "uuid": "08db3da6-f699-4472-b24a-0ba952ed9bcd", "comment": "Malware payload", "value": "24b782cef457b28d64d3201289bbb0e044bf50ba4a5afbffb220230f17b287025edc0b6d8f62b82b548f72aeda093d26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989092, "uuid": "81812091-8def-436e-b05c-4da36cc92a2c", "value": "T1AB757A57529C42EBC55AC078CE3B6217A6F3BC38131CAFDBC6954D942E23AE5C93B214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989092, "uuid": "cc3b7d48-9738-467f-9afc-592fea0ad4e2", "value": "a350416f97a6390c11b99ca186d67bb7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989092, "uuid": "fcc06f95-29f4-41da-bf89-12fa50738f64", "value": "24576:kk5mPUqMmMCsmsasmsCMmMKsmsCMmMaMmMCsmswVMmMCsmsasmsCMmMKsmsCMmMp:kchRuKkPuCFMZxkf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989092, "uuid": "0ecb8136-56e9-44cc-8573-bbc0a04bf71f", "value": 1627136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989092, "uuid": "61afdc51-6db6-4eb0-9370-aa25bcf595f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989092, "uuid": "6ea89d87-f71c-41ae-8267-a20888ffa1b1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.815.19276", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65fa6a6b-407c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956347, "uuid": "09e9d8a6-41ba-495b-b628-a67ca02d4aa4", "comment": "Malware payload (Mirai)", "value": "5cf3de4248e08710764532b3ff8b30a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956347, "uuid": "f16a1dcb-387b-44dd-932b-b703d934ddba", "comment": "Malware payload (Mirai)", "value": "d616344fe27f5bf83e4284e4c4d984648721b6b1c74c45203b049aaf009901ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956347, "uuid": "b79f3bf1-c008-48e7-838b-d3742fadd365", "comment": "Malware payload (Mirai)", "value": "24dc63050cc5f1ffaa5691b754bca2bcd982cab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956347, "uuid": "ee2dae37-9bc1-4e32-bdc2-138933a2bb99", "comment": "Malware payload (Mirai)", "value": "69ff2370465851142c86fa65907ea4dd55df40ea7bfc3ccc3042b8880fc32b8e020a1111b8255ae0bc212b274d2af19f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956347, "uuid": "bc3f6554-d429-460b-ba68-705228e89ecc", "value": "T12CE2F1A39371A052EE7C27F1F8AD85CB2B7D4B6CD17730A316145718295A0435E3C8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956347, "uuid": "e6dc5c61-9f71-4731-a35f-5f928f180f88", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9Xhj9q3UEL5IC:Porm1vpALgUJhiL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956347, "uuid": "9db09c56-7d47-4554-8812-e1e471c85190", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956347, "uuid": "a817e063-4e97-4504-be7f-090f85f9b2fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956347, "uuid": "79206000-c1b0-422b-9314-bd66963291bd", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d7d381-4088-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748961548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961548, "uuid": "63e77c3e-ae8e-44ba-8521-f564b945b191", "comment": "Malware payload (Prometei)", "value": "1b492d611ea5dbd85e1621912bf5e8f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961548, "uuid": "44d2955e-f8c0-40f2-be4c-0082c05573ee", "comment": "Malware payload (Prometei)", "value": "d628410bd091bdf2d19440a88a077615490461ab6c50df9c18153a2856d077c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961548, "uuid": "b7129544-f365-4c02-ae37-ca90f8c9ee28", "comment": "Malware payload (Prometei)", "value": "50a8c0db2e22245d792f483624b81383d90112f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748961548, "uuid": "2d729f89-887a-4591-95b9-28312d54bf12", "comment": "Malware payload (Prometei)", "value": "88d2035e5545ff0dec1ef54c66d4239187bce1d1a2fedff153f8ae40fc2cdce5fdfcb5ae2d58db63ae3eb5ea8d06daa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961548, "uuid": "9f6bf7f6-2493-44da-acb4-ec3f1a23d98d", "value": "T1D9155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961548, "uuid": "1f1d6024-a9fb-47dc-b819-a43183791ab8", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8MplG:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748961548, "uuid": "052b7b6b-984a-40d9-a3d3-b2928b936cf8", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748961548, "uuid": "27ba08cc-eab1-4a0a-bbbf-f3a721b0a077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748961548, "uuid": "db9237de-ec1e-4f69-8284-227fe3e3d18b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21625687-408e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Grandoreiro)", "timestamp": 1748963963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963963, "uuid": "bb739486-e6a2-4a97-be00-a14423644634", "comment": "Malware payload (Grandoreiro)", "value": "ca29859952e22fee4e194ae33c1e3dc3", "object_relation": "md5", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963963, "uuid": "ca7225c0-f95a-4f52-af24-4a359d0b87cf", "comment": "Malware payload (Grandoreiro)", "value": "d6487cb48da9578809114e934fe5294112fc5d15a437513b3ef742dec8e40ffa", "object_relation": "sha256", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963963, "uuid": "211aee19-ce18-4e2f-83a4-770c2173de21", "comment": "Malware payload (Grandoreiro)", "value": "3af2cae9967ec35c74987642be906a25ab525d0a", "object_relation": "sha1", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963963, "uuid": "1edb8981-73ea-46bd-88d9-e93304f4de42", "comment": "Malware payload (Grandoreiro)", "value": "961ceb616909c9325d7e48bbbdc9a50845eda74ce6c1eb224c413a426b56190e0fe4d6a880d1efcdc05cd34f63127286", "object_relation": "sha3-384", "Tag": [ { "name": "90MB", "colour": "#68E25A", "exportable": true, "hide_tag": false }, { "name": "Grandoreiro", "colour": "#0BC132", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963963, "uuid": "cd3ae66b-9a02-49d2-aba2-e2c9552c53f0", "value": "T1A9C523F1AD189E89FC0085B356400F49E2BF447053A1D3C687B4A67A2F6378A2F57DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963963, "uuid": "dc965b1a-44ea-420a-aa74-15ded2de0b92", "value": "49152:H0cROB9nydrXhARbjCOdOKWKsjiOe2rt78h8xF++OJ6RDkwDxAnY:U5h+rXhw1uQYXxF++i0DvSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963963, "uuid": "820fd6b8-b0df-44d9-bf7e-6de7f89137b9", "value": 2703974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963963, "uuid": "ee5f5659-13e0-43e1-bc1a-b6c97068849b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963963, "uuid": "f1d74fd8-f494-46ce-b299-50a87bfbfaf3", "value": "grandoreiro1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a9dc61-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748970785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970785, "uuid": "cabb68b4-cf9c-424a-b7d1-7359d916205e", "comment": "Malware payload (LummaStealer)", "value": "4fa6aa1450c169b3101380f2f5fdb988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970785, "uuid": "cb8ab1df-135c-4c9e-b494-a89271e1f1ec", "comment": "Malware payload (LummaStealer)", "value": "d67a50e98ffeac90e6f53b3295ef71e01a4f56f6f5963a7f9ea9085adc807ef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970785, "uuid": "c8a442c2-fb86-4bfa-853b-894104332eb5", "comment": "Malware payload (LummaStealer)", "value": "02dcc55117178e1d7bfd22e3bc069574f9d62957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970785, "uuid": "334cc4fd-2cd1-4001-831b-08b247c0a1e1", "comment": "Malware payload (LummaStealer)", "value": "f627023806940812d2e95074d8bb1263c4ede23d2a81c2b2295abfaca43204b1536a4fdbe2459dce6488f2bb6e3aa4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970785, "uuid": "6db2fc0c-4d7a-4d84-9090-1c3488904d13", "value": "T15D4612DFE06241E7F6A620F0CDC57946F433C71BD4C98769A085B167BC09A20A4EB97B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970785, "uuid": "d059d6c3-bd1f-40fb-8f2b-995272ef5fdb", "value": "8654aaf25e966a7a2f81e6b3b1367f29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970785, "uuid": "8e6217dd-afef-40ab-aaae-70e6732839d7", "value": "98304:WHMbB9VzoiF7oSlvi/T6MLbF8mKeYCDLZ8RZmvwAAgvWuW07rL0/FE:WHMfbdtlKT6MLbFpLC9VgvCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970785, "uuid": "e1baa660-ea5e-47c0-b2e6-d52a37a082aa", "value": 5537280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970785, "uuid": "0b206ed0-a3ba-4615-a358-5751b72acdd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970785, "uuid": "c848b21b-c66b-4020-a4a8-02128b74ad5e", "value": "Full-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8953efdc-407e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748957266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957266, "uuid": "5c69ae3a-b40c-4219-aed9-3fd2c40a4755", "comment": "Malware payload (Mirai)", "value": "6668ae0c4eb8ba3349942b8839f9aaac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957266, "uuid": "19ae8b71-f6a1-4ddc-87b9-49a0c965083d", "comment": "Malware payload (Mirai)", "value": "d89a83ba69993bbc023e298f9bcfe27f1f7fafff70e89b459676699a1134a439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957266, "uuid": "834337b4-ec3b-4500-bf9e-454e7a8ae23d", "comment": "Malware payload (Mirai)", "value": "42c679a5261cc53ac1647d710fc13ada3b439630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748957266, "uuid": "38819fcb-36fc-4dad-8b71-b170b76378ac", "comment": "Malware payload (Mirai)", "value": "73b164a82aad71af26168073eb2bce195f7d8fd02b1decf54981d63fec01840184a67deb6c44de8361ab85b7333710b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957266, "uuid": "7ea1d78e-1e0b-4725-82c7-3a80fb7630d4", "value": "T1B1735D24A97D2E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957266, "uuid": "f586b54b-a266-4b4d-b8ed-626a015db14c", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8K:YwfdNu4cmZvFqI3w7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748957266, "uuid": "bfb7660a-b6b4-4f72-803f-989abf6beed4", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748957266, "uuid": "ed8bf807-e770-4650-b90d-31a8c5306a12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748957266, "uuid": "34781b2b-8dd0-49a9-a68b-4cc7d81997e3", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f72149-4047-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748933769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933769, "uuid": "4855eff9-0d89-4b7b-b71c-3a9ecc16475e", "comment": "Malware payload (AsyncRAT)", "value": "72b14b1d458c90816411a64210ec26ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933769, "uuid": "c960a7a9-2f48-49b2-9059-45d3e8306c5f", "comment": "Malware payload (AsyncRAT)", "value": "d91a06e6a5486b015756899ed8c4f33f59875a4f1acb09820273032ae7ee39d9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933769, "uuid": "4623daef-3066-4fb6-8033-635ed03373af", "comment": "Malware payload (AsyncRAT)", "value": "9ec61dec20f4b94b7ca022c38a8e3efecaf4f755", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933769, "uuid": "92408468-70fd-4a29-ae53-c9e2a48566db", "comment": "Malware payload (AsyncRAT)", "value": "4e0458e1df19e6579ba2ec278c3e6c055af86f952c1ab23d2a5711ffda7ae1177cb3dfeca215d00a6b3fa1ebb9e77dfa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933769, "uuid": "508aa8c9-8a48-4744-9751-de2512d672bc", "value": "T1F5D44B34B597C0E7C302673C4F1CE6651229E8665BB827CB33C52A6B0FE62A79717907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933769, "uuid": "70287d77-b1ae-41d3-b8b3-d02299a83006", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933769, "uuid": "2ad8e574-94db-4e92-b0f7-d3d0b655f99b", "value": "6144:9limGUEx9eu5d9uDgwHCq6NZoGZ2GlGx6wYRqeXXr9lb:Dimqx9euhuDgQCqd8D7Xb9lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933769, "uuid": "f2891c11-4cbc-47bf-b46d-4fcd1e63eea3", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933769, "uuid": "ab89d82e-a7cb-4009-aba7-857ffc60639f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933769, "uuid": "b6687a55-9c5c-42fa-840f-3ac83e27ba7e", "value": "ingihtv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768aac7e-408d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748963677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963677, "uuid": "cbc37bb6-9937-45cb-9ff4-1a7f0cef8b97", "comment": "Malware payload", "value": "800739ad462ec154b6cb582189c369ef", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963677, "uuid": "55fa25ee-45d9-4191-86a4-d3e41d947d02", "comment": "Malware payload", "value": "d95d14f35d096587b43fa4f14b5e720681786f17b83b6e43c6c9730e5fa96908", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963677, "uuid": "6e91d085-2e01-48b2-8fd3-236a87c8ac88", "comment": "Malware payload", "value": "35ba2f2fb065e924f542649d1d85f870f39c03ae", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748963677, "uuid": "4bd69f70-fe80-496f-9d2b-586fa0d30870", "comment": "Malware payload", "value": "93cfcb1cd7cd519a2e2a9a522825972318883108718167bb6cbdc21b4c6dd4e882e8a4bac6a63c7ed2540f1436bf70d2", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963677, "uuid": "7bb73839-2682-4160-80ad-269754ef9308", "value": "T1CF9236884B0B75FD8596B9F82D51E3FDA5A42534CDB0C1866AC0F08406F989E5AD2FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963677, "uuid": "9a37a8a7-1097-4577-9dc5-3d03707aa818", "value": "192:/YDLo5fCc4LzeDLHHeV65OXy8zdxNZAtf1g+KtSOLN2V/L0LAVLsLYALLLpL6Fgb:qU5fCcsCDq651kTZqQ8VpgzIzTs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748963677, "uuid": "ca09619e-c033-48a8-af61-284665717c0f", "value": 19688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748963677, "uuid": "33fdc588-fb10-46b8-90db-23929884d9c5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748963677, "uuid": "925da450-be12-4abf-9543-80c29ac7f96b", "value": "mybestgiftgivenmebestthingswithgreatness.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a92713-40a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975703, "uuid": "c986bdba-4d57-4204-a9cb-d75fcf67bbe9", "comment": "Malware payload", "value": "8fd2d9fc642d1c9c0ecea8d380022754", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975703, "uuid": "ab4d5988-8c64-438f-95a4-2d81bada06bf", "comment": "Malware payload", "value": "d999082cdde5fb83cad0b4510bfcbb5c41ae8f03f37d5118dbd8fe32cf168a32", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975703, "uuid": "e14b0d1c-4c27-4034-8f7b-315c3ee3ecda", "comment": "Malware payload", "value": "57a0f82860456baaa161d604c24f7f3744cdb3fc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975703, "uuid": "c31d761a-0b35-4994-9c2b-d4878dbf58cf", "comment": "Malware payload", "value": "e79f8b3a57e9c1d54f4916b85796f9aa09aea78a49c8c68429cb7d4906193cc77b723b4752b3af49658feaec785b066e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975703, "uuid": "b982981a-eb60-4963-a0dd-ed9dd833cf04", "value": "T195F5D1754147BFEF136E0D88D20835502CD469ABB761C2D8BACC279EE2EA408DD6DD72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975703, "uuid": "56a423b1-2cb6-402b-a475-973c2b9eb364", "value": "24576:LAvQjuV0y+jJ5Vzybxo2yfpfTlozbsqocm+wEHNg5Co7mjHFElwSBGF3VkpO3xjg:Bsr+F5jyQR63apO6ZF46nUOGSpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975703, "uuid": "5a0e0746-fb90-433b-8d99-416edeaa0a42", "value": 3386262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975703, "uuid": "b21f4313-a864-4f10-8c09-d188535eeb5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975703, "uuid": "8ebe9dca-c9ff-4b15-9eee-0346dbc1048b", "value": "installer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b8471a-4083-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748959484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959484, "uuid": "dd41fdc8-b5d8-408e-8227-a1d460b35c5b", "comment": "Malware payload (Mirai)", "value": "d3fd810f8f5def60e15b1f3c4d1b78f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959484, "uuid": "2a40870c-7d8d-4131-9de8-9ad3ce773cdb", "comment": "Malware payload (Mirai)", "value": "da4c5cc0261e0a25a526dfaec6de1b1882164b617852fb562ce7889ad38cd8a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959484, "uuid": "08470733-f40d-4141-b084-002e62948591", "comment": "Malware payload (Mirai)", "value": "49f18674fc815877a647965fc909203f7c586e0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748959484, "uuid": "aa69120f-1f78-448e-b7eb-a97605770b33", "comment": "Malware payload (Mirai)", "value": "e68a4d4e8ea329a48b511639189c48617c39af0056dd12f572aac25a243dc074961bbcf30b154aeb7733b6452afc0e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959484, "uuid": "e1ddda04-afdd-40f3-ad1b-bc7978aebd7b", "value": "T15FC32A46EA818B03C4D61776BAEF42493323E754E3DB730699186FB43F86B5E0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959484, "uuid": "9b7ee03c-30c6-42fb-9814-636dded4add3", "value": "3072:j1mjbQprCoDhqI2NkJd9wR/2hm+Gj3M/9mTg0fApzM/:hmjbQprdoxNkJd9c/j+GrM/9PM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748959484, "uuid": "22bcd112-f825-45ac-bd02-94cace967e46", "value": 121958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748959484, "uuid": "fda086ce-152d-44c8-9970-f7dd5bb5acaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748959484, "uuid": "ef30a05d-a9fd-45d0-88d6-77d361fc7cee", "value": "hoho.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923c1e48-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload (HijackLoader)", "timestamp": 1748944396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944396, "uuid": "fdd1b90c-7549-4cb4-b283-1dd96ec1e656", "comment": "Malware payload (HijackLoader)", "value": "e180a28ee46ea64c9230ecb1dd8ecbba", "object_relation": "md5", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944396, "uuid": "aafb50e0-afd7-4ddb-bdcf-d78f03f6ea25", "comment": "Malware payload (HijackLoader)", "value": "db0a48bf74364163187c63f71b91bf77435207e2ce740f80189ff07af0e9cdaf", "object_relation": "sha256", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944396, "uuid": "a1455d9c-17a6-41ab-973e-737257eeef6b", "comment": "Malware payload (HijackLoader)", "value": "52fe189ae7dcc80b2373322133ddd053d8238c6a", "object_relation": "sha1", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944396, "uuid": "d5ac680d-b0ba-406d-9ad2-b2424827cb09", "comment": "Malware payload (HijackLoader)", "value": "bfe30d677455ade6d9f0d3df8795e083fa25d72bf749d253b6b906fa3c7413105501f4151f469157f2f19571bdf68b29", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944396, "uuid": "2b922e65-4e5d-4164-858d-74c168342312", "value": "T177A6F1137690903EE5AA01718C6FAE6495A97D738A314257F7A0FF0D2DF05C2B623B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944396, "uuid": "146a2e17-9f26-42a9-b4b0-9cda0a619a1b", "value": "2ac0df3cb49d714c81e70b5b92c304f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944396, "uuid": "91154548-af3c-4385-8c7c-12081a7a0f58", "value": "196608:AizEH8CuwFcLOj09WqoPIdkBi+LRORzFBCshzwP0pYTOu9qhviu:rQj7j09WqsIdkBi+Nq/CsBwPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944396, "uuid": "71e43602-2ab5-43f5-b928-8d20c5c08b9d", "value": 10232384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944396, "uuid": "276b9848-092f-49d8-b87d-ac36f27a35e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944396, "uuid": "44fd1dd3-480e-4ae4-ba53-9838e7ddc0d3", "value": "db0a48bf74364163187c63f71b91bf77435207e2ce740f80189ff07af0e9cdaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2e2a7f-40a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748975876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975876, "uuid": "a7eed7e8-0bdc-4fcc-b15a-d6d520c05fb6", "comment": "Malware payload", "value": "65eff58c060094f6ce4379daab433ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975876, "uuid": "22389b02-28a7-4679-84a6-281124132ed7", "comment": "Malware payload", "value": "db2134af7ac70975f834a3d89319347a094c00b8768793b8d95ccc7ac7dde750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975876, "uuid": "24903d99-433d-4b50-93ce-676d2a82d078", "comment": "Malware payload", "value": "0aeb9f2bb97292a99ffb5630f1fa7ff5902c0914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748975876, "uuid": "90bbafed-1ce9-4f63-be2a-a19e2edabe8e", "comment": "Malware payload", "value": "8dd0a6c20dd182fb3e32b1301e68286cf9bb4058d8982be1ebdc85e63776d20a2780f042caadee46daf418b0f6797629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975876, "uuid": "0770e93b-510f-4fef-a415-91080da14da6", "value": "T1DED7494666EA0481FDF7EA348AF65513C633BC166F3185CF620C1B2A1F776E08976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975876, "uuid": "086c896f-736b-4b0d-b23d-8a7746c64714", "value": "be4fab12f4723443ba169a0e35943ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975876, "uuid": "6407cb10-c070-4803-98de-e948cba4d1a3", "value": "393216:zsqGxqsktO5GG02US1P+/U7q7K0mAb5ZUjcDUND3usyBvaRRMV+o33irYVI31BL1:z4lmOIUMFCrYVKAGmjvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748975876, "uuid": "6c355811-38f3-41f1-acd3-245fa894e2c0", "value": 63453308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748975876, "uuid": "05b408d5-a69b-41d0-8579-762593276446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748975876, "uuid": "7d0cceb5-d41f-4298-9195-0743b6ddb847", "value": "Phantom_win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbb481d-4017-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748913114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913114, "uuid": "327eddb9-e360-4b41-a4bd-cbaeb72b88ed", "comment": "Malware payload (Prometei)", "value": "186e605be61a164a3bed88806d0797ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913114, "uuid": "bf91c294-d682-4059-a599-f5151e1e6b01", "comment": "Malware payload (Prometei)", "value": "db6c4030b2b697851126863f6d76adb2cb9e0cfd7995d9f6b02cc4376669e51a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913114, "uuid": "714bc8b1-5a16-45ca-a40a-8d7816af9de5", "comment": "Malware payload (Prometei)", "value": "b15da1bb481bbda2409e794c61d3f09f8beca83e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748913114, "uuid": "065b20eb-7882-4d9f-b48d-6629e5159de0", "comment": "Malware payload (Prometei)", "value": "089949abd91756df4f1d5186cab8470c89bc6d187feeeb4347366d5061c86e35e993a4f66157424b98d7aabca07bdcbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913114, "uuid": "cf838476-a14a-4e5b-b4f9-333d69f6a4b8", "value": "T1AD155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913114, "uuid": "becf1c5f-39c7-4add-b478-e243336089bb", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mplh:qmShf4OTjMgXSJhBXEsVrmz9MOup1KhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748913114, "uuid": "aecaa483-18f0-4320-87f4-33e47f60414c", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748913114, "uuid": "05c99e6e-730f-4f57-9990-17dfc9f78752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748913114, "uuid": "95891b8e-2006-4794-8227-68399119482b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c21505-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748931133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931133, "uuid": "87b28cce-522c-4317-a964-1bcd509dc40f", "comment": "Malware payload", "value": "0e9e7736ca08a8a0f1e223ef57462732", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931133, "uuid": "7005aeb9-f3c3-4520-ac5b-5df4b1626390", "comment": "Malware payload", "value": "dc8cd670dca08933ecca56f1774129dd6d734aab4cac1ab903213aab8856bd67", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931133, "uuid": "907b0714-dca1-4a69-93d1-141140be67a8", "comment": "Malware payload", "value": "ce3491d7dcc19ac16af52e03aaf3c382729ee24b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931133, "uuid": "efe74737-1663-4de9-a7ca-a2882316872d", "comment": "Malware payload", "value": "8abede31dfcf6b7855f991eaec4d5081f0555a7541622f844efa6e2388c712252a3ae6e9a2e0a6c9e6f5cfc0265bbf40", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931133, "uuid": "a40ab110-f438-4d52-a006-f489f4f911fc", "value": "T19A31B42809F211EAF637C7B9ABF973B74516F7E2DD654ABD008062411326140B8A3E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931133, "uuid": "87207498-bdc3-44af-8ebf-7d5567f98d53", "value": "24:8itnHYVKVWue/CWOOGUAkGgcCAJuhsrsysh6FtmuBaHW:8EHayHUAkGgcfJu2QVh6FtmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931133, "uuid": "4ae3ae62-8255-41b8-92e7-1fc70e5b8789", "value": 1670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931133, "uuid": "38a7571b-9309-4fbd-9258-acd50c658d64", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931133, "uuid": "c5fdbb6b-fd80-489f-b8c1-db6831518977", "value": "putty.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2691e48b-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748931330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931330, "uuid": "52cd9cb8-b28d-4c76-afd7-0bc51d6dac45", "comment": "Malware payload (RemcosRAT)", "value": "8cbbb192a14cc353738cce6723e6c67b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931330, "uuid": "b6787f31-09ed-4a9b-af31-62e3bc3a3abb", "comment": "Malware payload (RemcosRAT)", "value": "dda7c8c6c658b6e6bd74426b29dcbbb1290c51ddefe56e5603c6e9230ec723ef", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931330, "uuid": "134405dc-1364-4de4-8a06-6d67cb7faef8", "comment": "Malware payload (RemcosRAT)", "value": "dc187f7e8b66cb3ecf867e58d1b0e7b3012d4c7a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931330, "uuid": "b6a2618b-843e-442d-a5c0-8399df74a24b", "comment": "Malware payload (RemcosRAT)", "value": "f9400d924eedbf5ac161f929d84e83a687a455ea481c8fbb1a3b285b560bd5cb11e338efe938e219ddb8d63c0cf130c3", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931330, "uuid": "c325db6e-1587-443f-9808-3dfd32b8b40e", "value": "T12AE24BA7FF3008574DDF1696EE794F668278CA6240213C717EEE338E8406A5C767C52A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931330, "uuid": "7c430507-0a80-49ec-9c20-51d9bfd61652", "value": "768:qPrFwNEa4P4/7j8W9xj5FcKULlJIoYn3YYCmsTRDFY5GMFOFkURu:XNX4w/7jJR5FcKULleFYYCvE/FUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931330, "uuid": "39e0e20d-e89a-4ccc-bf27-3a5499a6bdb4", "value": 32996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931330, "uuid": "d97714e0-6cb8-48fe-b0b4-cb904dba5c64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931330, "uuid": "b91d243b-bb22-4845-87f7-01ede63049b8", "value": "FT001-20250206_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621cdd41-405f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943886, "uuid": "01256fbb-f809-4521-8fb4-bfab0f76ab26", "comment": "Malware payload", "value": "313642fb38a34138ea0dd820fa4ff47d", "object_relation": "md5", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943886, "uuid": "42c76a52-93e1-4cc0-ad2a-f2a4594c4cce", "comment": "Malware payload", "value": "de07a1c8442e461bb6f8e4726a9d73199d4c57881361f2411c9c19dc4c9e5094", "object_relation": "sha256", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943886, "uuid": "01f8f35f-dff1-4409-86bc-223f01cd5ebf", "comment": "Malware payload", "value": "248d670f2bf56c3c73937f2776d1bb8856b70d5e", "object_relation": "sha1", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943886, "uuid": "3eb5c9f8-9692-4967-98fb-4d87aee44b54", "comment": "Malware payload", "value": "6482028f6f43409be7ed90fc068bb168aa59a2b903aae46d82e7edcdfe00cc4aac33612049eec84d89fd4ca49935efd7", "object_relation": "sha3-384", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943886, "uuid": "9e120c96-7eab-4fbe-ab98-7bc6978ac2e3", "value": "T185258431EE43997387D35F53D3E7D20C7FD9A0EE292B4990AAA4D5801422A4C5BCCB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943886, "uuid": "4a8dd8e0-2cde-424f-b987-391421f40c85", "value": "12288:xiKZ+T2XN6lOIjGIvDChi63p2nBQhRuWfqt9at1OFWlOTk0zgH8xz5KwAMhSnteG:IJe4WvP83ECxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943886, "uuid": "de264aed-cfdb-41f4-92d5-f3e42adcf520", "value": 1032965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943886, "uuid": "ade2a016-d9ff-4987-91b1-713b5cea9f5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943886, "uuid": "c57fe7f0-6bab-428b-891e-eabef8baafd8", "value": "de07a1c8442e461bb6f8e4726a9d73199d4c57881361f2411c9c19dc4c9e5094.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c18c29-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748989143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989143, "uuid": "4058d87e-5a52-41c4-bbaa-15101f6c1050", "comment": "Malware payload (AsyncRAT)", "value": "d83d9c5532130a894b0a5748051aa16d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989143, "uuid": "2f14c6f0-b4d6-4ca3-bd94-4fe9c2b4265b", "comment": "Malware payload (AsyncRAT)", "value": "de91b41ca57e7993a67aa0b8666ad52f5e5b0af3d24de69a8b1712ec8f9e4179", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989143, "uuid": "72b8ae4a-c804-455a-b337-d70554e6c36a", "comment": "Malware payload (AsyncRAT)", "value": "65c7bc35f713f3ecadc31f4bd5b5751b351ab4ed", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989143, "uuid": "26bac5b1-b8db-46e1-bbfa-c931686659c5", "comment": "Malware payload (AsyncRAT)", "value": "4921aceae8e6c9100484fba539d52c3603f87bbf6c60592b46088fb5ebb46e1167611819ae234631747f25bef28f334e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989143, "uuid": "243debf1-cb6c-4def-b564-03d37d0898d9", "value": "T11EE49F4E718086BBC7E42FBFCBC8DFAD9FB8354583C06ECE926417E54176950A5089E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989143, "uuid": "3972ff92-f831-473b-8bb0-f285276630d2", "value": "ddec375ba06350d1d4f99f542ec22104", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989143, "uuid": "574727e7-6342-4006-b518-3bd33b271468", "value": "12288:sMqaA8xqaJohcDuM7oWPK3aLSypihJHQN7Ddxxz2J2+YobmCIi4wCGd50ILK4E9k:sMqa0aWuDuM7ouK3kXpihJg7jxN+5IX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989143, "uuid": "a0994476-00b8-4bad-8133-01e5b9560270", "value": 717728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989143, "uuid": "1c0b7abd-4181-42f7-ab68-d7b68f2dc046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989143, "uuid": "a833bf6c-ab7c-4462-9ee1-f3b4f5d890fa", "value": "SecuriteInfo.com.Trojan.Win32.Krypt.15484.5780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa154d56-404b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1748935416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935416, "uuid": "b2aac965-c7ce-45df-ba46-b0d2ba08339f", "comment": "Malware payload (XWorm)", "value": "d85597621dd453abe60981adc41b1412", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935416, "uuid": "5bd8ac26-3eac-43e1-b5ff-f010dc1b18a5", "comment": "Malware payload (XWorm)", "value": "dea2d13110aca4e763e9845eba9dba7a8be8f5b701d3276e55ff983406d3b8e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935416, "uuid": "27d856aa-31cc-4dea-a100-67ffae473a54", "comment": "Malware payload (XWorm)", "value": "1bf9b1c8b1367d66c105635298b7cb241410130d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935416, "uuid": "ad68b7ee-e59b-4d69-bd38-1d1b3458771c", "comment": "Malware payload (XWorm)", "value": "cd83ab945bed26e47b964c1e34048ff95db62fb27248d40c3e62e791a384dd3c052a61c231615fb62e324f204cb568e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935416, "uuid": "b85fe936-2997-47c8-94bd-04327c008b7e", "value": "T1D4D44C34B597C0EBC302673C4F1CEA552229E86657B827CB33C52A5B0FE62A79717907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935416, "uuid": "8fd2732d-e8dc-4c82-9397-c98f38557d26", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935416, "uuid": "cc9608ed-e425-409a-abc8-9ff51d9382b0", "value": "6144:YcJOn8TxSWdiXDa9DjwYhnYNso3ZlGcTuk7VQr9lb:TJO8T4Wdi29DjHhn2vjV+9lb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935416, "uuid": "187e92eb-c1ff-487e-998b-15c66094ccad", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935416, "uuid": "b12befc1-54ee-42e0-93a6-6747b366b7df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935416, "uuid": "6e0203fb-f5f2-4729-be67-c362011691eb", "value": "xsxascccccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3db5fee-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748930816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930816, "uuid": "91a04529-3ecd-415f-8feb-f78876e84240", "comment": "Malware payload", "value": "798d2192a6e121ade12e9f7e4ffb7415", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930816, "uuid": "45cc21de-a662-405f-baa4-76705511431e", "comment": "Malware payload", "value": "dea333021add76b6c01603d91f85a0de9c256655f01b826631ccfa4bcbc8a811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930816, "uuid": "a84f6b7e-0118-4779-a9e3-7aaad295949a", "comment": "Malware payload", "value": "ca0734ab801e7e54e21807f83c15d27848436635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930816, "uuid": "bef02eda-d0db-4cce-84e4-d1569f4d777e", "comment": "Malware payload", "value": "2a5fe2f7c891f0f0af8ad903e6150bd194f462a2ebd761a9a9e59b3a9c81821370a8b5fae6ec342345621b862088d430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930816, "uuid": "a530b15e-c22a-4cc4-b382-e487c5afa072", "value": "T1C806F632093C6E11D6AB43B134D240F21EE46539569DEA766C8EFBF76F1D3C8940A84B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930816, "uuid": "ae97b842-3134-48da-9d1b-81d6cabd0931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930816, "uuid": "5f9783bf-4b7e-4bbf-9469-b3a01ca3d621", "value": "98304:+GUBvhusNspLfwhxhArJrtH6n5yLLQYdSAvQTnFL/nz1B0xKqedVV/PsMDHxxk3j:+GbJgSs8alAlaGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930816, "uuid": "d33472c5-064c-477b-9cf4-abe8476e5f27", "value": 3722240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930816, "uuid": "a112faba-2879-4d30-9af8-7f0b5991fa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930816, "uuid": "eb978af2-d4a8-4808-9cf5-9aa32a473946", "value": "798d2192a6e121ade12e9f7e4ffb7415.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ff6272-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748972960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972960, "uuid": "c7bc448b-ba89-4e01-8068-3ac90c66ddbe", "comment": "Malware payload (Mirai)", "value": "a8d7805f2ea9a2fc5aac258507223744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972960, "uuid": "b8e054e6-39e2-4e88-8108-c17efce47f71", "comment": "Malware payload (Mirai)", "value": "deb5012987c7295de85901a3eeaaf6e8bbbb0175dc81569abe9edb382a50c4ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972960, "uuid": "66f690ca-b0a1-4150-b1b6-abeca894b10e", "comment": "Malware payload (Mirai)", "value": "feef170eb4e99af01472670fcd913dd937febb13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972960, "uuid": "d6865067-0c8c-4249-8777-230109cf325a", "comment": "Malware payload (Mirai)", "value": "6317f327cbf1a1c3456ee775d5ef966f5efc6b65804dc238e21c7bca78a56ad91152efca41f5740a78d5ac24c2bf2cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972960, "uuid": "71587920-6ad7-487b-8e70-5399f33f196b", "value": "T12353F7C5B881673AC2D1537BE9AF159E3350E7D891CB3317C8640BA07AD681F1CAAF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972960, "uuid": "6f77d062-b25f-4c2d-a444-cb1b0de34724", "value": "1536:Q8Vvsn7S7S1i7SiRWD0YxY3D5HZYeqK0DMhWL5RkHsf:tVvuXxOHZuKg6q52HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972960, "uuid": "f1f672fa-9677-48a1-81ba-61a611488509", "value": 64124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972960, "uuid": "d20f5108-2b35-4131-97d1-9fd0ba924e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972960, "uuid": "25eb3c2a-be5a-4959-a5d7-e293fc998407", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c4bba0-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994274, "uuid": "e7ba78f8-3ed1-4865-b0ae-9e5811ed4e20", "comment": "Malware payload (Mirai)", "value": "daa3d686efa7a26d434fe738ba59e40f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994274, "uuid": "0c4a4ce7-f82b-4b5a-a831-b5155ae8f596", "comment": "Malware payload (Mirai)", "value": "e17915ecf5ec40a72cf99147a7281a82de92179ac4d6089e5efa6b6644b66339", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994274, "uuid": "7904c869-a5be-4fbb-815e-02a9abc37548", "comment": "Malware payload (Mirai)", "value": "936e42aef726eba35ae62ef6bb9ed159d85dce63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994274, "uuid": "eb61881b-7321-47c8-99c6-47e3e230778e", "comment": "Malware payload (Mirai)", "value": "b2848725ac62d3a2370856ea13aeeab50b1cb60202f5cc43fee4b5ae417a767c3aaef35f22075d92d339c0256fddff70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994274, "uuid": "67c952c3-c6c0-4130-9d9c-be061c838cbb", "value": "T198041834E6404717C2E227BAE68B424A3F334F97A3D733155A38BAB43FD27995D22911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994274, "uuid": "d155e8c2-f92b-4716-b0b9-c7dc2cc6ce44", "value": "3072:8dZPSsuX8azEwqCiYEQ4YNCOdNNAmrIzM/95WKyGmELwFBXAyNu:8XA8azEwqCPEkCOPymrIM/95ffmELwFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994274, "uuid": "b99c5b7a-c920-4aa1-b639-2fdb77af8531", "value": 185183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994274, "uuid": "fc529b41-e9d9-4a3e-9c7b-4585d807892e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994274, "uuid": "403a6fa2-61fb-4b32-b902-0c9df043fe8a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51902b35-401a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748914223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914223, "uuid": "f2fa2132-0fdf-4494-85cd-2e601028b502", "comment": "Malware payload (DCRat)", "value": "56a1d366370c872a7b887497aa85dea6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914223, "uuid": "c70a7455-4ee8-4ba8-998a-d80af4943e96", "comment": "Malware payload (DCRat)", "value": "e213ec21fe0b16be400098aa6efa5e74aca032725ac4868f9f1bedfe34c44b66", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914223, "uuid": "24a6d394-adfa-4b11-86be-8ffeaba62886", "comment": "Malware payload (DCRat)", "value": "573a557ee1b6431480534b974be086508b495498", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748914223, "uuid": "b6c9c5e9-8284-43fc-980d-63c37c4b3040", "comment": "Malware payload (DCRat)", "value": "cf62e5afd98dca7714fc1e5982ad12a4302c76f217ab4bfbb584330551eb6f7c9d0539c1715c9e372b778e37a255da70", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914223, "uuid": "e7a18b85-9df1-45b4-a2e8-61a22a692a01", "value": "T15AC6BF06B5D24E32C3745B354667023E92A0DA723652EF0F365F2592A917BF18F722B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914223, "uuid": "6d8d0e9a-4511-4e11-8495-ad272c40a177", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914223, "uuid": "47943449-2d21-491e-8f84-0e8e3659f742", "value": "24576:2TbBv5rUyXVgoMRdaMW6aYqhj9DZRVhrGhO/anxHbnBPKKSRsZNAxeZfd9utjvKF:IBJlMk1RVhrSFxkK14I1d9utbKB27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748914223, "uuid": "0c4fc7ac-d2ae-4679-8959-8f0d70cf8a90", "value": 12582912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748914223, "uuid": "ce209fc7-05ed-4df4-93df-be769db45b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748914223, "uuid": "5bcbd888-28d1-4005-9940-c0bb773c9d15", "value": "56a1d366370c872a7b887497aa85dea6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da291289-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929914, "uuid": "80429e57-2eb0-4df8-80e7-c8ed596caac6", "comment": "Malware payload (Mirai)", "value": "f818482e7b820c8b1ec2c3f35ea79ec3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929914, "uuid": "e39cd063-0d63-4720-8784-a143ca5a3ef6", "comment": "Malware payload (Mirai)", "value": "e2d5c78518834a3d719c4b1a595748d658c909d6de419f9d8131ac0a69e6c7c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929914, "uuid": "4231ff97-a14f-47d9-9145-2f49db70aad8", "comment": "Malware payload (Mirai)", "value": "3a24bacca84ffcbd8219e2cd94c64dccbc21e229", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929914, "uuid": "b6d8ccb9-62fc-4dc0-9cc7-0a37d9f9bf5d", "comment": "Malware payload (Mirai)", "value": "2a7b6f1ce6ff364890718605ffc20afaa18172b96a3b3a9051f8aaa83a2b59d4db482fb6da3a22e749b57eb4a2d76259", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929914, "uuid": "c90d2eba-1335-4605-8336-935bf208d039", "value": "T15B51848911A1A370ADA5DE7273AA80197591E0B79CDB2E06DCFC7CF4E9DDD8C7081782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929914, "uuid": "dc498e57-8e84-4f24-9430-63fb4aac8f77", "value": "48:ipFrpWdWcNpffpARpq9pC1pYOYOp1n1ycpqZLpPlJpgZp6rTBpHnpJMUpm+9:iXEIcN14yqXHgLN4i1sUD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929914, "uuid": "7745397c-49a2-4ed1-a5fa-941263c6eef2", "value": 3059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929914, "uuid": "6aebfbee-578d-48c2-bf9b-15c3f3d353e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929914, "uuid": "fec485dc-d0dd-4c8d-bb38-c6d65d4d2c00", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cf2729-407c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748956352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956352, "uuid": "9fe1ce00-bbd7-4a44-bb81-b84520197727", "comment": "Malware payload (Prometei)", "value": "b291f991fba85aa895fa884fb65eb233", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956352, "uuid": "e3f79e5e-6bbb-4b39-833e-10fb13b8e9f5", "comment": "Malware payload (Prometei)", "value": "e2f01bbd0314252cd3fc618f76e98e04b88d0dbcd851ea1fce9a24b705796a9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956352, "uuid": "de618535-a0a4-4b5c-9851-e3a5e5f67c1a", "comment": "Malware payload (Prometei)", "value": "c1b8da3e688c1722345d0e1989a9762ba58d1ff2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956352, "uuid": "baa93269-b049-4469-8ff8-f2c9b82d34f7", "comment": "Malware payload (Prometei)", "value": "98f871132ca639c7dba64646cbeded814749c3279cce53568ef95840eddb4d52876422b2c7215591e59d9662ddd0a8eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956352, "uuid": "258a1831-faee-4d9a-9129-a9da45f10571", "value": "T128155B653700EF5EF39DE27108F287E046D125F31AD24296A278C71C6EE161D28AFDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956352, "uuid": "3fa5b370-3a76-4ae5-af6a-811957d18463", "value": "12288:qb143S0q+8eXS1/f2Wc3slC3yjTjMv+9XSJhBXEsV3b9gh4J8zMSv7MzOup8Mpl6:qmShf4OTjMgXSJhBXEsVrmz9MOup1Kh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956352, "uuid": "77027f16-cd38-42c3-8db3-7e5ffd4d48de", "value": 920568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956352, "uuid": "5f71fe6d-5475-45c6-b905-7fd462309115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956352, "uuid": "9bba1529-d4fd-4393-a2ff-4785790d81ce", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2552dca9-40b5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748980720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980720, "uuid": "ecb15479-d6ba-4721-9b26-6e7504124b8b", "comment": "Malware payload", "value": "0023f0a02630a160c2c4db2434df9404", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980720, "uuid": "d3e97156-a937-483b-8095-f0c4fb10ba01", "comment": "Malware payload", "value": "e4369c1ed4685bf9389db689a4879b5af1ef16ad891835e92dbca1fc8d5be935", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980720, "uuid": "b8453f71-34b1-46ab-95ea-43847e2b9cd6", "comment": "Malware payload", "value": "ff2b89f351430d1cf90c4e9fc335ff3b2cd45e14", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748980720, "uuid": "f2f20fbc-45ac-47ef-878f-7dbf9d53ec32", "comment": "Malware payload", "value": "0e17e997f754b482eb92825859b5f3485a269a7fb46934e68802b1bb1a54d7658f9252541e66d7b2eefb2ef5ef5f0571", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980720, "uuid": "42417988-f009-45c8-afb3-d96867009e88", "value": "T1A527330327D19031FFEAA2B35B26F206567CBD684037966E625C3C75FD749A2236C227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980720, "uuid": "1a0c8b55-d879-4df2-8842-b881fcb780e3", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980720, "uuid": "7c754df1-16a9-41e4-9a07-cc5da5e72d82", "value": "393216:iQf3/t1lY3RI5nswGRvC8jPaf/eoJ2Bk9eLPIhnIMeUW0Z2avcbwL:5xOINbGt7Ta3bQD5q9ZVvcb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748980720, "uuid": "8aed562a-4eaa-4c88-91e2-fd120c36c12d", "value": 21043712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748980720, "uuid": "4a3bfa6a-c00d-4d2e-80a3-f83cac75c3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748980720, "uuid": "84c98ae6-271f-4ca0-bcc3-99902f9c341a", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267d8e01-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955811, "uuid": "286328bd-95fd-4533-a253-de8e395573ac", "comment": "Malware payload (Mirai)", "value": "620c5ae5808ac078ed93318cc71087ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955811, "uuid": "38271e73-d024-43be-a23f-a1b7500be042", "comment": "Malware payload (Mirai)", "value": "e6670e18bee6181744366c1c3873dadb1187b21c50fc189759a40d54cc4320b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955811, "uuid": "46afa305-2e13-4075-b8e7-63e223f2a456", "comment": "Malware payload (Mirai)", "value": "86f8e3fe3a636d06325d3da24afa9c494e202587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955811, "uuid": "b86047ff-fe8d-4282-8ab7-22bcd1f33307", "comment": "Malware payload (Mirai)", "value": "50ecc80a237c2fc0a9ff2e8db169588bd447d24a4467e3b70ad3bc3302a920aed8f3d1992ab4550f5024de1192411ec1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955811, "uuid": "b30a737a-db4d-4da8-a015-c4c09c50a7b2", "value": "T159833A9BF401DC7DF80FD7774457090ABA30E3D11A831B3627ABB967AC761A14926EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955811, "uuid": "e21dec58-23a3-40a6-92b9-3c019447933b", "value": "1536:BMm8u5Dmvkt0zW0/QNXkAqv18ph8x1Nbb7AWaS4opHihznmFooiOLTfCcI:BMm8uto80nQFnM18WbwI4aHWQiOLTqcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955811, "uuid": "33f6d854-eb72-43ea-aa70-d45392019a81", "value": 81540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955811, "uuid": "2b3105ff-9870-480f-a13f-e05a5e85a461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955811, "uuid": "0118523c-e2e1-4cb9-a9ce-4e8c7bbad5f5", "value": "neon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fe93b4-4063-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748945521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945521, "uuid": "47ecc987-a7bd-4224-bb7a-5d6de348c878", "comment": "Malware payload (ResolverRAT)", "value": "2cb8446c5fe0b9e7526615fb10a427d4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945521, "uuid": "d6baa93b-c531-4155-82e6-2882dba2be57", "comment": "Malware payload (ResolverRAT)", "value": "e6c0e648b820b5cdc386446b3d382e8733c617239596c595b099b8b381f5a8ea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945521, "uuid": "c1b1ac32-8352-43a7-8586-165993128777", "comment": "Malware payload (ResolverRAT)", "value": "3737bef89c0b673b7709e3bdb9a62add53421cf5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748945521, "uuid": "e3109b21-64ec-41fa-be88-b0fafc55581e", "comment": "Malware payload (ResolverRAT)", "value": "6442338543cc89425305b7ba7db4462a63035a35d28799b6eb3b310ce46a12756156072099d20b8560a5f691bcb7d2d8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945521, "uuid": "475ca5f9-f91e-4cc1-bbf0-0eaf36177878", "value": "T13D13CF6C5D8619A1E8F5A0BA4305F234D39CD3D33F15E3FC846966E4643EAE3E668C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945521, "uuid": "d06a1002-7b89-42ba-9346-c6cb040a4935", "value": "768:ngteWcawsNm3AOxsVeaGG/yabpBCEBTyROlNlVo7hGoUXXvRWBheyi:nfawsNAA3UVWDCA8OF6VGoUpWdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748945521, "uuid": "f0713886-8de2-4fcf-9be6-5af827382d0c", "value": 45197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748945521, "uuid": "86acfc1e-77b4-4c0c-b1a3-b77b3849cb69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748945521, "uuid": "67b09aaf-b310-4360-9b0b-07a9e518a3e1", "value": "Zapytanie_Ofertowe_SMG_czerwiec_20250603.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0216ab20-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1748931269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931269, "uuid": "243e449e-d8fa-4f12-b468-f9c7542795e1", "comment": "Malware payload (AveMariaRAT)", "value": "0f034b09a6498ca3b84e64ca49b86662", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931269, "uuid": "725839ad-55ea-472d-a3d4-92724436bc70", "comment": "Malware payload (AveMariaRAT)", "value": "e86b85966698e32d7233c54325bfdc1a6772fcd6afa8fcf49f86a781aaacdb1d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931269, "uuid": "948bef40-e8b0-4311-9c04-91c647e9a690", "comment": "Malware payload (AveMariaRAT)", "value": "0e2cb9674c2d396d330f24c45975beded73325fe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931269, "uuid": "daff5e6b-d80f-4861-87cf-474570630c19", "comment": "Malware payload (AveMariaRAT)", "value": "755bbccaf96b0fbf23c577a43818d221c7ee62c2547d861fa814939fcbacff30aafa95333afc34e7d053adf9d876e99e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931269, "uuid": "38ef65d5-b003-4abe-81b7-dd2f5c36f7c1", "value": "T129550B5D94606DD26014FDB4F591FF93CCDB23851A278A420FD5A1AA2325883FFBA3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931269, "uuid": "588e1f7c-d392-40c5-9ff9-51dc3c9c6f40", "value": "12288:URIW4xzP5jmhJfFHuTSPAxUR9BClmmb+Ls5su7v7x:6p4xzPNm3VuueS+mmILu7jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931269, "uuid": "3e451a69-0fec-4f9e-b7c5-8b8e2192a577", "value": 1359144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931269, "uuid": "66a5e610-ff5f-4df6-8c65-43dd2fd90d1e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931269, "uuid": "b7412c1c-cf59-4462-9f7c-4a1dba0532f8", "value": "GLS Italy - Notifica spedizione V9 6609.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87087a8c-405d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748943089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943089, "uuid": "9b7b2054-5fe8-43c4-8624-45ea3b48cf0f", "comment": "Malware payload (Mirai)", "value": "435f659dee5bc4e7217a752b2ee8b386", "object_relation": "md5", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943089, "uuid": "16b6b8a0-abeb-4c1b-8273-33f859ba84c5", "comment": "Malware payload (Mirai)", "value": "e889e7e99b71dbdaa9b939f4c0e4730e62761759f4d932ea2fc92f1498905928", "object_relation": "sha256", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943089, "uuid": "99504167-2bcb-469d-8d2b-bb63fe21e61d", "comment": "Malware payload (Mirai)", "value": "32b9f7c3521ba4bbacf26e820ef975fc0545a2ab", "object_relation": "sha1", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943089, "uuid": "e0d0d622-4b2f-44ad-9f93-f26d58c23f47", "comment": "Malware payload (Mirai)", "value": "8c9532829687e3d47b588416a0e792cde4dc76229c5689657bf995c3ffbdf374913a3a26f1da5a49f8244053f45cafcd", "object_relation": "sha3-384", "Tag": [ { "name": "80-94-95-141", "colour": "#D3BFE3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943089, "uuid": "c6398492-2c94-4c98-bf6c-87e3a8ae9c3a", "value": "T1F6D67C43F8A109E8C1E9823485768256BB71BC494B7573D72B60F7382F73BD4AA7A350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943089, "uuid": "c0de1ac3-5c8f-43a7-97ec-2a8831874cc1", "value": "196608:zjNG4nZEIwh0szuqnLMBVhDRZZzwo+BPF9y:k4n7whSqnLMBvDRLf+BNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943089, "uuid": "ffe3bd79-7c8f-4ffb-9fa0-66104cd05d71", "value": 12733008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943089, "uuid": "3c848a72-f7d7-4912-9675-b8a2b9d22c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943089, "uuid": "e642e912-6470-400d-aace-2bafa50f278c", "value": "e889e7e99b71dbdaa9b939f4c0e4730e62761759f4d932ea2fc92f1498905928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2066de0-403c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929041, "uuid": "c971905a-63f6-494a-89cf-38832a8c6fa8", "comment": "Malware payload (Mirai)", "value": "dc9bc94740f2a382449a9abd7bcdb562", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929041, "uuid": "57d0519b-607e-4789-b7b4-6b106f7e205d", "comment": "Malware payload (Mirai)", "value": "e8e656e9e75e9ca7e9e30030d2b8f148ba6bf57840e5d0c4226f9fac6d3e4acc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929041, "uuid": "97f359ea-1c7d-4c15-818d-33354b2af885", "comment": "Malware payload (Mirai)", "value": "7fa169ddda6767861df568cc3ae70d6ba9e705cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929041, "uuid": "0fecddb8-400d-48bd-959b-db0919562803", "comment": "Malware payload (Mirai)", "value": "5852726c4ce41f6c56a13f42f4907b159065a666eae1a6f63b2af59aa8e07bb69e311145e815ae9785ca74d8846edb1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929041, "uuid": "ac10c036-9611-4f56-bed8-31df81e569e1", "value": "T1CD93D809FF610EB7D85FCC370AAD0B0239CC599712A87B367674D528B64A64F1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929041, "uuid": "4b2a29dd-d5e3-4e05-ac1b-787196c247e4", "value": "1536:VK33HdJuuQ4NlneyW86hV4e7MpZJNH9P3N3rcv9aQdn:VKHdJuuQRue7MpPxHQdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929041, "uuid": "ee603d51-227b-429f-bf59-cf0dbf353e8b", "value": 89560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929041, "uuid": "33938146-de84-489c-81ab-fa1e56f5967d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929041, "uuid": "92b30e1b-69eb-4e7b-af6e-f65d76a096ed", "value": "neon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b061b7-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955803, "uuid": "d9af3285-4e1e-4de5-8954-03ead9b04799", "comment": "Malware payload (Mirai)", "value": "da84ef69e418caaf72b64a3f49020fdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955803, "uuid": "9a80f7d1-afb6-4023-9554-80ee8f340956", "comment": "Malware payload (Mirai)", "value": "e92fae722bf69881b76d77f874be20bb7655c0342afdd27a9b85174bed65061f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955803, "uuid": "24e062e1-2975-48e1-9685-0c8c734c323e", "comment": "Malware payload (Mirai)", "value": "9d3dfbee5c7da35329df0c47f27413ab908f4f62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955803, "uuid": "61af180c-4858-4480-823c-18aa997b8193", "comment": "Malware payload (Mirai)", "value": "48150588637a53cf1546e6bb0875937fe407243deaec1c7879bd858c8d2e440f6bb4da718057ccc8ccd1376d61c21e3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955803, "uuid": "4ff68504-1668-4c7a-a7cf-f058c247c414", "value": "T15BB39CAFF2471591C86286F047CB8FCE3E2323C19F5794E72D2D267928762DB5902B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955803, "uuid": "53e3e5ac-30d5-4da7-8bca-209b5695ae05", "value": "1536:BcuTWiLvynk+hMJ8cm5V52jSlJn+TzhhBxVquoGgV/LWb:GbyvLuMJ9mXYjST+vhLoGgVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955803, "uuid": "bb2f265e-64fc-432a-863f-74daa0972f98", "value": 107936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955803, "uuid": "a5bba275-5b8a-4eea-9018-c8a1e61e29d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955803, "uuid": "85e27985-a82b-4333-a8d7-092fa91b4771", "value": "neon.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbca6e8-4072-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748952305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952305, "uuid": "3d3e1630-9fe5-4380-b578-b61973fe6873", "comment": "Malware payload", "value": "694b98f65c4cb0e93752d0c3438e0d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952305, "uuid": "0a68c41b-ee9c-4a79-8195-f159d5216ae9", "comment": "Malware payload", "value": "e93662ffeb1e3be9dd6a33a195fa76618fe323efa4a350fc98e69324ad094a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952305, "uuid": "22f3a98c-7ab1-49e3-ba2f-87d599324ee7", "comment": "Malware payload", "value": "df012713dc565a58f920fdc12354fed858e34dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748952305, "uuid": "d6ea0e0e-bfdc-42be-a35a-e34f864101df", "comment": "Malware payload", "value": "d0391e8fda56111b53eb746961557a945c528655df19dfc5fda94cb299dcec56014ec301763176d310a953abcce7972d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952305, "uuid": "664c50fa-83ab-4acd-9561-3bf5c9449535", "value": "T1EBC23A24667C8A23C79C4B7D94A623961379DB23B853F34FEECC62AA69533C10041BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952305, "uuid": "a06e3af2-69d5-4f62-85ff-d0f6e4390384", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952305, "uuid": "d177245f-8b51-4698-83f9-be8d0d5920e1", "value": "384:AIQcapplhMB/iQH0AdtAf5pWW0sYACTyyTLELcUL1jkrMKO4TiL9JpqplroaWX:AdcappTMB/yWkWPsYtyyHIhYOpDcLrU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748952305, "uuid": "318d2c91-9c19-4154-b0d1-4e3e8a9dbad2", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748952305, "uuid": "01b0bb9f-e777-4019-b27b-67e88f9e02cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748952305, "uuid": "edc355fd-31c2-4a15-987b-fb14c30fce7d", "value": "e93662ffeb1e3be9dd6a33a195fa76618fe323efa4a350fc98e69324ad094a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717268a4-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ACRStealer)", "timestamp": 1748970970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970970, "uuid": "6d982829-e623-4c48-91a9-98b0797ae60d", "comment": "Malware payload (ACRStealer)", "value": "fdde7a7acbe42b0ad3f3bbd31ac753d5", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970970, "uuid": "0f0b4bd8-76f2-47b6-8f70-60f82fa79054", "comment": "Malware payload (ACRStealer)", "value": "e94d1da301de3804708275fbd3b64fd7fc657c6977cd0acf14c01f4256e71137", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970970, "uuid": "b309a891-b031-4510-a681-6fba0b29d72e", "comment": "Malware payload (ACRStealer)", "value": "04cadcdb2706dee934f00c08646adea0179ff3eb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748970970, "uuid": "83a0daae-8007-4bc2-9b96-918c36d5523a", "comment": "Malware payload (ACRStealer)", "value": "39521c911e619aa7a815e0dbd885cf8b8e8f8a748c32a4080111e9bcedaf85ec56a055b10934cba1be8571177da2a0de", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970970, "uuid": "8d2cdfe3-dc7d-4911-923a-f14d3b8f74de", "value": "T167473333F6212B60EE27FD732054591997CDB8F52072BA2883CA47A9275178E31653FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970970, "uuid": "eea6f1d9-0891-42c3-bbb2-7364077528f4", "value": "cb2f8861ae9e888fc248b97ed817726f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970970, "uuid": "33eef463-e6ca-42b7-8f37-9250e448eadd", "value": "786432:cB7apWwVnJN3I8apWwVnJN3IlapWwVnJN3IF:cB7XwVJNPXwVJNyXwVJNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748970970, "uuid": "a2360740-3eb0-4446-a81f-0f2756d888df", "value": 26149272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748970970, "uuid": "a8ec8648-a5ef-40ae-a5e2-c2c7e66d6c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748970970, "uuid": "78ce5b9e-60ba-4d9d-bceb-55caab8079fd", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d41229-405f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943818, "uuid": "2eaed62b-470a-4d9d-9874-7da17ac8ac9b", "comment": "Malware payload", "value": "cebdb99414c798cc74bafe576f72630f", "object_relation": "md5", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943818, "uuid": "0f84fa80-cbe3-4b5f-8b59-85c4ecd5b7bb", "comment": "Malware payload", "value": "eb2688341917d739b2048e39c9913c0c5e0e0d82346757970883c5098a0b77f3", "object_relation": "sha256", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943818, "uuid": "662bf790-b7d4-47da-ab5e-9545341c2ddc", "comment": "Malware payload", "value": "787568a086fdd68734c7fe9ee5be8cf69e2b07ee", "object_relation": "sha1", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943818, "uuid": "52ca050b-b9f4-4373-baa6-ffeb0bc0d899", "comment": "Malware payload", "value": "deead2cffba7cd81b54363ef52373aa74183456385d86360bee4cb36eba3b883ffdd367543f9f60705bc0bf3b19d1ab5", "object_relation": "sha3-384", "Tag": [ { "name": "dnsg-microsoftds-data-com", "colour": "#39BBDE", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943818, "uuid": "cc6941f7-53b5-40c0-b991-3d46fd7deb3c", "value": "T1D7E2861776049331C48307758A1FE7E58B25AC589F67142235ABF39C2F729A066F7BE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943818, "uuid": "9127cf44-56b5-4259-9b01-babb885dcb7d", "value": "384:RFZ6meAB4WFHpyy3M5BCfx5Pyy3M5BC0ioXtLCvW:8K3yWMDC/yWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943818, "uuid": "5a1d1a23-a897-4a78-bdec-5142f50bb527", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943818, "uuid": "278bb49e-df76-482f-af86-98b4e09634fc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943818, "uuid": "bc5c6bbe-3356-459a-ab99-199e76b79f34", "value": "eb2688341917d739b2048e39c9913c0c5e0e0d82346757970883c5098a0b77f3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cff17e4-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955822, "uuid": "49af1db8-20fc-402a-a643-5a2e3b456d32", "comment": "Malware payload (Mirai)", "value": "48ed31562755995cc82bfbcc8ed7e49a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955822, "uuid": "199de3f6-b7b4-4beb-8230-faa1605d8758", "comment": "Malware payload (Mirai)", "value": "ec2aee5b8fe5e2ec51d668b91645a209bef17bb32b0aee6c59ba4e6d1fef1ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955822, "uuid": "40bd2348-92d7-479d-89e4-a5532905e187", "comment": "Malware payload (Mirai)", "value": "4e1178731f7eef27734fe7c039ba5d5bfa7fe14e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955822, "uuid": "4561b0c0-d2bf-434e-b55a-1198a8059af6", "comment": "Malware payload (Mirai)", "value": "da153dc89a5893abf78e1ea0c41b30b81ddd18af5caa8f9d5200040343f98669823008a1e91d85f3cfa0844207d4650f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955822, "uuid": "4b1953f5-10e8-478b-91c9-70605265bbcb", "value": "T117F2E162D9AB8B45D8F844FF8DEFA717843896081641C97B6184E223949EF1E273C1DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955822, "uuid": "53060740-23f7-4fe3-9954-fae81c8680b6", "value": "768:TuhNrfU6yAUSDbdg6shLFlAc0t5sLBCdXOqXnLcbLAjeZDLnbcuyD7UHQRjJ:TuhBfUPAU2dXs7ScNQNzLdeZDLnouy8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955822, "uuid": "34a22545-99d7-4b23-ac98-0b5e62fd2f79", "value": 35476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955822, "uuid": "82d90ad1-755a-4f9a-a42f-e4b9a1a5f3ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955822, "uuid": "d69624a7-836d-4247-943f-2d067851006a", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dce3caa-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748955958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955958, "uuid": "a9bd72dd-12bc-4be8-9a6f-2c4028d6ca1e", "comment": "Malware payload", "value": "48222623f02fc807ee09ad73142c5d96", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955958, "uuid": "94725c41-9eae-49c6-be44-c7c143679167", "comment": "Malware payload", "value": "ecbfd60a1203067531e95f628d105f8555da9b4bf49a36779127654585e33b9e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955958, "uuid": "d7d1fa09-03bb-46d9-b28a-fafe28d1b90e", "comment": "Malware payload", "value": "6a2027b40a24b466d8e35f445cdceef5075740fa", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955958, "uuid": "fc3a1ecd-2703-4cc4-a57d-cf364bbbde35", "comment": "Malware payload", "value": "4b85408219b6ca4091e7e79d8289c19e1f510910f30f17ad9d4efb8b3461a7b9adb7fb8b91417270c44d87d386002e20", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955958, "uuid": "24f94aef-9d7c-4b9f-83d1-3dde98b84df9", "value": "T12AE60126BD9BC469D5E3B03130C1D163E41D1988F927E4BB07E01A8A59F4CCA6B62FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955958, "uuid": "46fc0fba-47f5-4ac2-af61-22e8297fa560", "value": "196608:gtNa+CfRIteSHGtuAfWUJW7iqPtR9DTWQMarHNtVZMrF2gg59PNZ+J5HmviJ9YiQ:gfaGCwUwGq1TqQMawrAHNoYviJhkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955958, "uuid": "8f81654f-1256-4cdd-9f2a-c0126e236207", "value": 14662748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955958, "uuid": "a78fd4c0-2340-47b2-925e-a6310bd59b6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955958, "uuid": "3d582f4b-e645-477a-9929-b00d35073e50", "value": "ElectricLauncher.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec94ba6-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ErbiumStealer)", "timestamp": 1748989111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989111, "uuid": "2a54f336-b270-4196-ad1c-4e235898851f", "comment": "Malware payload (ErbiumStealer)", "value": "22b2de2e391992358166c03b15467b0e", "object_relation": "md5", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989111, "uuid": "edccd206-22f1-4e9e-a7f6-979974b286d5", "comment": "Malware payload (ErbiumStealer)", "value": "ecc3e2de3a6bd4596e9027ad9c90f4d88373400ec82b470b8497e4d0eb06cd6b", "object_relation": "sha256", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989111, "uuid": "69d870d8-9487-4534-a1e0-5b84adccccb0", "comment": "Malware payload (ErbiumStealer)", "value": "cf60644a13f1b4f0659393e8f6b95631c3ea211f", "object_relation": "sha1", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989111, "uuid": "c14fedb0-9b20-414d-868d-cb54cf310b06", "comment": "Malware payload (ErbiumStealer)", "value": "ddf85c747afa1b4f91729c42d94a27599e65f76a6725675385485e0cafa6736fada9b1ab4d6866b845fd986f316bc635", "object_relation": "sha3-384", "Tag": [ { "name": "ErbiumStealer", "colour": "#E39137", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989111, "uuid": "07548eae-4ff8-43fd-a843-1bfc36b23322", "value": "T13F02C701E742576AD9EA48F081354B8EE56D9B312B205AF7B0FE6C5DCFA47D07828623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989111, "uuid": "df7a7dff-e40a-4b20-800d-1cfb48fcf1ff", "value": "e2cf7e9b7ea276e49dd6f9224087577b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989111, "uuid": "a861f4a6-b861-4013-9394-b6929ce43fb9", "value": "96:3m2unjKp7Y5DkYoCYNiESNfWNsn8WEmO8qQuD1oCbyRTq8QNTtFS32hWN3QU:3Kup7iDkYDxNeNejEmO8q7xlbuTX653", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989111, "uuid": "34b12c6d-9c33-4f79-a15b-049007369411", "value": 8432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989111, "uuid": "0e6dab77-f00a-43b6-a2b0-e2420c293832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989111, "uuid": "0888e0db-5167-419b-bc40-5c93e35fe721", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.34463.6718.14769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db319c97-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989186, "uuid": "bfe9113b-8412-4f24-800e-9d168d4918f5", "comment": "Malware payload", "value": "cb99b26ea21d0f5a62a090f8892e1294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989186, "uuid": "64233eeb-a0e6-4177-99d9-281d16fd6540", "comment": "Malware payload", "value": "ecdd53a4b66858bef4ff94dafe2b8d58924f786bc50e42cf01519295297ec45e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989186, "uuid": "da2195b0-39b0-4a4f-a1ef-5e0d27a57ac8", "comment": "Malware payload", "value": "3c11fd9db1be44daf9cb7b61250b42930332b3c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989186, "uuid": "8e821fae-e71f-468d-842b-4645d57c5741", "comment": "Malware payload", "value": "a07fe6e6ee9011480e65fa13eacd575000730489b48cf5bb7139abb7bbaac3039ddff627be383530f597bf205fa7da47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989186, "uuid": "91197998-0023-414e-ba24-2aa5e24833c6", "value": "T183D40157EC46EE98CC1761B739B3C0919A513EFAA2A428B752D9332B5C24C31507FA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989186, "uuid": "6ede0e80-309e-4e39-97f1-ceac9df870a1", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989186, "uuid": "0ea18b81-c807-4c4f-a2d2-44da321cec45", "value": "12288:kY4xmtdO8oREEvZ7hTE0XUmglm9INMXb2oyW+pppppppppUpppppppHLwskttttZ:zPjoeEh7xE0Xwm9INMLh5RsszIx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989186, "uuid": "e619298c-e305-4d76-8528-46ba1312cce9", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989186, "uuid": "c2777d19-5d5a-46ad-af23-94551d1eba2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989186, "uuid": "0966324b-b37c-451c-b5dc-c70e2e68680e", "value": "SecuriteInfo.com.Win32.Evo-gen.22398.802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db48c98-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748931342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931342, "uuid": "6d4eb552-83ea-4acd-a501-eb6092c21326", "comment": "Malware payload", "value": "a8b889bb9f0979aef6159a18a26c648c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931342, "uuid": "6b66b4b5-dbf5-4e6a-b2af-a1f39a33d193", "comment": "Malware payload", "value": "ed41a722387aca11acda11e7ce7aba7128f04aed8b5d498e8925ecc3a8b203f0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931342, "uuid": "8149ee92-7fdd-4003-b011-3b98000dbc79", "comment": "Malware payload", "value": "62f7ee8eb5458d4474673993f509822984ffbcf2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931342, "uuid": "7523fc43-d498-4088-97b4-67e45e1b1d39", "comment": "Malware payload", "value": "80884b948f6ca6d42b981f92f63aa15a5f8123c233275e0b544617de17c6af038f7242a1128984661e2126c833f1dd97", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931342, "uuid": "6ecb3664-02a7-43d2-86d0-a6c2714e96fb", "value": "T16BE24BA7FB6400470DAF26A5EE790F26C4A8CA61402A7C757DEC3B4B84076AC777C11E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931342, "uuid": "324ea758-1a9c-433c-a954-c2281302da6d", "value": "768:qIrq+RvEQ4F42SKZ8kjSCYFc5oaJvhWMBpgoA+1Yk1e3uUsDFnD9ZVL3:DvB4S2SKZwehJJ1gw1MOvVL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931342, "uuid": "9293d323-95a0-4d5e-a2a9-cea74177d11d", "value": 33904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931342, "uuid": "ec3c6a01-fea7-4118-a4c3-305864aca3a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931342, "uuid": "1e450d65-455a-4810-8497-9ebd6e3e64fe", "value": "PO HWN-O0074_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31538be8-40a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1748972150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972150, "uuid": "f8b0854b-1c0e-48e3-81cc-87ae6e3e5e24", "comment": "Malware payload (Rhadamanthys)", "value": "be04cdf1295e245a9f0fa66de0a753e1", "object_relation": "md5", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972150, "uuid": "60697b2b-615c-474b-ad11-76380e675ea8", "comment": "Malware payload (Rhadamanthys)", "value": "ed4e8061c7f06454786b3d7b9961ae42a51355213c2d10f7f7ed742a9dd5de96", "object_relation": "sha256", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972150, "uuid": "49ab978d-e891-47f7-9337-08f035688a90", "comment": "Malware payload (Rhadamanthys)", "value": "7c39118cc1cb59a7d77fe2474af05228070e09ec", "object_relation": "sha1", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748972150, "uuid": "c53931bf-3980-4d59-8ec2-78fe9b22d49d", "comment": "Malware payload (Rhadamanthys)", "value": "17f410f8559c0ff52739011782caa1628f2c629d709e10483394ca279e55d04dcb3f2fe6783e9064d0c55b21233aa700", "object_relation": "sha3-384", "Tag": [ { "name": "5-35-38-7", "colour": "#620C80", "exportable": true, "hide_tag": false }, { "name": "api-gameforlikaks-top", "colour": "#9CE4C5", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972150, "uuid": "eef20cd6-14f9-48e9-ad2b-1548309ec420", "value": "T16FE35D33B615C572E59D03B824A56BBBC37BAD68CF7042C7A3849E7A1A305D32F31916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972150, "uuid": "ccc0f999-61da-420c-93f6-02587ee72e7f", "value": "5526b43f221834dbe17a1672e3091184", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972150, "uuid": "fd7e0ce1-0c24-4c45-bc36-e930f2388012", "value": "3072:XhvV8BSVbhdIYAdfMtbzaSlqG/e9tRuF9yW5eKglxz:XhrVbhVAAzJR/OE9yWUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748972150, "uuid": "c1b4c52b-51de-4e12-afe5-63ffac039e7b", "value": 145256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748972150, "uuid": "c68dbddb-86fb-4164-8ccc-8a53bb9fb400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748972150, "uuid": "0ce923a9-bc58-4606-9375-6e282b282b47", "value": "tier0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf3c21d-4089-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748962186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962186, "uuid": "02fa3372-0af6-42ac-ba5e-6fe74522295b", "comment": "Malware payload (Mirai)", "value": "d883f0d8a7e99176fdf2cc120c7c8445", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962186, "uuid": "6735577e-353b-4753-a267-5795078911c8", "comment": "Malware payload (Mirai)", "value": "ee6850a49dbe40a1758a2406edc2024c27767a5b9ad012f461b1aae3694050b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962186, "uuid": "374e922f-3de9-4608-b067-e5d3efecd0a2", "comment": "Malware payload (Mirai)", "value": "4e9d0a81150a7e5a457cf7f36267c1d8ddf63348", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748962186, "uuid": "ae2b2358-2162-4d40-aae1-e5da3ac1adc2", "comment": "Malware payload (Mirai)", "value": "7189ebc587f9d9c4f42f5284169032979199d7fbf0f80cde1550a809994a60c264775f5c1b6ac3c380fbc2466be6a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962186, "uuid": "2e1deaf7-bbf2-4f2e-8d33-5f993b0f87b2", "value": "T1DBE32A46E7818B13C0D61779BADF424533239B9493EB73069928AFF43F8279E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962186, "uuid": "1546f845-fd71-4edd-8992-ea456649234e", "value": "3072:5DdWFal/9Ji/bMG/sgeXOjNz5rXqetaGM/9EdGmC:5D8Fal/9Ji/bz/S+BzZXqetrM/9EomC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748962186, "uuid": "d28c23c8-0f0c-4e1a-8e76-9f1262018abc", "value": 155275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748962186, "uuid": "701e4baf-4413-47e1-9c3c-6f58892941f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748962186, "uuid": "52a8962d-b175-45b2-9843-b208ce0ed8c3", "value": "neon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af09a34-4042-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1748931338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931338, "uuid": "967f6f95-e944-4a94-93e8-c3602ea583f1", "comment": "Malware payload (AurotunStealer)", "value": "7552277a91bd299790ddd653248ec37c", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931338, "uuid": "5cec3617-c20b-4e07-a25e-04d771d43ffa", "comment": "Malware payload (AurotunStealer)", "value": "eec8cf0669627b21b8eecc78c6c9a096a9c8c3744bc2b8c8e779aebd791564b2", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931338, "uuid": "3404db88-f36a-4ad4-bc2a-a862436b1950", "comment": "Malware payload (AurotunStealer)", "value": "b4313767bcb9b0475c2efb2e1aa2b7d01e2bc3d1", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931338, "uuid": "662433d7-2725-4826-970f-f1d0aeda2bb4", "comment": "Malware payload (AurotunStealer)", "value": "409c8d8da2df3fe1acb0dfc482a2de644e5ca909a1aa461701bca0506180f6a8ce4d59764d3595755d932799d5a6c571", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931338, "uuid": "580a6cbe-ff7f-461a-9e95-cf207898cdb2", "value": "T1A8F6BF6AF2B800D9D47BC178C9A69617E772741813F057DB26A456E92F23BE03E3B740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931338, "uuid": "6ac2cba7-6173-4f44-b8a4-dce6e3c94e19", "value": "89d69ee60e55dee42074de52767a98bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931338, "uuid": "f39752b9-507e-4e00-b3be-66d8747f1d10", "value": "393216:vRYyuEzCdkhomtsE+XywYS7Xp+ZnZ9osWOyQ:jzZnZ9iOyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931338, "uuid": "5243d01d-3ccd-41df-a677-9973a97fa8fb", "value": 15794328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931338, "uuid": "8a9d7d71-44cb-4e78-8b4f-907bcad4d7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931338, "uuid": "0765a8a9-ca3e-4980-b6b6-948344fb9fe5", "value": "7552277a91bd299790ddd653248ec37c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504a2b39-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Neshta)", "timestamp": 1748934836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934836, "uuid": "e338aaec-a70a-47e0-afad-86b0962539ff", "comment": "Malware payload (Neshta)", "value": "e7e7c42670ad5348e743a46a4a00ccae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934836, "uuid": "60cb13f2-c3cb-489d-a4b9-a9371ca9fc58", "comment": "Malware payload (Neshta)", "value": "ef7938f9f1141b2be79e456624f7d71db709e7da68ef9609e21f28631c427064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934836, "uuid": "997ca0cd-ad46-462e-8563-76ca360ad3d2", "comment": "Malware payload (Neshta)", "value": "4c4820331688c3f61f807086ab6e2c78857abe03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934836, "uuid": "7003e400-e519-45f3-a1a3-6681dc47feb8", "comment": "Malware payload (Neshta)", "value": "2699d20d4f36111b878ca6f76ada6c220ddb4421e4f80bffe57d2623ca0fc9d14bdefc9f4215a9c3e6213a46d403b8fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934836, "uuid": "20e97dab-dfe8-4649-be89-dc4a0ae76c7f", "value": "T166D45B34B59BC0E7C302673C4F1CE6651229A8665BB827CB33C52A5B0FE62A78717D17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934836, "uuid": "32b0b4a5-19f7-4d2c-93de-a5c0af095aa9", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934836, "uuid": "5c9b044b-ec1f-4210-a2a8-71f196c039d5", "value": "6144:9Apba6GivXon1NRQX2Hbq4NDoCqQGyrj2FZreHJgt:ap+YvwRQXSbqSxrw4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934836, "uuid": "5bbc4564-0126-4538-9a23-92a8dae35013", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934836, "uuid": "526ad4bb-170e-4c39-91da-a0043ce72f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934836, "uuid": "30b5e3b3-7b02-4d7d-bf4b-86b18393f4b4", "value": "ficmcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0524c3-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748973140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973140, "uuid": "96934bd5-1478-4dd8-aa63-a1d2607cc7ee", "comment": "Malware payload", "value": "fe4f994c81c3000d2845b3e3beca5eeb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973140, "uuid": "9664ef2e-9e3f-43f5-9718-1f0cd1ad35cd", "comment": "Malware payload", "value": "f07df5acc8b31d2bf87719b7bbebf8033fbc50ecc3ff27cbbe6965573612f094", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973140, "uuid": "902984e9-f935-4cc5-8663-21bccd1e8c77", "comment": "Malware payload", "value": "db89ef84b630e19b8b801b6395095fba2737ea18", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973140, "uuid": "d4e531d9-5448-49c5-9af3-f132509c7dad", "comment": "Malware payload", "value": "4197276e4a90edfbd5fb1ae5223baf95033072a09cf8b3be0b9ae2961bbecd16df2118bdd33ac24da8d3836dd5f04abb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973140, "uuid": "8c05e691-a277-4327-926c-c9480d1e1e9f", "value": "T1A7A612227786C136E2AD0173B93DEE6E143EBE63077100DB67E87D5E58748C1673AA12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973140, "uuid": "33b531f8-b60a-45a8-8a30-056e8075597a", "value": "196608:OxFMk37WUgTJXDcM9xZAooeASDLDbhI/UKRB13qb7IJEXavYeoXKWY:yMkqVNDPxWXePLJIMK8b7IUarWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973140, "uuid": "1fb4774b-06b0-4590-8604-a3454a18944c", "value": 10357248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973140, "uuid": "098a407c-e86d-4ec1-86fb-907a1b31af97", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973140, "uuid": "f59a69b1-e6e6-4c56-a0c7-a0459e08163d", "value": "pendencia_530797.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd3b1de-404a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748935127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935127, "uuid": "5f8c8f83-d14f-4457-954b-f4eb3a304b08", "comment": "Malware payload (Mirai)", "value": "19354c28fb3a745d13370da6b0537b6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935127, "uuid": "6dbbebb7-4aa7-4696-82c7-7add8692bffb", "comment": "Malware payload (Mirai)", "value": "f0ac878b2f2232bdf419121d739e0a8bbbe1c81128ed3b80e47da14cc75655d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935127, "uuid": "88c4e69a-a754-4f8e-aa43-82a605bda9cc", "comment": "Malware payload (Mirai)", "value": "246c8f80d40703cd8d769e2c296b1444139709a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748935127, "uuid": "690d9bd9-a518-40c5-b284-4e4c4f23971c", "comment": "Malware payload (Mirai)", "value": "5cd543d33cfabfbfffae20ac3e514982456c5fa6cb6704729b53c1140ae7a86531e30130c13f55beb53ec0393b833cf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935127, "uuid": "82ab99c1-e587-43ce-90dc-56945812ba69", "value": "T1DEE27C69AB0E11E2CAA471BD17522E3C8F5AC377CA36F347811BA5345E61B0DAC507CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935127, "uuid": "a71aeda8-8854-4a9b-95fa-51882a73313d", "value": "768:scniiRw1jVg5oEjoXarhtLjA13F1WLDsuLJ/Zjkc:ska15g5onijoNuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748935127, "uuid": "c563f4ba-a5dc-416e-833f-be732e6261a6", "value": 34132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748935127, "uuid": "dce993aa-fce2-438c-9e6d-614dd28153ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748935127, "uuid": "b4650bfe-0249-4896-9d8d-82ae833daca8", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b874fd77-4085-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748960351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960351, "uuid": "a5c63ba3-9034-4c0d-8081-11ce1b2e828f", "comment": "Malware payload (Mirai)", "value": "e651fe7777e0334fb0dc7895f4c3a6a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960351, "uuid": "c596f4ba-25bf-47ae-9c87-aaa8a7275586", "comment": "Malware payload (Mirai)", "value": "f0f487d02d0be32843624fbd9495a417d635b57fc73c82c64b18335e0e836ead", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960351, "uuid": "07a44642-43fe-401a-9bb0-dc5dfe097a5a", "comment": "Malware payload (Mirai)", "value": "9dd411840bd5a781c588fc9060eb186a2ec7d1a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960351, "uuid": "f3df8fef-40b6-4a22-9f3c-f309df515de5", "comment": "Malware payload (Mirai)", "value": "0cb4fc517f98a07e2f4ffbe4cf655718aaae08c674687a35017d34ff177399a1d894f847dd6afe9d77449c1386750f9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960351, "uuid": "f6bba869-2499-48ce-9f1b-6db35a8898cd", "value": "T12003F124654F7292C6740A37E05A81CF27C1C95236EF311829550485E8CFAEA9FFBEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960351, "uuid": "02d3028d-b13f-4d96-ab45-5273c49d053c", "value": "768:vfXHjOG4HjxASzxuh4w1FPzbYdGwjEZKJ00q0j21nQgL9q3UELZ3:vPn8jxtM2w1F/YdGww2qfQgqLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960351, "uuid": "1fbbddf4-6725-4630-b2fc-3b4a2a29b35f", "value": 38104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960351, "uuid": "aa11deb2-1320-4872-8362-c0193520e2eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960351, "uuid": "81276264-a432-49c0-b455-28827c81fa4e", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7ad862-40bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748983932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983932, "uuid": "a80a7767-6642-4081-806b-862c26d1b5d8", "comment": "Malware payload", "value": "4a752b42d5489c76442130f8f5f53feb", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983932, "uuid": "19745a17-0c80-4e6b-ba52-45d559583484", "comment": "Malware payload", "value": "f1112dde1ed872efba83c3360d8abbff7b2bced4e533d2cf4f0b29a6df341973", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983932, "uuid": "2247dccf-5c69-479e-b83e-9059f6fe4c06", "comment": "Malware payload", "value": "9e595a9565fc46f47ca4c55dadabe17330db168c", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748983932, "uuid": "6b0eea84-3ece-4ba6-8cca-6b1558f8a9a5", "comment": "Malware payload", "value": "e03c4ca40d73636380a277404c985f01ff31ad420b48c6d8388732b8cf2132ca1ea9da48dfd19e99a13498998a8667fa", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983932, "uuid": "c9e85508-d21f-4b47-9a0d-cf5a553dd5cd", "value": "T177247D19B3A108F6F5778179C8428646E6B1BC150B60DBDF03B4876A9F332E19D3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983932, "uuid": "b1ca5b4b-cbad-4ae3-8841-9207dfb94d2a", "value": "3fc991f988a3985171beda2a70477d05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983932, "uuid": "d7b87f88-6e88-43ba-9d93-beaabe73f2e5", "value": "3072:Wl8ACJ1hGdtyqCOLaL/IEwNyk2ancItY1DyHvomtUx4zp5lodkhg:o8VCtLCOo/6yW1tY4BUCrod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748983932, "uuid": "9f563b84-7c48-4f48-b025-ca8307b5ce5a", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748983932, "uuid": "8d2f537e-215a-4129-905c-5eceb1c54e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748983932, "uuid": "5d8faf8c-7fc9-43c4-8c78-f18a65c66fd3", "value": "\u767e\u5ea6\u4e91\u65e0\u9650\u52a0\u901f\u5668(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c343ee4-407a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748955499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955499, "uuid": "356df4fe-96d9-4c64-91dc-fa0af8ffdcdd", "comment": "Malware payload (Mirai)", "value": "3d2bd94271aca49d255816a824392c04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955499, "uuid": "b70f552f-e25e-4c7f-a06f-b14fb0908049", "comment": "Malware payload (Mirai)", "value": "f169f6a1c9e452091721a83f8ff7f76f267558948850b4698db1ce9ab73afc57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955499, "uuid": "299564a3-f0dc-4f85-9dfb-daba3d4e1071", "comment": "Malware payload (Mirai)", "value": "0fd777e77bff3180b6845ef8edb872dbb9ac1819", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748955499, "uuid": "472a0ef1-ab24-4a39-bc3c-0f87eb392f9b", "comment": "Malware payload (Mirai)", "value": "e6d7412931aeede27e9c8f72a49fee02671c01d0a3e5dbb6fa10446887b0ee92af7d6e8c4bb8fd7f7e08c28585109610", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955499, "uuid": "908b41e2-d3ca-4db2-ab2d-179abedd8339", "value": "T1586328827880AA26CBC0577BFA5F108E331457D8E1DAB3479C191FA076CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955499, "uuid": "e30d8d22-6292-4ffe-bd98-5ede22afdab2", "value": "1536:dRqCA7shu+z506mEu82prPw+70w4Y8jkMhW65g8Yn:dRqG0pjp70zY8jLr5k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748955499, "uuid": "8f4a0e4e-e0fd-444e-83ee-c534dfd93c1c", "value": 69452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748955499, "uuid": "4a4b6860-3dac-40b5-b7df-f8f3e50b0a03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748955499, "uuid": "a961c918-6173-4f44-b764-f7dbcbf4bd1a", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d714a581-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748932056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932056, "uuid": "8127c297-1998-4a01-bfc6-c62c2c1e89a3", "comment": "Malware payload", "value": "165885bb8dd30d3714845a503a8811f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932056, "uuid": "c7abe874-7ed7-4dfc-8a9b-c2e69d90fc24", "comment": "Malware payload", "value": "f18e071a0b5a70136bbc53e242da97aec76d0c2af833f77f8455407a8ae7fd6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932056, "uuid": "0aa350e9-1b61-4301-8083-272284145178", "comment": "Malware payload", "value": "f6f974589262196ced6ebec5b487ad2dd175e7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932056, "uuid": "aa2e1bf2-38ab-416a-a0b7-ac30da01a357", "comment": "Malware payload", "value": "1db2a989d6ac3b5405a01894095cb06cc8387b211646c95cb375372910675e55ba02a5bf2658033e04541bf85578c56b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932056, "uuid": "5ade340e-63bf-41a3-9185-d2674141c59e", "value": "T11A260A27DEA0640CF973153156F4A663413D6C3A681DC90FF781AE986870AC76EB633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932056, "uuid": "688926cb-50c0-4b53-801f-4c0fb8971365", "value": "6ef1f1e4b5a2cb3968fa7e14964b34af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932056, "uuid": "ab19545d-07bf-47de-8da1-4d443014ef55", "value": "98304:ycunIp3Wq80Oj0nD3z+ZCEBM7L0XPHnjPtim/EyW:ycunIp3Wq80Oj0nD3z+ZCEBM7L0XPHnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932056, "uuid": "1c0f765e-4254-4ef2-a562-44cfa3037a68", "value": 4796416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932056, "uuid": "f323fdc0-2d4f-4be4-a32d-0eb8d12fcefa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932056, "uuid": "c2719dad-f2da-4f91-b73e-3a3a1fadb06b", "value": "xsh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a148d8c-4060-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944382, "uuid": "2784f1f4-013a-46fd-8f95-76afbcf76973", "comment": "Malware payload", "value": "92c02f182191d96a2a20609a9e133f58", "object_relation": "md5", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944382, "uuid": "8a3e62f8-88a1-494e-9853-82cd1e45fcbd", "comment": "Malware payload", "value": "f2987305888db67bfa917fabd1d6c9c1f017553ed534758c14f4c2a3fd48b703", "object_relation": "sha256", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944382, "uuid": "484f7193-9e54-42db-89f1-6ab6b8cc9204", "comment": "Malware payload", "value": "716e89fa8879d13bac5504605909abdd844c84f4", "object_relation": "sha1", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944382, "uuid": "c5def2db-2b83-4eaf-9dd5-9837b91d9de7", "comment": "Malware payload", "value": "fd82a5182ba9d81422070ec5cb11858087b6cf2e468236a23383983f4e600639a49b732fb51aec9184b1c66ce89f7ccb", "object_relation": "sha3-384", "Tag": [ { "name": "45-141-87-249", "colour": "#86F3C5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LLC-Stroy-Klining", "colour": "#5C880F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944382, "uuid": "d8005df0-20c0-4b53-916a-ab15524d84d9", "value": "T1FFF69E42E28340E0D983417566B7B6378635DE1E031BA9D7D2E4FDA6A9312F13D3B18E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944382, "uuid": "4c861d1a-a758-4b45-a86d-4b29c5e602c8", "value": "026117c026e08c8bf3f41122bd7ceec3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944382, "uuid": "e4b955b3-fca8-4fdb-8470-1eae8fcabf94", "value": "393216:XtN1Tt2spDWk7I3EqJ+1KFdu9CwJsv6tPWPi:XtN1Tt23NES+rWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944382, "uuid": "2cf1e731-00f6-4c11-922f-d57182351c45", "value": 16486648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944382, "uuid": "19402b32-4564-4eb1-8cc8-e867f0750021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944382, "uuid": "561d1651-56d0-4e71-bf76-8e078f1afffb", "value": "f2987305888db67bfa917fabd1d6c9c1f017553ed534758c14f4c2a3fd48b703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766e232a-4052-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748938336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748938336, "uuid": "0a1ef2f5-57b2-4c08-8740-7fb72eb18cb0", "comment": "Malware payload (AsyncRAT)", "value": "207312f02ecf7a09aed7be94a46b82fd", "object_relation": "md5", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748938336, "uuid": "39093b01-490e-44e4-bfa4-4583be74aa87", "comment": "Malware payload (AsyncRAT)", "value": "f2af47c9a9d66a58541d4b0f87dbbb3ec14c98f222b798970762b0caae084e9d", "object_relation": "sha256", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748938336, "uuid": "d5bf2188-9a49-4726-ae1b-be1fc8791761", "comment": "Malware payload (AsyncRAT)", "value": "58d45be45628dd29cdd9d64fd51ffdc7c5f84d6d", "object_relation": "sha1", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748938336, "uuid": "dddbfe04-372f-403d-88de-8f2deeb1ef6c", "comment": "Malware payload (AsyncRAT)", "value": "6b816aa0ab3bbdf7eedad86d0a37179fdfc1f2e51896f28be5d8e5576f310bfb07143227c4f6015631031cfa8d66931d", "object_relation": "sha3-384", "Tag": [ { "name": "3osch20-duckdns-org", "colour": "#AF138E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748938336, "uuid": "6850e220-8e41-4d42-9770-6c4485973b87", "value": "T14C211E11780893326AB2B6BF6D23BC0C64D3104DE04CA948A09ADDB905D432CC7BA8FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748938336, "uuid": "32d7e275-43ae-40b4-abc1-df3ca894b2eb", "value": "24:+RyGb3ZtO915X1Qdw9tB6C2xqXwGm2Q1kf7L0R/1ZIDFZI1nTV+m6f7L0RAV:u7bnm15X1QyQ7Gm2QmffWIWJ6ffvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748938336, "uuid": "54588217-edc9-4ab5-9584-b5383ecb81d0", "value": 1139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748938336, "uuid": "682c2fca-93a4-4981-bbc2-eb04673683ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748938336, "uuid": "cce041a3-9125-4fce-bc77-c7ac260926d9", "value": "MicrosoftUpdate.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271d50e9-405e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943357, "uuid": "2296ea0a-3ed0-4b71-825c-1888053ccc67", "comment": "Malware payload", "value": "db2e88a11a5eda75ee82bccfbfc5af6b", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943357, "uuid": "7f089067-f05d-47ce-ba48-34f8d70434a7", "comment": "Malware payload", "value": "f345495a3fad96aaab1d282236e50d1caa538c665b4f40ad6f7756424629dd1f", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943357, "uuid": "9746521c-3cc6-4099-9274-cc5abf11585e", "comment": "Malware payload", "value": "f2b018fff5072f4be0c32d607446ebd2ac1f6716", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943357, "uuid": "54b35939-62c7-416b-bcb0-2ceecc54958f", "comment": "Malware payload", "value": "d39e6352ff7c894ff28d019a7aa8a9bd1a4fa17d9ce18327f2c261963e5759a12493d8eaeb4406074e38b919bd0ee89c", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943357, "uuid": "618d1b1c-dbfd-4eb5-9f58-dec484696fac", "value": "T1F8216722AD07D7A4C33102F1C956587CE741A10B2799961DB284C86F1C1172D87E14FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943357, "uuid": "b6025cff-1868-4254-9894-fd1ad8e69d2a", "value": "24:ppZAVrrhJA1+iRCFdSP/Kl4LwQJyGAJi/6ke/Ig4MCO:zZ4J8ods/E4sQJL/FmCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943357, "uuid": "c4c173e5-b0b3-43b3-8e61-e8e86ec64427", "value": 1187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943357, "uuid": "95629769-0469-45a1-a93b-e1307046f5af", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943357, "uuid": "46651fae-bf98-4cf2-ad6e-94e84965dbba", "value": "f345495a3fad96aaab1d282236e50d1caa538c665b4f40ad6f7756424629dd1f.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6386893f-407c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748956343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956343, "uuid": "0ab7a5d0-95c2-49e9-a81c-21d39eb67248", "comment": "Malware payload", "value": "65b6981cf0b27abf0fd56c2f753c0f9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956343, "uuid": "79ee43be-a704-41bc-a8d9-aa1c46b06feb", "comment": "Malware payload", "value": "f3ac563adb48227e816c52bc97a04804669ffc05a817363abc18c1835a1a1f03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956343, "uuid": "413eb7f5-1ba0-4bda-ac31-48b9fecc2fb0", "comment": "Malware payload", "value": "1df7221dcd4d66eb019f3ce18d4ccf898d2dbf06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956343, "uuid": "26a59bad-2667-483d-a038-bb1232da9cd5", "comment": "Malware payload", "value": "0cf09a53bad8477413b55a8cb3ffa65aaa1f3c86fd98966daaeb8a0c9f7ac8c248c5b3636d40a5e12e3f1a8c9f4d65b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956343, "uuid": "963e40b2-4cd0-4b4f-81df-0ea02f7ec4f4", "value": "T1E5A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956343, "uuid": "00f83e89-d1dd-4f09-ad0c-5919131d554a", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956343, "uuid": "fb453eef-cbe9-49db-823b-404efb4cec76", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956343, "uuid": "1a2c5291-fcea-4f49-a791-e9e117eede85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956343, "uuid": "2807a020-4904-4186-a777-3158aa4ae6c2", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae2e0a4-4046-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748933351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933351, "uuid": "55877d93-7e72-49c1-af3b-08f9cf497c5e", "comment": "Malware payload (Mirai)", "value": "ab1d43bbe5d7369e70e3cb471f47d8ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933351, "uuid": "de3c6326-e2af-4ec8-ade1-a7a6ee4d8031", "comment": "Malware payload (Mirai)", "value": "f447882d68428ce275bab401f739657cc0cbf851f5f8a63103c09c949c0c890e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933351, "uuid": "0f5c09ec-c122-4f05-83d8-ad17c23b64b9", "comment": "Malware payload (Mirai)", "value": "c8a9e3c3cb9fdf305af951906f4afd2483c9e095", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748933351, "uuid": "7fec4f52-c690-4fc7-91a1-05fcd4c87b52", "comment": "Malware payload (Mirai)", "value": "0efe921165ebdfbf552381a26a3bcd6b5241cec25bc4bd69c9fa2aed43cf0dbc5a51a5fc821a351ece7f25d4788c9fb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933351, "uuid": "9907b6a3-1809-4771-b2a4-4711115e6f63", "value": "T1B053944A2A318FAEF76E82B943B75F30565877951AE1C684D27CFC410F6038D241FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933351, "uuid": "e67942d4-15bb-4b2a-9f90-9a0d24d4b7b0", "value": "1536:l5t/WlpPm2m+UdFVq+2qamAymQm4wrkZehEPkugQ+tdi:l5AaTq+2qamAymQm4o0QEPkuv+/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748933351, "uuid": "51025b21-bfc6-43d2-aefe-7bd6d373bb04", "value": 66132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748933351, "uuid": "00cfce4f-0aec-4c4c-9b76-0d878dbca914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748933351, "uuid": "46611647-c1db-418c-95f6-9ad0ea657499", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e09c98-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989169, "uuid": "51e5d4bf-b50e-4dd2-94d1-5254254e97cd", "comment": "Malware payload (RustyStealer)", "value": "8219cf8ff9c277b9eab141477e9df14a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989169, "uuid": "b1841c67-5796-4e16-94f2-925481dd6055", "comment": "Malware payload (RustyStealer)", "value": "f4ddddf321a14fd999abb12a63998124e5869b78c4ffc3c30cc80ca1824915d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989169, "uuid": "7e9ccc43-ce5e-4fc8-9e7e-b3fbba26e828", "comment": "Malware payload (RustyStealer)", "value": "f66e6cc6af6abd92b9b1dfb4069d2adc951cb764", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989169, "uuid": "813faa84-39a8-4c2e-b183-dcf30db9b08b", "comment": "Malware payload (RustyStealer)", "value": "c88da297363e85a1340c78bb8b3176630d6054b60b6c6d2843a5a9e4260e47d497e17075530f152272b8cbd304c9a571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989169, "uuid": "b6306534-7af2-4443-b4d2-10f69321faac", "value": "T12CC46B0EF2719199C17E0D756C7E536093765A269F435FBB0BD823A00AB25B27F3A438", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989169, "uuid": "beaebb14-f5b8-4e0e-83c8-ce368d62c5ad", "value": "d4b05170ea1a9a5c6b21bc3ea6061fea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989169, "uuid": "2567e5e5-6b41-4b8d-a5f6-a4b23fa87102", "value": "12288:DekeUwp3qjwYEYX/nL+CHXC+C9n97bGtD6zw:DeptIbX/JX94976p6zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989169, "uuid": "5a7c70af-a9e3-46ea-ac43-0d86157c7e51", "value": 582584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989169, "uuid": "54f83984-d7cb-45a8-9566-b62dc1a9c33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989169, "uuid": "a0f59b9a-c5f9-45df-afc9-4757f06c03a6", "value": "SecuriteInfo.com.Win32.MalwareX-gen.697.14221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c74753-409e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748971054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971054, "uuid": "d8721909-a757-493f-a93e-42d9b1949bd0", "comment": "Malware payload (LummaStealer)", "value": "ca4126dedbd91f9afb198ec096cc6257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971054, "uuid": "fe97734b-369d-4a36-a12a-bd9ddea182ac", "comment": "Malware payload (LummaStealer)", "value": "f4efc06f002b8890f5b5ad74a041a49373797d0aa565576695447128d418e489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971054, "uuid": "333632f5-5bff-4995-a142-ca7df131fa7a", "comment": "Malware payload (LummaStealer)", "value": "c1c147dd231f6688e90dc12a3e9af65518963fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748971054, "uuid": "2eed2307-87b2-4eac-81e0-2219bd3b9a33", "comment": "Malware payload (LummaStealer)", "value": "4b9af820f3fef81cdb8cbc3e37f90d869f1fca8617c1119e1c01319786228f998baebefd342f70cb1cb721c6bb92204b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971054, "uuid": "e4fb2944-aa46-49f3-95c0-a5db46680bc3", "value": "T1CFD7CF75AB1013E59F83599E4E07E7D5EE689110732124EFA28F068BDA438EC4373D6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971054, "uuid": "6db1f3d4-8d68-44c8-b50f-2daed01d2932", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971054, "uuid": "94ee7930-cb0a-409f-8b42-fece7bdfca9a", "value": "786432:wajURRCNNidbfmBjURRCNNidbfm6jURRCNNidbfmK:xjURgQkjURgQzjURgQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748971054, "uuid": "647743e0-6512-4947-a2b7-745634400dbf", "value": 61561582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748971054, "uuid": "88b40919-07c7-4f09-b2f4-198687e87bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748971054, "uuid": "d1cf912c-9eee-4e5d-9adc-80347048874a", "value": "\ud835\udc12\ud835\udc1e\ud835\udc2d\ud835\udc2e\ud835\udc29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d921e71b-403e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748929912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929912, "uuid": "61f96b87-17ce-4721-8f92-1c83cfefb3d4", "comment": "Malware payload (Mirai)", "value": "2296705f00a9adec8daf284a999ab2d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929912, "uuid": "31fb13ec-25c6-4593-9980-a53c0f2c4090", "comment": "Malware payload (Mirai)", "value": "f535f2c3a24b90531b18132dd28ce783137b498dd4c4a448a0bfe0e42d926ae4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929912, "uuid": "0b70189a-ade5-4a3a-b041-77483581732f", "comment": "Malware payload (Mirai)", "value": "8ea0a16a9254e87c043871144f8b7b6f9d0bd5a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929912, "uuid": "83956f60-563e-4793-bfa2-51088b78c79a", "comment": "Malware payload (Mirai)", "value": "46ff12a9b0995a1683a40bd3f05786536dc979a957d0818b34e6c523b448134401841ba2fc3e4469ae61cf1b83237613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929912, "uuid": "b103c8c5-b9e1-481d-bcbf-dbbf41437217", "value": "T1F4E2E114DB4D2EB1DFE52C783B11CB543BBE4B5C27A2CC93548AFE520A10D46B61AED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929912, "uuid": "1d060b70-2872-4d76-817c-6914541bc36b", "value": "768:9X7WOGJkPgDXrN0t3TCA3utdvWpuw9lNMOKHl4uVcqgw09T:9X6OGhXrN0tD93JIwzuOKHl4u+qgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929912, "uuid": "4a97481d-0a0e-4d17-8a57-94b2f99a2a2d", "value": 32424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929912, "uuid": "53ab6143-9e23-4dd4-951a-7127df1e717c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929912, "uuid": "903afe01-0ae5-4cf2-ac53-ed5c3757bbdc", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c870b88-4049-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ResolverRAT)", "timestamp": 1748934374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934374, "uuid": "d4ce971c-7d99-4419-a406-b2fe68817ab3", "comment": "Malware payload (ResolverRAT)", "value": "e10e2e1d307718595c48b90cd2c36226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934374, "uuid": "9305c5b0-2141-43ba-91c0-d5db3fdb1a20", "comment": "Malware payload (ResolverRAT)", "value": "f54f35b12e7bd0ead04ac2ccc31e62055ea8e803112eba3732b3dc9573fd9526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934374, "uuid": "4334d7d0-05dd-40e3-924a-479cd59d766b", "comment": "Malware payload (ResolverRAT)", "value": "3b8ced52d0cec88f784dfc0d8057e42c9aa6e4aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934374, "uuid": "581ea5fb-bf6b-4441-99a0-d525c9111b66", "comment": "Malware payload (ResolverRAT)", "value": "36859c75214e0ce301ddc3707b7d43e1760e4c2f56a221251831169a3eb80463bc6a48e8a9b3f2f12ac4b59aa3bc3158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934374, "uuid": "e7b02f23-b506-4fe2-a593-5536f9305c6e", "value": "T109D45C34B597C0E7C302673C4F1CE6651229E86657B427CB33C52A6B0FE62A78B1791B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934374, "uuid": "b906aa4b-0ec5-455d-a32a-368e3c3fad78", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934374, "uuid": "497a9e01-e8d4-4e91-acc7-4d3602f32988", "value": "6144:m4heg6np88RcGTxIXCqDNcouZZG82Fw9c/btFH:JegZnGTxoCqMHuvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934374, "uuid": "56a40fd2-e6af-4942-9850-48b38fccda8d", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934374, "uuid": "9bb8af66-5183-42a3-90bc-5f14782c4242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934374, "uuid": "546b7c78-2260-4c43-998e-4f92c7b6e53e", "value": "allexicccccc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ccf50b-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RustyStealer)", "timestamp": 1748989173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989173, "uuid": "ad495a30-8fca-4c3c-a5d4-1cadcb36a4ee", "comment": "Malware payload (RustyStealer)", "value": "659141870fc8b228cca7ca5509bcef3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989173, "uuid": "73ae2449-7f35-404d-aeea-93ef353dd6f9", "comment": "Malware payload (RustyStealer)", "value": "f5f1e34ad7a3e3931c6d6e59af300df4d31f0c052c399a7f1c8c5179b0964961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989173, "uuid": "0a63d886-eac4-4573-b3f8-117df9748474", "comment": "Malware payload (RustyStealer)", "value": "0366c6e0a67401041bd2e94bc516f74c5ba06068", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989173, "uuid": "2a26317a-02c0-4aec-9406-763b7a66b1bf", "comment": "Malware payload (RustyStealer)", "value": "8003a80ed95b4116455cae32c96cca05ffdcb849bd27b91fed56bbca8875f9d002d966133869a18accb55b982e8c4231", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989173, "uuid": "7ee1f4a6-cde9-41ac-8639-ce6cb280ad29", "value": "T120C45A0EF6B19098C57E0D362C7E536083765A269F435FBB4BD8366017B24A27F3A538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989173, "uuid": "57757482-359b-4966-9b9c-1c6799bbe762", "value": "d4b05170ea1a9a5c6b21bc3ea6061fea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989173, "uuid": "32d538f0-6c90-4b17-ab36-95dfe2231613", "value": "6144:lBQgbEeKe1H9NIuZ2mK9K+TUakhvP4VGqeRnfElydhSKQ6JuWxBB2qzH6T/qc:lkeHFNKZYpX7fcydhGsuWQqzH63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989173, "uuid": "b7a2b194-99c4-47dc-9ee7-5a01950cfb77", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989173, "uuid": "e5b1a4d4-d416-41ae-8418-62ef9804ebf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989173, "uuid": "89e68a40-e737-4193-a1b2-e85248451ada", "value": "SecuriteInfo.com.Win32.MalwareX-gen.32553.27357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8019cc0d-4048-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Vidar)", "timestamp": 1748934057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934057, "uuid": "77d18c6a-b895-478a-9ef8-feb9ccd85bb7", "comment": "Malware payload (Vidar)", "value": "ad66535be85a2eae555ac8d62428bdf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934057, "uuid": "05d82010-e6e7-4c04-bfe4-0b8fde039e6b", "comment": "Malware payload (Vidar)", "value": "f6695efea9ed968a8738b662e539b7719f11c9f36f6af68318222412f762bfe9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934057, "uuid": "ea460cda-1230-4bdd-ab50-6a49b5e9549e", "comment": "Malware payload (Vidar)", "value": "f4fbdceda49a1c2f05f780807c0096528af16a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748934057, "uuid": "478641c8-f936-447d-a835-18b42981605e", "comment": "Malware payload (Vidar)", "value": "c4b9df750c9684226edcc214ff643815261b7e237283423bafa193a2e3679fc5c72615e90c5d912c23ddda2dc73d1ffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-Fedmss", "colour": "#C6095B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934057, "uuid": "6b681b76-f373-4376-9502-7fcc0f3d3dcd", "value": "T125D45B34B497C0E7C302673C4F2CE6652229E8565BB427CB33D52A9A0FE62E39717917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934057, "uuid": "c836c317-235d-4299-b037-46a95ea2f198", "value": "b39df28435fc156e78d10e9e37e55e62", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934057, "uuid": "48d22c3b-489c-4aaf-82d6-fed44f98a777", "value": "6144:/gXX1RpvS6CKtPuHA1YBaB9YUt6oLaO2sx2Obf+tveE8kQ:A1q6CKtPT1YBc9YiBxj6NdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748934057, "uuid": "a1bd46fc-ec6a-4a47-ac20-2b75fa6ab640", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748934057, "uuid": "a947c995-3197-425f-8832-0637ab4ad17e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748934057, "uuid": "05b0b0b7-8569-49d4-a844-2fd7ebb880cb", "value": "FILSXC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b009dad5-407b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956042, "uuid": "8f408b8b-17b0-48e6-b74d-7944f3e455ec", "comment": "Malware payload (Mirai)", "value": "30cf85e3eecab45a9c1c684b2faf85bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956042, "uuid": "389bfb88-f13c-47f6-8646-761eca348331", "comment": "Malware payload (Mirai)", "value": "f6fdde80e82e18c4476e6856609089251d0a6b93ec17ee4219f9bf46779106fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956042, "uuid": "87b487ce-2dc2-465b-a7af-37e32b609630", "comment": "Malware payload (Mirai)", "value": "6cb682abef21b2bde1e6ef17dee8324caf4a69e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956042, "uuid": "e71dccd7-50ac-495d-8721-79b5c0cd0036", "comment": "Malware payload (Mirai)", "value": "ece727a47a69a8473d793a30d67af7b4ff0228ad9cda5c15b24c7255b9afabd56bfbd2fed745f9a93f22678326cad02d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956042, "uuid": "f9ffb25a-b434-43bf-b2b6-a153e38fc224", "value": "T155E2F155E1668D07F9A2E6B18E53A3D3BFF61E3CF162CFC192449805A897E1A28017D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956042, "uuid": "3d520474-f1da-4193-916f-2062123a0437", "value": "768:ZgV6XbbEyMcZYS9HSD+PWD+W+iyt34uVcqgw090:aGbENc+S9Ta+W+iyx4u+qgw090", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956042, "uuid": "3475c4ba-1e13-469a-a293-2da6cd208aff", "value": 33908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956042, "uuid": "015dbff5-dc9b-4060-bdc8-2f6fddc37037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956042, "uuid": "05211911-3e8d-44ef-8483-50c174dbffa5", "value": "neon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21012dd-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748960877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960877, "uuid": "53a977a4-7cb9-4cb1-9045-3a892a0ee074", "comment": "Malware payload (Prometei)", "value": "6191225731e036bf97abcf70788aecd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960877, "uuid": "2d09422f-a12c-4971-9e53-5f85f659ecb3", "comment": "Malware payload (Prometei)", "value": "f7279bd72ab6fefd624f8de83cb30d3f89da9cbb4349c9dc6766be98d2572db3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960877, "uuid": "0967c2b1-8b46-40a9-99de-3b63acf17c72", "comment": "Malware payload (Prometei)", "value": "b8f596f77ede31f2ed9c22392f60ea988d750ea7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960877, "uuid": "3e761d59-fd89-4565-bddc-b6ef24e8eccb", "comment": "Malware payload (Prometei)", "value": "3849de12a2cf1cef52a09db8365c3540533066594e5ea18b36919e80c3eb2a09d69f97de39beef2250068a182ce3708f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960877, "uuid": "2fba13be-3b1c-460e-acc4-f6c165b59e98", "value": "T1419423F8C83D2E3098169B3CBB5A8268F0A15772D9562F6EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960877, "uuid": "1c5cf98d-3a3d-4555-a5a5-7fdc2311025d", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgP:25WOSACZSV6eKRH5EPiamb4DsDwwc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960877, "uuid": "622e5b52-7212-47b3-a51e-cb9c6f8a6e71", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960877, "uuid": "0706f15b-3606-41e0-ad18-c3b589ccfcf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960877, "uuid": "c77e47e6-d78e-4185-b283-3785f8cba64e", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76890e9-4085-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748960376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960376, "uuid": "17140014-d3d7-46d2-9a4d-007efffa96b5", "comment": "Malware payload (Mirai)", "value": "d009ec601703d59d7421ccc6ea52b1c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960376, "uuid": "e3230f7e-1763-407d-87e0-820f79482480", "comment": "Malware payload (Mirai)", "value": "f7611cb6dba3f4b473b6b2ca46fcafab16e4bb24ad9094871e2c3949771bd505", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960376, "uuid": "aaafec43-35cf-4f39-8fc9-830c85193775", "comment": "Malware payload (Mirai)", "value": "24458b1ef985ad5fe34d843666537a02701e419b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960376, "uuid": "cac27e9d-b0b8-442c-a012-52674639d14a", "comment": "Malware payload (Mirai)", "value": "85cde372617e90efb69189d89130de65dc9b9600ed14fb0440e7b32ebbaaf4747f95b7b62ed0c8cbe364d07cf0992ee0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960376, "uuid": "64dbcab7-6232-49e5-a201-78beb1ab3773", "value": "T12683195AF9819B15D5D202BEFE1E118E331317A8E3DEB2129E249F30678752B0D7BC15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960376, "uuid": "3b4a1759-6235-4b15-96ea-a3d5dd7d1015", "value": "1536:ZgnRw543jBdzTTnSzjZU/3SxalSZgQ0MCiYJAA2a172G5PYY:kVOi3SxalPJAA2a1iGtb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960376, "uuid": "2becbcca-7615-4844-bbf8-af1e23acde35", "value": 83388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960376, "uuid": "bed941b1-c6a5-44df-a91e-0d38ff089ae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960376, "uuid": "3d973366-14d7-4169-8df7-e3cffb160a65", "value": "neon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307a5ab4-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748944661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944661, "uuid": "13a8b4f2-ec6d-44b0-99fb-bebcab540dd9", "comment": "Malware payload", "value": "03344f27616a004542d8c8b36f782946", "object_relation": "md5", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944661, "uuid": "b51e3e22-69ac-419b-9605-cc6132b52f67", "comment": "Malware payload", "value": "f76202e902fb0526e7ea687a591bc78a63eb97f771abd4cb902c0e8cb6d3bb03", "object_relation": "sha256", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944661, "uuid": "a0f77556-ea50-467b-8f20-258919cc387c", "comment": "Malware payload", "value": "7eb40d36517860e3301c6806284564f765a881c0", "object_relation": "sha1", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944661, "uuid": "0df96def-7ac7-405f-91c1-af82a3f2e6d7", "comment": "Malware payload", "value": "a32e0288cc1ee23e300507bab796f12a889dff535f65b6f5469cc75e83846fcc2cfd9bdd583dda88fba7b531869a910c", "object_relation": "sha3-384", "Tag": [ { "name": "dat-decoded", "colour": "#9708BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944661, "uuid": "1064d6de-e27e-4997-a251-359f44db5df6", "value": "T168C423DE6E3CA1B0C780833D148768430FBF97DFC515C391A5E91897E9B3626EA36168", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944661, "uuid": "cd49ce6c-05c9-41cf-8488-d7088c633e89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944661, "uuid": "cb1a3afc-4363-432a-89ea-ad7da746b04e", "value": "12288:tr9u41mtJu3Wr1GI71XIxbvOlkkIi6e/2yfQ4qQgapoliMJ8jk:tr9uXsW5HB4vSIieoqQgapoliMJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944661, "uuid": "01f1af54-f7bf-43f3-825d-e135a1c20d04", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944661, "uuid": "a8e51c16-a1d5-4b0d-94a1-2efe9b1687c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944661, "uuid": "31b2acd6-d142-4f5d-8695-6882958e972e", "value": "17489314844a8b101181ac1b0e69630af6acffbeb6750de22c338c2e28e704a9f7946ba500312.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b7a657-40a5-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Prometei)", "timestamp": 1748973960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973960, "uuid": "0beaafc3-8766-4ff3-b725-db33e48e65b0", "comment": "Malware payload (Prometei)", "value": "180abb9ec9f437c9bafe8f3a99d846c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973960, "uuid": "c501c466-d330-4e48-9d24-f147ccc7ddab", "comment": "Malware payload (Prometei)", "value": "f78a0f44cca7f34363212fd84530481c451135e20a604db0f41ef1b7c4e3a146", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973960, "uuid": "bc552b88-0de7-4208-80a8-643643eee485", "comment": "Malware payload (Prometei)", "value": "c501426544dc0a7fa3a2017189af057c7ec61f28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973960, "uuid": "a63b6628-1bb4-476d-a652-e4ba5e507f37", "comment": "Malware payload (Prometei)", "value": "e6a0c52c08072c86da63a7d44f6d7817eaeecda7bf7cecbfe579b13862471000ffa526035b5ea3a462fa283d012d7d63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973960, "uuid": "3b6ec9b2-95d4-4fd5-8f72-921166bfc1ce", "value": "T1F99423F8C83D2E3098169B3CBB5A826CF0A15772D9562F7EB51AE5732179F1FAC60101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973960, "uuid": "d6f67ad8-424e-41ab-811d-a618237eb7f2", "value": "6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgW:25WOSACZSV6eKRH5EPiamb4DsDwwcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973960, "uuid": "2fd07723-2464-41d0-9b64-c71f67168bc0", "value": 435932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973960, "uuid": "ecfe71db-8da0-4a50-b9ee-ca0b34002ccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973960, "uuid": "de0052f3-c31e-46a1-95fc-8778ca31ccf0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb97e84c-40c8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748989160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989160, "uuid": "b6019582-c29d-4cbd-b818-d30b0b0cc9e6", "comment": "Malware payload", "value": "6c704a7f56208368acc4307197e6b8e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989160, "uuid": "dfa87811-9a76-4e5c-8afe-ffdfec40d31f", "comment": "Malware payload", "value": "f817ba3189e592c81e613607937407b914797b76f289989912dc214103516a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989160, "uuid": "d891b498-de98-471f-afa8-ede1a325b1cc", "comment": "Malware payload", "value": "147211e6dc79ca28dda9046cd6540bef14d3a350", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748989160, "uuid": "ae1b5230-fb82-4330-b4ea-47198a6c76b0", "comment": "Malware payload", "value": "271783d61f162900ae8844f2b9084eba59424b0eebe3402dfb162fc12dc6d015a476d3b3121869ff9f212afaa243f770", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989160, "uuid": "e8a28001-ce6c-48a9-bfe6-d0bc0dfd4447", "value": "T18CD55A769F719DC2C78B52B29CA65D8C1EEA0732404A62CCC1B746814E5B7F6DE4E83C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989160, "uuid": "a5330ce4-6f36-4b2e-8dde-a854a22d52c1", "value": "8a6199944cd758fdf4ad2ca239f496e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989160, "uuid": "9b256abc-185f-4ece-93f9-a5c63f0e804b", "value": "24576:7F8dE9orBIXFUlsCNBqnnp/+usHmtTTKP6v8043WlbqWFdr4YJH8i1Dl9xZVsWk5:7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748989160, "uuid": "24d2523e-8eda-40bd-8921-37b54edce946", "value": 2814464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748989160, "uuid": "8c0fb8a1-a346-4619-9fcb-a5751a070b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748989160, "uuid": "4d129f50-6c0c-42ef-8c04-3ac600ce1dc1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.29294.6542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bdc27e-4043-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748932060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932060, "uuid": "3cc16db9-c12e-4e84-a309-dc521a1bc85c", "comment": "Malware payload", "value": "2f7565980d5268999a92a9123d8694bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932060, "uuid": "459c83a8-f88f-44ba-a7e6-5725edc9d7de", "comment": "Malware payload", "value": "f83b099a8f901168bca304a3b6a23e415cd2debab8b1d684191004b925d4ee25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932060, "uuid": "9dfb370b-8295-4536-a703-479d2e13312e", "comment": "Malware payload", "value": "646c4eb0fb2cc9592da78a28d04c131cca71f79b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748932060, "uuid": "22866db1-482b-4df7-8892-4b107336feec", "comment": "Malware payload", "value": "7e3e9c36cb1d7f11ba4c6d43aa39c2a10c11b1b46294faddc810be5705a2fd161c358ce90ef4f1ba6ca18fe3902ea566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932060, "uuid": "748f3467-bed9-4afb-946d-20e59ad50217", "value": "T1C026337B69151847CF0080F464C2CB12ED87830948CE5D931E8F66AB696337F67BEBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932060, "uuid": "14714a18-0c8a-4594-8abf-51308ef0c60f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932060, "uuid": "b9e3d46e-8669-4787-bb78-370c2bb9945a", "value": "98304:KSqdVPB1k0lHaDmsnGwDJKKEoRgxXs2Yfl0BQNj:kvPBWSaDXnGm0fYflxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748932060, "uuid": "2d56bb5e-ff62-4831-9c18-273d6dc8199a", "value": 4784640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748932060, "uuid": "8212bc0d-6095-4db2-94cc-d4082ee5e526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748932060, "uuid": "5d786995-9d84-4686-ab67-267b5a1692b7", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54745015-4061-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1748944722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944722, "uuid": "a65630bd-bb08-4ff5-9444-f20c8fce56c2", "comment": "Malware payload (RemcosRAT)", "value": "e21110da743032f76bff5b4e0562bde8", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944722, "uuid": "59a1caaa-144d-4378-9222-fc87c78a907e", "comment": "Malware payload (RemcosRAT)", "value": "f843cdcee44e6298aee3865d30fd491856a0ca2e26a463f81096b7dcf2c908a7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944722, "uuid": "d24f86c8-54dc-46e6-a6ac-13d74a685b8c", "comment": "Malware payload (RemcosRAT)", "value": "2a838bfd2d24098720f1f222c1a40b6953bf240e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748944722, "uuid": "fb3cef1c-2ba4-456c-911a-596847f6dc53", "comment": "Malware payload (RemcosRAT)", "value": "14e2eb4327771505e27646ed755ef74d3934f3c66ba199cae0bf717677a73f99185a95fa7a1cb80152afca7f46dd39d0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944722, "uuid": "5acd2f30-517a-4418-8147-7ac011861ace", "value": "T12E920549470775FD8686F9F82D51A3BDA1A42534CCF0C18A6A80B08806F99DE5BE5FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944722, "uuid": "b282e851-af6d-4534-8981-456fe8c75691", "value": "192:/sDIo5fBc4nDLHHeUtutQOjtRYPRVokRN3RdRA+K5RP7Rr2P/7RSS7R8V7Rh7R/b:m35fBcMDlUQ1jo6LPU9fg07XzWs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748944722, "uuid": "a0a328cb-c731-4ebd-af97-c567055e2945", "value": 20895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748944722, "uuid": "aea232b0-3309-4b51-b0da-773175417d62", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748944722, "uuid": "b5fbea98-7181-46d7-a99c-dda958105c83", "value": "kingsofthejungleislionsbutbeautiryofcreation.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa382e81-4085-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1748960462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960462, "uuid": "2170d2ed-bd4d-4501-84ea-1b48c4eb931d", "comment": "Malware payload (RedLineStealer)", "value": "a2ab3820c442b772eef79b68f92c4f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960462, "uuid": "7efe4745-1511-4932-af30-6a1924599b9f", "comment": "Malware payload (RedLineStealer)", "value": "f904ab44449fe254d89bfde5b03e3034c769539a161da18b11f34a7fb5b9d669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960462, "uuid": "6ee56a32-4175-4b08-877e-e2882221a3e3", "comment": "Malware payload (RedLineStealer)", "value": "fc668e8481ecc2fd96e3231cd7dc191430efa24f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960462, "uuid": "87f4308a-8f77-4fd6-93c6-c9aba6e2738d", "comment": "Malware payload (RedLineStealer)", "value": "cb17d83d16c2409ae424689c46178ec3352df63ba0110f0aa9c39e56a1ebe80ad2a3b891d2758d7d25038434a421e3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960462, "uuid": "25e31d88-a140-4474-b728-cd7f96eb1eb4", "value": "T1EC35CF2363DE8361C7B25273BA657741AEBF782506B1F46B2FD4093DE820122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960462, "uuid": "2b0777c7-d527-4c1a-9c37-7fc44b8349ae", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960462, "uuid": "7c9f39ba-e36c-4a36-a0fe-c7af71790881", "value": "24576:etb20pkaCqT5TBWgNQ7aG9K8OlM7Lv83v26A:LVg5tQ7aGxXQ+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960462, "uuid": "98a10a88-124f-4593-b860-e0f6765626ea", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960462, "uuid": "00a7cdc3-26b3-4b7c-871f-01bef713f187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960462, "uuid": "60e364de-dff6-4287-bee9-a26b1ac9ebdb", "value": "doc0030602506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c24e56-405e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748943350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943350, "uuid": "019b3770-8ea7-44c8-89d4-defab7c382b1", "comment": "Malware payload", "value": "148ac56002d565184a65b24f61fe9273", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943350, "uuid": "698e2752-d598-4c6f-9d53-2fa761b901ab", "comment": "Malware payload", "value": "f96ddc38a8b923ebecec5b6c1fadd18bc138e88b01bc9c20bf4ee11131fe889d", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943350, "uuid": "dde73867-d948-4e37-95b7-1ecda07c9321", "comment": "Malware payload", "value": "c9eebd89dbaab367a14908c7ee9317b6911bd3ee", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748943350, "uuid": "f9db2be5-db21-4822-9232-c784d22c75ad", "comment": "Malware payload", "value": "4bfbec337ca8acd1f2bd3698b6a76ae4c83a7c37f8d798180e7054e6ba759e206da053a1ca3f64402241d620ba2f5337", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot7834836576", "colour": "#AF4C2F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943350, "uuid": "18940371-cc21-4460-9007-61e0f9c175f0", "value": "T1ED16430F8702D535288A635B7FFE486233654EAB01E4E754B86E33E013E7A66D137663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943350, "uuid": "0a8c962c-0e1e-4b3b-8b2c-65148ef18ba7", "value": "768:hnHNZNZSKHVXd4uzr2c2pWkMWFWU2juFogAi7JER3x4dgJ3eW5BLBt6i0/ySMWkE:pts/6ttsDBd0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748943350, "uuid": "45149033-5818-4957-8502-f69cff82fd03", "value": 4320169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748943350, "uuid": "b2268201-d866-4c7c-ac4b-c00b8050c3b0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748943350, "uuid": "afab42ad-3be1-4900-8695-84b2d9bc88b5", "value": "f96ddc38a8b923ebecec5b6c1fadd18bc138e88b01bc9c20bf4ee11131fe889d.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3de8346-4086-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1748960827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960827, "uuid": "8fff2c4f-b0d1-48c2-a450-b9b3bd78d5c4", "comment": "Malware payload (MassLogger)", "value": "18c36d4d01b7f36e31e8b91cdcb72be9", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960827, "uuid": "c4274971-7f14-47e1-a044-80baadd52881", "comment": "Malware payload (MassLogger)", "value": "f986713ff94bda45de1cd7edfc20df66d718ce76fecaeebab1aa8d237761fcd9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960827, "uuid": "e03549c5-e3b1-4e0f-969c-861c5ca7aa6a", "comment": "Malware payload (MassLogger)", "value": "91249988eaca2bb97a59ae4cd1786d336b1b1e05", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960827, "uuid": "eabeccba-f7e2-4743-adec-953b23810590", "comment": "Malware payload (MassLogger)", "value": "122d0bde33a0b96af38b05cc262cfc081bfdfe6709d2def6e8a6ea9c9730fc7ce2e9e811c46a552a6ac8f2781bcb094b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960827, "uuid": "faf10265-46a2-48fc-ae48-cf4555162b36", "value": "T15EC4E01876B98B56CAB607F12822D17453F86D9EA432E35A8EC27EDF7871F000651F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960827, "uuid": "057213f2-fd41-4693-be99-98eabfe81f07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960827, "uuid": "b07a68e4-a01d-4bc2-9bb5-4256b0b2a6b8", "value": "6144:TDiwoCM1VlIvBFHX88Ik2c20KRUP1MqTE8tYIPmJ3IqdLcLzE9elwlGtuAoHFqSv:6TF1VlIv3X8nR6qGN3mJ3rdLcLDlnSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960827, "uuid": "53c6ef1b-7134-4a47-8782-407d6f17e058", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960827, "uuid": "04bdb978-2371-4fac-a94c-c5b60a451429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960827, "uuid": "35774011-0684-4702-a69e-dc265afe4280", "value": "DHL EXpress_AWB434633179800-708439321-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad68acc4-40d4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748994263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994263, "uuid": "6351be2c-a0e6-401a-8d62-0a989a9939a4", "comment": "Malware payload (Mirai)", "value": "abfbf3633987e97a72159eff4e3552be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994263, "uuid": "94af1f53-5ea2-4751-92e1-0b2e781e0e37", "comment": "Malware payload (Mirai)", "value": "fc50c0ca87182b020d8c42cea99306ad91186a9ace07bc87ef15cf187c00fc61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994263, "uuid": "bc49be4b-9c12-4416-9e51-a3c39322e756", "comment": "Malware payload (Mirai)", "value": "48941822470a153fa98240279c085d44960b1232", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748994263, "uuid": "57e1dbbf-85f5-4be2-8b12-3e0b7fdf9cfa", "comment": "Malware payload (Mirai)", "value": "436ea52e02b77619f5dbcc8aaba421fcf80e914f851da91f34df54d9fd8074a183c4b8834fda295920975b19d376f06e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994263, "uuid": "530b2918-b845-408d-ba0c-55a831938c4f", "value": "T1C0F3A436BB619FB7D80ECE33059A49011C8CD99B02D92B6FB2B4E51CE76AD4E48D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994263, "uuid": "526659f6-334e-433c-9df4-46daf3d572f8", "value": "1536:2h+geTE8OWVT/BsTOfEa0ywgwZqRbSUp7RuBfiNBEGuqiCnFBmUlHmPaLEwBvI6N:0++fa01gwWp7kWxZxrmUlGPaLEgvI6Nb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748994263, "uuid": "73670a81-33aa-45b4-b2f2-9f758c4932f6", "value": 160201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748994263, "uuid": "9919c71c-0aa2-4a4d-a52a-8582cba07c3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748994263, "uuid": "82a5fcfa-0b40-440d-b0c2-82922864febb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e98123-40a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1748973170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973170, "uuid": "444d5182-511d-4837-a537-a57487d429ea", "comment": "Malware payload (CoinMiner)", "value": "d51663e1d465c328c0ff8512880af535", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973170, "uuid": "b255f4bb-3d50-4d10-8016-9b33c1fd6653", "comment": "Malware payload (CoinMiner)", "value": "fc5370dafe589e64d45fa8da975e000ee1df5163a0b1804e24c97197c9b3351f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973170, "uuid": "b96d6b5a-6c67-4519-a01b-41961042725d", "comment": "Malware payload (CoinMiner)", "value": "9fe65d138888cabb196ba38bbdeabc854c2adbbf", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748973170, "uuid": "fa3156ae-5755-4043-bd26-22d7960d119a", "comment": "Malware payload (CoinMiner)", "value": "b74b4919829162a573cb64e62848242a58fab023c94d125b10eb95ee1b6f6879e5a00714cd2b00dea20ab4446b6ea2ec", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973170, "uuid": "2d98bd3a-9549-4a77-a89c-79f24b68f42a", "value": "T1EBF2374D9072ECB52D65C866DEE1322DB0BEF088C5F37B88AE253D3C15A4105FA715AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973170, "uuid": "ab88ffa9-5eb6-4538-8de5-07cf7575e690", "value": "768:bq7mzQ5VFNcDAFLcIwgnoYq0xFBWytfwu3:bEVF+D6cIwgos1d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748973170, "uuid": "6df24b51-ff9b-41c9-818e-17a5cab04a13", "value": 36910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748973170, "uuid": "745536ff-9a14-4e2a-a11c-567ede85e97b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748973170, "uuid": "bee82afb-e3ea-479c-b8d5-06721faef4f5", "value": "pg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231a9cd8-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1748930895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930895, "uuid": "34b03ffb-652e-4d6d-8f0c-fe34564b30a1", "comment": "Malware payload", "value": "aeb57fe358e48eb14ea64ca2e14649ab", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930895, "uuid": "c33aa380-5beb-469f-bf0f-44493819a1c6", "comment": "Malware payload", "value": "fca02431c1cc1002da9f9d077b07e57bfea7d010b90aaf28071fe1ffbe80a6e3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930895, "uuid": "25509050-8f36-4fda-9718-945e67580244", "comment": "Malware payload", "value": "98339c85632a3ae4da00a6b497c5a9537c2a4207", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930895, "uuid": "61aede0f-41b0-4cb4-8db1-f9a4807b83e3", "comment": "Malware payload", "value": "47cc173e59b5d1103b7670f5f1e908a7bac42e24d97541c47521441637c5e553bda4ef240ef8944b4fffb0309d7a9005", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930895, "uuid": "0ca1d14d-de7f-49c9-979e-c0db292d2585", "value": "T12F853802FFE0FE13D464037B99FB47653275EC81AB53470B1248B71A6DA13D81A9B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930895, "uuid": "f7874562-76a0-4a3f-b815-b12cd422b737", "value": "24576:WEEx3B9YApNynkdcI71aWHaBRmdANpZMTOEF6l/inKa4kEI+fwhnt:WJx3B9jzWOYUanmdgpOTZ+/RjI+Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930895, "uuid": "637b16ff-9ba6-4cd2-b3c6-a9ef4d66eca1", "value": 1775104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930895, "uuid": "b01f1dff-53e9-4251-bae9-3f4e52da8a94", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930895, "uuid": "305fe42e-0600-43f4-ae96-26830d183cf4", "value": "pro\u015bba o wycen\u0119.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9e5313-403d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1748929515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929515, "uuid": "95ddc5c9-305e-4524-ba6a-5a3946a1dd72", "comment": "Malware payload (DCRat)", "value": "72366c65c333bf7ef3d082d1bb3645bd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929515, "uuid": "47d7eef3-569f-453d-bda3-f0c39792450d", "comment": "Malware payload (DCRat)", "value": "feff1bf844bab637c8574b49864ff122078ca8c15d0eea205657e28587c16eba", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929515, "uuid": "d72906db-6c88-45ad-8dfa-a2b294a6025d", "comment": "Malware payload (DCRat)", "value": "2faa96c6ad37e7496c673a837ea5fbdb212d7dad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748929515, "uuid": "df473c86-9b2f-42a3-9bbc-2bfd48784046", "comment": "Malware payload (DCRat)", "value": "5878d0e8a3c13748cd9b40a55bfc84a75d426feb8f2a03ccd8123e3d003e8e234fc1d429003ac37cf3fafb63b5d1ec50", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929515, "uuid": "83063fb9-7f57-4365-8219-dfeebba7b9be", "value": "T114A5337470D1C1B2E5A6103584CACB32A636B062877EC1CB7ADD76F56F603F1623A6C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929515, "uuid": "4a0ecc58-46bf-41d6-a3d1-05453a179fd0", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929515, "uuid": "7e71f247-6222-49a1-bb50-696d818b8e97", "value": "49152:ykQTA9YS/v6h3+1uhZcT2NnvOyLXXjFpNXCym/hXmL9W6EppQpN:ya95CbhZcT2lvnDFpFW/twU7+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748929515, "uuid": "b7845823-8dee-4ad0-864c-e66cbae1bd43", "value": 2078720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748929515, "uuid": "35f52a96-6560-45b4-81df-59aa2ebaaae2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748929515, "uuid": "8012b84f-2b3f-458a-acff-2267497133ee", "value": "72366C65C333BF7EF3D082D1BB3645BD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f13960-4040-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1748930799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930799, "uuid": "98139ee6-1eed-477d-90b4-7c2bb6e0b992", "comment": "Malware payload (LummaStealer)", "value": "6148c86090eef12cadc49f92ddcd3619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930799, "uuid": "ee006aa1-4f18-4876-8b1e-edd78fe67664", "comment": "Malware payload (LummaStealer)", "value": "ff0077ae5fe95768e7fd3a4445ec00f13bb12344a63d0102cccce04b91b2f13a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930799, "uuid": "153354bb-35ea-4ee7-8727-5d271b93c2d0", "comment": "Malware payload (LummaStealer)", "value": "7283124c0d876cafb6277f811a3d6a7b00913f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748930799, "uuid": "e045ee53-da4e-4f3e-86ec-217209ca8029", "comment": "Malware payload (LummaStealer)", "value": "0c450b58eb78688b0ee9c6f7936755d3081b12e10e0851a07ef6839a830a376ce940effaafb4d2aa6b533f442bd6350d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930799, "uuid": "c0fea3e7-059f-4bd0-9f84-8e25e23a5ecf", "value": "T1BA85330CBE43E374D83C4778C47CEE263E3259B6C32A749366B8A7A94DA64865651C33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930799, "uuid": "271abca3-302e-4ef6-a580-484478dc89aa", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930799, "uuid": "df687796-cd2a-40ce-9548-3d8090746122", "value": "49152:ZRN6ZiAYUS8T907NICNl9eFohuSqGG8NVFeZLwYY:t6ZiA190R7NkxwGmeB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748930799, "uuid": "f4de4955-41da-47ce-8edc-ee0ee2fbe9ff", "value": 1857536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748930799, "uuid": "ffd9a159-fc23-4c8c-8d13-92f83b5314bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748930799, "uuid": "c69aae65-4638-4ac6-93cf-0a92d1a2473d", "value": "6148c86090eef12cadc49f92ddcd3619.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ec0ccf-407d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1748956673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956673, "uuid": "2bf10944-7647-4079-9375-ef788ca97ea5", "comment": "Malware payload (Mirai)", "value": "4541747a27fbf9fc0a93784ab269e383", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956673, "uuid": "f8fb53ce-e337-448b-96b8-8a6e8067cc1e", "comment": "Malware payload (Mirai)", "value": "ff0e7a59eabdd5946c9d7cffae64dec4044b2f884cedbf48a46b824c57fe2e6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956673, "uuid": "deca3a17-2faa-4b14-910d-1d0782c7b9ca", "comment": "Malware payload (Mirai)", "value": "60398333a718edbe691f3c6dbc5bbf734cc1b44c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748956673, "uuid": "ecd9edde-52b4-41d3-be59-aaa64692fa65", "comment": "Malware payload (Mirai)", "value": "f71e3a051320207546eb62719242c990b660ac183248c3a623e0136bcbc88387a12d570590fedab1ed1bcddfca5c59f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956673, "uuid": "4edda606-52f3-4061-980a-9b41c3839bba", "value": "T1C4D2E16CD94D7905C6AD3EB911DE56B5394C70C0735DB68E17228448BA27B8BFC070F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956673, "uuid": "15983ffa-7747-42c4-bc07-339dd70724a2", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNwVJbUWUf:kbDs06t4BEub4sU/MbUuYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748956673, "uuid": "ebf63123-6c67-4b2f-a274-056ae4f7821b", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748956673, "uuid": "b2404c0e-14dc-4b03-bf19-31c488927a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748956673, "uuid": "3d7f4c6c-8008-4b13-a40a-fc6b77e1f487", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e97df3-4090-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1748964860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964860, "uuid": "a21ef2a2-2192-47ce-bdb2-81297d5f57ea", "comment": "Malware payload (AsyncRAT)", "value": "c4a77b5c9b4d196f6e5edfae9cf08d4b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964860, "uuid": "5f4b6835-7f83-43b5-80b6-c0aa77d09d77", "comment": "Malware payload (AsyncRAT)", "value": "ff5843826addfc145290f79ac6aad7160c59ad6f508b77e0d76e784046fc93ad", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964860, "uuid": "8387348a-4c3e-4c5a-972c-6b5716890513", "comment": "Malware payload (AsyncRAT)", "value": "4f473a2a10918390a0f401eced74c448bf68492f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748964860, "uuid": "37b8de86-6941-4936-8e54-9183162d86e5", "comment": "Malware payload (AsyncRAT)", "value": "53054dc899a7c2952ebf2516be53b080f7a7f2236c142455337e727574e8098082eca18f458246318a33a4597e7650af", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "shripzone-bumbleshrimp-com", "colour": "#59A6A8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964860, "uuid": "0cf2a915-4ab2-46d0-98eb-224aef69ee46", "value": "T1012133147958D3315A62BA7B9C23FC1C5093204CB1586D58A089CD78048432CC6BA8FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964860, "uuid": "11d7cc5e-da2a-4dcb-b6ab-e5540b9028d7", "value": "24:0WQLb3ZtO915X1Qdw9tB6C2xqXwGm2Q1kf7L0R/1ZpMjzFZpMjlnTV+m6f7L0Rg:gPnm15X1QyQ7Gm2QmffWyjzij3J6ffj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748964860, "uuid": "c87f2a15-e4f5-4780-819d-527a0fdda939", "value": 1129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748964860, "uuid": "a2b263ff-1319-4f51-8f93-788ac614d386", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748964860, "uuid": "65fa193d-25dc-4d14-bfdc-a26679e7e283", "value": "sc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c6fc43-4041-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PurpleFox)", "timestamp": 1748931114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931114, "uuid": "23ecaf39-0374-4d5d-bf0b-10be7e712ee5", "comment": "Malware payload (PurpleFox)", "value": "581a7b064f38ef7b2e3c58ec7cd10a54", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931114, "uuid": "3abb5e39-3aba-4505-8c5d-32856f868af6", "comment": "Malware payload (PurpleFox)", "value": "ffaec0efa996ed3b95ab80643540b9c54ae15e489b5f8ec0df86458fc9580533", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931114, "uuid": "21f59522-76a6-46e1-95b7-aa3eae173789", "comment": "Malware payload (PurpleFox)", "value": "d3b405e5a865c7127a4af90c01dc8a16d2aee922", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748931114, "uuid": "011108e5-141e-4ccf-808c-fb38adf7da1a", "comment": "Malware payload (PurpleFox)", "value": "139ad17ce6befde5e270b96f8d755749c81d8ad29487fa529cbc2d6a5cacf14f1587e185a0c374338378acb2619b7839", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931114, "uuid": "3696f0c4-7c38-412f-bd32-46d8f7e80134", "value": "T186E533527E231329C152A337582A0BBBD3047C9AB769B1A07DCC756F4F3276961B9EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931114, "uuid": "b00335c2-b6b1-4d0d-8785-60bec93f0ff9", "value": "98304:pUQYHrZvcLBJGUk3OpvcWGd6dpHwlKxZ:pWHeOUUav546dRcKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748931114, "uuid": "baa5c01d-677c-4ea8-ac57-45d7da8019ef", "value": 3272704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748931114, "uuid": "af566b89-6581-4c1a-b429-692d4da9c861", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748931114, "uuid": "f5e3952e-b2ce-4635-9f83-160e60dcd4ff", "value": "cflHwJJ.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e227f6-4085-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1748960456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960456, "uuid": "63e6f208-d085-42e7-9808-d98ed8906b86", "comment": "Malware payload (RedLineStealer)", "value": "090d44a478b355c1f0cfdea01674ce7e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960456, "uuid": "1d7278e8-29e0-43ad-9e90-edd91423ad80", "comment": "Malware payload (RedLineStealer)", "value": "ffb34f55a61a2fc6b0d8a0a1f795e71626132915612f16b94f3ccdf7ac8b85cd", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960456, "uuid": "b6ab93bf-69e0-4b5b-85ae-d792bc9c7551", "comment": "Malware payload (RedLineStealer)", "value": "dc1026625a78432acd0730aa2c1160f3d456c614", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1748960456, "uuid": "b7161bd2-40d5-46f6-b81c-c0855152a9cb", "comment": "Malware payload (RedLineStealer)", "value": "32861b11652626d87487a79a6f54aed3fe35b5477c54c7be0c91a6a005467db18f7ab45074b305ac6bdc32ee7ef5a745", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tenderi--dzpn-rs", "colour": "#AD06CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960456, "uuid": "d9118a84-10bc-4e34-aa14-007d9fa2dce3", "value": "T126E423BD505A12B81F1C37FE27C84A39AF6DB61A4663B4DBD0051BAA4CE68237D01DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960456, "uuid": "cd3f2e05-7a9e-41e0-a443-1085aea37a70", "value": "12288:NG/oLGTVvvsiTzKNI+OR2mZf9eO673W7LTWv8B9tS:4/o6RtEI+OR2mSO6q7LY830", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1748960456, "uuid": "7d3eda89-2376-4e3d-977d-4ff63f1a89aa", "value": 657570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1748960456, "uuid": "2ee04551-9e9d-4d40-8474-9dd759c78f98", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1748960456, "uuid": "0d591f9b-d131-4c16-9fc2-c3b312a35795", "value": "doc0030602506.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }