{ "Event": { "published": true, "date": "2026-06-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-12", "timestamp": 1781308982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "62240f42-6982-4bbd-b04b-49eeef533fec", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37290bbe-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262583, "uuid": "0197ee71-a751-48d6-aebe-9fc67ab29160", "comment": "Malware payload (ConnectWise)", "value": "601f1f51cc30f7cfe429dd58cabc3552", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262583, "uuid": "a0108dca-eb41-41ee-9b57-9d18926ce0e8", "comment": "Malware payload (ConnectWise)", "value": "00489ef4d50d368d4b8b99ee58a635ffd9cf23ba777f8db5c958e685decc3e94", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262583, "uuid": "6b3d4b12-0bcd-4154-9cc4-042d168ef915", "comment": "Malware payload (ConnectWise)", "value": "c0f34b1ea22bb2f3254e512ae7ec6f22f95a15c8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262583, "uuid": "41fc9ae9-80b8-47da-b26e-d0863ee90846", "comment": "Malware payload (ConnectWise)", "value": "4b2cd2755dcd113cc24fa1b16659b7b086265da3ff4ed62b1ac3177867a8690d85d350a01e8e2cd69a3840260f1cfff4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262583, "uuid": "6cc5097b-f372-45f1-afbe-7e7d4662f429", "value": "T1A2F72330B64ACD36CD9601B08D3DEBAE602DBA75076590C7B2D83E2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262583, "uuid": "c77c3a89-564c-4e6a-848c-22d27700b620", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262583, "uuid": "e25e14ef-d091-4cac-b185-7efcd6e6da8a", "value": "1572864:CDuwPeE7jRgZ8shpCNc4xkHt4vrGm9X13588cns06b1O4Lt:CywPemFgZ8s9FSvr1P358Q06b1OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262583, "uuid": "ba0ee165-7af1-4ba4-93ea-c50fd7ee0cfa", "value": 76210808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262583, "uuid": "527a8cee-4758-4a5a-880a-1173eb699ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262583, "uuid": "1366d043-eaad-426d-abb0-6b38e2b44647", "value": "00489ef4d50d368d4b8b99ee58a635ffd9cf23ba777f8db5c958e685decc3e94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c99d90c-6633-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781250593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250593, "uuid": "b2787a7b-bb0a-4775-835a-3f3949765153", "comment": "Malware payload", "value": "f766fcac7d92dca9f0ee4f67e17309c0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250593, "uuid": "91b7be81-4997-4750-9515-7e57632a2444", "comment": "Malware payload", "value": "008dd0203ff022c94a45e75e3c674dab83889c08b4e92713c4d8713eb5064de8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250593, "uuid": "5382a731-069e-4b09-bf62-9faa252928f7", "comment": "Malware payload", "value": "fd02cb37a5ee3ac4d3adc6e3b00552a0aa2869de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250593, "uuid": "7023e3a6-4c9e-47ad-bf75-5e6a9bd5f2e9", "comment": "Malware payload", "value": "cd13df8171d78e1b0ed4750c5978ca48cb323ff23f49849ec9eb45a89fc0c86bf2d5dfb66e9a27b6948e267852a4593e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250593, "uuid": "1d4af557-c580-4551-91f3-72e25045ff15", "value": "T11D836B1176D1C471DABF2A311864C7A14B3DBA20DED0DD6B27990A7E4E702C1DE34E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250593, "uuid": "e40d2e81-711b-4653-ad0d-b4e2d6f504fc", "value": "eac05df480f0337c83d3179acccab006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250593, "uuid": "dbdb1340-29a7-43f8-a7b7-4df9ad6b76c9", "value": "1536:7otaxeTBaj3OwrC7Sj8kmb49EIVPOzFNSz/CqsWnXcdlwRVvP6:7otao1aCwrC7YmbxfwPmlwRVvS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781250593, "uuid": "d5101c69-2930-4e05-92d3-bb4d0abfa807", "value": 84480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781250593, "uuid": "7480e38f-b113-4d57-ac72-2378eb240d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250593, "uuid": "c02644aa-43c6-41c5-a98e-544761a23c2e", "value": "CNCLID.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ab67af-6641-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781256570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256570, "uuid": "398c2a0b-68ec-414c-b06c-851c4bd252e4", "comment": "Malware payload (ConnectWise)", "value": "b6508f451b935de6bf17282fbf4e15db", "object_relation": "md5", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256570, "uuid": "df0b52cb-2da6-47d1-a0b3-7e134807f4d2", "comment": "Malware payload (ConnectWise)", "value": "01f8832e1da252782190d58b1d4ed7cebb9c6dade34ca58dd19eebd5e537d604", "object_relation": "sha256", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256570, "uuid": "37a3b066-ae09-4d25-acd5-746a3a56d000", "comment": "Malware payload (ConnectWise)", "value": "593c2c8ac41fb18442c5c235d9a2e0d577e75583", "object_relation": "sha1", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256570, "uuid": "981edf9b-21a1-462f-9645-28cfbb002353", "comment": "Malware payload (ConnectWise)", "value": "5b7873a33e1df049198367795eb64b731f73a860332c598a6e9371aa24764b5948a812b83eeea094a0b8861396ab08d6", "object_relation": "sha3-384", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256570, "uuid": "e344fabf-bb15-4f89-add5-9279d319fa75", "value": "T1FB971230B64ACD36CD9605B08D3DEB6E602DBA750B2590CBB3D82D2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256570, "uuid": "6c990b32-8b0d-459d-8f90-407098510eca", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256570, "uuid": "ca156d21-7932-49ce-a659-54b04e2eacee", "value": "786432:0DuwWc8MBee8Lnj1jOX8lZamshpwxyUJNfUh4+YEKqIklrdtJqraWrGbcj9T:0Duw6eEhjOgZpshpCNc4xkHt4vrGm9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781256570, "uuid": "a38db417-f323-4b24-a254-cd9a53f10465", "value": 42323680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781256570, "uuid": "c54598c7-3da9-496f-a300-008a0c07866e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256570, "uuid": "153c13bc-bb0a-4b8d-91a6-8f0d4ca469e5", "value": "DocusignSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211f127c-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301201, "uuid": "d4907605-46f1-490f-a337-4c2fa5d393bc", "comment": "Malware payload", "value": "24e68386fab129408ba1426e97852846", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301201, "uuid": "d5163d41-0c77-4572-8f4e-bd7b3f31fddb", "comment": "Malware payload", "value": "03145c133b223dca2de0bd3614bb372c50b28e09c65ae1842f8598b51791fce7", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301201, "uuid": "3546d490-7d15-417a-9896-5a503a96e457", "comment": "Malware payload", "value": "c161d96dc626aef68c4bec913ccbe61d6613043e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301201, "uuid": "26295bab-bd73-41fb-828f-6af0ff9ac06f", "comment": "Malware payload", "value": "3ff552e4b370517215eeb717e6fcd4bbcffac771086c66cf7791142824b872227f2c343c9ef8a9f04b51262d796596cb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301201, "uuid": "e0e3ecca-9e1d-4da4-87ff-ab1b14ae8398", "value": "T19FE42256B8458E1BC393C23549D8DAD704ACFD853B42DF8B32987B9B76783B7840A24D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301201, "uuid": "32fbfc5f-b6c0-4526-aaaa-7175c9627ffb", "value": "12288:3lrF0mlzVXgxpdLHosXpejIVLIe3DAQAZvQMhu086/fGyS/7kc9kdZ/n0:NZlztKLHosZ4Iqe3UJmYm7kcO30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301201, "uuid": "daf1793b-2f9b-4e8e-b6d4-15b6d99c1cd9", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301201, "uuid": "1632594f-c274-4c15-98e2-69e4f2bb16d7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301201, "uuid": "1888446c-39f5-4628-b10a-c8826fbaf0b8", "value": "PO257493XSITCVN.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d81a5ba-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781301222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301222, "uuid": "e6f62b3c-9a81-4b3b-8a86-c24d880e4557", "comment": "Malware payload (AgentTesla)", "value": "3c2ddddfbb2d52d6598fc1d146df0578", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301222, "uuid": "ac686839-823b-47eb-b63b-4368f699e857", "comment": "Malware payload (AgentTesla)", "value": "03d42240207d0b29a39afb6c5581480df704b179c239f45733c4a513bfa7f7d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301222, "uuid": "470ad404-e116-488d-950e-7f3f400d18e3", "comment": "Malware payload (AgentTesla)", "value": "d82195cbc22cce7d3b6fabe44cebf829a2c54971", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301222, "uuid": "05bb1690-8d11-475d-b7dc-136569b66134", "comment": "Malware payload (AgentTesla)", "value": "088a415186a9fc157baa130f2c69f62ea7c5b6326f28303bd060f997682b9608b2a4eca582320e26e1c421c932e444ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301222, "uuid": "0e2f04aa-1afe-4da3-b467-1dab968a33b6", "value": "T19175335AC3D2C1940316F767FAF603C57D46ED36AAE28D0B38B2C84719F25F9861E846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301222, "uuid": "644b04ab-2b4a-45d5-9221-744b882377b1", "value": "24576:n3Si5/Nx4pOTVMrGeVXef8Ew80zUlVUTLLEWWVm9Km/WbNc9FVWz9T2FkWBRJ:n3SiLx48TVzeVE1w80QlmrEWiUAk2N2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301222, "uuid": "8b77f49f-c03a-4385-b9c6-5a930563fb44", "value": 1560035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301222, "uuid": "932da279-e70b-443e-a2c5-f080a43a6b4d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301222, "uuid": "e505258a-c09d-45d4-9ae4-cb7f33d0ad9f", "value": "InvoiceXforXfirstXpayment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23462b7-6638-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781252911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252911, "uuid": "4c143107-bcbc-4957-a766-28ef4f600442", "comment": "Malware payload", "value": "5cda16dc8e63822beb8f7ec4f7fe62bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252911, "uuid": "e8e557f8-04d8-48e7-9590-60d9f427d409", "comment": "Malware payload", "value": "05e822946b3b4222caa37fe7fcc91b0e92c5f68d09068a26b0a1b96dc2c2a5c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252911, "uuid": "d172ed41-a1d0-4871-9faa-8cfe88527240", "comment": "Malware payload", "value": "5661ae72a61c1f304e1e4951f755c16686fcc30b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252911, "uuid": "e8c50da9-c3f6-4d97-965a-1c063aab5a90", "comment": "Malware payload", "value": "139103bf7521cf7c61f4b78bf4d8ee864672769cc21536fc094332bb3a79ad3efe80dfa1a909accdef32b39747191112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252911, "uuid": "8929e853-3ef6-4d2b-b0c1-b0fee9c8f867", "value": "T13D34865A6E228F6DF668C73047F74A25A76D33D626E1D684D1ACC1102F2039E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252911, "uuid": "6dca3f20-ff8b-46da-bc17-bad34b8cc582", "value": "3072:QTtzXy8k8whx7zgPX0fexjnxmolGsPCVfquytFjOqd0OxhwWpMUE:OzXy8dwTokfMjXqRQtok0OvwWpMUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252911, "uuid": "c76e0777-6e52-4de6-935a-97136349d3fc", "value": 230864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252911, "uuid": "c23c04be-b3cb-44f3-8604-59b5a4ee854c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252911, "uuid": "89a10664-a9cd-419d-9638-c2ff07a0d501", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447ffbd-666a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781274282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274282, "uuid": "78f525d3-2e44-4557-8218-9c016033229c", "comment": "Malware payload (Mirai)", "value": "a9c1098920206fd0903fea3e97f13b37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274282, "uuid": "3a2538d4-e93a-4aa4-be81-b5b622d53bb5", "comment": "Malware payload (Mirai)", "value": "060d4594102e3e0e305a532b72e4479f3c3a9da126deece2d780d8fe8a788699", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274282, "uuid": "6607d185-0308-439b-acb9-8b15ff7e9c13", "comment": "Malware payload (Mirai)", "value": "bfd81058f0db3aab2b64b1284ccb6cef8181e422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274282, "uuid": "01f03151-8e10-41d9-9265-b7f7c3ad348f", "comment": "Malware payload (Mirai)", "value": "bece86288ee47142eb6402ad5bd2d86151857d9d91099655b845aa506bafa47da1c711c5d5a687a5e69c785025e40c9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274282, "uuid": "fe7701aa-d26d-4516-b864-f5bbf32bca9d", "value": "T157A3F985F8514B17C6C652BBFF4E438D7B2A1758E3EE320399156F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274282, "uuid": "7e64afb2-7044-4182-a51e-c39121c11b13", "value": "1536:WcSBQmFQAWD24VxxuV7nP13z+OQm6bbInflU5wyw1lHD3B6IRYsLcl7cv70:WLB3FQI4lQzP1sb8fFgBq70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781274282, "uuid": "c1556e81-21ce-48ee-941f-5ace97e597de", "value": 101196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781274282, "uuid": "62e03fe2-ace5-4584-a192-237946ec592a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274282, "uuid": "55fd93aa-8869-4003-ae22-40cc73c0292b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42a0fb5-668f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781290335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290335, "uuid": "305dd898-0167-413f-9fed-267d12d14aca", "comment": "Malware payload (Vidar)", "value": "c110de2781bdadbe99358d281f17869a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290335, "uuid": "92b50919-55a6-4ec0-a46b-7d05fd4d2220", "comment": "Malware payload (Vidar)", "value": "06c225ee35c4c4f709e99f54d0d930b622ef3481a9a7aff2dec5d110b43d0389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290335, "uuid": "d241334f-e2fc-437a-9f5a-d5d05e602446", "comment": "Malware payload (Vidar)", "value": "302149ea3aa19b594a2e2d635ce7a362d05d506f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290335, "uuid": "842c9b9b-e87f-4758-bf8b-8c6f5b60f980", "comment": "Malware payload (Vidar)", "value": "3eea0157c417bf29af98c128b722d92c30b121fcee8019ecd2cd570d54b5cadc9f8225ec38ad673966767dc8600c75ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290335, "uuid": "58c3332e-0dc2-4f08-9e5e-eb6cf4c61e8b", "value": "T18BF58B07ECA548E6C069A3318AB38266BB71BC452F3267D73E51B7782E72BC46D34351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290335, "uuid": "9605ab10-9f68-42e1-b3a9-069b64841398", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290335, "uuid": "4cabfad0-1632-4d1e-8fa1-e2d3ea61578b", "value": "49152:QJCjV3kI6rYFvYGqCcU6CGsHKPTzuYi57FMCY8xup:Q+DYGqJCyr6Yi55MCYdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781290335, "uuid": "ff48f6d7-e477-45ad-8133-a3356c7c16e4", "value": 3370360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781290335, "uuid": "9fd8a5a9-0b20-419d-92ac-8cdbe2c9d78f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290335, "uuid": "dbbe7467-65ac-4154-9230-c074b1030340", "value": "kizar-soft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40666db-6666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781272644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272644, "uuid": "0520449f-c6fc-4ae2-849d-6d5aa1805658", "comment": "Malware payload (Mirai)", "value": "d2911c1bf6bc7bfacfece1067a10806b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272644, "uuid": "077e8a75-7d2d-487d-9696-d8f3bec921ea", "comment": "Malware payload (Mirai)", "value": "08a041f41888dd09a5542efd4f0041d7cec0b7ce77ff415f6d89a255759d5bb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272644, "uuid": "0fd844c4-7377-4959-b462-ec786eabf02d", "comment": "Malware payload (Mirai)", "value": "4555bb00fd9053ed3157ff0d5869730fa7b358a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272644, "uuid": "6cb39d8f-d441-495c-bcfc-97c3e12855ca", "comment": "Malware payload (Mirai)", "value": "95cc44972a16316cd2eac58a24a8f0c4c2a1c657aa5fe04e68769c977a02b5cc5f155d3afdccb9427a6e5f8e60a11e6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272644, "uuid": "a75ac0ba-e414-47c3-b8c3-fb0f7dc09ac3", "value": "T126D31946E7418B13C0D71779BADF42563323AB54A7EB23069928BFF43F827A94E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272644, "uuid": "44e996c4-5ec3-4d4f-97b5-5839d53f69c2", "value": "3072:PLV7ugJscqaOCUskxC8TPTYQ143b3JihM/9JhWO:xigmcqaOCUskk8/e3b3JUM/96O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272644, "uuid": "ce5c6ec1-5a78-4f8a-bc55-3c108c825dbd", "value": 131493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272644, "uuid": "83f208de-f7fb-493d-a585-1da7ef46386b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272644, "uuid": "8a39681d-ebe8-40ce-ba0f-87ffad8a0f1f", "value": "CRY.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe5e5b8-664e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262457, "uuid": "7fab7504-f57a-49c5-b5b7-4520c07e1df6", "comment": "Malware payload (ConnectWise)", "value": "ffa1ba133090a31fbb441e184af633e9", "object_relation": "md5", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262457, "uuid": "ef92ed98-1525-4bca-8e5c-cb058e69b3a1", "comment": "Malware payload (ConnectWise)", "value": "0a05d255f12dd5f797483a89dc0575fc30ff388a84c0ec3be9c938f90df834b1", "object_relation": "sha256", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262457, "uuid": "50e54814-6f07-48d9-9441-b86857e33e1f", "comment": "Malware payload (ConnectWise)", "value": "eadaed3f985da38465fa9140925c725282702a0b", "object_relation": "sha1", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262457, "uuid": "7d5e4179-d26d-486f-a38a-d0867be9db31", "comment": "Malware payload (ConnectWise)", "value": "5a90e5e70694bb2add2220ae75eb5592b9eccd8159452954abedce5af651936f2fbf4fc622041a8bbaf229c0241f10c6", "object_relation": "sha3-384", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262457, "uuid": "d08e1d6d-e368-478d-b78e-267c6895965d", "value": "T19B971230B64ACD36CD9605B08D3DEB6E602DBA750B2590CBB3D82D2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262457, "uuid": "24690c73-0e3f-4d38-b4f4-ef58e9db1e98", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262457, "uuid": "75d88871-f889-4830-a8bf-9c34c67a34a5", "value": "786432:KDuwWmHMBee8Lnj1jOC8lZamshpwxyUJNfUh4+YEKqIklrdtJqraWrGbcj9:KDuwHeEhjOzZpshpCNc4xkHt4vrGm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262457, "uuid": "b837b32f-46cf-4e43-a578-e004beae79aa", "value": 42300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262457, "uuid": "96f3c5ef-4f50-4bf1-98b3-5f31f70faf85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262457, "uuid": "d85ee35f-e5a3-47f8-8aeb-0fae251a5f64", "value": "0a05d255f12dd5f797483a89dc0575fc30ff388a84c0ec3be9c938f90df834b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f1f795-6686-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781286155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286155, "uuid": "d3ff2ce1-703f-4bc4-ae4b-53df868ca427", "comment": "Malware payload (AsyncRAT)", "value": "2bac31a29be8885e900083aebb6c2cad", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286155, "uuid": "468adbaa-39f6-4f9b-8f25-21e35b646014", "comment": "Malware payload (AsyncRAT)", "value": "0af84cc7993eb64d51a1ce695c43749e1635b5040f17d6cae1da4b574dc88658", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286155, "uuid": "fa252d43-fcd7-4be0-8e5e-fc94b9e4b60c", "comment": "Malware payload (AsyncRAT)", "value": "dd108b8a271095bcf42ab3c69f57d9a229b33373", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286155, "uuid": "7d5511c6-7fbd-4703-882a-96ba7c5cdc01", "comment": "Malware payload (AsyncRAT)", "value": "c8a66109b363269881dd0417a10c9adddb513ccf0b6937b66589562b8c6d5fb5160b05cf1030e9e3a663a3e50affed99", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286155, "uuid": "a455f8b6-c428-4737-a491-aaab03005724", "value": "T14B354A1137ED6AE9F07F6F35D2E56255D77AE3722606DB8B1E00C24A1D13B42CE4283A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286155, "uuid": "404baabc-8366-421a-9689-79c03d3f6a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286155, "uuid": "92a50cf6-66c2-48da-b382-45cbfe01f46e", "value": "24576:BulhFab5Rz8uXXrdrc4pir95BTFH4enH0d04Q0dew:Bulubpir9zTFH4enUdXTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286155, "uuid": "8d343fb0-0346-4ab9-8933-9bf101c7a642", "value": 1069056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286155, "uuid": "0389fa9e-f024-475c-8c4b-b1c080b7d1f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286155, "uuid": "3b03de79-1cbf-48ee-93da-443148fe2068", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c61a3d8-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301327, "uuid": "d8c6936d-3985-4f9b-a736-f1d5addb313c", "comment": "Malware payload", "value": "ce3480917a5285a03b9de320354f3e1b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301327, "uuid": "ee61a61f-3338-4d3d-ad37-ee0c4aadb8ea", "comment": "Malware payload", "value": "0b47f8d79e37ebec7edd2333ab70caa1e3e710b310b8201c5447820886ce8d49", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301327, "uuid": "b5ec8403-894d-4c2c-8add-c0790f468b82", "comment": "Malware payload", "value": "5e1172c07877a4d44f3c2f33abb268d7e6b3114e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301327, "uuid": "f4f7769a-012e-43d5-b9e0-5698b0c55ba0", "comment": "Malware payload", "value": "bef80aa73c9f166cfceb594cf04c3703b635274125c07b9516d736a6af513b6bff3effc8cf20b3df6f8b5cb3d2ab77a1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301327, "uuid": "67f755d6-cc46-4fbc-836c-d5bbd5b93f92", "value": "T1CAE3F1077320C501C96A96F84DC2DFDF1595FCA46C428B8F31C87BAD3ABDAE2850B659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301327, "uuid": "324d125f-3087-4db0-9d6f-a289ad14a3af", "value": "3072:3n1LZvTTZGzN6YZ5nuTib2W25cURmuccQg:FLFZsNjvnyi6fRm3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301327, "uuid": "b222beda-6d1d-40ba-aac3-f9b0be33e529", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301327, "uuid": "984bddc0-46f5-4222-92d1-51b353603a47", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301327, "uuid": "a558c284-b7e8-47c1-aa23-4d92c1a0c5d5", "value": "Product_Catalog_2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7796b379-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262692, "uuid": "875d23d3-ee41-4454-a3ad-ef8c36a1d439", "comment": "Malware payload (ConnectWise)", "value": "a5e5aa1c1f30a1b9e0fa8c1220d00cf8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262692, "uuid": "80b0c989-662a-43fc-a1cf-4c5a729fadc1", "comment": "Malware payload (ConnectWise)", "value": "0b6b835423883613cc8ad03d3c8e6c588ffd302fc815fa0dc1c7d5ac77a43a9e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262692, "uuid": "3791b1fc-b797-445b-b661-a39b3cd53c4d", "comment": "Malware payload (ConnectWise)", "value": "2b4891625967321fcba2ea0cd3791d43ddf399d7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262692, "uuid": "c1770294-ca5a-444e-b8d4-2c38a326d31c", "comment": "Malware payload (ConnectWise)", "value": "4c6de5eccef10b53909d073b983dd0158b9e565b2af983c6728a142bc72852c1b45c6d3098a8745bc0b70121be84bf0e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262692, "uuid": "fc8069c6-bc1b-4804-881d-d0239568b4ee", "value": "T140E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262692, "uuid": "fb0a20ba-ad2d-46a8-ab09-c0cc07e537b1", "value": "49152:IrGLq7FVsLBe+1GVxrKlsuQ1g7GenGwfZVkVjOi8ifyXfKVzhP:Irn/TYGVxz58GBwRVkGuyXOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262692, "uuid": "6cfe9ca4-ea9f-4acc-815e-41ef8288c20b", "value": 3183616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262692, "uuid": "d0eb27fa-9cf1-4a1b-bc9e-96a964bb5310", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262692, "uuid": "6e6a4a7a-762f-447c-a288-fc1e1aa4b35b", "value": "0b6b835423883613cc8ad03d3c8e6c588ffd302fc815fa0dc1c7d5ac77a43a9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b501341e-6651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781263654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263654, "uuid": "ac6d157d-cc1a-4eaa-8696-15b6764d643a", "comment": "Malware payload", "value": "f6c2d51d7b3438e9a10d8c85cdc207e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263654, "uuid": "05bd302c-703e-4ff4-927f-07b4d406078b", "comment": "Malware payload", "value": "0bedb49487bc7cb0999b40180e48ee2648b6938a55afa4ff92d50375a45feda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263654, "uuid": "c51b7a0d-1683-4961-967f-8217676eeca3", "comment": "Malware payload", "value": "27765bed81605ce7a382a384b16d9b29ab631011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263654, "uuid": "b4b8eed9-e291-416e-8ca7-0f26f5d21e0f", "comment": "Malware payload", "value": "0f15877137f86774542c644fb736bc4655d6ca31bf1e74ff3a7d06d79e625d6d30e18a8f7024e7d56a65c1f9e3d26834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263654, "uuid": "49786a0f-968e-458b-aab5-7224ccf40875", "value": "T1137612FA064B01AED4C02770DE1E56EE1AB16EA144508B3D29B0737DE0FEB6E511637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263654, "uuid": "019b81d3-db96-470d-a3ed-83abea1f7777", "value": "5df95e38aa73403ecd8e5e62f3ce3396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263654, "uuid": "972e5d55-c38f-4354-b0e6-dc15edb1a119", "value": "98304:RdvqN3e1OgWoRmGnqyls9Wf71UGD6cA4FKrNPbeOcuPHsnZQGh5VYtk4DyfRbQ+i:Hf2osCWGD6cKrNPbvXPWuGPIkdtyXjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263654, "uuid": "737ac9e3-ab42-412d-866f-2308c87734be", "value": 7436616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263654, "uuid": "b935327c-9b10-4083-a7b7-8d9fee497457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263654, "uuid": "bc92ce06-6ff3-40ac-96db-5ae4a2c217bd", "value": "0bedb49487bc7cb0999b40180e48ee2648b6938a55afa4ff92d50375a45feda8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02e4172-6663-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781271457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271457, "uuid": "7b25af8d-fe41-44ca-85ad-2a55ef53f61a", "comment": "Malware payload", "value": "c96387614ed1a2fe73e72587690c0ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271457, "uuid": "e0f1b0dc-bb02-457f-977f-1fe9b04d5b70", "comment": "Malware payload", "value": "0e1064d17c17e1ab0df575e109db2d95c5ca214dc99a928a62ada872a2717cfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271457, "uuid": "4c48f829-485c-41da-bdf9-82f0f3bfbf89", "comment": "Malware payload", "value": "c37368c4b93034e7f468c30511d87bd06bc4f9a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271457, "uuid": "ac87e10f-f767-47d7-99d4-04f92e789463", "comment": "Malware payload", "value": "8d73f2d63eb2f3f04707f4be5690ea134a0b2d8d4944c9f0be03335e0f3231c1d1da4e32d2d7fae0b307aa0a8ff29907", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781271457, "uuid": "4dbf1a45-a848-48b6-b9c9-a402ec2130ba", "value": "T1D717BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781271457, "uuid": "b75cef8c-81eb-4eba-a813-b391a3b7a0d5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ7:cqYUQuVDt0TZEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781271457, "uuid": "c9fbafa4-e3dd-447e-8529-48d42fa7a8ee", "value": 19824640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781271457, "uuid": "7da002ce-b831-457a-881b-bf3d69a4aa0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781271457, "uuid": "4ddb438d-e992-4c38-b3f2-71f7363af8e2", "value": "0e1064d17c17e1ab0df575e109db2d95c5ca214dc99a928a62ada872a2717cfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b088e98f-6663-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781271377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271377, "uuid": "c52fa5e7-5743-4e66-82bf-fd09b4982043", "comment": "Malware payload (Mirai)", "value": "abf73153538c0ee7f4bdd887c328ec6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271377, "uuid": "fb7b4132-5bbe-4a04-be68-5d48717d7d44", "comment": "Malware payload (Mirai)", "value": "0e6f2e466d1ada0a620232e4c707412931b7b3b63c2f6130530cf06b09a77dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271377, "uuid": "75f2e924-204c-42e0-9104-0ebdb53360b9", "comment": "Malware payload (Mirai)", "value": "e08341a315919aea237c4c1b28b6886c2edc1176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781271377, "uuid": "5730c7a8-652e-4eb4-8c7c-40de6340e20c", "comment": "Malware payload (Mirai)", "value": "d49f4c82b6223418785b58a95086ae056fa8ca32c13388c46c7dabed3e02f501126995cc704afc105d0358288c27b7d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781271377, "uuid": "b8101b03-c7a9-4f1c-b386-e956a131c26e", "value": "T16E83D605EA429F01D59731FAFB8F425973936FACE3B97101DA245F6123C6ADB0F62212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781271377, "uuid": "9d1d80c8-06c8-4f88-b658-fd86ebf8a3c0", "value": "1536:CMnrAelt8ex1r4bvpPwRaADx8yJUZUAT0lzAHlji4d7U5LYiJWP:X3NDUbvpPwRaADx8yJIrdU5L5JW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781271377, "uuid": "4c2258e8-925a-48eb-a8ff-e9995100cb35", "value": 81580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781271377, "uuid": "4af475bb-52b8-4d0a-b8cd-5b90697c742a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781271377, "uuid": "162f0b64-c3a9-4c80-8674-aa1cca4914ef", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a813737a-6650-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781263202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263202, "uuid": "567bf83d-261a-42d6-add0-b03912178c8a", "comment": "Malware payload", "value": "430b4ab78fb5487d2789d67b272bf3cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263202, "uuid": "a6e49f42-75b2-4bce-a150-ff3c58ea080e", "comment": "Malware payload", "value": "0ecf94aaad04c9bd55d2a41e809277e6c13f887b4d1edd94671aa76b986c646c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263202, "uuid": "04ca01f2-4f6e-4931-88a0-92ef51571782", "comment": "Malware payload", "value": "4e1eab3f2c484489e2fb86473c0990b7f586aef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263202, "uuid": "42d83eb2-6b45-473e-9e9c-19ccde6a6d84", "comment": "Malware payload", "value": "c6fa5ebc6027bb9b9b4165c7f83871277f72169f37a196f17818cebab3c9bf219373d877cb74d734c79a45e9f3959fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263202, "uuid": "c3f0f9a9-812a-48c7-ab5c-febc9e2482b4", "value": "T102347D16B88080B3C83764F1D4ADCA75962D7DFA4B2497CB738C7E399F231D1962942B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263202, "uuid": "735f9a6d-0008-486d-b0c3-c571bcd15118", "value": "1b461ed8d73479867e75976e9550dc52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263202, "uuid": "7e7410d3-4c71-4e22-a264-a303f4734b2b", "value": "6144:KTMcChJsP39HyOvmDy8uI346nkMSz0De+/:KMcCiyOXHMSzie+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263202, "uuid": "1da3cb0c-9cdb-4a52-9d71-05385df848ea", "value": 237384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263202, "uuid": "0b1d4731-bf42-4968-81ae-22a83259eb06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263202, "uuid": "dbecd414-53f0-43b6-9c0a-3043240a0086", "value": "____.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d678a1-6602-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229770, "uuid": "e714176e-13ea-489d-bc13-9d9715aa4fc2", "comment": "Malware payload (Mirai)", "value": "6c53b4c07e3ab857cf00994892ee2dd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229770, "uuid": "be3cef90-a32c-4bb4-bd13-e14f8e0080c8", "comment": "Malware payload (Mirai)", "value": "0fbda0da8c2446cccf6c4aa3e4e01906b677ed6aa0775ddb9c2803ba0dbde45f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229770, "uuid": "de9b6d76-456e-44e3-a788-1465af8e9026", "comment": "Malware payload (Mirai)", "value": "680b8d312102bcbf3ab42f0886de4b6bc29e8786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229770, "uuid": "3f183759-6817-4aed-9cdb-a149ea5ce9a5", "comment": "Malware payload (Mirai)", "value": "3f6316c72ce97687d2e9a64589f44b07e69a92abbd50eae564298112b19b462af4621171784dad5e43d579bc6a6f3723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229770, "uuid": "adf033b1-6030-4407-b5ee-64c687a7ce5b", "value": "T1C343F845BC818B16C5E413BAFA2E118D33172778E3EFB2139D105F25778A96B0E7B902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229770, "uuid": "86a6c952-682d-40ef-8eff-1fc3a2c3c44b", "value": "1536:ONnd6vFEQLBS0O4p6wPYmROGR3VMEiU/ljHYt:B9EYSv4p6IY8/ljHYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229770, "uuid": "7210bcbd-ba65-4461-86e0-130841833619", "value": 59396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229770, "uuid": "811e22d4-4797-4e9e-b750-abd447103d29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229770, "uuid": "923da871-60c6-44fc-81b9-0a83746c88bf", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e0a03b-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245482, "uuid": "3cabd763-5cc6-436f-b483-e83214707269", "comment": "Malware payload (Mirai)", "value": "05145c920cddd48d946ec703ec3b2d8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245482, "uuid": "dd84ba5d-21ff-49b7-b354-5edf61907b40", "comment": "Malware payload (Mirai)", "value": "0fce2a7dfc66788b30858a8726942d1c62ee59d129b581be25b10179db4f720b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245482, "uuid": "49e76c8a-b618-4823-8690-45a125511da0", "comment": "Malware payload (Mirai)", "value": "d89a72b0187d0fc9f7140b89ea7bf7b2cff7a732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245482, "uuid": "3b87abc3-a824-487c-8fb6-908e3e149442", "comment": "Malware payload (Mirai)", "value": "048ad8aa20f99b8cab93cb5c06c624ca24e1cdd342775aeba464a6281afec70ff9780d14f9edc024fb4225044b39d046", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245482, "uuid": "d236db4e-b7e0-455c-976d-c28ed6e6e0bd", "value": "T1BE144911FB0C0463CA931CF48E3F0BFAA3621A9115F99115250D7F5A1A32DB7A68BFD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245482, "uuid": "3dbadf1b-c468-4845-8217-6efa9f2e9abe", "value": "3072:ty5+GoCEggi4NerYqltSwJpH6+cYstk8Uat:o5H5BT48rYq1wjY2qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245482, "uuid": "046a79d4-fee7-4087-bf84-5d3421e799f8", "value": 197308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245482, "uuid": "3daab421-b52c-4f53-81ff-6118812a0007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245482, "uuid": "dda59f4f-0b72-4724-80d3-ad15827eb2ea", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c873e35b-6601-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229326, "uuid": "493e644e-8f7b-486c-aa97-d7c78e0e8078", "comment": "Malware payload (Mirai)", "value": "aa7161f6343126a49a2a774a71fdfc5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229326, "uuid": "3de50ec6-9ab2-4c1e-9193-0096cf23ab07", "comment": "Malware payload (Mirai)", "value": "1067213c7ef6a954644aaadde887781cafa79f8930ed6ca8235bf95210c3f974", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229326, "uuid": "95ea8801-ade9-4e29-b015-1d2a9066ad82", "comment": "Malware payload (Mirai)", "value": "26308a6133a23b7ffe418fa4b1b24481e4dee269", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229326, "uuid": "330800d9-6525-4db7-8274-959bfcfdb945", "comment": "Malware payload (Mirai)", "value": "4aa89ceda7f00a66d8d2a36d49e606e055e2e0a0e8afe6094d2bebee4226955f542dcf8cf73fdd85ae580f42b5d83ad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229326, "uuid": "13cc5c52-8b9c-42d6-9f9d-8672e694d577", "value": "T1D453930ABB650FF7EC6BDD3B09A9171425CC650B21E97B393934D918F24B25B09F3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229326, "uuid": "a8a0d85f-4d63-4ed2-8a05-c4cd2577bb2f", "value": "1536:uZTRrK2Ol4yayxoReVZUA1kBbmqyxgxss2Djy:uZNrKR+yayWReVt1O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229326, "uuid": "e484d2e6-ca0f-45ee-aaed-b5779e579756", "value": 65728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229326, "uuid": "877f7de5-5b20-401f-87e3-07168986cb00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229326, "uuid": "0c230ff3-60bb-4d0c-9244-be7469dec481", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f245dce-6651-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781263483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263483, "uuid": "6e6576b7-15c3-4b7f-92fb-0560e430828e", "comment": "Malware payload", "value": "dcf7951ce5cde3498b35c09a2036af44", "object_relation": "md5", "Tag": [ { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263483, "uuid": "e2f9b862-bf2b-4229-b31d-030e10e54e4c", "comment": "Malware payload", "value": "127c03eecbc40619e789cc224bbae004f413faa0188249f333e4b43cc63f3c89", "object_relation": "sha256", "Tag": [ { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263483, "uuid": "cca3d992-46ca-4cd2-a80c-f492ce53be8b", "comment": "Malware payload", "value": "10ae30761eedf8ab41703687a23e4f28c40a476a", "object_relation": "sha1", "Tag": [ { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263483, "uuid": "f5f56940-66c6-4133-a6d5-e6eec71b8d67", "comment": "Malware payload", "value": "6d1f4d88f6f284f8e595803bea8f27516d65cb0d55d253fd1996c572fd9561cc8716d83f42d3870d9e01838151beebc4", "object_relation": "sha3-384", "Tag": [ { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263483, "uuid": "99bde17a-64bf-4aae-b051-b1f89c35fe38", "value": "T11F13BE87BA29C903EA436F3182E5D7836A70AFD35D62421739A9F2491E373C437192D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263483, "uuid": "97e69a12-eb9c-4991-beef-0fbe559a64f7", "value": "768:5PuhJFlL+rPeoN64PaBCrECqPkmccNG5GRYT2Ip40Wbxf1mlys8Hd:i6rtDaUrP1A0MR9vfIn8Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263483, "uuid": "8841d4f2-68a1-414a-8d47-504b30db1f1b", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263483, "uuid": "18436ce7-b0c8-4489-aa5b-37f6f7843440", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263483, "uuid": "badcbe4c-1491-4d53-b622-2fe4f613b6c0", "value": "127c03eecbc40619e789cc224bbae004f413faa0188249f333e4b43cc63f3c89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd41740-663d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781254887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254887, "uuid": "74293a6f-4345-46c7-a878-ebbd54e505b8", "comment": "Malware payload (Mirai)", "value": "006a4544b456ab1ac490c7e7aa3740fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254887, "uuid": "62339044-3e5a-43cc-a03f-096995d91ef7", "comment": "Malware payload (Mirai)", "value": "1312422bcbcbaf993e2c2eb68f01d2dd1a467b49d30468a96898eb21763701e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254887, "uuid": "0c4dced5-e703-446c-b188-69c8d1cd85b6", "comment": "Malware payload (Mirai)", "value": "7f86c87feb612c987f845d4a565e12539c720668", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254887, "uuid": "5fbdc13c-5bce-4d28-8a80-3011bc7b78b6", "comment": "Malware payload (Mirai)", "value": "e06d9098ae3895b37e5b0e346c77f454018508f053a262a344ecc2e2313e0c8a11a22e0c3127ef7441819c86e632e0ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254887, "uuid": "e616f5dc-717e-4239-982e-f21ce97b4e19", "value": "T118F3D81AAF610FBBDCAFDD3702A90A0539CC954722A43F763674D528F54A50F4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254887, "uuid": "766eda51-78c0-496c-ac97-be524b3ddc8a", "value": "1536:M6oI5lBSPJXRQmQP4GkXbCR+ExyXmzD6RzV3f41sxZljjKthgGE5t/dxkoBJ4i0u:MzI5lBSPJX7Q0moQ1sx8vE5XxfJ5+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781254887, "uuid": "03e2c33c-78cd-43fa-b720-dcb8017138c9", "value": 161184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781254887, "uuid": "88a2ce71-04f6-4666-9684-e6b5572730b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254887, "uuid": "837e5aae-5f91-4560-9db7-106cdc51adf6", "value": "CRY.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e53450e-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262676, "uuid": "e18db32c-075a-4d67-87e2-c3d9034ca4fe", "comment": "Malware payload (ConnectWise)", "value": "b328b6ae76198c4e90f205cfb723a6d8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262676, "uuid": "deb83210-4928-4a8d-8e8d-9f6f597ccb6f", "comment": "Malware payload (ConnectWise)", "value": "134fdfc328481913d8fb742bf2965de93e4669495260104164f3274e5b9bfda4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262676, "uuid": "a79c11ae-c750-4fe0-b15a-64aa89ee3646", "comment": "Malware payload (ConnectWise)", "value": "7c892a8822d669ab31e87ea7e9da50f0ca41c653", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262676, "uuid": "a2ae5e68-8e96-47c2-807c-ae3a94301b61", "comment": "Malware payload (ConnectWise)", "value": "085cf0a63adf8f60c312a3b9d3fd7780028ff2031693a3d17e2562e014772c4688ad5c4804466c6c34e603b10ad92488", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262676, "uuid": "ae0352b9-3dd8-44c4-acdf-9401be24ee0e", "value": "T167E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262676, "uuid": "f43e451c-0cbc-4835-84a4-447413700fea", "value": "49152:krGLq7FVsLBe+1GVxrKlsu11g7GenGwfZVkVjOi8ifyXfKVzh3c:krn/TYGVxz48GBwRVkGuyXOFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262676, "uuid": "1a2c4dd1-8487-4fb1-a5f4-8a63b8b1c3bc", "value": 3182592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262676, "uuid": "25c85c40-dbde-4281-a20b-f01983c75f47", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262676, "uuid": "1db92e5e-cee0-4f2e-8481-64c4f3ec3002", "value": "134fdfc328481913d8fb742bf2965de93e4669495260104164f3274e5b9bfda4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978dc386-6647-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781259309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259309, "uuid": "c28fc018-8a62-48a7-91ad-dab18a88fb3f", "comment": "Malware payload (WannaCry)", "value": "991798060e5aed12cbf02e8f5f94ad71", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259309, "uuid": "0d72cc33-2ebf-4bee-86d7-869cb445f9a6", "comment": "Malware payload (WannaCry)", "value": "1361763ecd20057a916fb87920d294abe9c346eb067c6064a6e2a11fa9bb324b", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259309, "uuid": "e9069e96-5f47-4b12-9f92-9d7c969d44de", "comment": "Malware payload (WannaCry)", "value": "42005dea8e535d74fe0ff478d93cbfcf56b6eaba", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259309, "uuid": "b4f8ef64-2eb1-4a13-aeb8-83e95296a618", "comment": "Malware payload (WannaCry)", "value": "87d7023e0ea0068d8c675ec1239d4960ed26c563ebf1decbeb05a82de8a08830ff56482d4e3c1baa3f0105529d57f897", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259309, "uuid": "63fafe04-07e1-41ed-a6dc-db06187c40eb", "value": "T12B362359327CC1BCD1061A7844B78E27E3B37C5A16FE5B0F8B40866A1E13B55EBA4B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259309, "uuid": "b1bb4705-b2d4-4cdd-b561-0d8522b86dca", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259309, "uuid": "268fa71f-2a46-4513-92ea-1f60a7e3bf68", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DXDqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781259309, "uuid": "f46d87f4-d4e8-4848-b5bf-1633011925a7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781259309, "uuid": "4d5a82f6-e107-40c6-8f8b-c9b55f26affd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259309, "uuid": "867ca916-5606-4cc1-9b67-c01240531fd6", "value": "1361763ecd20057a916fb87920d294abe9c346eb067c6064a6e2a11fa9bb324b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066c8ba1-665b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781267656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781267656, "uuid": "f160930b-0f8f-41c7-858f-08fa85d66f4a", "comment": "Malware payload (CoinMiner)", "value": "0c7fc9536762e91f9cb3a571f3551f21", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781267656, "uuid": "a87fec77-2a31-40cb-8253-8c2ffc2262d7", "comment": "Malware payload (CoinMiner)", "value": "13b63315771f0d2c3e3d2e3cdad85d9adc655b26f8864e12a62fbc3c6024f853", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781267656, "uuid": "978d579d-730c-40a2-9bb6-b2c456a67e44", "comment": "Malware payload (CoinMiner)", "value": "18652abbff22abbeaf68becb27967482b83a91ec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781267656, "uuid": "b5a34032-4b3b-4a40-b121-15dcc392b4b2", "comment": "Malware payload (CoinMiner)", "value": "c6b1ac6db77d475dee704b08b3b71340c5f36f86edaff2364452d56e56b3a910de7d1f829b5e8c598167b6e323c304a2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781267656, "uuid": "2f1d807b-eb9c-4d86-9723-7400dcfbc410", "value": "T161322A2A7E590232E3A049B45175874F553C1533A3D7B3EBF373A65A4BA62888440EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781267656, "uuid": "746b119d-1a5a-4454-ac9b-be3754e7bb47", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781267656, "uuid": "8ee1b6fb-18d0-4e43-835e-b8d91abbbe9b", "value": "192:SZojW0EaBlx+eGlLUN9PFJxTEZmFhSuc:SZoxEOwt6fPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781267656, "uuid": "84c1e440-5016-40c7-bb0d-62d7ece4e776", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781267656, "uuid": "4efaa489-cab9-48e0-ae36-8f125c896454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781267656, "uuid": "ffd6af54-263e-4e6f-8080-b96cd1fd8dfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d26e3c4-663d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781254782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254782, "uuid": "74ef82e5-9026-41ce-9e04-76e40fa22a18", "comment": "Malware payload (Mirai)", "value": "d2435b24f7ad30c5a72b85d8ecc712f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254782, "uuid": "57a17364-29cd-4f4a-878b-1b7db5a0e5fa", "comment": "Malware payload (Mirai)", "value": "13e7904683733977bebfae73fc1020bcb3fb206b3c48d7d4f8bbeb803ed48a1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254782, "uuid": "b8caf867-5a5c-423e-b5e5-57324cac5b86", "comment": "Malware payload (Mirai)", "value": "f5adb74259676c001aff478e8599dedaf06b31bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254782, "uuid": "de477703-84ce-439f-a9cf-f3cbb1fcc1cb", "comment": "Malware payload (Mirai)", "value": "b4749c6ecda878ab99707f448304b37363509cdadd5b932d139e288d40e1b18847c774f27263a717e24abb7c79c4b35d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254782, "uuid": "21d3b613-1cd9-45de-b81a-e94ad23a2b7a", "value": "T1CDC37E85E982E4B2F4A301752A67D7738A32E4366027D987E3693F35CC76641CB1A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254782, "uuid": "08bc8fe7-93f3-4537-b3ca-f24d8e7cd25f", "value": "3072:73knv+AnaAbU/SlFyV9c8bZ4FJYTIiCwuxBz:8+AxU+oOPYBCwuxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781254782, "uuid": "52522876-a43b-4b4a-b6c7-c66086883a59", "value": 123648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781254782, "uuid": "800f502c-6a7b-4362-b030-3bde154d7f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254782, "uuid": "d6f111b4-d89d-40de-bb54-58684099059d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c756d42-6626-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245010, "uuid": "3e983b4b-556c-45e7-93d2-393a36ddc3a9", "comment": "Malware payload (Mirai)", "value": "b670d78fc29c74ccb5e44bce7319b77d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245010, "uuid": "b36201a4-41af-42c9-8392-6b47d55bc961", "comment": "Malware payload (Mirai)", "value": "13ee5b721f1870491f32804eb678c704fae5bb77e22d2bf770fd302116ae8f90", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245010, "uuid": "f69539a3-23d6-4130-bfe1-5c3af14638ed", "comment": "Malware payload (Mirai)", "value": "12e8a6e9887460654dd09bbbb32ca54b7adeb23d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245010, "uuid": "0bd2b665-66da-4ab6-b573-864c8d498e33", "comment": "Malware payload (Mirai)", "value": "101b5f65643ba6878dde616ceecb3c20b0ba1b4a37485bb845142135f2585fdd37b6a110c84fe9ba4f0f0b061d46aed9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245010, "uuid": "61f774a9-60d7-4c4f-a74b-d8bcfd8b8789", "value": "T19211DACB51D07332897A8E0C749C86A0704F8FB6D4EA7A3EAFD82A6F85C9705B154B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245010, "uuid": "6b964d2e-35fc-48e4-b655-8bdf1795bacb", "value": "24:KpyeiwNTyPuytNIB1yPKuwyMfyJzV+tyrAyAy8Jyey7:Syeiw5yPuyc1yPBwyMfyJzV+tyrAyAy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245010, "uuid": "33fe54e0-7cd9-433d-818b-5d2a8db5b549", "value": 960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245010, "uuid": "ee8efa78-b52a-429e-ab77-30bfc94919e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245010, "uuid": "bf31bad3-6223-49f5-9115-65e2de56c68f", "value": "yarn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92ec35c-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286048, "uuid": "74e157da-959a-4d41-8f02-4e6c77c1cf74", "comment": "Malware payload", "value": "d31dd14aa821f48bb00795ccbbb3be65", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286048, "uuid": "03c3a870-3860-4d45-9718-6d2696f8f584", "comment": "Malware payload", "value": "14667f3be0f0716ac2f6aad090faf34fea55418d1cd251ebf789b6091ba33b1f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286048, "uuid": "9ca94f13-c9e2-4795-bf9c-06eb0e12fce6", "comment": "Malware payload", "value": "6e6fb1ae9dacb7f3ce0c2490c7a80cd5fa1eddc6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286048, "uuid": "cbf560e7-c318-47c7-a49f-71826bf04f0e", "comment": "Malware payload", "value": "7ef133706a3026879780cef2f405804bc4ab355c8756e9cdb49046ef984ae9af4ab5ee99887fc77a94e3231c46069fe4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286048, "uuid": "98dd6885-aa1f-4fa5-9e0c-3d772d857431", "value": "T145D2DF34C4C82FBDEEAA2A1C06FA6620D7D68B1E9498860B37437D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286048, "uuid": "9f354965-f97a-4cb2-90d4-158b93ebf0a8", "value": "768:numWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:nu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286048, "uuid": "11ab2b19-d304-407a-adc9-3ee84c5892d2", "value": 28650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286048, "uuid": "523c0d22-b243-45d0-ad5d-f7794a6ffc05", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286048, "uuid": "9a81ee20-ce66-43f7-bd86-6b6d2281b0de", "value": "194.9.6.40_1781285999886838_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d46c8c-664e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262449, "uuid": "520f1d9b-c4c5-477f-9bcd-c9fabe667639", "comment": "Malware payload (ConnectWise)", "value": "7b013599d1b60471307051d62dd164a2", "object_relation": "md5", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262449, "uuid": "8bac7677-6aa7-4aeb-991c-9885731bdd73", "comment": "Malware payload (ConnectWise)", "value": "14fb165a5b331f97c9746754b8f8a3293541aa08b4ea4f39d9e8572aeb8233d9", "object_relation": "sha256", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262449, "uuid": "3fb8747f-7317-41f8-b274-4b1712b79398", "comment": "Malware payload (ConnectWise)", "value": "803925e2c0f70d8b9ed1569c413b55c782209b9b", "object_relation": "sha1", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262449, "uuid": "15367b9b-50c4-4cd4-b651-bdf2dc8d14af", "comment": "Malware payload (ConnectWise)", "value": "2a67fc9cb022bdd7b9a8bc29f85bfb37e1e047c0f13289f48535cf53a80a4f48ffd0600bc1709174a276491d4abdbe12", "object_relation": "sha3-384", "Tag": [ { "name": "bbytati25iy2-anondns-net", "colour": "#260703", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262449, "uuid": "267b1d25-312c-4aeb-9ed5-a138e6a1b499", "value": "T1B5E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262449, "uuid": "1f07c291-d9f4-4f4a-b58d-2282c10801e7", "value": "49152:CrGLq7FVsLBe+1GVxrKlsuJ1g7GenGwfZVkVjOi8ifyXfKVzh9:Crn/TYGVxz88GBwRVkGuyXOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262449, "uuid": "457cd949-14a2-47a4-8fdd-369e9d5a853a", "value": 3182592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262449, "uuid": "345f7717-83a6-4634-90de-5323dca193e6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262449, "uuid": "2a0c3b7f-00f3-46e2-84aa-f236fa72ae59", "value": "14fb165a5b331f97c9746754b8f8a3293541aa08b4ea4f39d9e8572aeb8233d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a9a062-6666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781272379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272379, "uuid": "f2736037-7b1a-4567-9497-9ea295c61b7f", "comment": "Malware payload", "value": "cd4ea7f2616d05b2c74469ba7be4d910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272379, "uuid": "d9f1a5aa-d5d1-45bf-b817-1dc8bb0f806d", "comment": "Malware payload", "value": "15064f69d502a7b9cc0aa9d5f4c4932479c4970530a7e25be2bd251c77de942c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272379, "uuid": "56665b73-69aa-4043-862f-b9c170574ec2", "comment": "Malware payload", "value": "b1169381916cfc79ebc9efb5a4e9fa68a9852215", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272379, "uuid": "202b7e17-4b51-448a-afac-6b1af39a8fff", "comment": "Malware payload", "value": "b5e043dcc36cba77b9219548ff640a90369408f28c3ff624ca162c6b39b7521cfa408f10222c37c52df365b3fd8e09f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272379, "uuid": "f18a8a15-3618-400c-8fe5-5011ca46aa53", "value": "T11E822B8FEB9709F9D239C3788EB36D25F5617129433216DF878081580E7AEC16E3DA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272379, "uuid": "065a97d7-a2ee-462f-8b54-5b7c1afb17d2", "value": "98500ce4ec4de21ae21ff67a33ef6d7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272379, "uuid": "382927fb-2ee4-4993-af81-cda45d1cdf9d", "value": "384:iMepxX2d8OmrhYgKCIfJFEzodaSGE493O3g:iMuEKrhYgOx+kawH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272379, "uuid": "1c335732-7c7c-43f5-bf34-87b579ebb343", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272379, "uuid": "cb43964e-7845-451a-a0c2-6c1658a5d78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272379, "uuid": "de83c14b-2671-4aba-9dec-1df75bae7081", "value": "2026\u5e746\u6708\u4efd\u8fdd\u7eaa\u4eba\u5458\u540d\u5355.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1211d897-669f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781296881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296881, "uuid": "5e649640-8fab-40bb-9b92-0e203a4cadba", "comment": "Malware payload", "value": "521c5366121b528e6844bb476730ac7d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296881, "uuid": "6eac293c-1403-4db5-9836-879f2cefc9b5", "comment": "Malware payload", "value": "18daef9e3e931cc07c146562f97d64bc5257672d38b17a45cc619b03865840ec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296881, "uuid": "cf32a153-f280-4bbd-ab44-407a5262c1ff", "comment": "Malware payload", "value": "c1b920c1d4e011e66733719c97f14d0115208bdb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296881, "uuid": "d730fc1f-0b66-4e21-a28d-bce57bd74104", "comment": "Malware payload", "value": "80b3431e2b57d489bced77330593513fa634df216dc141c8a6d7abcbf6433a82f67ebd78f52f0eb74492dbbf16aa9b85", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296881, "uuid": "862ecb18-1bd3-41db-adf6-0513b37ab945", "value": "T1EE06E73CC958413ED2B6D628C68A450FF8573E07623DD84B69CB174F5E639827BA232D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296881, "uuid": "36911f8a-2347-4089-a494-eba0e1484340", "value": "3072:F1ptnTk9Cr3GLUOoR2JwvOR3lsf7BUwo7dE3bRtHAKKkiZzRZb35M/yrQ+cT09R8:DnTkSJSEKwGcHAKwB38icHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781296881, "uuid": "67a35bd9-bd92-4f62-9ca8-6022939825b6", "value": 3936312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781296881, "uuid": "4c38a29c-8109-420c-a552-5f463eca962b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296881, "uuid": "843e9b46-944c-4a78-bd82-1fb7e73ac3d9", "value": "orden de compras.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782e0850-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781301347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301347, "uuid": "de7f8a3d-2ffd-4dca-a008-bcd17906f74f", "comment": "Malware payload (RemcosRAT)", "value": "0fa8a55e51a26bd85a9ce5b5f3afd329", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301347, "uuid": "025115dc-05f8-41f2-a43b-d89a00406e56", "comment": "Malware payload (RemcosRAT)", "value": "1915c2240b44a3cbad72c893eaafa570d666d852804333e0abe230532c99a164", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301347, "uuid": "65ed6266-c22a-49d2-9852-e9e239326405", "comment": "Malware payload (RemcosRAT)", "value": "31f9f9586cd0ee5bfad4c6a7a028f3e28c3d11a0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301347, "uuid": "75ea2c73-c30e-41b6-97bd-1d6bb0d595b3", "comment": "Malware payload (RemcosRAT)", "value": "d6d8cd0e0321e2e5def63732fbaa235ad6638f0ef659737ae689988569825e099e4a198ac9a1a0754d09e3e20b6e8d35", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301347, "uuid": "3855ad3e-f8f0-45b5-9ca3-62223c956efe", "value": "T12C4145144BE94318E6F38B3AA8BEB31599767C56FE62CF9C015060CC6461610F0BAF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301347, "uuid": "bb71f923-ee84-4a21-b6dc-d57aa70b94ce", "value": "24:8Al/BHYVKVWf+/CWTluL4yurtVvyAWBqJUMkW2p0+/E4I0aH/pGlpgY6Q:8I5aWluLStVvyAWBqJHLAIlolqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301347, "uuid": "8c2577c0-ca9f-4b9c-9275-95099190fe15", "value": 2272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301347, "uuid": "0aa69163-c959-464b-b409-e1e90eda587d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301347, "uuid": "a9dff117-b04c-4556-bbee-7fa11a670e82", "value": "Bank_confirmation_letter.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e4ab78-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286066, "uuid": "d53701e3-6b3a-446a-b661-81326aa8e862", "comment": "Malware payload", "value": "5e48a977958144ef9edd4b47994645a2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286066, "uuid": "4b5762c6-fea6-4520-891f-c73401d60d61", "comment": "Malware payload", "value": "1b524e120b6ab396b46c021c6f36055d89a5df337cb4f6fc592af745fb259c39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286066, "uuid": "a47d0ea1-fd72-4c13-9add-eef8c2b0ec89", "comment": "Malware payload", "value": "b39fd56e39d5de421c2d9fcb1e4cb5b5d80791a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286066, "uuid": "6ad8b8e9-c787-438c-b994-a15d2d10a7be", "comment": "Malware payload", "value": "a79254277dbddfd4b01916e23d390570a59509e997aa3fac1d06982725b54aa71a48ff04ad96ac7cf79a5f5c3d4b1e0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286066, "uuid": "5042723e-e512-46f3-8810-de86ad234fb4", "value": "T11DD2DF34C4C82FBDEEAA2A1D06FA6620D7D68B1E9498860B37037D9B4F37C80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286066, "uuid": "3dbd5873-0781-4e1b-b20d-3b06d0a945c9", "value": "768:iumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:iu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286066, "uuid": "70269b2e-73b9-4b67-a307-a43971c59cd3", "value": 28658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286066, "uuid": "ef45ebc9-5aca-4b22-ba25-af5a6e75cc24", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286066, "uuid": "113d0b7d-5d14-4324-a089-0a72f978204e", "value": "194.9.6.40_1781286003659433_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc15efd5-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286053, "uuid": "216fabfa-aa1d-4ada-8d7c-654f816c2d7e", "comment": "Malware payload", "value": "31c2ed4e52402897a9cec2b9ff8bcd97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286053, "uuid": "534d0bff-bdf8-4e23-8db4-07dfc925e3b4", "comment": "Malware payload", "value": "1e98de2740c9e996a976cac0751346763fc5a648151d3155a6218fbe271d6d6a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286053, "uuid": "fae1403b-1431-4aea-8f17-42c7c8dc63ce", "comment": "Malware payload", "value": "c7fd4276a3145ecbedf826dc49978853a28fb3b9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286053, "uuid": "b701026a-256e-4bae-b700-7426408d633e", "comment": "Malware payload", "value": "b1b0ce84c6d7268d343bbeeb19607a34414999618e8edf7eb454c08baf02af13ebe11474910fa1d920be2e89974dc805", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286053, "uuid": "bf8d2b62-33e4-4b25-95f6-319b907e2c63", "value": "T149D2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860B37477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286053, "uuid": "75aa2050-28a6-4710-9bdd-8b23882ea86f", "value": "768:NumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Nu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286053, "uuid": "4186d4ef-044c-4188-b8ea-a88145c24c30", "value": 28656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286053, "uuid": "5926c54f-b9a2-49ae-a6f2-18113957d7b9", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286053, "uuid": "c516a15e-8edb-4467-b1c1-95d12718e67d", "value": "194.9.6.40_1781286000986595_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab332c4-6607-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781231692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231692, "uuid": "dd5bb533-2687-4419-9a67-c2bb9bb642f2", "comment": "Malware payload", "value": "58ce6ba89dcadd90a71edf8d9f236cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231692, "uuid": "6cb71b70-ede4-44b4-aa23-10a1809c2c67", "comment": "Malware payload", "value": "1f978caad35865e1667ac10c57fb85b3cfb2da48837ed366d2fafbde89d59c72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231692, "uuid": "8e36fd62-a5da-48de-9964-9547e0579097", "comment": "Malware payload", "value": "0902a88a6cbb32812aae5882d19f22cd2f60a006", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231692, "uuid": "3135da8b-2ff8-4927-82aa-791787dd560a", "comment": "Malware payload", "value": "549ce49526084d98b66e66b0d12acb6dd8c834b181111023d7b9c01b217579d2cc290c8dc084f42d3737704ee78e7dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231692, "uuid": "31ee51ae-82dc-4a03-b40b-ac734086eeda", "value": "T1E3234A42721C0A57C5665AF0293F17E0C3BEBDA030F4F688655F9B6A82B4E361186FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231692, "uuid": "6991fb9b-14c5-4d9d-9d7a-b5229939f6e2", "value": "768:0nU/0I40W0GhR4hrH+21cpqgVOv5snavmLXUiqDqppcwx:98b7rcpcpbVOBXvm7U3DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781231692, "uuid": "5e5e2686-5fed-48c1-a87d-784efd7f5752", "value": 47772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781231692, "uuid": "673fb875-5bf9-40a6-b918-54616d21af5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231692, "uuid": "ec347386-8268-44d1-a40e-40372224b5ad", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4695b9aa-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245429, "uuid": "fbc2fa6e-0a3e-4523-98dd-dbb493e53de1", "comment": "Malware payload (Mirai)", "value": "7e4728f03b6b116d4143208628b6e8b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245429, "uuid": "a6ade098-9bef-45e4-b92c-4e951e20ee5b", "comment": "Malware payload (Mirai)", "value": "204198c7036809b764a85f714deff7f2cef8ed012084b4d844be74d4baaea30f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245429, "uuid": "acbce830-17dd-4580-845a-c7b285e7cc82", "comment": "Malware payload (Mirai)", "value": "b3f768a1d3aff7f79ebaec9ad6b2c942172bd13d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245429, "uuid": "39420901-2543-4f44-b835-92c3ef320d9d", "comment": "Malware payload (Mirai)", "value": "7d7a0898324cbf9eee2cea6ead2522dd418eb136732745af68a7d06bf3bb9896bdfbf57959ede4c3d5c4244874bca8a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245429, "uuid": "47bea7e8-7228-4936-bb5f-90a32fcd8e1e", "value": "T16AA3080ABF610FB7DC6FCD370AE90B0125CC651A12A57B3A7534D818B24F64B5AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245429, "uuid": "0b65480d-341f-43cc-b7dd-43ad5d2f6c40", "value": "1536:IHDY5vUxQFD/JAz2SM2NQFlEMyzPjZer8+sZ37p:IH85vUxQdvE5jdpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245429, "uuid": "6a612586-3d92-4627-bc87-ba04aa77b432", "value": 99260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245429, "uuid": "c72c76d3-8084-43f2-aa2c-9848c6d28b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245429, "uuid": "fe642d97-2b07-4fe8-b56b-876cd7df77c7", "value": "dipndotsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11bdc9f-6649-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781260211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260211, "uuid": "d441f3df-caca-4912-a585-8d9511c76f18", "comment": "Malware payload (Vidar)", "value": "2bd1fcca468d4e69d47a4e293baa958a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260211, "uuid": "aba844ec-bff0-4490-a3a3-cc4b81409692", "comment": "Malware payload (Vidar)", "value": "218cb51eda0edc94617d53922e081a9efdf5c30249b58bedf5b1c3807629b170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260211, "uuid": "74852538-f260-418f-a175-231814b6b9cc", "comment": "Malware payload (Vidar)", "value": "7f535ce39ef2fc9d3b684c995913b299c0dc438f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260211, "uuid": "2c4cd037-9582-477b-9481-f0371cb53c68", "comment": "Malware payload (Vidar)", "value": "7e084d021877d25fbb681ae481ea54b7a720601e4bccb19500707ab8358214ae7fe9df0056c72472265bbddb5dcacdd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260211, "uuid": "2d1c86d4-1870-447c-940e-ceece5adf477", "value": "T1ECF59D07ECE549E8D09E62318EA391933F74BC152B3623E72A9076742FB27D06D76724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260211, "uuid": "7898baa0-2463-4d3b-99af-a86df3da7852", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260211, "uuid": "0b7cd1bd-7e0f-4e90-b7e4-992340dd625e", "value": "49152:EnJ6OAVr9fQi1wMffV3eAKve3ZDofP8Re2C:EcvHARvehomm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781260211, "uuid": "0bd01c58-ad21-430e-b77e-f92bb91fd24e", "value": 3542928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781260211, "uuid": "f95d1e25-1384-49a2-aaa5-bb7399953458", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260211, "uuid": "f99d29c6-2050-4f85-8ed1-472cb1216642", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ca4c68-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245428, "uuid": "b8fec20b-6725-4104-81f9-09e7a4bd5ca9", "comment": "Malware payload (Mirai)", "value": "4312dac5f6b5ddd15e11a1f391678318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245428, "uuid": "50190a24-55c2-49c6-aaf2-cb914d8ef71f", "comment": "Malware payload (Mirai)", "value": "21f8a4449314f8afba8128641f9a9d5997c6919192e541744c75ef92b006cd77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245428, "uuid": "19887fa9-5a4e-49a4-b603-fe8107eee29d", "comment": "Malware payload (Mirai)", "value": "2e6b675856025a8b987fb092f26b53dca3484f19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245428, "uuid": "3456c0b6-cbf4-438b-acaf-dfb2a0d7d394", "comment": "Malware payload (Mirai)", "value": "413d011c5854b6bf30df85077bdd0f3ebb390dcf3b4ec76e9f2718419f02c8c945bfc02240cd7ad9ffe06b5b81d71b2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245428, "uuid": "adc80ab7-b8f9-4221-9b06-6dcf779fd795", "value": "T18BD3C021E4006DD1EC2129F578BA96B80350EE740BDE1582EFFDF95E647BD98386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245428, "uuid": "973c41a9-dd7f-4e49-844a-94069c8d1791", "value": "3072:PHiBTNkAgcly+hoVpE6AKUjq+8biA7JBd/xT:PCdny+hovsmzbisJfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245428, "uuid": "60c98ecb-f83a-4711-884d-a5c0b9618888", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245428, "uuid": "8dd99d85-5242-46c7-ac9f-63ffca410560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245428, "uuid": "7dd3f84a-44c6-49e9-af7a-bf7d67b55e69", "value": "sh2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0488bd67-6668-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781273236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273236, "uuid": "3ecd6ab7-96c8-4d68-ba11-0dbde5fe17e4", "comment": "Malware payload (Mirai)", "value": "794774b10f6cad60fd2064cf4ef26544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273236, "uuid": "181291c8-abf3-4c44-a10f-f8e70ef82f6a", "comment": "Malware payload (Mirai)", "value": "2270dfb3d16523ae9156ba2a6d3ffafd6c97b9242807a8ae7bafb58f329a2cf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273236, "uuid": "5946e120-91e0-40f1-a712-7019b3a3d7a9", "comment": "Malware payload (Mirai)", "value": "a57ed1a8740b51354c3cc73aeb858381b30b08d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273236, "uuid": "75ffdd51-282e-4be6-9c34-d4041c096464", "comment": "Malware payload (Mirai)", "value": "8c90cad2cb13ed432d5561fb374c52a10c8bdf444930d484fec9832e32706aff4332702ca314e4f84604abff9b7e278c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273236, "uuid": "4e100ada-7e50-4adf-93fe-ae218b37f58e", "value": "T1CFB3F945F8515B17C6C212BBFB4E438D7B2A179CE3EE720399256F20379B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273236, "uuid": "8fe65c9a-6436-44f3-bd56-b1e6cf51dcf1", "value": "1536:4ftyaHvx1DzrYhqV2p0a4Va2LgQTL3S7KKf2WJXlq0bwyweN65u8Pcptym+Oblvj:sPx9whqVy4RbH3SpVKbEbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781273236, "uuid": "29e33196-d98d-4b9a-97ee-22dcdde7266e", "value": 117312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781273236, "uuid": "6e1d8fe2-6eaf-4390-9027-e076eca74177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273236, "uuid": "9cf49e41-7c54-49a4-b2ae-8343d21f7026", "value": "CRY.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c1af20-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262682, "uuid": "5f581c0a-cbac-403b-a97a-e138da75994e", "comment": "Malware payload (ConnectWise)", "value": "9e8fd53064ae53c0f499b29e8a9cf28e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262682, "uuid": "a2c35f6a-1a15-4f93-9ae8-61d2d39f4c6c", "comment": "Malware payload (ConnectWise)", "value": "23ab41d7dcd2b7a576754b7677daafb432edb382c025cd66f754b48cc4bbfef9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262682, "uuid": "9fc3d203-0cb1-41c1-a8b2-e5b1bce4fa9b", "comment": "Malware payload (ConnectWise)", "value": "e967f128a3e4b634a22b42ea3dd1c08d03fd694f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262682, "uuid": "7561911f-967a-4f73-b99f-fd6fea406da7", "comment": "Malware payload (ConnectWise)", "value": "1901524af4e85051e118e47a764bd179b6dbbf662f964deac04a634f5fc4e1dea7663feb8fd6fca4b7590469e39a25e2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262682, "uuid": "9736cba8-267b-422f-b4fb-996425da9d2d", "value": "T111A62332A5E44136F6F71672A939D070BD3DBE246B20C85EA7C8681D2DB198193F3727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262682, "uuid": "3d3ba75c-5403-4a88-af08-9e6715c8af55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262682, "uuid": "66f2009b-84a6-466f-b9a4-1b28ac183cf9", "value": "196608:YLZfOXtuDj+lkIbrhibcDrlC0OqatbB5bMebjLrnLYG3zfhukOF:cMgKeBbcBeFLnjLbDDfgvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262682, "uuid": "9f7ed7ad-1562-4953-ab09-2b736b5e1577", "value": 10073600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262682, "uuid": "475e2400-d988-4de2-97e3-9d9bab1c3726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262682, "uuid": "7d6d043b-8c65-4d7f-a20b-7fb8464d4f30", "value": "23ab41d7dcd2b7a576754b7677daafb432edb382c025cd66f754b48cc4bbfef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44898910-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301261, "uuid": "2a7bc9d8-1b98-47a8-9d78-1703664df27b", "comment": "Malware payload", "value": "a822b55a9a6a8b66c068d22e52d3203f", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301261, "uuid": "f9e01370-1389-46ac-940e-d0a0d012e643", "comment": "Malware payload", "value": "248da1553ce35bb6c499a660fcd92bde6e3545b56b65b63308e7b7630f376bfc", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301261, "uuid": "82fde474-23f6-449b-a23d-26551c58ca78", "comment": "Malware payload", "value": "50fdee4b9ea69300c2769e613c92a69e4adcc0a8", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301261, "uuid": "8aed3fae-3ce4-4aff-8aa9-98e4bab52f5f", "comment": "Malware payload", "value": "4063e316ab00e3c531f8b3c1dcc1201732424d76cdd5c6c88e2c026273c22a22baeddb85f04033d38bda56929b15342a", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301261, "uuid": "3ed3c0c7-43e5-43b3-a581-7353fab89c33", "value": "T102C3F111B5A0C010D566D6B40CC2DBCB9664FCA05C47CB8F72C43BAE35BCAF1CA4B6A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301261, "uuid": "88b0d962-c42c-454a-bcac-ce776537cd33", "value": "1536:BKiQuvggRL8ZbWNTE3P6ZIl1ScKeLqN7v9Qu23df5wBAhhu5dpQxDj10aHKjcVt2:Bn1LZvTTZGzN6YZ5wWhu5dSBjR4cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301261, "uuid": "a61d224e-32c8-45ab-8f86-e4bc2d9b9bb0", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301261, "uuid": "389f6468-2424-429d-acbf-6731f41aeb16", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301261, "uuid": "6f3c9a78-d21d-4e5d-a084-e08fbbc473ba", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf93e18-6648-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentStealer)", "timestamp": 1781259827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259827, "uuid": "83898aff-3041-4511-85b5-b35ab03bf1d2", "comment": "Malware payload (SilentStealer)", "value": "f4fba8a0f3cfc8f10db4eb62c0578509", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259827, "uuid": "5e0810ef-08f9-4939-a275-b8bba7a73a3f", "comment": "Malware payload (SilentStealer)", "value": "25d698139f84c382dda5a725bb17d2812f763d32362aa01ffadd82d59c735582", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259827, "uuid": "24e5ea47-d1b2-48d5-8c11-a633a6e30fd9", "comment": "Malware payload (SilentStealer)", "value": "b64f28ef016c1200922473b5f88e35ab68c0877d", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259827, "uuid": "4654949d-f39d-4fac-836f-1128a89dbf3d", "comment": "Malware payload (SilentStealer)", "value": "19e7d6285108a7896ada834a6a79f00647d291e3c8c565211093aaef02b58e335065d8e841563a06acabf91b9f7755b8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false }, { "name": "SilentStealer", "colour": "#123ACB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259827, "uuid": "b6bbdf37-252d-434e-b315-85ca09ba6344", "value": "T1DA8302463C66DE34C3058B36658C6A4CB3963D14D16AB86B04110CEAFE79F5C9E43BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259827, "uuid": "95829c28-031f-45a5-b5ad-b4de36c57c15", "value": "1536:cSi/axjV5PgbWfSJr5IBurbsvctiKZpq5bq3PN+GntR720N8JPe1d0bFqXvm:cS1xjVRgi6JrfbnA5OF+GntZEAXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781259827, "uuid": "0184a4fb-518e-4038-85f7-1634ec36e43b", "value": 86065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781259827, "uuid": "f1b2a65c-5de1-473b-85b3-3d819faea221", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259827, "uuid": "07a484c5-88ab-4396-8395-a9c5803e210f", "value": "totemcounter.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8857f4-6657-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781266059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266059, "uuid": "8e27fc1e-bfc4-461f-bade-6611c00141da", "comment": "Malware payload", "value": "1b2b917354879a60a52056f9994a142f", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sirkeira", "colour": "#D08245", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266059, "uuid": "dc6522d0-85ec-4016-896b-908b8be2a880", "comment": "Malware payload", "value": "25e1577ccee5bc33d5273e5d4aec9442e31d7158e496cc11189b4790e25ded5c", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sirkeira", "colour": "#D08245", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266059, "uuid": "f28fdf3d-57fa-4a38-bedb-da95db6b47a7", "comment": "Malware payload", "value": "502ab4ca49761addf087a248d57866fd301468d4", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sirkeira", "colour": "#D08245", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266059, "uuid": "1ed35f86-3707-4a41-ad3c-8b380a248dad", "comment": "Malware payload", "value": "82b441a002f71f9e7c9e94a5e520709e7e82c27f870f5411f9d5cf3a1e7306de9f410b17499f0e45c492cba352538537", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "sirkeira", "colour": "#D08245", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266059, "uuid": "d98bf87a-1007-459f-9d52-9f922c089de0", "value": "T1D133E816AC6D1413A9B2CA4D4897C027FB14970315021D2B7AFD87481F7CDAAA2F1BBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266059, "uuid": "675bdde4-51a1-4711-bf47-ef90aec52592", "value": "384:t9Zfz/V77fOxi7t06OjleSnE+SpaIMTzkYh7eMye2p3cyboYdCPJEM+nj6axHODr:tXz/VeeTZaH7eMyXwJEMaZl7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781266059, "uuid": "6def801b-b6e5-41cb-a013-2d40aa737ac2", "value": 52834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781266059, "uuid": "b595afab-e983-4ca7-b583-b7762f345533", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266059, "uuid": "af111dc2-d27f-42c1-a863-51828a3d38e4", "value": "sirkeira.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434ef4c3-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263463, "uuid": "2416c070-a4bb-48c6-9269-5b3c694340b1", "comment": "Malware payload (ConnectWise)", "value": "e643b211903346b830f1bf93a8eaa03f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263463, "uuid": "39c72c3f-2bb6-481e-849c-32661fc86566", "comment": "Malware payload (ConnectWise)", "value": "26cfe3e982b980ea48dcbfb29897d6602d2f3388485ee09f078db60aec0b650e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263463, "uuid": "84b79ee1-7733-4f1a-8678-6f03b3611215", "comment": "Malware payload (ConnectWise)", "value": "1eb066cd491a8fbf6f5420e8dbbb8f706f0194e8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263463, "uuid": "38792842-dfd0-4e2c-9d8f-9c0130973e86", "comment": "Malware payload (ConnectWise)", "value": "fdc2c88b3935895a4afefbbd4d93543de91c9a833ef22a721f2170d7d190800c252c1fc05e5cb55020c10527d52eadb8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263463, "uuid": "6d6b937d-3ecb-4ece-8023-b99ae2a5dec3", "value": "T1D0E5232236F88539E2F72730AE3E91A1D93ABE605F20C54F5358142D5DB1A9097F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263463, "uuid": "c1c9bb83-f111-43d6-9d29-d82b6f7538bc", "value": "49152:WrGLq7FVsLBe+1GVxrKlsu11g7GenGwfZVkVjOi8ifyXfKVzh4:Wrn/TYGVxz48GBwRVkGuyXOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263463, "uuid": "71dcd45e-65f0-40f9-af5f-098f990a5b17", "value": 3185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263463, "uuid": "ab365ed7-fe75-4560-9998-14cf652e4c44", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263463, "uuid": "46bd0ea6-35d3-4a3c-8aa2-c4f01910d170", "value": "26cfe3e982b980ea48dcbfb29897d6602d2f3388485ee09f078db60aec0b650e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a04269-6653-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781264376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264376, "uuid": "974d13d2-2757-426b-a00e-db074bb95900", "comment": "Malware payload (ConnectWise)", "value": "7c5a8f239175f4e8cc21b3a44d311dac", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264376, "uuid": "ea2a35f4-c21e-4cf5-b06a-ddaad8a4ed12", "comment": "Malware payload (ConnectWise)", "value": "28c74cdea827d157d53e31cd347b04e9df88424d184e7d47d0f7bc742bd2f655", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264376, "uuid": "bfc58ab6-1e8c-42a1-a29c-d887e6a53915", "comment": "Malware payload (ConnectWise)", "value": "b1856c5615f5a1ad1f4bf7d1feb261751b98297f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264376, "uuid": "784869cd-70cd-4703-b97f-c5d1ebc5b082", "comment": "Malware payload (ConnectWise)", "value": "5f572ed05e8cf7b9c820443f996c7c076b2e9b24311f73e33f534e0ae94cbdd23e551ad3c6ccbf433e708fd34debbfa6", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781264376, "uuid": "111b70d4-96d2-4709-891d-0726303e6388", "value": "T11A516417324C977A02B45148C97D01A6FD6B018B561139F8BAAED1601F233C0EBFE7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781264376, "uuid": "746ef159-dea8-4be6-8c58-6dd6387719e3", "value": "48:Q7Old+4yrAJwld5HiJ3wqD1j7w2fLUwgdiXg02O8GKk4:Q7ODffKDuy2fDh94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781264376, "uuid": "28288bd4-870d-464d-9755-0c1557ed200e", "value": 2624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781264376, "uuid": "7d993f03-4677-41d3-abf4-fb4fe857d829", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781264376, "uuid": "3cb706af-0d7a-4cc7-b652-b6d6f0e44fc1", "value": "Property_Brochure_File.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8384fd4f-6627-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781245532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245532, "uuid": "5de31534-f132-420c-b672-a3690d990a15", "comment": "Malware payload", "value": "405852bc74d43ff850584cf23394599d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245532, "uuid": "bd5b11a8-e090-47fd-9038-657ab14a3466", "comment": "Malware payload", "value": "2a0f415fdd9eb24e0d39124c81072154a5a3b8f48650540c6cab1129698fadd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245532, "uuid": "59edabbc-2fb9-47fe-a20f-50f513d551f8", "comment": "Malware payload", "value": "9324c8173875485d1b65374279395e7c7d541f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245532, "uuid": "5c591e02-70be-4b4a-8dc4-309d13a81247", "comment": "Malware payload", "value": "fc86f04adc5c13e902fb6d60514e7f237996ed154c8dc60057d598c17bade80f8eb0a939b84d8699362258c1e01e3414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245532, "uuid": "6a293de2-c57b-4860-83cc-f68dd2db2146", "value": "T1F7B53B06BCE109E9C45A633288F26696BB24BC440F3623D72FA1BB782E777D06C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245532, "uuid": "cab41c96-b082-496d-96cd-c905f64ff245", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245532, "uuid": "c4a1b325-f207-4731-872c-ed9a9e8482a0", "value": "49152:NitAEdHlktX6EocDreCgx6QRdwpScnqb:NCCaCgx6QRd7cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245532, "uuid": "7f2c2fba-83b4-4cb6-a80f-cc2002a6c2a6", "value": 2404488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245532, "uuid": "b2e1b1f7-e2a8-444e-95b9-a4dc2789a8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245532, "uuid": "5e910bad-0450-4327-844a-0669848c5e1b", "value": "405852bc74d43ff850584cf23394599d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640538c8-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245479, "uuid": "fdfbd449-7b1e-4e46-b5fc-365ad4e89e11", "comment": "Malware payload (Mirai)", "value": "089770a186ea4727d1eed7a06a53b961", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245479, "uuid": "41f98c4c-128e-43ab-9c55-9fe9684c3e49", "comment": "Malware payload (Mirai)", "value": "2c80ac6720be04126b8a41722c21967f744b1b8825e1ec3a53f53f3828644b24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245479, "uuid": "1051556b-6a3e-4245-9943-543ffd61d0c4", "comment": "Malware payload (Mirai)", "value": "be8269e00d58cf366ce2fdd6ccce87ac8174f919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245479, "uuid": "d1703905-b6c9-4383-a034-2df258e54ac9", "comment": "Malware payload (Mirai)", "value": "d2b2a0eea806e37f041b313652f279afa7ae40c1e7641229255d898fa7baf0da30ac4fbf817de507c11afeeae6c78e58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245479, "uuid": "beaa989d-1e2e-4bf2-ba3e-d6d37da1ace0", "value": "T152148E68FE8E78D2D2C7E37DAD4A0FA230277D749565C0B11A00A29FD5EAFD489D0613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245479, "uuid": "65eb06b1-18e3-4622-a1f0-bdada9646d4f", "value": "1536:OYtdyYq3BANtiz4UoUWHyeCFbjKEdAStt8YTpQURvqL4dqiofCsHNNjzPx+P7dF8:/yt4wz4UJP8EdAxYC4qfiofCeNRzPxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245479, "uuid": "1d512c15-d012-449a-a0fd-65756f433677", "value": 197488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245479, "uuid": "892673c6-0bee-49e1-8097-6066b20f08a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245479, "uuid": "00bc00d5-52cd-459e-b2bc-41290dea1a15", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63171a55-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301312, "uuid": "f0f6980a-6cda-410d-a7ef-008d1cec7351", "comment": "Malware payload", "value": "8706f246b4594326e9d4ef0b9208fb7a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301312, "uuid": "62ecefbd-c8c3-4339-a399-4642caf9f9a6", "comment": "Malware payload", "value": "2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301312, "uuid": "69abf787-a721-41cb-82f6-56eeba0ac724", "comment": "Malware payload", "value": "ec6deea196a0d187b70d1dde0b5455926c03c129", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301312, "uuid": "41c06a04-abf2-417b-9213-7d67a741ae79", "comment": "Malware payload", "value": "d3b465c65a47bf579d03c476410ffba12d0771d82d94c4a291adc3826b13fe85763ac37561a9545de420168ad5810e31", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301312, "uuid": "56e359f4-1c45-42ff-a08e-f20ce2a33051", "value": "T1BF515C50AC149FE0D5546F3626C8906332634F0E946C84ACAA6FF26B85107682E68D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301312, "uuid": "31c9f06f-46a6-4c93-b299-3c4c5e89e9cb", "value": "48:5yKxD7vPUWa7SKgKwD/pj16PISTAC15YMl+G7v7qnxSWT+ZV7KN+flajlK:5PxfvPda7S3pjUjxYzGz+xp+/Kk9cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301312, "uuid": "2e1c039c-f1bc-43dc-a93b-b3d17dea289b", "value": 3036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301312, "uuid": "50a4eeeb-0398-4e64-a0d4-133d18430b83", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301312, "uuid": "908e1185-0786-4072-b7fa-094ff98599d0", "value": "BL.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0cc267-669d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781296418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296418, "uuid": "31d38886-970c-4bf4-9b53-c472ee4fb465", "comment": "Malware payload", "value": "2b3b4005c97de95abc143edf027779ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296418, "uuid": "e1c34fd7-69ca-4741-8647-7b3a20fdf361", "comment": "Malware payload", "value": "2cba920d9d99e8f2342701c33450f5c7d53022688dd5441d6f2921be9c00b296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296418, "uuid": "4712ae94-2b39-4c51-aa56-bda3e9b6240e", "comment": "Malware payload", "value": "b59ff925ba83aa118ad215cecccaba118a5f01ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296418, "uuid": "4527a377-e151-4efa-b2f5-a1b03c662da4", "comment": "Malware payload", "value": "ee7e0f9fac97aaa712b04066147351fcdfee345bbb1fe75515fa3d99cda70c0e65d15f386bed5953a0f4520e27f8eb33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296418, "uuid": "dfcdf863-3af2-4e88-844d-796cf1262ed2", "value": "T1AEF318D7F900DEBAF84AE73644134905B130BBA244925A377217357EEE3F1890977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296418, "uuid": "c44d1323-9432-4c7c-b73d-d3da25afea52", "value": "3072:gJ6gCi/vKjvgrG5hy1YlSQIfNUivo0XkVTjbifL2CR9lnDu49Kn:paEy18Svftg0XfLZLDv9Kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781296418, "uuid": "3547ed6d-8ecc-462c-bfe9-5e9df9f82145", "value": 172068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781296418, "uuid": "7df6d422-0319-4929-85f5-cee796cff028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296418, "uuid": "ab425de0-3f04-4838-88c5-97232e1ed595", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b908d7-6670-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1781276801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276801, "uuid": "de63ee6e-59e5-498c-9898-8cf2040633e1", "comment": "Malware payload (STRRAT)", "value": "a9bfb3202e8aa384d14ae55f65c9bf79", "object_relation": "md5", "Tag": [ { "name": "Diddyware", "colour": "#178032", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276801, "uuid": "2d46092f-d7b3-4229-a8b3-0c459fd9c161", "comment": "Malware payload (STRRAT)", "value": "2e18f573a3d725166b259af96ce51f56a690c6fe04de739275099f8c02f6d2b2", "object_relation": "sha256", "Tag": [ { "name": "Diddyware", "colour": "#178032", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276801, "uuid": "13cc5f86-665e-44bc-b764-8c7716736c95", "comment": "Malware payload (STRRAT)", "value": "2e1325626f89911cbb934603b05dd0b36f3d444c", "object_relation": "sha1", "Tag": [ { "name": "Diddyware", "colour": "#178032", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276801, "uuid": "4d581f01-6dfd-4e36-86a7-0fc42db15c9c", "comment": "Malware payload (STRRAT)", "value": "2c7d151f06932ea0949e08cead94e16295b7bfadccccb0a9d485b06df8e5222ec05cd0bc42c49b7656d632c7c3b18475", "object_relation": "sha3-384", "Tag": [ { "name": "Diddyware", "colour": "#178032", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276801, "uuid": "ea9eba02-824e-4181-86b3-6dbcbfadd6a3", "value": "T1CEC42301AC5F451BFA450B30BB998D77F31783CCC789A620C96869BE6D0DD42BA897DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276801, "uuid": "6eead3e1-225c-4c5a-adbd-894cb2b95415", "value": "12288:hfSRjLsaLYRMZmcJP38MGrbqGS2pJ/ph/xb+Nv1tu/bo86H:h6RfLYGAmP38MGi4phDJbgHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781276801, "uuid": "57e665fa-30d9-454f-99b6-9b2087a4f214", "value": 584673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781276801, "uuid": "be5d019b-3482-42e7-a795-44ab881db065", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276801, "uuid": "5cfe515c-4528-4580-b0c9-f383a51198a1", "value": "HypixelSkyBLockDupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26682d9-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286064, "uuid": "19fe848c-7378-45ac-b30d-efa222478db2", "comment": "Malware payload", "value": "af6de76d7c6034e43d01cfd5abd379ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286064, "uuid": "782a85a8-dbed-4dde-b96b-2de255a2e16f", "comment": "Malware payload", "value": "2e333d2617ab3ea038f9a3ddd05b48af259167c361c6afaf7121f1db6b2a4f5d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286064, "uuid": "754d09ed-9f49-40de-b2ac-6fdc13ebcb47", "comment": "Malware payload", "value": "8b6ba5c0939d8012dea7c92db996a9d878a81d14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286064, "uuid": "65b4c9bc-ab04-47cf-8793-dc415841b261", "comment": "Malware payload", "value": "e4c36d81d85680b2355eb6cdf27376537d1a4387ba22e2a020bb7502f4f6142da037da7215540fdd5cf8e2eef9862b25", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286064, "uuid": "1102fd6b-fe77-4663-b0b8-a853f2dfad39", "value": "T1BCD2DF34C4D83FBDEEAA2A1C06FA6A20D7D68B1E9494860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286064, "uuid": "9108e279-9ccb-4873-ba77-e8d050297150", "value": "768:ZumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Zu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286064, "uuid": "57fff509-1542-4188-9ac2-cd0d2f13f651", "value": 28668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286064, "uuid": "25b99676-052c-4a3d-bf3f-c80cfe573998", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286064, "uuid": "b7edd256-f7b9-4589-bcb9-ca23e64fd2d2", "value": "194.9.6.40_1781286003064040_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18852d27-660d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781234185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781234185, "uuid": "afa48e0a-3501-4377-a4dd-cd699cc21b5f", "comment": "Malware payload", "value": "42982b76aa2d7c96f081542547776dd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781234185, "uuid": "936dd59f-b075-47b0-9629-cfb51cd78496", "comment": "Malware payload", "value": "2f2e6e45945ef45dc34f4b9d513a4739ef5427b0f32c7929513eaae552ac80cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781234185, "uuid": "4cff4b89-a0cb-4a6d-a248-811cf019911d", "comment": "Malware payload", "value": "b7ac00aec2a54f0f7139283d0c98f74ff4aeb155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781234185, "uuid": "fdfdaad8-27aa-4343-880a-5d407b6e21ac", "comment": "Malware payload", "value": "3a975859a3293ec344fda20fcdeeb7fee372fd51ea7341b927cebe2828ff0586f3080a3afff8137a1f4eb29cda9d76a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781234185, "uuid": "9fa67f38-f42b-4cf3-94d7-27236ec07f21", "value": "T1D146E017FCB518B6C0ABA23249636051BB71BC052F2163C7BB90B7782FB2BD06975B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781234185, "uuid": "917694f8-1aad-46a4-b5e1-b385309a5aa9", "value": "f604c1c3e882e6a725b213d7fdcb6bc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781234185, "uuid": "224125b3-fef1-4866-bf2b-bc9460828f34", "value": "98304:Xy1G5EVhS4bvs4mNhCB/HwgPrFsPW0AyMT+CrP3jKr:X1uV04b+hCRPZwpMaCrPWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781234185, "uuid": "372b38f2-1198-48f9-ab0d-418519996e5a", "value": 5866680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781234185, "uuid": "7ee8343c-029f-44c2-b2a2-331fcf1b6fcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781234185, "uuid": "b24b5f09-0d95-43ba-b40e-79ea2ae5fa91", "value": "upd_helper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4173665b-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245421, "uuid": "30114677-a74a-45e0-bc76-20794f3883ae", "comment": "Malware payload (Mirai)", "value": "2334e119ebfecede83a6924ac2605677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245421, "uuid": "08c1c60f-b089-4a1d-af43-f0049fba5774", "comment": "Malware payload (Mirai)", "value": "304f178e03d2b97e57ae4ace130b71cc59039224d6c14a64a52ae6efc9a037f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245421, "uuid": "17b7175f-d508-40b4-a98c-6f08e0440116", "comment": "Malware payload (Mirai)", "value": "08bc1d11094b15305ac0f8919cfad070b7bcf480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245421, "uuid": "4c5bc9a4-2555-44f8-896b-2494cfc511f8", "comment": "Malware payload (Mirai)", "value": "a65873de36b7f375e6ce85129eefc5e69d8290017d3ffbee58e3369b31b3956b13110018e841b3791ea760293c5991fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245421, "uuid": "ef7c5d36-711a-448a-9836-e9714d44c89d", "value": "T1C404392F258192F0F6411B746BCFD3976C390BBF51A9909F6B416329B6E0B7BA02C447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245421, "uuid": "4e7ca178-c0c2-4ac3-97a1-665e05ab6aab", "value": "3072:7mflblbBDfvNUZem/LVA7bGQU66gOVNLddnNgRdgJi55wnUX9:7IJ5k1DVA2nDXNgEJi5aUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245421, "uuid": "8f4b24b5-247d-4bc0-80fe-865c59d25c38", "value": 180808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245421, "uuid": "2686f137-9eee-4c6a-ba78-906841b9031f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245421, "uuid": "4cef2b48-05f7-47d6-aa6c-1b73613e7e2f", "value": "or1k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b049fff-6655-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781265274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265274, "uuid": "78ed3699-40c6-4952-813f-8612fa3d7add", "comment": "Malware payload (CoinMiner)", "value": "d8affaee6cb3455f5083cf4fcff58189", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265274, "uuid": "60bea812-627b-47a3-aa05-9881c7d1b84e", "comment": "Malware payload (CoinMiner)", "value": "31c8b69276db00052e45a0bbc82f88e2d4440f4b0479529ab4c94a0ef84a6a6c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265274, "uuid": "eb419c19-ab5a-425e-ba4b-ff5c571164e9", "comment": "Malware payload (CoinMiner)", "value": "cfd3e1289b33f3705d3136e090478688055ab8f9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265274, "uuid": "d65f18d4-a0a3-4abc-af85-7d7fd1f785e4", "comment": "Malware payload (CoinMiner)", "value": "0984037812f15a4b2c4c90605609e812f2397b332b06e734423c95dd959df8f792606a996f3a4b333a6f68f9c94904a3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265274, "uuid": "741f9d8a-5123-4211-82f3-e309cc23cc56", "value": "T1AB22491A6E5A0032E3E109F067B68A5D117E857327C6B3EBF333C4994EE5644C001BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265274, "uuid": "b1ec6467-6aa7-4a0c-a7e2-fe91a5c36e82", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265274, "uuid": "135c6eaa-9378-4353-b95a-4feab9f9f3ad", "value": "96:xOd9o2Yz/9PYz/qYhdB5Bs+dy8LDL1x+ZQtY2dcNsm8EPFJxGE9mZ2FFhxC7tCEy:xkoFWlB5Bnx+etMtPFJxTEZmFhSKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781265274, "uuid": "4bed68fe-19b4-4f6d-999d-aefd71e95930", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781265274, "uuid": "79061457-9686-4e0f-87a3-c1d7b489a7cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265274, "uuid": "47c92d5a-781f-4cc1-a557-b39ef864fc92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c22bd72-660b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781233520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233520, "uuid": "f578fd7e-a486-47b9-b108-4c4dcd3ece49", "comment": "Malware payload", "value": "7cf04975a772a99cdba29fdd993817bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233520, "uuid": "5cb433a5-e085-4af7-b48a-35e4cecb4435", "comment": "Malware payload", "value": "36f9dc2c9550610e0835de0653b9ba633e6770d280065b0c3f1a438079d421bf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233520, "uuid": "e20f9795-6ceb-4fc4-b1b0-9bbf9d32082f", "comment": "Malware payload", "value": "30ae63e3f0623a50aece6bb53fd9c5d56ab56b70", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233520, "uuid": "585b5697-d343-495b-9104-0b141b8f97d5", "comment": "Malware payload", "value": "bb2712375ed173cf7c9410957b08c9514d2bc2d4d61d44fa3f2919340b6a4758d04db4b7f7654099c08135fe7cba2aea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233520, "uuid": "6d7640c2-293a-4bfa-8d1f-5a44dc27232f", "value": "T1B54120D624A05F73CDC4890175A2E2BD216C90DFFF2F2FD5E4588AA572883D2B1409CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233520, "uuid": "3d6ee54d-7d2f-4862-b32c-618ba21292ab", "value": "48:gfXkYeNPhiW45D67J6dgBK760rrIz66ahmiiA:i0d055D67MdgBK760vIz66ahmiiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781233520, "uuid": "a927276e-d71e-454b-8812-c799c091739b", "value": 2023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781233520, "uuid": "04555d3b-dd56-4efd-bf19-afd3ad5e0264", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233520, "uuid": "e7b0fbfd-439f-4b80-b52a-52c1819b871e", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd612190-663b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781254245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254245, "uuid": "e91e69f2-68f0-4049-b316-1c5f5c38cc39", "comment": "Malware payload (Mirai)", "value": "69fe4b09ef86b258432a90dddb170bad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254245, "uuid": "98c8345c-9818-40e3-b3bd-af0e10acdf57", "comment": "Malware payload (Mirai)", "value": "37aeecd2749319b1b4bb923b1dc8fe7fbd769a558094676bf952e93e911e71da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254245, "uuid": "8a53be06-d20f-453c-a26b-965742a11885", "comment": "Malware payload (Mirai)", "value": "4b3b7abe36ecd11c588bec52b2b3b8b4940bd18e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254245, "uuid": "b77ffaf5-e67f-4e4a-8641-53bddaef5131", "comment": "Malware payload (Mirai)", "value": "a1d237a1ce72587697c9ad9ac9ebcabc37b252993bbce4a1df465b35dd774fdcab8a426810115c851f5a23cf4ebc550c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254245, "uuid": "21187aa7-e8cc-44dc-aabc-75fbe100098a", "value": "T152C30805B30C0943D2633EF43A3F2BD1A7EFAAC121A4E640355FAA8991B2D375946DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254245, "uuid": "39dfb81c-3027-48c6-a80f-09e87e49fe10", "value": "1536:5P5Jw3FjVxpOVV/PhP8DWJpzOfsuENEHWl7vAtJ9aTMVAfrqGo7Y+0S:5hJ8FhxsGhsuEaHWqtAB+0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781254245, "uuid": "0cae08c8-8b82-48b3-81e5-af03aca10bfa", "value": 119192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781254245, "uuid": "dcf79803-3b9f-49eb-bf2b-176c09c75c29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254245, "uuid": "9d40e077-e83d-4ede-b459-0953c1647890", "value": "CRY.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6822c8-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245416, "uuid": "a930d41b-83ca-4b45-8b53-42eab3a83795", "comment": "Malware payload (Mirai)", "value": "bc3e3b3389488a3fecfe566195f646b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245416, "uuid": "8c2253c1-d79b-4c03-ae23-8a45ab7435d6", "comment": "Malware payload (Mirai)", "value": "37dd9aa98bbf90bfc39bc7f11418f29c005b0441f504972d5163fada13003fcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245416, "uuid": "6dedd70d-64bd-427d-8979-932a44af6310", "comment": "Malware payload (Mirai)", "value": "c86e92cadeae511caafc3eac4f65d2344e418a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245416, "uuid": "a582d3f0-06cb-4f4b-a656-a77304cca834", "comment": "Malware payload (Mirai)", "value": "30cd31adfcc3e80927de32f6b91f5a12ee086e0b29013c8bea7315f4db18bde148f8e245d4343ccf4ad691b97ef2f346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245416, "uuid": "fd16c131-1a48-488f-8651-d8d199903b9a", "value": "T18F93F91E2E229FBCF769C23547B78F21A39833D227E1D585E25CD6015E6038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245416, "uuid": "a4a906f4-f270-400a-9067-6744e0f78a34", "value": "1536:R2yoZQSgK70mcHN+cuAGNn3IXlyvGmOb+BbHIbLLPeHt2+3bP4H:B0Q/K7i0IXUvGmOb+BDIbLLH+rPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245416, "uuid": "1269a89b-20f4-4d3a-b356-613b0a637fe2", "value": 97452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245416, "uuid": "0cf25382-1e7a-415d-98f5-8fd84989afa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245416, "uuid": "5f35b908-9291-4cf9-a22b-dfbd23472b86", "value": "dipsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5630ed-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245437, "uuid": "44471ff6-1582-48ea-a207-a08ae419c1c4", "comment": "Malware payload (Mirai)", "value": "26e36e16c2bd128427fd59bfadd17f93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245437, "uuid": "20ca9384-7773-46e3-883a-2aa904893d7a", "comment": "Malware payload (Mirai)", "value": "38cbf2203a0522d04e06502f0009a1db5c97cf93dea7a3f354dedc1a35fb08d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245437, "uuid": "5da89aea-eeec-4449-82ff-653ce0a5380c", "comment": "Malware payload (Mirai)", "value": "215717290b3fb71212bc1a2520a23ab1aac6efe3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245437, "uuid": "4849ca0b-5987-4184-b5df-4ac92db017f0", "comment": "Malware payload (Mirai)", "value": "4cb4c379c3bbc3b953c0d2c87c669217fb0110f828a5c70fa06b432a63f13320258b1d64c4b8fa8caaf34b30cde2b587", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245437, "uuid": "0f7c4a6f-02de-4b6b-961a-02221697086f", "value": "T15C53029150F4F469C63283B262044F062789CD91BF05DCDC38CA132B6D9AF5F9F89AE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245437, "uuid": "8260be7e-b458-40f7-8b92-24a6dfaba674", "value": "1536:LznwRRM10ac1B010ZtaS4SV/zQUjsPwttl65y4Lkg4azHx:XrREB5taUVLQlwtt0JLGazHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245437, "uuid": "4a315108-4822-476b-8111-6e518989442b", "value": 60788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245437, "uuid": "c553baa1-eda4-4a25-8f85-62c7b5865fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245437, "uuid": "a63b6267-fcf6-4b87-ad8a-2520ccbfd0c1", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f784ccf-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781245552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245552, "uuid": "6f482163-e9ce-42e7-b84f-88eea9e1b40c", "comment": "Malware payload (Vidar)", "value": "40cad489faafdfcb9140d877c8745bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245552, "uuid": "cb3a752a-0dd0-47fc-a7a0-159b94b58871", "comment": "Malware payload (Vidar)", "value": "390221fc4d0610e40d53c0fc9f1ff4f780d5e5ae8e0f782fae645272fa269657", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245552, "uuid": "2e3c6f1e-b52e-4699-97aa-74457be3adfc", "comment": "Malware payload (Vidar)", "value": "e387b0352ee1e564bf371fb3e3f615fa0b8a5e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245552, "uuid": "2c4fa13c-ff5c-47a6-aca7-508ff7f5de90", "comment": "Malware payload (Vidar)", "value": "5707f16530a4089dad6fcdfe2130dab8f81aaa9302ad09350101c4473446caae13653c4acee29f255a714abdee0b33f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245552, "uuid": "c8a28d22-bf74-4e59-8c5d-b6c89ea747ba", "value": "T16ED59E07ACD208E9E0E993798DB24681BB76FC490F3267D73A51B2382F71AD46C75364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245552, "uuid": "16383e72-4b40-48d1-af0c-0650248cfa57", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245552, "uuid": "39b78408-c44e-4e7c-aab3-5e5396234db1", "value": "49152:Q1FwYGJL3uUa/POrc1Cmo+Schbh2InIFFZT0iLinHp:QJVlSn+HxhaFFx0tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245552, "uuid": "4c1dd882-a571-4122-b4f2-baa6cab1ec85", "value": 2927776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245552, "uuid": "e45c3bab-11e1-4e3f-a224-8390f04f708a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245552, "uuid": "a0a202d0-0bac-465b-b6f7-dadba771b7d4", "value": "40cad489faafdfcb9140d877c8745bd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c9e717-6635-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781251496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251496, "uuid": "ab085c0f-99c9-4651-8e2f-e4b3f72972ce", "comment": "Malware payload (Mirai)", "value": "74ac7619bc9fd0ea4f928861faf9e0da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251496, "uuid": "bb1550ae-008d-4b9e-9d52-8c024ee7127c", "comment": "Malware payload (Mirai)", "value": "391f08b27458f868bcf38007fa015a229daf3f32de37ea021479956742ae8189", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251496, "uuid": "97ecf1f0-3835-48d4-84ea-ae8f66d68dff", "comment": "Malware payload (Mirai)", "value": "0e1103e5ccad06c49338d966a81e4e7c0d56ab44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251496, "uuid": "ca2cc9de-2a32-4812-bf45-4f95eb7333dc", "comment": "Malware payload (Mirai)", "value": "a3351e4199c4807dc040202e1fedae7ddefebace40bc3fa29878d8798e904beaf342f4d0770880e9401cf92149dfc1f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251496, "uuid": "92842f8e-a5ce-44c1-a9b0-48809c60989f", "value": "T1B0F3F849BC518F66C6C252BBFB4E438D772A17A8D3EE7103D9156B24378B85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251496, "uuid": "15c33b3d-af70-4de3-944b-5c13359c9ea0", "value": "3072:4dCTQMtQMrAX73cMv8eLLzv1bCKcABa3tNPh4z2CTAxq1VC6qkAQWL:4dCTQ830X73Zv8gkKcAI3P54zJTqq1Vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251496, "uuid": "da757d73-2b4a-4b24-b80d-2eaa01d57484", "value": 163044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251496, "uuid": "75532f08-7681-45be-9beb-a3612cc25c9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251496, "uuid": "bf9e4c34-1105-40ae-a8a3-233f7dd1ca01", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c848f80-665f-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781269545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269545, "uuid": "f52ae3fa-0009-4025-b1c6-0608b402f7ee", "comment": "Malware payload (Formbook)", "value": "d831c69244e6a99085d38adc6c203b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269545, "uuid": "f5c76414-e5c2-454f-b181-4021ef49f81c", "comment": "Malware payload (Formbook)", "value": "39603c646ed7cc717e7e86b727df7a4ae9b303cb35d94d26ce314c19a334c489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269545, "uuid": "ac0eb3eb-1542-49c7-8d2c-8d6497789a0d", "comment": "Malware payload (Formbook)", "value": "357e5051dddfae0f9190e32dc57c7b481c7ae610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269545, "uuid": "a3a2edb7-8a81-4863-bdbc-79947a6a15ba", "comment": "Malware payload (Formbook)", "value": "66a3c7a3cb1220190ce50c1c5a119a70cbcca5f4d1cb131f9a9d378cc06a25d141d0aebc6f45779618c128cf16d69d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269545, "uuid": "fa285393-fbd2-4f1f-bfb1-bee8ea029996", "value": "T1EC55E00113E4A6D4EC7AE7389AB206504BF0F91BD623DB4EF5A810AD6D21FD6954F323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269545, "uuid": "118a49ee-21a2-48ed-befb-2b8afc2af066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269545, "uuid": "f8025efd-a960-4e65-9151-1a1490344106", "value": "24576:dgNlRLsebAI57hBE4uROmOYoyfJuz0cy+37il1z:dUlpdkI5LyoycNyqil1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781269545, "uuid": "08bdaf2e-9ab9-46ec-8dfc-ba75c641f888", "value": 1359872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781269545, "uuid": "57f353ee-3620-4c05-8c8f-37f91b0edfcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269545, "uuid": "bced0e3f-7436-431d-87ea-7193141af511", "value": "New Quote.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf31753-669a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781295126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295126, "uuid": "3de187b8-4036-4402-9dc7-bf389f5c8d1e", "comment": "Malware payload (Mirai)", "value": "66ad30d9ceee23d18a5f6b126b34b6ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295126, "uuid": "13895081-4034-4355-9efb-0b500ce67c33", "comment": "Malware payload (Mirai)", "value": "399df624c1a46725a00c61ac737b8f80e1241f71cb24a0f5e228b67c90739697", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295126, "uuid": "9cc3a314-75c3-415f-8065-735c319aa6e3", "comment": "Malware payload (Mirai)", "value": "67cd8d8675041671bf574bb899377685905d7b22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295126, "uuid": "266c5c68-f033-4371-a182-3902b71b2835", "comment": "Malware payload (Mirai)", "value": "4a7feb3ffb62beb6fc363887286ffd4afe882e8eeb0479e0af917da0598c1dca7121553d678016302b86a7466ac760ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295126, "uuid": "63ee825e-5c65-4b82-ad92-f83f56859134", "value": "T19EE30845BC519F57CAC562BBFF4E438C372A17A8D2EE7203D9256B24378B95B0E36102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295126, "uuid": "db3f7001-fd25-4f13-b456-c746768cdf8d", "value": "3072:t5D54QchqY1dg+VnaYD4dpjDIVa8tY04FiHSff692ueiS1AnT:t594QIqkO+VnLD4rDIE8u04F8Sn692ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295126, "uuid": "d5166c81-65f3-4d6b-a14c-7afade0103d2", "value": 152516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295126, "uuid": "a838a4c5-11a0-444d-a04c-92d67c7fef89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295126, "uuid": "f017b0c2-3f23-48f6-bf43-d8e255a53c32", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeeb4337-6699-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1781294567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294567, "uuid": "c54e3009-f80c-4b8f-8671-21e336989709", "comment": "Malware payload (NetSupport)", "value": "4af25b0f58535db40705f9d8065f3187", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rmm-tool", "colour": "#22BAF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294567, "uuid": "aeb63370-bc02-47cb-af96-f987d69daad2", "comment": "Malware payload (NetSupport)", "value": "39d523a5486403cfe8f8e1f97779d5aa5122c1355dcb8fba4501004cd7f0a321", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rmm-tool", "colour": "#22BAF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294567, "uuid": "73b61a5f-72ff-4743-9f8b-ad87ddb8bde9", "comment": "Malware payload (NetSupport)", "value": "07fc8aba1594c9b3b5322c55b4e22b052627565d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rmm-tool", "colour": "#22BAF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294567, "uuid": "56a52b6d-a351-44e6-9c8e-651e255d3191", "comment": "Malware payload (NetSupport)", "value": "3fa9189e619c00d4bef5239ab640a2321c4365f597818330f7094837ef99c2304a7ffafe1a5ed186d7b590994b3de78e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "rmm-tool", "colour": "#22BAF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294567, "uuid": "9747c38b-f62c-4a69-b3a5-fce3e8e0f15d", "value": "T163C5335B3E70CD44E3A6B075ECBD9254E5E5EE2B9E33001986C3FB686B325160741BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294567, "uuid": "40c682a7-ff05-49db-b9f3-1287a4184380", "value": "49152:EmmqygW9ccCoofQczXNmpZZ2mogvRhk/vDNfiTY70lOP:tmPggNCoofQczXApr2mogvRhk/vDdi22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781294567, "uuid": "d3e894a6-8e0d-4d4b-a7b6-c05d2410cfbd", "value": 2519040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781294567, "uuid": "767accd0-1df9-4278-bd14-4c3cdc3186f6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294567, "uuid": "2cdab1e7-ca77-4019-a25c-10f29d199ac6", "value": "package.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4c7bf5-669b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781295556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295556, "uuid": "86a79245-8682-485d-80a1-695b7b7274d0", "comment": "Malware payload (Mirai)", "value": "3c4959e8ee6c7ab405248b7475ecdc3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295556, "uuid": "bbef2e67-2181-49af-b47b-a81c6b88d5b4", "comment": "Malware payload (Mirai)", "value": "39e354d05a987aa3ba6cdb5ad0d835c302b47b9ce60cf52102caa0162b815075", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295556, "uuid": "714ec87f-aa3d-4698-a39e-8e35e205b01c", "comment": "Malware payload (Mirai)", "value": "d81328d7dc34a7b23da0e4622c70be34e140e7b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295556, "uuid": "280cd786-47d0-4890-9ac8-0307fa25e825", "comment": "Malware payload (Mirai)", "value": "836661095ae4a4f4890ae0f515670774b13ef557897edca19c2e238841ea3cb8f23b98e6f2f4b311dd6d9806f41234e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295556, "uuid": "5c7aeb2f-1b0a-4a64-868a-afd52748cd66", "value": "T1B1B37E85EA93E4F1E09301B12966D7B38733D4366027DA87E3A92E31CCB1551C76A3BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295556, "uuid": "a757b0fb-bd3e-42ba-a604-5104c4a3f9fd", "value": "1536:JzakXA+Ajw7vRJ7ErPF5xLvgUVCwXiqS9SAMSsErB9clggm4GkgG:J++AsDRJ7gNEwSqS9jpL99cyHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295556, "uuid": "355a3412-391b-4ec1-b4e2-c1ddced8778d", "value": 113056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295556, "uuid": "7c768116-9d83-4cb1-ae77-716e1ade948c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295556, "uuid": "9b0ff2dc-c70a-4461-8450-34cea7ae0b0f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47612b60-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245431, "uuid": "7f27d5cf-e45b-44d8-8bcc-b829ac643d20", "comment": "Malware payload (Mirai)", "value": "8382884d407b9e472ab41a7c4a561a47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245431, "uuid": "b12957d2-b635-4141-9b65-a78470769ef7", "comment": "Malware payload (Mirai)", "value": "3a93cbdad030396150b549833e028652939d25e6362d212b9d539eefd7db886f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245431, "uuid": "224169d4-fcf8-40d8-b89b-8826bb87c1aa", "comment": "Malware payload (Mirai)", "value": "3871d55214afcfc4e9900804b738dd133d3eb79b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245431, "uuid": "c34200c6-a502-464c-a5eb-f46a8c8c6887", "comment": "Malware payload (Mirai)", "value": "00c4dea636b533f96ef6783d4aa8ec523fae304461613dbdcf34eafd9d40575d2cf5712aed39b48f954817e7195c11cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245431, "uuid": "60daaafe-1380-477f-b6f1-0bb85a167a47", "value": "T1A7D3CF32E0086DA0DD2116B4347659BC0340DEB40BD59243EFBEE5AE28B7DA57DEDB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245431, "uuid": "251a24fd-2852-46d0-ba6d-d48d9f67de9b", "value": "3072:kNulV+GOAc3YSmDEjdX/VuHVv3WDRGGRhaUNZkP0Z6a:yulo2ubIVv3sXL5NZmO6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245431, "uuid": "c7b865d5-e42d-4087-9dee-80f999434d41", "value": 131656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245431, "uuid": "f7d53f56-5ab9-42f1-b4a2-1f78833d5d9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245431, "uuid": "9d2125de-1f9f-4723-ad8c-2045daf44808", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2842ce-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245496, "uuid": "fde9401d-4ab5-4d89-981c-d30a5624ce45", "comment": "Malware payload (Mirai)", "value": "6bc4647715c333b63a3247a00dc66730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245496, "uuid": "4ee07897-62b4-4339-8f27-fec43bfb438a", "comment": "Malware payload (Mirai)", "value": "3b0641c10dfec08e0252f14a8f686c0d2f92d20ae0de0672bd03847c8da73163", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245496, "uuid": "f15447cf-49a7-4a40-a371-479c63a26353", "comment": "Malware payload (Mirai)", "value": "62b85e1e74feb22b6050503358aeee13bbb41a90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245496, "uuid": "58145269-3d9f-4f96-8a67-45729f2bfced", "comment": "Malware payload (Mirai)", "value": "23cdb0b3479e7115392940b32d3b1bf3e4b8bd5be31e5cb1443666b4a07eb868e9dc6c03eb13c4499e5fd5da46504179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245496, "uuid": "b926b880-2472-4c19-9cea-85e2ef2af682", "value": "T15DC35B82E6A2D0F1E68701B00557F3E68935EA305416CEC6EFA93D71EC717829D9BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245496, "uuid": "f886d141-e5db-4ac8-ae62-dda79fdc2cf8", "value": "3072:36tJsoRNjmj1VGCLUZMIV9Sr+QVrxZNiokw:VoRNjmj1VGc3rRioj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245496, "uuid": "a7bb3017-8993-46c9-bec6-eafdde8497a1", "value": 123472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245496, "uuid": "b26ffd55-6b9d-40b2-8590-5ca2ea70cf09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245496, "uuid": "8a6f0560-303d-4a22-a5dd-acb868c1728d", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d929d2-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301176, "uuid": "3520c6f2-1f82-47c4-bee1-163befcdf106", "comment": "Malware payload", "value": "9f798787e9dcf3e084a19019ee3138a7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301176, "uuid": "d67d3e7d-3ffd-4ee9-b8a9-7e2e66725dce", "comment": "Malware payload", "value": "3c3dc4631bfc5d4da207718a064851c01bf8946b630c3548342dd5db35ec00d4", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301176, "uuid": "69ea15d1-fdf1-4798-a71f-c1e72f2e412a", "comment": "Malware payload", "value": "886c5f28e449fccc2ebd7a2991837bfcf996b2ca", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301176, "uuid": "48a55030-7cde-4b9f-94f4-6b6e49f01fb6", "comment": "Malware payload", "value": "d524b127bc451b816439c35e8d79d1b5f1892daa0d054aebb72a102ff2cac2e7abddd579cea39e4b97bbed5fdce8f8dc", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301176, "uuid": "c9cfef99-fc6a-4267-804a-e278a4b13802", "value": "T15FB3124B7DB626709EC2956606DC3F44045FF27D09F266439337E612A9E2FB05B68E30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301176, "uuid": "2ed8a5c3-67a4-4419-bc52-b91fd621a306", "value": "3072:a8ZsisXRUqaBOK2811rZbxIsbiYofnxY/HNt3:9sfB3enrnlFb/tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301176, "uuid": "f5afa41c-0ea4-4387-84c8-2ad5934f7d41", "value": 109493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301176, "uuid": "dfa1b7c4-9ba8-4f3e-ae7a-394a0631a2f1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301176, "uuid": "aafea35c-ff61-46d8-964f-070498d7ba7c", "value": "REQXForXPaymentXInvoiceXXFER48012000266666230-7134009_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf07b76-669c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781295986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295986, "uuid": "09761dc6-5a7a-4b29-bd3e-cab08aba87ca", "comment": "Malware payload", "value": "8631fd9494665636b6e7381a0eb77609", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295986, "uuid": "45385b4a-8fc1-4431-ab47-9ee6a98a7796", "comment": "Malware payload", "value": "3dae305a8f49979223df7c767dab84f2ccdf101ae45d8fc84ca84324e8cb18f8", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295986, "uuid": "e55c2a46-7cf3-4ccc-8299-aed1b0170691", "comment": "Malware payload", "value": "3e4736ca7c14def23cdbde482e00b4e5176f0749", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295986, "uuid": "293e40a9-c32d-429d-87eb-d3ea3460dc4d", "comment": "Malware payload", "value": "dfa0e415769e92e9981d07bbecb8205cba1f010fa1fd235980e63be7fdbe02a6b98651753e7a1ba0fc8078d0529cea40", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295986, "uuid": "8c313192-80bc-453a-baf5-f38cc687ffe8", "value": "T1DFF57C0AFCE14DEAC06A637189A64256BB75BC450B3623D33E50BB783F72AD09C75718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295986, "uuid": "7e0ec141-ebc1-4679-9c7d-d267160da332", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295986, "uuid": "036e2ed0-ce80-457a-97a5-b25ed7c734dc", "value": "49152:tSrnJMq2B9xtpRn4rGxTG3D92bHrmKne8Y3h:tw6pSKxTG3h2bHrmKeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295986, "uuid": "8b544aab-d8d1-4e20-948f-2cef33d5415e", "value": 3370856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295986, "uuid": "c1cfee89-d643-4164-85da-fa56148c2e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295986, "uuid": "6c20dabd-63e7-4496-bf94-7e29312bbd92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b3d4dd-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781301403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301403, "uuid": "fb393d87-9f9e-446a-8b94-971926121be5", "comment": "Malware payload (AgentTesla)", "value": "3d15ce61908afb6fb7db2bb3c1493e64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301403, "uuid": "6139b166-d9ce-46cf-a74d-a4111f7f435f", "comment": "Malware payload (AgentTesla)", "value": "3e022c9dd7c1268fdb9108dd4a92c54f1c8cf071e8bdd7c93e371fe3a9fa4bb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301403, "uuid": "877d9aaa-9e47-436a-8339-92d4435dbb90", "comment": "Malware payload (AgentTesla)", "value": "09ccc608e74b1e42939b98f49ed85db467c5c9f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301403, "uuid": "725bc16d-e831-4b32-a604-551e6afed3a0", "comment": "Malware payload (AgentTesla)", "value": "5c089e975d986d9922c43e07fef497c03c2ca12da41549c0ff13af21e17c4ba8402c18aa6de3d53b34368f5179febfc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301403, "uuid": "056635c9-6719-4419-b146-e1d3761937f8", "value": "T1A375330A322263BBF7E5DA7637243255957FEABF395B83FAC030A643085CD1695728C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301403, "uuid": "5f5a8b84-81c4-472b-b7d0-d9409f1136f2", "value": "49152:4tsfivvlq9fFFsdGUtzwXyC0ft6XEILs0zd2:XfiHg9fFFAzwiC0ft6UszQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301403, "uuid": "3f3e2959-15dc-49b5-a18f-1b0e00b15dc8", "value": 1575426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301403, "uuid": "2e5b2dbd-c52d-474a-8bee-cd4ac9a6c8ad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301403, "uuid": "9d295d7e-f136-45c6-a108-54da6393af1a", "value": "\uc120\uc801_\uc11c\ub958\uc1a1\uc7a5_\ubc0f_\ud3ec\uc7a5_\uba85\uc138\uc11c,_\uc6d0\uc0b0\uc9c0_\uc99d\uba85\uc11c.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b37d72f-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262671, "uuid": "0cf7c329-9fb2-4e87-acd7-89d3d0b9b06c", "comment": "Malware payload (ConnectWise)", "value": "f25651a6e3af686d311908a2e0cf3846", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262671, "uuid": "f094b6e8-e2f0-40a8-9911-0a28186e6bf9", "comment": "Malware payload (ConnectWise)", "value": "3e0bef49a581534b918178f06d19bf08efdb5102ed24af7a60e0944c1095ce66", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262671, "uuid": "b982139c-32fe-469a-a28f-b850b1187be0", "comment": "Malware payload (ConnectWise)", "value": "86fa113224ca862e89ad378b1bc71862638e88da", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262671, "uuid": "9d0dc30b-0bac-43ee-aa4e-656516b67f15", "comment": "Malware payload (ConnectWise)", "value": "084a85ef6504e695481b5a407bb0a86513642fa486f5eb1f3d0d723d6172f7d2fd38f0beefedea19fcfac2c93fd7f0bf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262671, "uuid": "33d96ea5-d468-49a8-8dde-6923c0c73bf3", "value": "T151F72330B64ACD36CD9601B08D3DEBAE602DBA75076590C7B2D83E2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262671, "uuid": "781d8119-164d-4e68-b2b2-ec835ebe0698", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262671, "uuid": "705532cc-572b-4c63-960f-f9fcefc562ba", "value": "1572864:jDuwAeEnjKBZ8shpCNc4xkHt4vrGm9X13588cns06b1O4Z:jywAeKWBZ8s9FSvr1P358Q06b1OO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262671, "uuid": "2db01815-5522-40ce-be51-5a20c0ea6286", "value": 76208920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262671, "uuid": "b9c2ccb6-9ebd-4fdc-b332-2cca535ad692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262671, "uuid": "d32469c8-7a47-4bbf-bfc2-e7ca9eeb0a81", "value": "3e0bef49a581534b918178f06d19bf08efdb5102ed24af7a60e0944c1095ce66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d536ef5-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245468, "uuid": "d2ec2644-eb00-4597-a61b-283d402fac1b", "comment": "Malware payload (Mirai)", "value": "d45036cd4c08e64102072bd4e0ca83e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245468, "uuid": "6a1ceb52-6b01-45c3-88d0-9236512726e4", "comment": "Malware payload (Mirai)", "value": "3f84495595e4270548e01c84ed301f0479db05204e62d1c3d632bd12ffdd967c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245468, "uuid": "e53b129e-fc05-4b45-ad2a-de287a789d83", "comment": "Malware payload (Mirai)", "value": "1526dd481fda61b29d19a3268212c161b8e7fb49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245468, "uuid": "6a6e4c5c-cd2c-4d02-a88c-aaca0a86a2bc", "comment": "Malware payload (Mirai)", "value": "e7971b5871d4f0f394a3c1586db4fb7377320733c34a8119cfcdabd733f256dc0d224ec6d9b65079ae14372df64df105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245468, "uuid": "7a67d7cf-ea1b-40fa-ad5c-5177015f606c", "value": "T199F33C47B7208FB1C368D67009B3CB67A6E6269216E19985E76DCD107A3075C6C3FFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245468, "uuid": "9187b2e4-79b1-41a9-a3b8-f97dcd621344", "value": "3072:o3VJgzikZXyrNo/tqTHmnsHgCtEUQW0l/1wLxpvEcJz3n+fau:oFJMZBtqCnFCtE1R1WpvD4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245468, "uuid": "9bfea481-72e2-4fe1-adb0-3f07a166f009", "value": 166944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245468, "uuid": "a7bed227-ef5d-4ffc-8df7-2ea814a938a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245468, "uuid": "24c6d60d-25cb-4327-afec-019b7b593c80", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9612bb3b-669a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781294955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294955, "uuid": "87415fd4-2478-44a0-a0dd-a7f9f05cc7df", "comment": "Malware payload", "value": "65d48b03c73eafab5a9307a21a6164c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294955, "uuid": "605b87c4-d1ba-48c5-bb1e-8528c4a1e2ab", "comment": "Malware payload", "value": "409bf5649561daa704228fcd83fdb0cb7b8083cc5b60f1f55d11527d5fcb6ecc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294955, "uuid": "34083918-69ff-440d-bd24-cce96576035c", "comment": "Malware payload", "value": "f2eeb3878ad3e4ea85b8e8f174569ef7d60a483b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294955, "uuid": "1eeb5f96-cbb2-4433-b720-86008151fed5", "comment": "Malware payload", "value": "f15e8fa777e948c163a27cade8feeef015993185bba4f5f8a498cf24db741a8347f5e41bc6e441f14db30f45b39413b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294955, "uuid": "38ccaccb-639e-444b-914f-601482f21c74", "value": "T17FF34A17B4D080FDC8D9C2B48FEEE12B9A32F45A5134B15F27D86F262E5DE206B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294955, "uuid": "6161753c-b65b-4bdf-a274-081d4c45f976", "value": "3072:WBMsVH6S3JfpXGHy2AF/zDf68wXv2pR4vLbl6i+K5nQ3wTK3N:MvJhXGkNu+K3l6q+3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781294955, "uuid": "292a7196-2d23-4c99-9dc8-5f67af03a8a8", "value": 158504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781294955, "uuid": "860e2609-4efe-4413-bc60-d02c0c3a6794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294955, "uuid": "eb549c8c-b538-4cb8-8b79-f736b57989ad", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c202e9-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245435, "uuid": "b38532e1-198b-4cdc-bc27-6b733801b942", "comment": "Malware payload (Mirai)", "value": "12cf6e0493b3882c5a8f51f73408ed78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245435, "uuid": "13ec298c-5fca-4b11-90d5-fc34c0e538b1", "comment": "Malware payload (Mirai)", "value": "40d08f4d13eac1bf87bc273cfe529c8e5de2a43cd9598bf38b39d10c921cb0df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245435, "uuid": "3a0b8226-9cba-4dd3-96b1-67d94a773ecf", "comment": "Malware payload (Mirai)", "value": "562121ea0c1c48967faeabc61536d30249940de0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245435, "uuid": "7c3cd01c-5456-4b07-bb26-7549142388b9", "comment": "Malware payload (Mirai)", "value": "10c895250a3e8a9ac921d158b80053ec2b9e090f788fe493c7772c658a3f52ef96019569d3a47d6ab8cf08e22b233e44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245435, "uuid": "a80b68c5-e5f0-48e9-aea0-51d7b54ef185", "value": "T11D53022616A5807CC475C7320E4C8CA2837A81199B74439BE56AB6FF2E42E05F860F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245435, "uuid": "62ea204a-5bfd-4652-809a-db8dcaad512f", "value": "1536:zoZ/Yzn9l6maZh7RybbM6EwryUxNW78z77Sshed23lAQb:cSn9jaBybw6E4yUu707bhed6+Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245435, "uuid": "dd82ea4c-74bf-4827-b298-262c4aa05ceb", "value": 63912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245435, "uuid": "2b2c4abf-dc51-4bdd-b313-aeca498c7fe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245435, "uuid": "368ed103-bc3c-4e70-9cc0-514ca2b5ac5b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678fc697-6635-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781251498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251498, "uuid": "f1ced1a1-017d-40cf-80f6-c29ad4052669", "comment": "Malware payload", "value": "11b5d7797b1ad5ab4607eb1cb9d08b16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251498, "uuid": "901df727-8992-46bb-a6f2-5921bd4e6c9b", "comment": "Malware payload", "value": "41b79ef9aeb8d422ae5be89e2311beeb85298c195a1830faf1e30f53e021e16b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251498, "uuid": "00b057a1-a966-44b7-8292-3970259a7930", "comment": "Malware payload", "value": "fe9895a724c02eb685eff941d6ed2840c24569a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251498, "uuid": "27a66b89-c417-4498-a75f-39bf84baeb22", "comment": "Malware payload", "value": "075bdf62ca16a73c4b45f88c4b166c392a21395cec94f45ef496781f82f392fd7dd24373bb9b600dbbd9bcda7368bb8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251498, "uuid": "71e21b4d-346d-4090-92cc-2084fa95c5fe", "value": "T10ED3BFDFB28B5590C42506F01BD79F9E3F5322658D5FE8E62C1D623B24B26CB090A7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251498, "uuid": "1d8faee1-1278-4035-9701-fc4e8e89877e", "value": "3072:GoG8kRINXCZivPkthkaGmdf1IVOgbWeJq:GXVqNcttrzdClWeJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251498, "uuid": "c3550b33-ad88-4073-a12f-a1baf7978118", "value": 132272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251498, "uuid": "ed975c25-c88d-4359-8a4a-081a9d57568a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251498, "uuid": "ea7030a9-872f-4028-896c-59325d494117", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a4217a-6637-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781252219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252219, "uuid": "b1c37153-5a86-49a1-b374-8842e6281942", "comment": "Malware payload (Mirai)", "value": "ff10d4ff99cf52138eb7fe9720064be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252219, "uuid": "03bcebff-dc3a-46b4-8fde-ebc475d3e43b", "comment": "Malware payload (Mirai)", "value": "42a11483950a807472f9fdaf12e734b69b4f98370357e784c6b2df8dd560152d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252219, "uuid": "0caf22c5-8401-4f89-b380-73b881e747f7", "comment": "Malware payload (Mirai)", "value": "6889b27a843056e3577584ad3efd919488054fca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252219, "uuid": "b76ed953-fd48-4590-8e13-40ba17a7f073", "comment": "Malware payload (Mirai)", "value": "d85b88df3b1dcd6510ff7517a70efd5b3ad0d1139ad8950ada88a1cb5630b45527e75a088ed22d3d38c95d97a410420f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252219, "uuid": "498d6a12-4ff3-4ba9-968f-c4e95e26ce6f", "value": "T134041897F900DAFDF84AE3374413480AB130B7A255925A376217396EED3F1D90877E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252219, "uuid": "d87facae-4d75-40ad-9504-40ea405d3575", "value": "3072:XT7BcworqLB34koy6he0jM3aiunaingd7V1jbiRLuCbHFYCwuvKT:D14S6y6AV3a5aGgd+LfmCwuvKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252219, "uuid": "d98c311b-e4f6-423a-8eaf-39572f089686", "value": 182180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252219, "uuid": "f8643bc1-af96-42d7-b154-158ceeb45fbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252219, "uuid": "88f5dd75-d83a-4873-92fb-44508e086589", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3209fe5-6671-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781277448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277448, "uuid": "0877e2f3-a2bd-49b6-aa6b-5b6a65fb2436", "comment": "Malware payload (Mirai)", "value": "02b2d352d16ab6d0d17ab2292fdc8834", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277448, "uuid": "6c12c8d3-eee4-47a9-8649-d5bfdcfff86c", "comment": "Malware payload (Mirai)", "value": "42c982251c083492949a37c78bad1af1370c79ea4c842a212d1d51d2015fa821", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277448, "uuid": "647b8480-dd56-491d-81f3-8a9e478c8439", "comment": "Malware payload (Mirai)", "value": "2727d089c47bbea90c38a4a8eb8fa6889d1c9a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277448, "uuid": "4d5ba1d8-0d92-483a-8b13-bb6ec8db4e6d", "comment": "Malware payload (Mirai)", "value": "6188b9d0e14771a4368037da8c456c45950bc1e2e761736dc97730524f7b427b2bfcf3b0b39a80bb5857978d444bcc6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277448, "uuid": "f8fbb987-641a-4b50-9a50-83917e764e98", "value": "T157B32B05730C0947D2633EF43B3B27E193EFAA4121E4E644395FAB8991B2D325986DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277448, "uuid": "01ef227b-4ebf-442b-8151-0d79c205399c", "value": "1536:J25j4ZawxBxrgyJ5h25W6PEs6t/HUYvAOJfPAarWEwrqig3k7a:JiWawxBxrpK+s6FHMOT+n7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781277448, "uuid": "338161b8-acb5-4ebc-85b4-5fcbd32c5fac", "value": 117716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781277448, "uuid": "50f2cfc5-5260-47f3-99e4-ba2d4aa61bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277448, "uuid": "7982dfdc-09d2-47c2-9363-c93f164f07a1", "value": "CRY.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe27d91-6603-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230225, "uuid": "617d0b2c-8695-4e56-951a-aab8853fa8a0", "comment": "Malware payload (Mirai)", "value": "0451ca1003795e61c878df101ea61daa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230225, "uuid": "e663f75f-3011-48b9-9fba-798c6ec6fe53", "comment": "Malware payload (Mirai)", "value": "4464d02e2aff702f539b7e762592a345c92cf8b9ee631a650b6f64c09e7f6fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230225, "uuid": "74a070b4-eba2-4887-88b7-3c79e6b44125", "comment": "Malware payload (Mirai)", "value": "3450ce1ca84ad5748da8d1fbcd7f3223d954ccc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230225, "uuid": "20b18703-18ca-4930-b2f7-dea8885e375e", "comment": "Malware payload (Mirai)", "value": "87c01c201611614eaa54d645ae1f473b5529ac4c03ee33fcc3005fb8ffcd1dce4f893c3c8005d0c7d3771cd00e4af1d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230225, "uuid": "22d02a3e-a151-460e-85f4-129ee2a7b318", "value": "T1D0D34BB6A107716CD6E010F0A98353EE3EC31914AF6EE5D23D8BE1F7A9342CA5506F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230225, "uuid": "bc73e9e8-e6d1-4d1f-8b6a-051a49e1a7a2", "value": "3072:IAnJkQ7dqLAgJQAt+qQVB92ArRg/niUKq:IAJ374heqKV/Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230225, "uuid": "1f37768c-e0d8-4576-9036-f4d7b8e9b1b4", "value": 141164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230225, "uuid": "b2195817-a25b-4802-9b17-6bb0f23b1a2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230225, "uuid": "3d09dc70-2515-4914-944a-6b04a9a05b9f", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c5aa6f-6666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781272646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272646, "uuid": "31afd482-0d44-4440-b7d2-63ca60bea436", "comment": "Malware payload (Mirai)", "value": "168f13c3a97277a165f5e0d70d3fb8ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272646, "uuid": "698c36c4-bc45-4f4c-817c-c6bacd5cec5f", "comment": "Malware payload (Mirai)", "value": "455f013fdd05af7b613741ab7663e021a094222658c8a7a31ae0efe512c07922", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272646, "uuid": "a419d6bd-682c-4330-9e31-546fd063c824", "comment": "Malware payload (Mirai)", "value": "30454c04894c1aef3463f4821de0a513d0bbd498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272646, "uuid": "265fd3d1-6c44-4644-a206-992c9bff7d9a", "comment": "Malware payload (Mirai)", "value": "237d89ca7c7c7069bfdf047addd81db0cf2a0cdacb8d8e9d8945621050a33f2e3a189d7b962bd7a3044dada86afc0e3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272646, "uuid": "0028c818-b007-407c-b920-af3fb4910445", "value": "T16E938C9FF24B48A0C4618BF00BC74FCE3E6322619E2798E72D5D567A18756DB1C0A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272646, "uuid": "a2446468-c1ff-49fa-81d0-ba7d9abada9c", "value": "1536:MxS6xUxpG43aOwrE97EBHQlrLdsrG+FDgVlr/LW21:CS6xUxpG43aOwrEVkwlrLerG+NgVlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272646, "uuid": "ce666d43-ed41-4208-a4b3-cd2be96d9199", "value": 91416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272646, "uuid": "fe9e77f3-244f-4644-9dcb-e838fe33819c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272646, "uuid": "6bfe0c66-e1a4-486d-bb41-81fee934867e", "value": "CRY.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1faa0243-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301199, "uuid": "397e844f-d29d-4650-837b-8cb4c5c02856", "comment": "Malware payload", "value": "2e1d7450a358520838e719ee8fd8b249", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301199, "uuid": "4e026114-9cc4-4abb-9bf9-8ba08c475e4d", "comment": "Malware payload", "value": "46041ea50df52cd2be4a5f4762faf903d730335ed23c6565be817c2cf9f2143f", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301199, "uuid": "103faa4c-ee0f-46e4-a79a-f6fb2188d726", "comment": "Malware payload", "value": "d36b5c1c654998cc88da481087e9829f158717f1", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301199, "uuid": "5467e1ab-fa7f-48b1-9f75-2d9994520cba", "comment": "Malware payload", "value": "dd5139e5ac080cfbb707971d481fb15e6dd48c056e966ab686b6b9fcfde5b955fa54c0b7e89031d17c214b0e083b29d5", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301199, "uuid": "68a7acc9-5fa2-4b30-ab70-fb83f1d45f08", "value": "T15AF42323F8C25337DC93A4754DD251DA9704BC8A6C85850BBE01B32DBA73B369ED690E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301199, "uuid": "77796484-bf14-4e8b-83b0-12267b2d88ac", "value": "12288:84FRRUHEPgAXXcouNh6cGY0HS2FlPGAH00oHLhnryi8KXvuUt0WUVScxz13:GEPXciJZ9Khrhui8KmRAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301199, "uuid": "820422d8-e6fc-4a63-8475-75483f063629", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301199, "uuid": "f08512de-f5aa-4dcb-8576-655580d6c53f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301199, "uuid": "a3b7c979-7156-4901-9d5a-6c3260c13d7d", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574369d1-6605-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781230855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230855, "uuid": "3d11c006-ed48-44b9-b3de-afcbbf9dc558", "comment": "Malware payload", "value": "8ab350be57f9a99b02dbab56d734d083", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230855, "uuid": "9994598c-65c3-48b2-be26-7ded03fbdac9", "comment": "Malware payload", "value": "4699a6e2e8964240533c236f1b2657a3ee2017e921592f15475dbbf2f7f48773", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230855, "uuid": "ffa1e1e6-040a-4271-b604-84800f727a70", "comment": "Malware payload", "value": "14f8eaa4e096ede3f2923711c044bffb66c47484", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230855, "uuid": "ea9d2866-fb95-48eb-9089-e9469cc7fdae", "comment": "Malware payload", "value": "93856380bfdf2cd8803ca6f3d09ce96f89644f076846cf8d5bbacb234438af7426cbcf8e6f68e306e166b76f8064759b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230855, "uuid": "71f947b1-0a90-4747-8459-54d726bd2cbd", "value": "T16D136D6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE31875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230855, "uuid": "78530bac-4f78-4359-9f98-f0ad73970cfe", "value": "768:ir9NyXsZztCQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:sHusZoco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230855, "uuid": "5620fa8e-947b-47b0-8960-3e5de3e6741c", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230855, "uuid": "2825ef14-4f9e-4338-8492-722460008a20", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230855, "uuid": "0c96a38f-401b-4ed9-bd8e-b0d8867b6547", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eebe245-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263455, "uuid": "a6dfd7b2-37ee-4e4e-a301-53458ce26189", "comment": "Malware payload (ConnectWise)", "value": "7045f19d0b66dfd301722e3a2046d5c1", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263455, "uuid": "14cf5ae4-d96f-4d78-99df-600b2e3b00db", "comment": "Malware payload (ConnectWise)", "value": "4717927ba7136c7149215bda25513aacdecef883242a98d2574ea385d4112c02", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263455, "uuid": "1c82f2c4-61e2-49a2-b16e-7e8576ec9ac1", "comment": "Malware payload (ConnectWise)", "value": "1713dda2b106500922204704b4ce3326ca54e7a0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263455, "uuid": "2a323bfb-3510-4620-975b-c040fe310243", "comment": "Malware payload (ConnectWise)", "value": "afc49217dafe2dd793ffe02e8a243a2d228e14e76fad03edd6d51f63db07ee4e6f3d67689bdb8bee56a38522785e5521", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263455, "uuid": "bc771eb5-1b83-4675-847a-8a1065b04651", "value": "T19CE5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263455, "uuid": "6b848f8b-d0c7-4368-bb52-1a73441abc10", "value": "49152:21girGLq7FVsLBe+1GVxrKlsuWGenGwfZVkVjOi8ifyXfKVzhc:2Vrn/TYGVxzTGBwRVkGuyXOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263455, "uuid": "9a34c202-a90e-491c-a28f-f4f8a933f8f3", "value": 3182592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263455, "uuid": "741a49db-800c-48f3-a7a5-bed2d894abfc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263455, "uuid": "94562748-3fc6-463d-908c-a64310fcb55e", "value": "4717927ba7136c7149215bda25513aacdecef883242a98d2574ea385d4112c02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7fad25-66b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781304205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781304205, "uuid": "9ec998d0-fd6c-42bf-9b06-a703ac5ce5df", "comment": "Malware payload", "value": "a0488d6b21eac64760ad5036d8deb94d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781304205, "uuid": "d9b21c91-1122-4bde-88ba-7e37100f2213", "comment": "Malware payload", "value": "482a93acf04c83e6692f7575cee7b9e6fc79ac148c8824456ac3dfb7f198f5ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781304205, "uuid": "31377e29-f047-4405-8271-bba9da17eccc", "comment": "Malware payload", "value": "26fa6dc50ed8fd8ae708d7a19c023cfd6980166e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781304205, "uuid": "2fa449cb-0043-4b22-b96c-9383ec652400", "comment": "Malware payload", "value": "a4b2af309cd2e0c206b9ef72a43d6ae80326581a8b6b2d8d922fe4881254b5a2dbf1e7251c7593c84df6df0aa3066a60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781304205, "uuid": "ef9da967-e827-442f-99b9-0e2af2b906dc", "value": "T186F4F73DCC64422FE172D519C899494FF8825A1B222CE90B60C73B5BAF3398677D729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781304205, "uuid": "32eb0872-8367-4647-b855-8099c2ff02c2", "value": "3072:0VgX3Vb87eZpo5L/0QP/QC1mVIqcJhkfRfbc09RlUxGy9MfKEDNlQCjmeghArWpy:T3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781304205, "uuid": "abade2ce-d5bf-408d-9944-6cb457534365", "value": 782552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781304205, "uuid": "74812219-0f0d-4885-a63a-f8871f0009cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781304205, "uuid": "156df995-7e67-4726-a880-6ebabb6b19e9", "value": "Quotation request 6572600197_00003221.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394a86d1-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263446, "uuid": "1ed9b23c-537a-43c1-ba8e-3f7ed4a391bb", "comment": "Malware payload (ConnectWise)", "value": "6e2a35a6fefcc83fdb82ec5e4ca3c00d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263446, "uuid": "41a32b1e-f7fc-493e-8fb8-743c8485a399", "comment": "Malware payload (ConnectWise)", "value": "4834845a41a26479e00660c0e2ca85d751e7be0162aca908b75d8ac59e4a5125", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263446, "uuid": "bd4d6884-76b2-408d-b2e4-325ad7139b11", "comment": "Malware payload (ConnectWise)", "value": "28a64df6d54988727b357d33d7e033fefcb652f0", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263446, "uuid": "c7748a6a-50a6-4b87-88bc-338a3f1e0335", "comment": "Malware payload (ConnectWise)", "value": "34e9755a1af17ab327c638a2946fbfafc6bf0fee0b773a05a1050a4a772392ae31e777919223ac3090b298a291d8923c", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263446, "uuid": "564e2b6d-ef6f-4911-8d17-44cf8b597f74", "value": "T1ABE5232236F88539E2F72730AE3E91A1D93ABE605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263446, "uuid": "4b1e55ec-1069-49f7-a7da-7eeb554a4efe", "value": "49152:WrGLq7FVsLBe+1GVxrKlsu11g7GenGwfZVkVjOi8ifyXfKVzhj:Wrn/TYGVxz48GBwRVkGuyXON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263446, "uuid": "dbe8d3ff-2510-4c52-b092-05031131305b", "value": 3185664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263446, "uuid": "b44d5825-18c1-4828-9e4e-79f191e69baa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263446, "uuid": "0f266b46-ec05-4049-a622-57a2e9d518a4", "value": "4834845a41a26479e00660c0e2ca85d751e7be0162aca908b75d8ac59e4a5125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b00c9e-6601-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229325, "uuid": "a8388350-b8f9-480f-9450-3df2792a7f8f", "comment": "Malware payload (Mirai)", "value": "23fed0ecaf977fb9a2c64321b203be27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229325, "uuid": "0c8bd2f3-cbad-4794-97a9-5a18fd3db3b0", "comment": "Malware payload (Mirai)", "value": "488ecaf38597ad581185f61942850ca785176ff8ccc55e490f544aa67a6f332f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229325, "uuid": "53357a9f-2559-4b33-a655-fdef960e7d63", "comment": "Malware payload (Mirai)", "value": "91f04905b76a02e8f600a2994122d45355ab2708", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229325, "uuid": "66cc1982-6486-4fb2-9748-3c3339933264", "comment": "Malware payload (Mirai)", "value": "c06ba3371f9d4757f1b272fce0bdc489f79771052ffb79dc5258ccf933afb6eee331551e515a5fdf87341af851d6833e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229325, "uuid": "ef404ad9-ceea-444b-a93a-71837c34513a", "value": "T18F333B21B93A1E1BC0D0B87A61F34768B2F6170E26E8CA5D7D720D4EFF21A8061176F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229325, "uuid": "50f65184-a3bf-4358-96bd-f4f6cceb99d1", "value": "768:WJV0go5q9h0YVYpLS1FBVEyZenVYdK6ZBsOO+N8rNw:EV0gcSh0YVY4TBV5ZenVaKGs85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229325, "uuid": "d07d100b-da33-4431-b350-436f00790f34", "value": 51412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229325, "uuid": "7108b301-d0be-490b-95e4-2b4155505969", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229325, "uuid": "095895d3-a948-434b-ab17-0e324a6fb78c", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a9994d-669e-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781296748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296748, "uuid": "a7842d0c-1b0b-4309-9164-627721184f81", "comment": "Malware payload (Amadey)", "value": "347187dc7824a887b8f6a3272b3baf12", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296748, "uuid": "4779ca3c-c552-4bfc-9c65-c16c8a21cb36", "comment": "Malware payload (Amadey)", "value": "49999f257686cfba6fe9504ff99a7776f998e3ba4887d28d2957f040ac346306", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296748, "uuid": "7fb1acaf-02ff-4b42-a3ce-c5dad0c408e6", "comment": "Malware payload (Amadey)", "value": "1d3a5e780488095d6174bcdc49ee16c0ea802a6a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296748, "uuid": "56b8b013-4ec8-4052-84b3-25c83b61ee32", "comment": "Malware payload (Amadey)", "value": "429ed3b37a6e05b9eb779c547aadc9d12a8a08309c4cf87caae8c93ecbf420954ddb2fdc85ab620f9ccab2deda5d4733", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296748, "uuid": "f3774ded-3757-49b2-ab46-facf0290de3e", "value": "T181B63355DBF903F8CC60497501995A726396FD28172EDF4B1AB932CE3E2B08B6E34E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296748, "uuid": "dd41080a-0f24-4585-84b3-3f2901e01dfe", "value": "753375591aacf62c29fa5daa215a217d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296748, "uuid": "dd6534f8-7254-4a5a-8223-48825419e434", "value": "196608:UaH5F6kcXSnJN5iJxTgzfSshnDvadAlbn3iNdBfyudB60XL1HM022:Fn92SnkGzfSspGQbn3VgT22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781296748, "uuid": "b5cee928-7cb9-44a2-ba0e-88d94db089b6", "value": 10696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781296748, "uuid": "70cabe09-8e7f-4815-9fc9-654f8256bfd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296748, "uuid": "a6b03b16-6d90-43e7-a231-e25134294546", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9a3865-6667-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781273120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273120, "uuid": "eb06ad7a-c355-4648-b03c-21e00852ddf6", "comment": "Malware payload", "value": "4e34c41be16ccaf6b1f4457a15969ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273120, "uuid": "f7e090a1-9f83-4420-ba2f-ed8e0ddb7832", "comment": "Malware payload", "value": "49d54129a650ce97f3e6b9de4f7160d27bed7c026a6611e1eca8692df23983ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273120, "uuid": "c470b5b1-aced-4908-bb3d-a8245ef2925f", "comment": "Malware payload", "value": "74047803bbe88d74d777fadb2a47fe47f18684df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273120, "uuid": "8575cf70-7979-4262-ba02-e25830da8ec3", "comment": "Malware payload", "value": "273b8fb86505cd13c30df6ae5916fc853ec1b61b97bba35fa53bfa70848e9ef6fd4fd51a6d0715ebdbd33ea5af4a8136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273120, "uuid": "0b285ccc-6172-46a4-9fac-4177a6656675", "value": "T15A66CEE3FA8CC09FD095D5339359BD6395A9BC410720A5EF02607F59293BBE02BF9294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273120, "uuid": "7dacb4a9-dc5c-4b3f-96e9-a683417bba4f", "value": "9d3b05f2cf11e8a13ca61bb7756a0697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273120, "uuid": "0e4edcbf-6284-4f7d-b539-1a99d8e3a393", "value": "196608:I/+d0eJyZfay0XSiaDrYIdPcI3WAk65UNjI9d3Fc2cj3AODROR4B84HVvRG/mZ6y:I/i0eqN/3dUm5yNEf3628J0RaHPG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781273120, "uuid": "3ff761b5-e7d4-4953-87bf-53617fac844a", "value": 6971392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781273120, "uuid": "8ca0614f-b5c4-4398-bee8-55e3d660cd35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273120, "uuid": "8c788ece-62ee-4b57-8c80-3cc2351e3cac", "value": "\u5f00\u53d1\u8005\u5e73\u53f0\u767b\u9646bug\u590d\u73b0-360\u5f55\u5c4f\u5927\u5e08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c18fb7-6603-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230129, "uuid": "e067044b-16c4-4d6d-a615-b5befa3d2af9", "comment": "Malware payload (Mirai)", "value": "af56cc5dec61748ae3df519d2beb70ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230129, "uuid": "8d200c31-528b-4c50-8a19-6bc7ce70d9e5", "comment": "Malware payload (Mirai)", "value": "4bd0fddc41f71cd2b6f6fb20006aaa94a54f0e3ab2e132807f8b6de388d263de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230129, "uuid": "9989be57-4270-4a1f-8803-5c6b60e18514", "comment": "Malware payload (Mirai)", "value": "5e4ae4af53ee2a1bf4e6d68a462a7b4c8e5a851d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230129, "uuid": "9eca5fbe-00d0-4f36-aaa1-3c23766cadb9", "comment": "Malware payload (Mirai)", "value": "f0fa0905d8dfc8c0c969ff2d73d84483c1f928dfc2d1e4fa62e3fc6a12c0cac19fea907a2fb02a83257a65120ba122f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230129, "uuid": "c464eef5-aa5f-4e2f-aae7-cb8daa3e2f58", "value": "T15E231980BC919617C6E413BAFB6E418D332623A8E1EF7217DD221F15778982F0DB7642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230129, "uuid": "8299c7ae-9747-4f52-a5fe-733526a02c59", "value": "768:wAYKyIYegK53aEVw4N5l4T4Uo2WLOVAP2OfthuHANT7XUCxdvmBF6o:0KVYMwM5lSo2kOVE2327XLHIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230129, "uuid": "1519a7a7-c074-4a32-af8a-65fd1a4e3fec", "value": 50000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230129, "uuid": "c8b418e9-e44f-4e53-b591-d6a458c4f199", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230129, "uuid": "98f76956-f9fa-475b-a782-c217945fb195", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f567dbd5-665e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781269345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269345, "uuid": "e18fd4d8-823a-41c8-aeeb-a599e2f9605b", "comment": "Malware payload", "value": "091e3373e6b8852e32573778bfb5e2aa", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269345, "uuid": "f4338bed-f28e-4424-ae7d-2f993a090f8f", "comment": "Malware payload", "value": "4c3e5315e95f9b6e638c7b50651c4c3f98dbb406c1ec89e034d530efe7de55be", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269345, "uuid": "a4e0e484-d9dc-4d43-a243-fda1930b4b9f", "comment": "Malware payload", "value": "35a549a8bf316febe82971e1495bb1b8acba9b4d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269345, "uuid": "1542c31b-cb48-49b1-a26b-29f2aec03ed4", "comment": "Malware payload", "value": "22a00669707ba2570f0afc18e8933dc33dffd2dac234b6a9f7bf2b0bc228855f16368c1f6f2fc149d29d43a19993439f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269345, "uuid": "d4d705f6-6a09-4aa6-b6ee-d9800c48e730", "value": "T1CE0633DDEC56ACF26688EA242BB5A262D53038D13F70AF47F59B2D6E5013B835237443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269345, "uuid": "fff1c57b-30a5-4372-8ab5-d0f82be21408", "value": "98304:k6iMdyV4Q1Ii52LRrSPjpu0a9/UmYgEIkVisLdlRttMZzcThvdkO:k6iT350cjp2qmYfIkMsJttJTtdkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781269345, "uuid": "6ea6e7c1-b427-4acc-b19a-208695532618", "value": 3800934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781269345, "uuid": "b1e08e77-a144-4723-b473-299a8209b4e8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269345, "uuid": "7ee3f046-79fd-4648-945a-a21846b8c3ed", "value": "Food Procurement List for a Group Meal for 28 People.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c01d02f-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781301219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301219, "uuid": "6b0b88e4-4234-4e03-87d7-a7fbb5e85ad3", "comment": "Malware payload (Formbook)", "value": "936094a96b879b1bb788fa2c5197f05f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301219, "uuid": "db836cf5-3582-4bb3-b21c-062bff51d4be", "comment": "Malware payload (Formbook)", "value": "4d0553443e7b38a2fedc70606777b3a45dfca09e3f1d2c17992ba50a75db4676", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301219, "uuid": "3e93c356-4f35-4648-8904-8895416a0a42", "comment": "Malware payload (Formbook)", "value": "99408b77564395686e917add8e5b66072487984c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301219, "uuid": "a03d325e-477f-48d7-b4a1-be6242760032", "comment": "Malware payload (Formbook)", "value": "ce4e273a6be421127a89a9f042e28f74ae9a4a6215a1813407fbf6ba19d3bf11a02d1f8dfc06e75046a380cc8f37d871", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301219, "uuid": "6fdef9f1-3205-490e-9020-e3b767562207", "value": "T11DE1A0DD8A46F0EC2549F9B530AB8CF69E77E959F85DE4C361E45CE29108C02B0D7D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301219, "uuid": "cdd7fc1d-e3c9-4828-9818-b899adeda28b", "value": "96:8DYR0Ze1AsXz4FFd925qaiFHyOtad8knlh0a/3g1wQXBo8u/Vz4paWqcoc8TCOG7:pR0VFF+m3adPxfRzFWqceSae7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301219, "uuid": "41ca3ffa-08b7-4070-abd4-9f4ebb24cd30", "value": 7249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301219, "uuid": "6cd72200-e431-434b-a544-af3725b34acd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301219, "uuid": "e06e4215-c089-4d66-bbe7-69a41a3e6696", "value": "OrderXno.X3241688.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5668b578-6648-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1781259629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259629, "uuid": "1e78f301-4dfc-46f7-9317-c571f1ea6b72", "comment": "Malware payload (AsyncRAT)", "value": "75536e12ebe498b2f4d84752d1e7e5d4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259629, "uuid": "1f1266b9-7bd7-4497-ba84-b90ef3d9b675", "comment": "Malware payload (AsyncRAT)", "value": "4df39fdc84ae481a5fd7f19f4291d590840c63f264e0f59a823c7a98f2743eb9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259629, "uuid": "a8a08c0b-66af-4108-afae-3b0c03430a28", "comment": "Malware payload (AsyncRAT)", "value": "5835a16ffba06da87593ef83548f1d2ff7a398a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259629, "uuid": "d32a634e-f773-443e-8396-d91ff7e239af", "comment": "Malware payload (AsyncRAT)", "value": "e15272f8151433982f073e2cf6699e5cbcc95da2950d48d28a935cae64899488951568d40af15a02841f596fed3eaa69", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259629, "uuid": "48ccad7e-e86d-4bfa-81bf-9445e142ef38", "value": "T1B5232A003BE9812BF2BE4B7869F26241467BF6633603D54E1CC451DB5613BC69A43AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259629, "uuid": "8793e678-58c2-42a2-9473-55e2f6498856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259629, "uuid": "a6c2587a-a91a-412d-b13e-9a648aafcbbb", "value": "768:au/dRTUo0HQbWUnmjSmo2qMl26470CujPIYzjb+gX3EYouiYo3POlfBDZux:au/dRTUPE2IJgsY3bBX0oyGfdux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781259629, "uuid": "751ee3aa-a92d-4925-921c-4b45eaa8da57", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781259629, "uuid": "bd0f6e41-305e-448a-bae8-97c4328a3818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259629, "uuid": "42d4869d-a0dc-4ca3-a0d1-c31a9d182c10", "value": "fivemcmds.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2298690e-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781301204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301204, "uuid": "5d0cd0ed-17c8-4ff3-9ad8-b3ed3bed38f0", "comment": "Malware payload (RemcosRAT)", "value": "0816e1105dab7a951afd61376dc8bdc2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301204, "uuid": "7f64e33b-d958-46ff-93ed-f62d3646b59e", "comment": "Malware payload (RemcosRAT)", "value": "4ed9bba58f65d24c35a4ad077ac912b997152b388b1ea580f35be68bdefb3ab0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301204, "uuid": "a8d40d64-5f1d-4ee3-a5c8-666941a36082", "comment": "Malware payload (RemcosRAT)", "value": "9b3428d97cf13a090dc9677bc00012c4a3a37eb5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301204, "uuid": "2338357e-f73f-4154-8384-ec455bfd4af6", "comment": "Malware payload (RemcosRAT)", "value": "977df49d13169eb61dc19a1efc2d7f3c85bde9f97899822c5d3e66d7c42031a82f615374fed640fdd9ac56688934a3e9", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301204, "uuid": "23dcf736-0d6b-405c-8737-cbd7894fed24", "value": "T17401CA7CBC57DD43E7D7A3E1C4A3081EA5DFE222809AB1556255550F110305BC7FD0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301204, "uuid": "7fd1f3c5-361e-49b9-af30-885fdb79ecc6", "value": "24:ZOrW/HEgn1LZ4FZ7LrB9CSBdi7EjvcLjy:ZSKkDFRXPdiojvYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301204, "uuid": "5a0a2fd0-5be1-4468-83d1-d04e5a3a8143", "value": 814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301204, "uuid": "d7a40f7f-2c8b-4026-a232-6363c1802be8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301204, "uuid": "5004642b-9085-43d0-8a38-e5e97905cb98", "value": "BankXconfirmationXletter.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d23c4e5-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263426, "uuid": "0db1ea29-53a2-460f-bf45-827cd7a3b0d5", "comment": "Malware payload (ConnectWise)", "value": "58eac8013f8d825716e048d5be5ce6da", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263426, "uuid": "9f2a7719-68c2-49af-84b1-12ba9111ca88", "comment": "Malware payload (ConnectWise)", "value": "4faf038a0900962f06e8d20f9db26358bad631f2467f23b9bf707167208d357b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263426, "uuid": "76791279-f687-40e0-aa70-81a9701c8c27", "comment": "Malware payload (ConnectWise)", "value": "a15fce369baea3668938ae6fcb6dcb28417b3da9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263426, "uuid": "523d265a-32e1-47e4-bc09-a0b79551b30f", "comment": "Malware payload (ConnectWise)", "value": "f8c16119b221084fdbca912bf5e70b9bc63f51da948b92ef664fac913992d3b553ed0320ffea7ddf9247c04f979aeeb7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263426, "uuid": "a9441e2b-55fb-4f74-8edc-255918b76878", "value": "T19CF72330B64ACD36CD9601B08D3DEBAE602DBA75076590C7B2D83E2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263426, "uuid": "157d139e-f251-44a4-ac35-1345f4c1651e", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263426, "uuid": "e3a1bce7-4a40-43eb-87fb-693c4af4e8d5", "value": "1572864:eDuwteEnjKpZ8shpCNc4xkHt4vrGm9X13588cns06b1O4w:eywteKWpZ8s9FSvr1P358Q06b1OD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263426, "uuid": "de054ab1-763b-4e10-a05e-14fda35a1bdc", "value": 76227360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263426, "uuid": "2400809a-9554-438e-8df0-50768400d2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263426, "uuid": "6bc880f4-3f9b-4a73-9943-f99664d0003f", "value": "4faf038a0900962f06e8d20f9db26358bad631f2467f23b9bf707167208d357b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae7afa1-6670-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781276978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276978, "uuid": "9d79457f-7005-4909-9347-7b90b490e9b6", "comment": "Malware payload", "value": "44771cdf3b6efabe90895a600ccd4072", "object_relation": "md5", "Tag": [ { "name": "coraline-work", "colour": "#D6B508", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276978, "uuid": "848531d2-84de-439f-928a-d9030ec34973", "comment": "Malware payload", "value": "501772bc592e0aaaf595fdfeced15012c75bfd632f6de7504fe53717710656ec", "object_relation": "sha256", "Tag": [ { "name": "coraline-work", "colour": "#D6B508", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276978, "uuid": "b51b4e7e-a059-4f41-8db2-e78681f1a4f9", "comment": "Malware payload", "value": "600e16621c42b1d1d8a25766cdbe676b1bee8651", "object_relation": "sha1", "Tag": [ { "name": "coraline-work", "colour": "#D6B508", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276978, "uuid": "b36bf3ce-9853-491f-8da8-8049c9bbffd6", "comment": "Malware payload", "value": "ba6ca46bfb5fba219aa6bd9a302a7be0788628da1e2937a822923faa78f96d57e1fb219df83e16583dce990d88302975", "object_relation": "sha3-384", "Tag": [ { "name": "coraline-work", "colour": "#D6B508", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276978, "uuid": "7e48e3fd-a777-4395-8d94-8ab0f9059e77", "value": "T1E50833860A58E91BC19F827D65F0F335AB52C3FDEA151EBB7F197B387154C4028B8268", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276978, "uuid": "0dddea3b-de7c-44a7-832d-4076e175efd7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276978, "uuid": "c53ff52b-ca46-4d66-a106-466c7630b900", "value": "1572864:qt9IKP0Ci1BERWY4CjFHcftGYQhNafvZjlZGkhEP5ZSy7:qUKM3TERWijF4fJfhZuKy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781276978, "uuid": "bc83860f-a2bc-462b-92c6-8a110b6753d9", "value": 77250354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781276978, "uuid": "a2bbfb5a-4325-4382-8226-7b0e0c92b638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276978, "uuid": "e2294df4-11cc-4818-a4c7-f96ba09592e1", "value": "coraline_4.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a24587f-669b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781295338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295338, "uuid": "cd9d743c-f5b8-460b-a36a-c43b88eb1dec", "comment": "Malware payload", "value": "e0ce73dc29250f54d32fad4b8f9c98f5", "object_relation": "md5", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Vader", "colour": "#DDF5D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295338, "uuid": "174ae85f-866f-464a-8729-8d1cf7e37985", "comment": "Malware payload", "value": "508ff171ee6fc0bd0a406f1541932396b90923ea2707b4a41029eee93c39da4a", "object_relation": "sha256", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Vader", "colour": "#DDF5D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295338, "uuid": "c3667a29-d86f-4c69-9044-195ffe403450", "comment": "Malware payload", "value": "8137164e6d2c4d8470ff284f6524eaf205d77cfc", "object_relation": "sha1", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Vader", "colour": "#DDF5D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295338, "uuid": "f4d6c521-d839-4c3b-858f-ccf1fe2665b8", "comment": "Malware payload", "value": "de41e6259d91baf619bd4f3473cf5a5212508aa26c7a80a94ed7f594627170d167b3f1afc59a53467e5fa196084d958f", "object_relation": "sha3-384", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Vader", "colour": "#DDF5D3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295338, "uuid": "b721589f-ea01-43e9-8ed0-5b73d6c8e594", "value": "T1FF017A40085EE4A7D14DC47664135C7A5F14B575D116E4FFC4CCA5D18862A992723244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295338, "uuid": "a19ab55a-10cb-47f9-9a11-e09d31e3f063", "value": "12:5jHh2Zw9w9BG7HQHvRFwYIK6VnY6q2+KevW+9SYPac5L6uUkGtx2xvTBZtV5quGU:9B2kwy7mvfKTnYxQevJFskOiv9Z38nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295338, "uuid": "d3cdf860-86da-4a0a-8f9d-e0d81d6da6df", "value": 809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295338, "uuid": "c979b1b8-67f9-4d4b-9fff-ebd6150e4ce0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295338, "uuid": "7c9b3f89-d797-4f82-b464-f6b2906c68dc", "value": "doc913796.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e648ce8e-6657-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781266313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266313, "uuid": "f3a49c07-6c47-477d-8383-9bf8e67309c0", "comment": "Malware payload (ConnectWise)", "value": "ddef49e6a202e0c8bc500b7bf6cd39e6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266313, "uuid": "5b5f0ddf-f6d0-4b51-9af4-7aaf1029f433", "comment": "Malware payload (ConnectWise)", "value": "5098d85b211f0503ddb56c71c2ecb2c02fa0074ee513085fe94f00dc3aac5df1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266313, "uuid": "79c3b508-6b80-442e-8216-2c28ce3b3e49", "comment": "Malware payload (ConnectWise)", "value": "c1d8862e2df27cdf45d87c6ee84eec61e9fc78fc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266313, "uuid": "98c8d0a2-974c-45ff-ad89-e55f4d18d1ad", "comment": "Malware payload (ConnectWise)", "value": "db283c4cce4342fe4c59f54a35a293982533a650cf8f2024c2b175d715ad9142e870498324b159bc919ca91cd8404a20", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266313, "uuid": "7594045e-a464-4316-9122-a720cba6d992", "value": "T162D61211B3E595F6D0BF1678E87992655631FC044722C2AF53A4B96E2C32BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266313, "uuid": "bf161915-76a1-4c66-b4da-29cd07ed4ebd", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266313, "uuid": "c4303137-4c34-4190-bbae-2c56cfd3cf94", "value": "393216:CCXvI5MvHx2J4CXvI5MvHx6CXvI5MvHxlCXvI5MvHx3:CZ6Hx7Z6Hx6Z6HxlZ6Hx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781266313, "uuid": "a179fdfc-20be-43dd-bbcb-1b35f4880505", "value": 12762168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781266313, "uuid": "7b400733-f49b-4557-abae-cf4884cdd4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266313, "uuid": "d2620b18-097d-420a-bc32-4771a0a5742f", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f389b1-6689-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781287821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781287821, "uuid": "16b51091-9205-4060-bc06-5910f72d0040", "comment": "Malware payload (Vidar)", "value": "dd41d2f8ece37d28dd855c43fa8ab00d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781287821, "uuid": "d8c9fb7f-352e-4729-b9c3-953322a7c975", "comment": "Malware payload (Vidar)", "value": "50b1664b5e16378ed8a3a3031596237fec3b8d2cb39f278645f4364eadeccf01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781287821, "uuid": "5f7f5897-e768-41c2-b379-48d8da2fe0a2", "comment": "Malware payload (Vidar)", "value": "c6810de0024358620b0b8c84d5e3178328e82846", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781287821, "uuid": "615142f1-9df5-40a7-bbec-f29fd1bd7d98", "comment": "Malware payload (Vidar)", "value": "f423f55c85f46cc161679e10da8984a26a10f85dbeaac367b4244c657ec57553c8f8fcaf972fa7eab9a697b728955f37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781287821, "uuid": "e729c758-7f2c-473c-ae11-1c72529672d4", "value": "T1C1E58E0768A985E5C5E7A3308DB36252BB31BC180F3663D32F9172382E767D0AD76764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781287821, "uuid": "0f512427-6c1e-42ac-8159-bc6cc2f73390", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781287821, "uuid": "8d10a42c-5c74-4e37-a777-fc44b73e5fea", "value": "49152:F0L5LIbRY+IZRDKI+9YDBMj+7HT+u9I5D14IKWfZ60xHZIgeAeHNvcaJ2:FkSK/i5D14IKWfZ60xHZNeAeNBJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781287821, "uuid": "b845e23b-2711-4dc9-ad22-f0a158c39bee", "value": 3104432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781287821, "uuid": "48e93d97-1833-40e3-b461-f9988acf7fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781287821, "uuid": "4496f625-4339-463e-b5f0-e57c31e9387b", "value": "Aurora-Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b162f5-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245420, "uuid": "8698a632-fc8a-45b2-9c65-79ead0b2bc3e", "comment": "Malware payload (Mirai)", "value": "681aa48a910c10592977e087d3cb9105", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245420, "uuid": "5d8494c6-d9c2-4ef9-a2e4-2c730d303d27", "comment": "Malware payload (Mirai)", "value": "52f1276d126395e31bf38b54bd4c3768c5034c310e9631bc341bdcddc75cd8d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245420, "uuid": "b5df22aa-9051-41ca-bf66-727e659fe024", "comment": "Malware payload (Mirai)", "value": "af860b066f54464846f55a269f0ecd19b7fea9bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245420, "uuid": "299ef1ab-7451-409f-83f5-da884e394f10", "comment": "Malware payload (Mirai)", "value": "34cc01a391e6910bf20af98bd474e939b11fdd66f97824294cd1fac4c70278bbb9911579a2f93a50d58a79827394db50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245420, "uuid": "e3af064d-b7d6-4049-bf9c-20346402d54a", "value": "T1F6C3F185FB636991D0A342FDA4C00AC387912E318BA213080699F774387DDFB1F69DE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245420, "uuid": "59ef5cd5-cfd5-4f52-8b5e-d68ed3a4df95", "value": "3072:SBdQK+TG2nIjnRdZaUXUSgkLCCVwHWiEiBtbMMTnO:eMQRtXU9kLCP8ifbxTnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245420, "uuid": "cd29928f-84cf-434e-ab94-95b80c80531f", "value": 127816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245420, "uuid": "735eb359-b7dd-426f-b068-ed2c0bf8162b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245420, "uuid": "bda29725-af19-49ab-8224-83405ebc492f", "value": "riscv32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da7eeb7-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245414, "uuid": "27d84015-47f9-4a2a-bc42-0a5dd5d07a32", "comment": "Malware payload (Mirai)", "value": "1dcfdd1201ff88954e3a3e0c4b2973f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245414, "uuid": "27dff0ab-5612-4700-a75c-466ba69095c7", "comment": "Malware payload (Mirai)", "value": "532a6bde5d6c5821a20a52757162f221380a2f9b2e2d5a9998edb8d09b1dca69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245414, "uuid": "1eeb8325-72a0-4728-bfd3-fb4189215cd8", "comment": "Malware payload (Mirai)", "value": "190ae6317a46ef365ed23329df71bbeb6e1f14ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245414, "uuid": "39b68449-3e0f-48fd-8b64-7ac0440d0f0c", "comment": "Malware payload (Mirai)", "value": "13d685558f9e43cfaf26351e146270aa706af5df9e58a9d0a332a0a4742d053e15b4c0a20bddea68ec2d09e9c6206288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245414, "uuid": "b09708bc-da4a-4e9b-b585-a048f1761366", "value": "T1FA73022B518F0BB3C1F9ED33701B7A34AB78E057E4F53B05F8519446EA1DCA2624467A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245414, "uuid": "a0be6888-9cdf-4054-afaa-3a37b7074902", "value": "1536:mOlDJ9nqHLw+ZQeuFvQfPbYGiNw7VI/rW0wvnEJ3gzE94e/ohy7NorJ:9pn40+ZsvaTYbeO/VwP/zE99/ohaNSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245414, "uuid": "c7ebf3b0-a5fb-4b02-bdba-d922db7c298f", "value": 74732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245414, "uuid": "fb2b1095-8bc8-4be4-8787-973ed64c8a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245414, "uuid": "2a3867d5-88c2-4e8e-9930-1ba58502041c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e3589c-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781301228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301228, "uuid": "36726dd8-d704-4541-8055-b2634ad1b490", "comment": "Malware payload (MassLogger)", "value": "d4aa204da71682fb881f8f26a584f46b", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301228, "uuid": "903ffcae-b04b-4ea0-a578-c01f1fe681ea", "comment": "Malware payload (MassLogger)", "value": "54a7bbd5d51a0acf7ed06c7ef29f3c2c76e32d37e9141020e176808158267804", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301228, "uuid": "4d058c4e-a22f-482c-9425-bfd8d9a769c2", "comment": "Malware payload (MassLogger)", "value": "8f4493120dfd19ace17f804cd7086049267eea89", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301228, "uuid": "48b7e356-c39e-4bd5-bb31-c868db101fae", "comment": "Malware payload (MassLogger)", "value": "ad15d67f52114a970fd93402be750e0ba89434042158c7c8661fb6bb1eef0eac55c0911fa0321a6eb624d5475cad75fa", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301228, "uuid": "022fc551-f0f7-45bb-af45-9e2709f343d0", "value": "T18BD312BF77519BB04E7061100A84E821848E100F1B11BDE5DFAB27EC6F877D9FAB495A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301228, "uuid": "7f38722a-a9e1-42fe-ab9b-8c295aec8c5e", "value": "3072:FtwNpoNeGMTnacHM42G7LEMFfCs7dmhHMNRXBvyQKvUsbvFvy510:wNaeGMDaX45XEY5c9MNaQMBb4510", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301228, "uuid": "ac1b87d8-ef4d-45fe-b30e-28495cb43437", "value": 140308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301228, "uuid": "29c45f4d-ec00-49aa-aa14-681a81ca186e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301228, "uuid": "07a99f62-30f9-4d67-9813-aeef3bc204ee", "value": "RFQ_PO#4500101228.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813e8358-666f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781276452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276452, "uuid": "ab3b4881-c097-4640-8aef-0fac78cc8575", "comment": "Malware payload (Vidar)", "value": "75b92da91e849a240a3bf55d2cda45b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276452, "uuid": "a722e33d-1829-42ff-a611-2dd9cbbb3bb7", "comment": "Malware payload (Vidar)", "value": "55c7ddb0a7309dd7ed634b33c88c69155ca4dacd3ecea6d6902e48fce94b783a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276452, "uuid": "9dae33f1-26bc-4dc8-aba6-f8c0c11dda29", "comment": "Malware payload (Vidar)", "value": "86a97cc88b01475516cd8beaba0b0361625bc87d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276452, "uuid": "88272d22-3462-485f-b81e-d4e35fd1d277", "comment": "Malware payload (Vidar)", "value": "3365549e88065cfa1634f6a78297ab857d43b850ce7807f55657bd452bf25efa8cfc9c6507daa09a683d208a68c0dd99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276452, "uuid": "a47186c5-b2b0-4285-952d-7a4de487bcdb", "value": "T195F57C47FDE508EDC15AA63289A650927A36FC045B3523D32AA0BB743F727D23C78719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276452, "uuid": "6dc2692b-0b97-432d-8f5f-b2a5cf20d198", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276452, "uuid": "60e84aef-f671-4977-9447-129fb7c3d041", "value": "49152:rr83pcKgO3HuJpe+R3EtIrye5XB2IcUdPc1V+8Z/kK4PX2rkCH0:rr5bNR3E+yVMnurkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781276452, "uuid": "d6e730fc-9a44-4c06-a2a4-d10bc3c1f3a0", "value": 3563384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781276452, "uuid": "e3445ccc-ff57-44cc-9fa7-f2d38ad1ab4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276452, "uuid": "7776cdfa-d48e-46d9-9280-20f20e5ff837", "value": "ToolsUnlock_v6.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9827a518-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262746, "uuid": "b3836a7b-3aa3-4146-a50b-af31355ba049", "comment": "Malware payload (ConnectWise)", "value": "79dcf1991a96fa6cc37cb9d2ed2b0110", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262746, "uuid": "4f48862f-ace2-401b-98ae-8691bae50467", "comment": "Malware payload (ConnectWise)", "value": "5700715b1f7cc10e3a6ec3836d88067637a7055f36260d1e1c91d4db65eb4dbd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262746, "uuid": "2eddfdf1-b0e0-47dd-953d-90e7c8692524", "comment": "Malware payload (ConnectWise)", "value": "e20ed08f5b8880a496aef9c9052de49af6667fce", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262746, "uuid": "c0204ba7-0982-4143-8dc7-9be1d07e6411", "comment": "Malware payload (ConnectWise)", "value": "b5873e8742b4446ea0af2673d58ad19faaaf2273b30c647e89d9c77eee7e400844b1a29e9ec1afb5b771e7d69b9931a2", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262746, "uuid": "2470a24e-bcb2-48f9-b34b-3994ef2850f4", "value": "T1B2F72330B64ACD36CD9615B08C7DEBAE602DBA790B2490C7B3D82D2D19B15D32736E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262746, "uuid": "a04e5425-7667-44d3-aba1-b45e6d52fa5b", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262746, "uuid": "42691a20-1503-46ff-9607-87ee680da577", "value": "1572864:YStBe5eEZjJRsMxyv2+uXeTk9mTtxbwS6YESK:YmBe5e0F1yO+uXe4w5xpESK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262746, "uuid": "6380de52-9654-4345-8f1c-474daed46ea7", "value": 76323544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262746, "uuid": "28c45489-81d6-429e-89f6-bf808cdb6ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262746, "uuid": "c790230a-09e5-475c-97a3-c6b64038beef", "value": "5700715b1f7cc10e3a6ec3836d88067637a7055f36260d1e1c91d4db65eb4dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339d90d3-6635-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781251411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251411, "uuid": "8bfa4541-9582-4756-956b-4130b42b0930", "comment": "Malware payload", "value": "0e5d33a4081d2eb06bb97ed2961a502c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251411, "uuid": "289648fd-8637-4fc5-85f8-15d1a8f40364", "comment": "Malware payload", "value": "596dacf0a3f60e6680cd330255adc2d8588695fae8112f9fe2abb9e831b20b8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251411, "uuid": "4039e63c-c7b2-4614-a21b-ea3631338ae2", "comment": "Malware payload", "value": "9ac77795dfd904a2f426f0a80590f58d765ccf47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251411, "uuid": "9263c19c-42df-40d5-9720-3c889d95f4d1", "comment": "Malware payload", "value": "c7a8712de27b14af7228a7e5bf2046a6534fb9fb637a21f94f0f678c54f30e90dace4a917d63121da93d30c98cff349c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251411, "uuid": "52070887-16be-4b89-b20f-683737b4ea96", "value": "T158F35B1BB5C080FDC8D5C6B48FEEA12A9E72B4495238B15F27C86F663E5EE201F1D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251411, "uuid": "e43c1318-a5a0-4bc0-a2aa-119192e02a57", "value": "3072:3rHHwnHWkOifF6pTOut36L0C8vZu2NjTZw7ZFCHIndnxeP7yO1tPXCwuB/Y34u38:bHviN6pTtVZRTeGHInUtvCwuB/Y34u38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251411, "uuid": "05abdfd5-9f89-47ee-a5d3-6e3f9cd94b9f", "value": 169096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251411, "uuid": "6746a037-8f9f-4d25-bc9c-4e5c878c567f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251411, "uuid": "322aca7c-6466-402f-8fad-574ef5d79e8a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95f6814-6636-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781252038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252038, "uuid": "f644040e-eb3b-4655-b2d0-e1276bccc1e2", "comment": "Malware payload", "value": "d6d486d1eeeb9330ff65b9c00d11e9ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252038, "uuid": "d89a14d8-3170-4566-9778-d458e3947d26", "comment": "Malware payload", "value": "5b0aeb319dcb2096d483e56711f3fc50c04fe244e0a9bbf95b1ac58966735d61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252038, "uuid": "474eb12a-18ce-4f55-a1e3-e44f7bd1f740", "comment": "Malware payload", "value": "6b2f2906b96c5623c3c6bcb2ef5faab2b9b291dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252038, "uuid": "3faa07f7-4dea-4fd7-aeb3-6d46766ffa4c", "comment": "Malware payload", "value": "131f42995932da17534e1508ae323ea78a168f71ec5e750ee1123079faa8a1dd6e97c4fb2ba66f32bad41f837ed7cc8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252038, "uuid": "e5271d98-fd24-46e2-ba8d-1a832c7f2e1c", "value": "T1D0A67C87B8D24956C5E43637BCBE81C432631EB99BC716566D04FA3C3ABE1D90E39318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252038, "uuid": "27d0cb0e-e3e1-4127-b3c5-42e7c4d02261", "value": "196608:xsrqn7dcOgogz20QOl7AZJMyN8mT/FEA3Q1:eqB0Pl7SJvV/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252038, "uuid": "b199a608-8889-49f1-8b3f-b556f2d6a6ef", "value": 10120858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252038, "uuid": "d26ff074-a32f-4695-86fa-8f5ee996acbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252038, "uuid": "2368a14b-4a2f-4ecc-b15b-d6dce81500cd", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e98c27-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263410, "uuid": "65209ca4-6c42-4072-b152-704a0dda6e5c", "comment": "Malware payload (ConnectWise)", "value": "31f02cf6918422a762cd155b2cff57c6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263410, "uuid": "990d714d-e2a3-48a4-ba14-05143956c8b4", "comment": "Malware payload (ConnectWise)", "value": "5c851abe1cc251e2f19c45e8e8a9052f73380f6803be6dff819d286807fa4e1e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263410, "uuid": "5b5459ae-f645-450d-8636-3743071b5457", "comment": "Malware payload (ConnectWise)", "value": "aed49b76ccee4be84fc4955de9fa7861efc3a00f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263410, "uuid": "23e0a82b-e6dd-4a2e-8c4b-b315ac17a283", "comment": "Malware payload (ConnectWise)", "value": "bd4907f0f799cafe1921038b172ead738d067e5a6437cfa6ec14ceef91e1b64ac4cb28099da03738686b05e73952c550", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263410, "uuid": "686a1080-7b5b-4919-ba17-702637bd3979", "value": "T183D6233167FD4A18E1B36774EE3A91E1D1367DA4DF11D18F2264386E68B1E4082A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263410, "uuid": "67a78440-6bf5-448f-85b7-422c007cb170", "value": "196608:ErnLYG3zDhukO7rnLYG3zlrnLYG3zprnLYG3zxrnLYG3zYrnLYG3zwrnLYG3z:EbDDDgv7bDDlbDDpbDDxbDDYbDDwbDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263410, "uuid": "0f7dee20-60c8-463f-927e-56ed1ef8ddae", "value": 13594624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263410, "uuid": "9b999881-96d6-4112-9f61-1dbbae57a5d7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263410, "uuid": "1f3d6872-c304-4f6e-b808-2b50cb50c551", "value": "5c851abe1cc251e2f19c45e8e8a9052f73380f6803be6dff819d286807fa4e1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52503c97-669b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781295271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295271, "uuid": "644d6fcd-ae79-4f44-b08e-2d4b8682910a", "comment": "Malware payload (Mirai)", "value": "37bcf4f95c3f4c6ce5c0fcf2bef73a58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295271, "uuid": "bb139d0b-b2c4-45eb-af42-27238e3a0755", "comment": "Malware payload (Mirai)", "value": "5dca7ff5f05844fc96d42d3be4591a4fe4a148472c9d13cd31920634c0b5ef2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295271, "uuid": "1fb8b1e7-5273-4696-b2ed-ca93bbce0ae8", "comment": "Malware payload (Mirai)", "value": "d2c4ca7b80c8abccfe6488064faf10caada083a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295271, "uuid": "92768eb8-49de-47e2-9ccd-64f196515e6b", "comment": "Malware payload (Mirai)", "value": "0c51e6b225b78cd261f3038067df77a341b4dce5ed8cc1a19ccbbdf72470b297b740ad1e6c05dc9244a687bb2270cf0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295271, "uuid": "d129428b-c326-4720-8f68-7a4336dcc3e2", "value": "T1F3D33972DC396F68C224E579F0318B782B93A96581472FAD55B7C3788087D8DF6093B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295271, "uuid": "fedd8707-8bf7-4c0d-92ee-fde949e4c86d", "value": "1536:BBzUYSE0WRh2R3SOjiACU5W+EKx9PpJbET5WDVYj7FcbCZ/Tp37:p0swFSOj77W+rx+T5WBYj7weTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295271, "uuid": "429c85c6-811e-4865-b552-e0bb7a149d0e", "value": 138156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295271, "uuid": "6e5bed72-c471-4004-a7d0-cad12cfabfc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295271, "uuid": "bd0a0e5b-924b-4455-babe-53a2c460293b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240a38be-6638-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781252673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252673, "uuid": "b95e9584-bc9d-4c3f-8203-0054fa7a5076", "comment": "Malware payload (Mirai)", "value": "99c613214b2ef203eb5acf15cb6ccf59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252673, "uuid": "281213ad-b2b3-44be-bd84-f9f5bc039c5e", "comment": "Malware payload (Mirai)", "value": "5f17105a8af08d1a82d9b0ced66819edbc97866a1e16a760663cedcab8f58dfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252673, "uuid": "d8b8d8a2-97f2-434c-9e9e-195dd57559a8", "comment": "Malware payload (Mirai)", "value": "a24dd7399d4a8b3a1ab8f52e4ee17f7933d936a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252673, "uuid": "65f53e90-3458-4e63-b0b0-1026e604f450", "comment": "Malware payload (Mirai)", "value": "65a3fd96da42dee17531f9175565fe63b16b6ae7258c5e269f7295fe45fc0a464661bfe0ace8efcb46703e81113e4940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252673, "uuid": "247970fd-06c5-4c9b-b024-afe0f78f2963", "value": "T140936A9FF24745A0C4528AF00BCB9FCE3E6322919E1394E73D2D167A28B55DB1D06F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252673, "uuid": "15f72446-da1d-4914-b4d2-b965dcb782b0", "value": "1536:66W20vSWtB0cuzn9dM/PMJfPB7yQUD/W6SugBqF/LWx:6/20vSWtB0cuzn9dMH0HB7yv/W6xgBq4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252673, "uuid": "95aa8cfb-53cf-4303-be46-42683d27239d", "value": 91420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252673, "uuid": "caeb38b6-5a09-483c-b3b0-87a52f46be3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252673, "uuid": "18ab2170-4dcb-419e-b6dc-9192b7b954fd", "value": "CRY.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313e400f-660a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781232938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232938, "uuid": "aa1dca94-68c4-4408-8c51-a0c00f4956ed", "comment": "Malware payload", "value": "bf08471201941a37df0e9c2244845e2b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232938, "uuid": "5bd06271-b25f-40aa-b307-971a16b2f44b", "comment": "Malware payload", "value": "5f618d11c54161b66dbfe1a83cf6b52fe94f023d1f7ef6b3aa8328d68608d987", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232938, "uuid": "24bd0890-21c5-4d9c-a6b0-e2c5261f481c", "comment": "Malware payload", "value": "80fd118d3fe3bea1f36f0b50cae8249683a60955", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232938, "uuid": "3e208e25-39c9-4cb3-8c81-f02d0ea47bbd", "comment": "Malware payload", "value": "b646e2b5cb9c15dc3d65ac7ff3c07e3b7502f143e970c9b2fe3bcc1b6a21b3958d5685fc9f3c9a9fedbc90e396f661a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232938, "uuid": "2687d9f7-c5e7-4ec9-9c55-f504d506885d", "value": "T134419ED621A05F73CC8485047592E5BD106C91DFEF1F1FE9E89C8AA572887E2B240DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232938, "uuid": "9d3ec34a-abbf-48e8-928a-189656a30154", "value": "48:oCnQYDPFWJ5W67k6UAoq7XUrKou67ac/vCME:jQcN05W67tUAoq7XUuou67ac/vCME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781232938, "uuid": "6f7f3c74-01ee-4cf7-b27b-2c3c9d03be49", "value": 2182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781232938, "uuid": "eaa380e9-17b7-4e41-b28a-25547d03ce72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232938, "uuid": "f1218eee-4e37-498f-b042-10ee869cfadd", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba12d83-6688-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286992, "uuid": "c0c6b7c2-09db-467a-a102-5d36320c6d74", "comment": "Malware payload", "value": "a944b8bcfc156f0ad6b52a8553b5fa09", "object_relation": "md5", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286992, "uuid": "ea5f2166-2361-4699-a8b9-1e61904a16b5", "comment": "Malware payload", "value": "62fb046372d16c11c57747723db6645ca6686cc5faed03335c04d98a5db78a84", "object_relation": "sha256", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286992, "uuid": "e6d86806-4449-4839-a5b0-8450a7431ea6", "comment": "Malware payload", "value": "759c118f2456a69f0a6a7102cd14fa5dc2d356d3", "object_relation": "sha1", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286992, "uuid": "d350a47e-504f-497a-8fab-754ddd3ff6b3", "comment": "Malware payload", "value": "2487e362cc543ea3182e273710007398d3959b22dc1126f7ca31b700de4500c04fab3ede3fc430cca5d380e7b9f385e6", "object_relation": "sha3-384", "Tag": [ { "name": "11032026sver-blob-core-windows-net", "colour": "#5E8359", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oamorprevalece-com", "colour": "#B4902B", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286992, "uuid": "36fa1893-e417-4d9b-af04-712e1d7557ed", "value": "T1D6567D13B7C4643AD4A71A3B8C3B9648683FBA612E15CC4B7BF40A4C1F396816D36B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286992, "uuid": "fed83408-bff9-4893-a61e-73df9a021e6b", "value": "0a8c4a4f37cf3c0ef08dbab272fca40c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286992, "uuid": "558ed6d6-4d07-4a52-b49b-0ee4c36d3314", "value": "49152:eWJsZT9OMhuSgA8er7lWzHLrMsgMlv+XPs9F2Ml6c6Z2IhEjGWNVFPN8S:xJsx9Oq0XrMElmfs9FzP02pFiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286992, "uuid": "0a261b29-432c-4517-bac2-dddf25b40536", "value": 6085632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286992, "uuid": "94f1c84d-ad64-4769-9bfe-b3b88facfe33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286992, "uuid": "96b35a85-09f1-4b8b-b78b-9d0650293ff5", "value": "RMMClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6846897f-6680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781283711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283711, "uuid": "7063eda9-7e6f-4cf4-8cf7-e2d8a7de3d88", "comment": "Malware payload", "value": "7830b4b158fe9ac40a1cd02340b4df38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283711, "uuid": "691d3f2a-9b9c-42f2-8c36-5747f5d93419", "comment": "Malware payload", "value": "64689ec4b7958fb18d8e5522284ac3d586007dc64ae03ce6c46bf9297f94a960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283711, "uuid": "29be7e6f-d276-4395-a98d-5b331f034937", "comment": "Malware payload", "value": "c9b9f2480238484faead093e54397f8696764914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283711, "uuid": "6550e049-dde0-46c0-b994-b697e9b6f498", "comment": "Malware payload", "value": "4984030952c6304cf12208a6646befdc543a4897885e7d56c1c842e6ef0f69de94078662ed2aff0648b448e75d4e1695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283711, "uuid": "6de11f52-9a7b-4ac6-a72c-47ae7ea53911", "value": "T18A967CB3945224D8E1A9C9B4D51416527DB83C8B573873C7BAC472F61BBABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283711, "uuid": "8a335ae7-a1c4-4a1a-b825-94d0f56cdac5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ1:cqYUQuVDt0TZE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781283711, "uuid": "6d15fe84-ac5a-405e-a308-1a80f7b83cc7", "value": 9273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781283711, "uuid": "311ac040-358c-4f28-bf4d-073d03d07162", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283711, "uuid": "913318df-656f-4942-9a84-1344868af57f", "value": "64689ec4b7958fb18d8e5522284ac3d586007dc64ae03ce6c46bf9297f94a960", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7282b2c2-662d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781248080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781248080, "uuid": "d346ec25-29f6-45b3-bfcc-e1a991859b6f", "comment": "Malware payload", "value": "ae824557c64120658472201a68054b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781248080, "uuid": "1a4c3eae-06e2-4a5b-81bd-0a747ee2b0ae", "comment": "Malware payload", "value": "6570890558b0fe7fd8903349ade634a47a61d3b9f7bf7c224826567d42b623fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781248080, "uuid": "51953353-055a-43b3-944e-67cd78ecd78e", "comment": "Malware payload", "value": "149c8791560932a467f8b6d525071e4e19f1c9d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781248080, "uuid": "f1c9174b-c230-423a-ab76-4a14ee27ae3e", "comment": "Malware payload", "value": "66ce07aa081240e4d33105d46c6ca31ccc0251abe8e390e487466bf41e77f25dc5358ebc77a16521f17940ecfb3640ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781248080, "uuid": "4425a3a7-cfa5-4627-876b-029da21d984b", "value": "T1B8860117FCB114B6C4BAA232896365817F71BC491F3163CB2A90B6782FB3BD059B9714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781248080, "uuid": "d491b0ea-a5e8-4e4a-bba6-a9f14690ecee", "value": "f604c1c3e882e6a725b213d7fdcb6bc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781248080, "uuid": "0c9f2bea-178c-4cb7-862b-863c663f0119", "value": "196608:v3Mkeic2r7kV5Z5utnXzIDCbC/jqiQs1DR:v8keUQ5ZgnDIpjKgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781248080, "uuid": "cbeec1ac-36ce-45a9-98ff-a48176f96760", "value": 8564448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781248080, "uuid": "3abbd4fd-ac8c-41e6-8b3d-f206afe492af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781248080, "uuid": "dd6cc559-28ac-4ced-ba98-a82625240458", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc7f962-66a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781298565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781298565, "uuid": "f2240797-95b8-4b0c-b8c3-71ed3abbdfff", "comment": "Malware payload (Mirai)", "value": "498a9f25f86d0bd006665cecda1ae36c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781298565, "uuid": "210b1e96-652c-4a23-a9e4-130f152293a9", "comment": "Malware payload (Mirai)", "value": "65ba9c1fdbf4c5e514f3f77eb7127cd482f21315bf79ebc96b182a5762a78a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781298565, "uuid": "e4028e13-37e0-480d-ba95-c6a1404aaf1a", "comment": "Malware payload (Mirai)", "value": "f91d8ed2fad07361c99fede18ff4d66522f54362", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781298565, "uuid": "902448bf-cc54-4d62-84a1-24f36f1210cf", "comment": "Malware payload (Mirai)", "value": "5d12f9ba06b6a24656cd2565602e0993b2e4bb9e3725de0fa060f0840c605419944f97807ea34e05eeb0ce96920eb8af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781298565, "uuid": "50aaea3e-77aa-45b8-b533-996a7716b2fc", "value": "T1DC358D2AB2B2F6BDD057C03047DBC6A14532F0756A323D7F26C49B353DA6DA51329B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781298565, "uuid": "149c192f-3c27-4b68-a38e-94c0f03465e1", "value": "24576:IbKtwLZNglVGYIPWobJkVQ+0NvzcL4NM58C:IbKtKZNgqFbJl9NwL43C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781298565, "uuid": "4c53104d-025f-4bb1-ba94-49543016c222", "value": 1135160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781298565, "uuid": "10d1ff7e-1eef-4ed6-aa8d-abbe367bb148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781298565, "uuid": "e57e508e-3074-4490-bf35-0f9f0952ada1", "value": "bot_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9c734c-666a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781274135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274135, "uuid": "c5bef5fa-bd56-4dbc-b1c0-36c485cedd24", "comment": "Malware payload (Mirai)", "value": "dda4ad49c3c064dca94fed1902132dd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274135, "uuid": "85ee7d2b-ce95-40db-985f-d54acf9a5941", "comment": "Malware payload (Mirai)", "value": "65d463e3318e2319d411575597d582b870d79e866dba7efab3ee05f25e30037e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274135, "uuid": "5fc914ac-66d9-4334-9739-552ea1512c95", "comment": "Malware payload (Mirai)", "value": "063057480ac26ef24327d594f08ac223a361d65d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274135, "uuid": "9f457edf-c6b4-4c18-b524-ca067ab4061a", "comment": "Malware payload (Mirai)", "value": "5b46a27b5b507f66ec348a87900a32461c4f5c09d6f792a0ab971da349a6098db3c6c049005f6f9c73313604a177da4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274135, "uuid": "2698fee0-0ea8-4b59-9b87-b6bd2069bf77", "value": "T1FD132A85F9819A13CAC151B7FB1F43C87727079CE2EA7303AA1AAF2137879660E37155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274135, "uuid": "c75872d8-d018-4da8-8ab9-b496de728b35", "value": "768:s8NVAZ/85sLvPPfbpVodTa/NmoSMFjMvc3MpOLVCGrKTqNCWAALV8w3xvTgTI:HCS5s73VZG1v6MpOLV/rKTdWA+jxvTgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781274135, "uuid": "533c5b8c-b222-4522-a498-73f3fb3ed75f", "value": 44452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781274135, "uuid": "f01e08ac-797e-48f4-97e7-b317cbb5ce86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274135, "uuid": "caf97e89-9507-4acd-89ad-6808170afab9", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56fb783d-6603-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781229995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229995, "uuid": "06dcce90-1c52-49f1-8102-e7cb3a572fa9", "comment": "Malware payload (RemcosRAT)", "value": "9cef0ee26a65e6c770719e61b2964a73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229995, "uuid": "ad5af0e0-e98d-4d6f-81a4-a8d432a00ee1", "comment": "Malware payload (RemcosRAT)", "value": "6851692e3b8006c3810b7fe6aace46230a15bc1f6ae33bfb6ce516df676a7bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229995, "uuid": "44f3a743-b3e5-4551-b53c-24c5bb51d065", "comment": "Malware payload (RemcosRAT)", "value": "eb4cbe2f34bc09fd08dc8a19bdca76649783e551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229995, "uuid": "6832966a-3dce-4f52-adec-a0e93c7cef82", "comment": "Malware payload (RemcosRAT)", "value": "eff7376df9a0b5d848480c801a43168a4b578a5c3a04bac61daf735d213f8be5458be36429aa2475d115177f68b283cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229995, "uuid": "b8ef19a2-93d2-4f92-ba10-f583f876eb92", "value": "T1E15501989A9BE807C16403755AF1F17413B95E89F903C21B2FED6EEBB932F954C80643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229995, "uuid": "f1eeae5a-d7e4-43d4-985b-8f3472795984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229995, "uuid": "0e4bc4e5-4d17-4bb9-b35c-ccdf66a668a1", "value": "24576:0DCpsr+fGRQqVCTHo+eBcHGUKlNtD88cJBak2ipcAx/Rs4ycN943Bw:0F+fGRCro+pfKlNtD8Aknh5s4ycNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229995, "uuid": "f216a990-22a6-44e0-8625-8db7349de375", "value": 1408000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229995, "uuid": "c712dd96-f5b6-4b59-b0f2-95622b538d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229995, "uuid": "da47d1f7-6eeb-43df-90af-c4c83441fa8c", "value": "PI TT 10526-Palmehaverne.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3adcca3c-666b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781274616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274616, "uuid": "cc077998-c148-4580-b76d-af8f9e86f92d", "comment": "Malware payload (Mirai)", "value": "bb26641337bf8c3b39a6e8c614537250", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274616, "uuid": "959b2079-a610-49dc-8b2c-7d8df6492513", "comment": "Malware payload (Mirai)", "value": "687c7a2852b2e3440d69340c4fe29f94e2f8fd9b0302e050311708fdb3e6cf1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274616, "uuid": "062c0252-730a-45f1-b395-663fde921a45", "comment": "Malware payload (Mirai)", "value": "bf9fbc18d7e058f1fbad6adff18f33e32f0c19e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274616, "uuid": "ba52f7bc-d159-48b7-8901-41a722874398", "comment": "Malware payload (Mirai)", "value": "c863aad0194149268019b8843df9b54e4a485809a7ac706a2b64f55a1110b73cad5825573c1da0cf3a21db806b4adeda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274616, "uuid": "d2e6af1e-6046-4d57-9222-5d9f7c6c3fca", "value": "T1C3D328C7F900D9FAF80AE33748570805B230BBA649925A372257357FED3A1D90577E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274616, "uuid": "9ac373c4-196e-408c-b066-fd2dd30824f4", "value": "3072:wmAkRMy51coEkpCIxUlQoDVejbiALj9ANyK2kzCW0:3A21coEkpCmWQoGL6yK/CW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781274616, "uuid": "659c6620-faaa-4433-a207-fb97e0ef7f54", "value": 135232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781274616, "uuid": "476887d7-0486-4621-88b8-7b9cd5a79963", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274616, "uuid": "86c10627-64f0-4b3d-8463-3f690109a50b", "value": "CRY.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742c2da1-6636-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781251948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251948, "uuid": "bc2931c9-bebc-44b7-92b0-da4c2db0f5c0", "comment": "Malware payload (Mirai)", "value": "85a2aa4b2df950dfea6ff477ebb1e76c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251948, "uuid": "eb5af8b6-c047-4b6d-815a-eb54a1b0057e", "comment": "Malware payload (Mirai)", "value": "68e7cfa7ad230f942b6d6e1a634d24becfb6904b87e67b389c98cd1b86710c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251948, "uuid": "f6a0a160-b83f-4e03-8de3-97a68a2d257b", "comment": "Malware payload (Mirai)", "value": "9dea0ffef435c176d97d2c2abead3d0a1a5ef2be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251948, "uuid": "022e8ff8-0179-4c6e-ae6c-3744943bd937", "comment": "Malware payload (Mirai)", "value": "8c509fe0b0b4c7c259cb4af5821f36fa6b9ffc0293f9096d8cbd97bc28e0bacb448a30a63bd275c73f3bf7dafc5ef1fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251948, "uuid": "63148b30-4283-41a3-a641-fb0f81d86793", "value": "T127241946EA808F17C4C61779BB9F834633339B68D3DB730A99186BB43F8375A4E66105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251948, "uuid": "dea2d797-5fee-4035-bc51-3ec5fd305475", "value": "6144:nT65kaYFGl13/4uqEZ9CjQxYaajBVQuk7QWz/rNL/KHEmM2zeTWC:T65JYFa/4+Z9CjQVaFVQueQGB/CEmM2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251948, "uuid": "b07a2c5f-0526-457b-b58a-d89b26e6633f", "value": 222864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251948, "uuid": "1cd46d3f-987a-4feb-888b-0768b316d67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251948, "uuid": "eda95957-d963-4bda-9e3f-1fc44090a010", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "164e8406-6698-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781293882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293882, "uuid": "6b0a21df-59c0-4f1e-b4f4-8ac473043b82", "comment": "Malware payload (ValleyRAT)", "value": "6682fa03762e214e48b3685a975cf11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293882, "uuid": "6c13d076-311a-43aa-9d86-5ad0a7a9c825", "comment": "Malware payload (ValleyRAT)", "value": "6ab5299316714d117c464d4707d5dfc33a8bf0aa0488b0ee240d2d152e96bf6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293882, "uuid": "ddc3fc08-e566-4a6c-8625-745108de7d16", "comment": "Malware payload (ValleyRAT)", "value": "e6289d2f019ec811e4735ac2e7f1f10c02e5a4a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293882, "uuid": "55d95342-2037-4883-9d37-16799257fc30", "comment": "Malware payload (ValleyRAT)", "value": "195584320d01407c60f048733e1f20d6950d96719c1331630e73c288c0ab75e4613d19a81f3d7b7c4c7e28293e80e5ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293882, "uuid": "449ae96d-ed7a-4e15-8bb0-85ec4f430059", "value": "T1CCF7C74A7B00D989E4279234A0979F50F336ED719B71932323753F586EFA35DCEA2098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293882, "uuid": "8edb100e-d988-40d5-97a9-de5f7a38b9d5", "value": "a5396d0e3a0b90f35cda230c0314ce27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293882, "uuid": "405bd499-ab6c-4679-b1a5-a4414a1ab888", "value": "98304:APEqhFI6q65OY/Y8oDmkZOWBMaEj4cEX3fpuGtT4Z0UT6F86c910T12W1:FqhTcKyhBMHjKXcU/+9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781293882, "uuid": "3f49b2d8-c64f-4b15-96f9-bf889602f45a", "value": 73556992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781293882, "uuid": "fb2dbdde-bff9-40ca-bb33-abfbcf68c075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293882, "uuid": "a93a93f6-d504-4d4d-b390-a25bab7b57b1", "value": "a_instapp83356013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900646f2-6604-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781230520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230520, "uuid": "0839192a-975d-4e16-b5d1-1bd44116d4b9", "comment": "Malware payload (WannaCry)", "value": "bbb510d3a817da0bc17ae3a081388384", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230520, "uuid": "6a6a2cca-f28a-4678-ac5e-84c66fd58663", "comment": "Malware payload (WannaCry)", "value": "6c3b88beb2d3524dbfeca7c19572e1928c3267d075ca1b9f4431557885075d4d", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230520, "uuid": "2e618c16-38c8-4b1f-b56a-23c34c1e5fbb", "comment": "Malware payload (WannaCry)", "value": "fa0929c713bd4bca262cee8d049fbdce3c469035", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230520, "uuid": "be7572c3-02d2-4fbe-8111-957331f7ad0e", "comment": "Malware payload (WannaCry)", "value": "a5deabba07be926b9420f91e2c7bc816f3ef3ff5299f06b76a4852749747dbfb0dbb74207cc43766f3d6e553a0fd8ee0", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230520, "uuid": "8fb5019f-c0f3-4dba-9b08-1f8773f65e14", "value": "T19C361292F7BDC718F446B37234B77823713E2801E471875F5A9DED822FA900A7A5E126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230520, "uuid": "99e0f271-0946-44e6-895a-c27c2dd0646d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230520, "uuid": "a7069fc2-cc7d-4519-b59a-4b5f7a4150db", "value": "98304:DXDQgpXQXvaNV/Bhy4TRe2cRVYUlkVJ2I4iCmTrMDbMhZMzbaXNXu8/AZgAU5le5:DXDdpAXvmXBTU2+YSWJ2evMHMK3iV/4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230520, "uuid": "0148e8d9-9e8e-4845-bb91-fc23a7802681", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230520, "uuid": "e7d42982-6e09-46bc-b3b8-827e75712f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230520, "uuid": "55a052d3-075e-47a4-90e9-1ca7e5dcfa92", "value": "6c3b88beb2d3524dbfeca7c19572e1928c3267d075ca1b9f4431557885075d4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc5107b-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781301194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301194, "uuid": "d6a4dfaf-b529-47ee-88e7-845f580b11bb", "comment": "Malware payload (Formbook)", "value": "1078e2966c0d86d1d87a2408e2ad4701", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301194, "uuid": "206e7310-bc97-4402-9030-34793bf0f2b8", "comment": "Malware payload (Formbook)", "value": "6c417a7be904852d37d6e345a6b711976ad426d31e4ab7bab58a7d3440142996", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301194, "uuid": "c2402ddd-4525-4182-b9f5-c9cbd1969590", "comment": "Malware payload (Formbook)", "value": "ac953ce43c1ff33c2d6bd2d30bc4afae95f8d1c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301194, "uuid": "778f278d-dc22-4d8b-99f4-b7af3e464dbb", "comment": "Malware payload (Formbook)", "value": "6e8b08ecf577abf00bc80b577a0e56d9d95216d2c3f7bf850aff07126f8c80ca067b571b6a84246223b9c05bf93356db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301194, "uuid": "9ec3edf0-8695-48d6-8d4f-3f30a25f4332", "value": "T1C90523E0A960B7062F0B99B3A901D474D9BF951E0DE16F577D8D703EA6FA64A30072C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301194, "uuid": "ed6eff9c-b660-415f-b76d-d825cdd3b21f", "value": "24576:7bFEsS95pkmVlzwgTG8DOUXvp2omJMHzrO+P79hm1tB:7bjiXkqlvMux2uO+DItB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301194, "uuid": "1eb351db-b456-4d67-b601-9ab79e00e69c", "value": 863769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301194, "uuid": "036d78c3-8f10-4722-bd2c-3d9ef824dd2d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301194, "uuid": "0f985118-dcbf-4b61-8bf0-2d1f104df3dd", "value": "DOWNXPAYMENTXCOPY_20260510_160955_0000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05453b62-669a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781294712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294712, "uuid": "3451f8e3-bf5f-45d9-a091-2e0745d82d4b", "comment": "Malware payload (Mirai)", "value": "858228049bb768645543e308062ebf0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294712, "uuid": "4143455a-64b1-4105-863e-8a3de748c1b6", "comment": "Malware payload (Mirai)", "value": "6ca52ee29bbb9b4192debb2d92797b77217a7465ad09a18f0343d2c227467f8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294712, "uuid": "fe241b43-5287-407b-8e5a-6fd69408af4f", "comment": "Malware payload (Mirai)", "value": "ec3f084fef3ddb8c0fb077219079ad2b5afda952", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294712, "uuid": "9ae9813a-d3f6-4249-b4d1-754573490471", "comment": "Malware payload (Mirai)", "value": "68cdf016278a17b9f0d3ac639d6b7813c5d0049a95c37c1d49070e74efe6e0b4a7f51a30160fe9e91b8657e81332af64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294712, "uuid": "488bb80f-141e-43c7-bddb-48e9bb16f99d", "value": "T131E31945BC519F17CAC662BBFF4E438D372A17A8D2EE7103D9256B24338B95B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294712, "uuid": "2c55e576-4736-46c8-beaa-d28d34b92683", "value": "3072:ntTA5isoJguGfGqb0+zXzvoa7Rw/49EOOkkcNVvBVrC:ntTA5iZquGfZb0kzvh7O/49fOTcNVvvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781294712, "uuid": "2de96ffb-574d-400f-9db1-32db6f90aaeb", "value": 155620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781294712, "uuid": "bc406b51-1654-4f04-bf9a-bc1d61d84ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294712, "uuid": "199522db-b72c-4e47-abd7-ecf2d488dfa8", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0462fe7-669d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781296341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296341, "uuid": "a5a7b249-1088-4f14-858f-924e0d2ecc36", "comment": "Malware payload (Mirai)", "value": "01e7d33cfb6eaa19c0317552b84e4447", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296341, "uuid": "44893a7b-10bc-44cc-89a2-403f5d9908b1", "comment": "Malware payload (Mirai)", "value": "6db62e0f0e5dbcb5e17239d66763fb083828dc1201d87df804891de3c7bde75e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296341, "uuid": "8070bda7-7c1f-40cb-921f-175141bb1d8d", "comment": "Malware payload (Mirai)", "value": "dc0ec769de9f0c19e185784c538529111a3e702a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296341, "uuid": "34cd2d4f-7e1c-401f-bd83-2254ce673d91", "comment": "Malware payload (Mirai)", "value": "acce60cbb3b4b1da1ad4c0ee6943ddaac49e7cd131310ebdd11ceb84114d8fcac4c1a3a46388f2f4182c9d012afd88d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296341, "uuid": "1d9b541b-ba74-4481-a1b8-a083a22db228", "value": "T1E5241846EB408B17C0C61B79BB9F534233339B68D3DB33069928ABB43F8775A4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296341, "uuid": "7d563f3f-e514-4dcb-b12e-60ccbe8355d0", "value": "6144:akaZP7NcikgBuKwB1cSCvpxa6dwSN4kAukL/KBmgHGY8pC:QZPpcikgBiB1cSCLagwSNXC/qmgHGY8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781296341, "uuid": "367faed7-196d-41d6-ba20-b9ed16476400", "value": 212635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781296341, "uuid": "3f73156b-4442-40d2-ad44-b008d0cc91e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296341, "uuid": "14507b60-22ab-42ac-90fa-f232555f2719", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037ac451-65f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781224271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781224271, "uuid": "b7d35971-98f7-43c6-b79e-e41afed3e909", "comment": "Malware payload", "value": "9c14fb0b1a41cb0d3523914f47765316", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781224271, "uuid": "be1bd426-25d4-4826-b3b5-477b914e5a97", "comment": "Malware payload", "value": "6e08a9b19df98e36da4409a8ae5990bde3ed6dc583fbea9f112cbc55421aec59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781224271, "uuid": "d77a2e4e-0472-4b6b-be4e-9dbf054a9975", "comment": "Malware payload", "value": "ff2bad63304c183528d04b0ba008057cd6b6fbe1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781224271, "uuid": "03618f66-409c-446d-b7c9-c829c4ac6f48", "comment": "Malware payload", "value": "bc5c66388f7afa125e5147ba39f3ae67aba1bfcd6357c0f3f007bf10990590246bc74c14dccbdd094385cb7044d4e482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781224271, "uuid": "6a59a51f-0cb3-4749-953c-5d11156dcb81", "value": "T1BE35E757E89590F4C1FEE174C626A213B9A13489073837D36FA18BF11B26FE866BD314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781224271, "uuid": "b683f924-aefd-45fe-bb6b-129d7e62099f", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaWPlT:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781224271, "uuid": "f56a23fe-0cde-4ee1-87be-c30d4fb109e5", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781224271, "uuid": "6a3f793a-0da1-4a64-b15b-880fab3ad238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781224271, "uuid": "d1acfdb6-f33c-450d-ba1b-b9ffc4ea40e2", "value": "6e08a9b19df98e36da4409a8ae5990bde3ed6dc583fbea9f112cbc55421aec59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983b5881-6609-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781232681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232681, "uuid": "505ca206-dd95-41dc-b238-15be24256855", "comment": "Malware payload (Mirai)", "value": "fcfc0cecfc6e8e13aed04624d469398c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232681, "uuid": "d7dd4a71-bf8b-4039-a769-58efb0cb9374", "comment": "Malware payload (Mirai)", "value": "6f88a71c6cac4955aac15f8d13aad38dbfa6a89b78ddc7710f813be7bdfad028", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232681, "uuid": "4ce08c4d-6258-48de-bd81-bbd82c684833", "comment": "Malware payload (Mirai)", "value": "7270660755fb7630c791ac7fa410a641273e8cfc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232681, "uuid": "e330b24d-b24f-4cbf-b687-deabf5dc1cdf", "comment": "Malware payload (Mirai)", "value": "e0de7775c833117ce1524edebb96e705f3923224fb49e518c2a55a8847ffb4b31c101217dcc97aaca15ba775cd780a65", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232681, "uuid": "d1898a60-40ed-4375-b053-973d45c40685", "value": "T19A01FF8D4034955A111BDECDB297125C9DC59BFEA0F27BE1388BB63DA48624431E4F4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232681, "uuid": "377762df-8c6c-4ac6-bf41-5d15c06f5381", "value": "12:+7AlXXCP9AhZH9XQ92mOP9XvTlUXYZq92TRzlZxAE9IAX9e+Vb9cn:znDa2h5vTsShpDen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781232681, "uuid": "fbaa0dcd-b49b-4e42-a821-718eb9484d17", "value": 676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781232681, "uuid": "d0afc646-e634-457c-8e41-c0c279ff263f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232681, "uuid": "6667028d-5803-42bc-910b-faf3e9e74f0f", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946de936-6608-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781232246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232246, "uuid": "5bcb9ef2-c28d-4787-8596-16d4bf33aa3b", "comment": "Malware payload (RemcosRAT)", "value": "bbea04f2a48f4bd62e03d5c5d32f9404", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232246, "uuid": "c189b402-f46e-4031-9c1b-88181e6cb0c3", "comment": "Malware payload (RemcosRAT)", "value": "71305d4216f763c51fa65f5b3819c2ae0e971720c0653e151c3f14b0dff85ea4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232246, "uuid": "cf2d5921-316a-47fa-8ea3-ad9ad5ffd7ce", "comment": "Malware payload (RemcosRAT)", "value": "89d86d8847bb3b8188dc34be50ee5c207bbff08c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781232246, "uuid": "5539ca61-9d82-4e54-89db-4b51dcb7a207", "comment": "Malware payload (RemcosRAT)", "value": "3c1f4644bff20f65482c660b041bf09bd2091833686a51cc913e46b1b1d1944e24daf7a67b62219ed79fe835e3a7de59", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232246, "uuid": "a36670c5-79cb-4ff3-8b92-6de6e3574643", "value": "T151B33B20ED6403994E4717BEFC9516218EBC8B19462644F5FADE130D600A5FCF7BEBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232246, "uuid": "d5536005-8458-46e5-99b2-def48c4a30d1", "value": "1536:qUklZJg8ZiN5YdxjAxIkAlm1yEWbvez8LLKaZ2696nKQ+h/w19AgW8P:qUklZtZiAJmy5Wz83KY2MKw419AgW8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781232246, "uuid": "3d62accc-1cf4-46a9-9897-7ed40264f9ca", "value": 115364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781232246, "uuid": "f55954fd-f4d4-4562-b9f0-bc9acf598a42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781232246, "uuid": "1ddbe842-1668-4b57-8111-176e70a9302d", "value": "TT_Slip_SOA_Proforma Invoices.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3d100d-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245493, "uuid": "f7c543c4-5617-4b2a-8560-5dc8b3ba1e3a", "comment": "Malware payload (Mirai)", "value": "baca5ca3381df4885628bb6643f94805", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245493, "uuid": "37866330-93bb-4ca9-be44-91329078396a", "comment": "Malware payload (Mirai)", "value": "72000eec4d45afddafa90ccef141aae96d892413b4cc308999ae0e21969357e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245493, "uuid": "b74412b6-c128-488c-b47c-fa81c3199898", "comment": "Malware payload (Mirai)", "value": "4f08e4005cf875eea8a5354d895624d2ba4f9bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245493, "uuid": "3cdd7d84-6c88-419e-a6ba-2d2c653b67d6", "comment": "Malware payload (Mirai)", "value": "fdbaf5df20685d886521547261b421e9851b27f48130576647208d9151a2a6dc66a95c6452dc0bff76f3b57da14fd92a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245493, "uuid": "6eb8a112-0f46-49a7-a514-4dd63bbbee2c", "value": "T101D35B0A79D270FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937DE05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245493, "uuid": "a1c222b8-aed0-44f7-b45c-7a75d814a091", "value": "3072:lAFWsh8fkY6i3iP+9gK8JYYvk9d5dAl8tFEU84YTn:yssqf/3iPcgrerAl8fEtHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245493, "uuid": "f191e9f8-3c68-4039-aa38-e5cbfb0dc0dd", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245493, "uuid": "6f7b2dd0-3dfc-4a8d-8e12-ae63edddf1db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245493, "uuid": "855aba52-de94-43b9-b6bd-5130bc7ab830", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017320b1-663f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781255621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255621, "uuid": "97b81cd7-83d3-4023-b6de-ff1a5a767c67", "comment": "Malware payload (RemcosRAT)", "value": "6fc142fd4d8a14a3c090a75a2192295d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255621, "uuid": "0dfd861b-a6e4-416a-adf8-f18fbb1218a7", "comment": "Malware payload (RemcosRAT)", "value": "736868a099a9f87adac575dd3f9061e00296a7abd7fbacaf5edc89702f90f6cb", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255621, "uuid": "fdf7e486-fd51-471a-89d4-9cdf8292d3d5", "comment": "Malware payload (RemcosRAT)", "value": "0a0e55112b2a694f216d12a3bc58028f88dcdf24", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255621, "uuid": "896aeb79-1b1a-4a76-b409-1fc040d495ec", "comment": "Malware payload (RemcosRAT)", "value": "ce7d7cd7215c1edfa90895b55742b30ae00ed870b53c839e51d39196152307c8de8eb2044462be8829ea1a2ada7269ec", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255621, "uuid": "73121025-eccf-483c-9b0d-4cf9dffa28f2", "value": "T112B34C20DE6003594E4317FDFC9916628ABD8719422644F5FBDA730D60099BCF7BE7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255621, "uuid": "5ad99a34-5e4f-44b1-a6f0-8fa137db5153", "value": "3072:uQiVlVoJEVWwWuFEURt9KicPyXXCCSqAqR3:TiVBgwlWUjIiIyXXCCpAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781255621, "uuid": "cfec3c80-7d12-4b1b-b38e-81fe5b565b6d", "value": 115517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781255621, "uuid": "f5e9a02f-080a-499c-8404-7ba3f3d50b92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255621, "uuid": "85dc07e8-fb4c-432f-8b3d-7f2166d40ca6", "value": "Hugues.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f935a1e2-6638-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781253031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253031, "uuid": "bbc640a0-945f-4734-b02b-30091cd342ab", "comment": "Malware payload", "value": "631986b3a488e3abf33dee4e77010eee", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253031, "uuid": "06249942-e71e-4bb1-880d-bde65b95fafa", "comment": "Malware payload", "value": "73b7f5db3f22f8caffcd10ccc4b08e68d1769144b2110d9909111f5878f8cde9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253031, "uuid": "f1b5218d-f8e2-4a10-9712-70bfb1939922", "comment": "Malware payload", "value": "4c5e53435404cf36223056ffe59d67534dcd4a09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253031, "uuid": "4fcaf379-997d-4ca1-8b40-5c1a8c208a81", "comment": "Malware payload", "value": "c4e16c43734fabc7d37d130495979e98d740f68327d6c40c65978ae6cb204a27e58a4c71f3b30ebdafa09ce5d8becb31", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253031, "uuid": "c3dbc25b-f461-40e9-8ef6-36fc910dd0ef", "value": "T119137D6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49ADCE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253031, "uuid": "7acdb012-ac1a-4332-9a16-c9e1b4f5b14f", "value": "768:kx+x9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:kx+6co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781253031, "uuid": "fff44cfc-d19f-4dc5-bd32-b4278cffadc8", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781253031, "uuid": "a2308755-37fd-47fe-b843-02d7ecadab18", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253031, "uuid": "5aac7ae6-0658-4fd0-a99c-558244b6dc9c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242626e0-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781301206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301206, "uuid": "800f9ed6-151d-414d-9c91-664429d9c70f", "comment": "Malware payload (RemcosRAT)", "value": "fa545ee7f377c8e555412c262d04982c", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301206, "uuid": "070a9131-b11e-4ba3-8f49-e79bb4a9c840", "comment": "Malware payload (RemcosRAT)", "value": "75eccf5671e7575e4ce4519cc8b33ccdb3a162e745750b220d0d603bd58902b6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301206, "uuid": "a523a2bd-9e81-4336-907b-7bb7e30e9ac9", "comment": "Malware payload (RemcosRAT)", "value": "08ebdfddcbb1ad409622458956107b376c4e40f1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301206, "uuid": "20e94fdf-ed4f-43fd-9424-892d3b279e39", "comment": "Malware payload (RemcosRAT)", "value": "594b59baccb379737e29b540a1a4c40e45e72690493ac4d3e056ccb83da0cbb316a15969d224af3b423262c4e81585aa", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301206, "uuid": "f29e8050-c654-4e22-b7e6-fb893e1463c9", "value": "T1760175C95443B29C1A1B4AE26A2D4FC50321F24439008895F8516E5AB740A6D496D16F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301206, "uuid": "adf9c2e4-eba6-4bec-b2b5-9750b5f8f2a3", "value": "24:ZOrWQuvvOwUVW2OI8NcTkaI7uS/7MiAkIr:ZSWh+wwW2hgaI7V76ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301206, "uuid": "9d1f912f-a8e6-4aad-8de6-876f86b18b5b", "value": 795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301206, "uuid": "9fb14bac-46f2-483f-a2fb-d3e631fa4e07", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301206, "uuid": "4c5d1b18-45e1-4100-b2fb-cc58d2596c09", "value": "ProofXofXpayment.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82a8880-66a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781299280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781299280, "uuid": "51b2f57f-7288-4b43-9102-4dc4514f9c22", "comment": "Malware payload (Mirai)", "value": "2a0ce54a5f4e1c0b113cc7141e4147ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781299280, "uuid": "5faf2e82-9362-41cd-9cd8-646615cefa5b", "comment": "Malware payload (Mirai)", "value": "763301cf6a4aad157d558cd537589102a8a50be00b8372d93fdde4032148a9b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781299280, "uuid": "3df31020-36b3-49f5-9269-2ee6aada65f0", "comment": "Malware payload (Mirai)", "value": "4a42f6d6ce447baae864fe192c2c1d8236f23e1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781299280, "uuid": "2c48dff9-be4c-4bdb-9c6d-4be25b3455b7", "comment": "Malware payload (Mirai)", "value": "d9e6a0275b11911182e8504d9bacbe65fa6160047cde1f26bd2cabd50b8eea9143c1daf10532eae1c4754baff316050e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781299280, "uuid": "dc7b8f34-342b-48b6-a39f-63713a9edcca", "value": "T175052A16F8809F62C5D1257AFA5F82B8731347B8C3DB720699199B343BD782B4B3A741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781299280, "uuid": "250de430-496b-4616-a9bf-635327109009", "value": "24576:Jbzu5NVT46GrC0gN3yteZibLS43k6Aog4rj/2as:RkN3yvk6Aog4rNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781299280, "uuid": "bafd113f-2e09-4aea-8aa5-1c1055acc23f", "value": 805252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781299280, "uuid": "cd2ec235-f552-49c9-b66a-7b5690eb6450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781299280, "uuid": "213e6cd5-3f79-4a51-adca-5250b0786aaf", "value": "bot_arm32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088c884d-6636-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781251768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251768, "uuid": "6d8dd76b-2523-467a-a541-2c1a933470da", "comment": "Malware payload (Mirai)", "value": "a30590deac9af0d5a8921c90b28d8821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251768, "uuid": "a793d167-5968-4ccc-9526-cc056ccd9eb2", "comment": "Malware payload (Mirai)", "value": "765745b79847886e94f8ec77f8ae810a3dddb5db3797af982b93886ebe875d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251768, "uuid": "2e569816-13b7-4d69-8089-5c65851e4aa8", "comment": "Malware payload (Mirai)", "value": "35c5c179900e836f04863ad1cf81acf63d103eac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251768, "uuid": "8960739c-8d38-4489-8d7c-71b018727597", "comment": "Malware payload (Mirai)", "value": "61cb1ab6b08b061419711d2978d67a3dca0d84ef0388a6985fbcb244acd5c6e7b4fbe5e6e00496fb3658a0b6a6b46adf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251768, "uuid": "c7d30e02-4239-4d7c-aa83-ec374c08c21f", "value": "T1DDE34973C839AF98C664E5B8F4309B792B53A56581871FAE94B7C2748083CCDF5097B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251768, "uuid": "7a9d3ca8-1737-48e1-8fd3-1f51d35ca87b", "value": "1536:70UVSFZEsz+/QCnWegzRv3jCdtr8jKe/UKSW7pWtyySbLOqWW6HD9VwhQj7:0qL/LnWFzRL2l8GeLFW8yudWLjQW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251768, "uuid": "c2f8dd5e-8df1-4504-acab-a38122b5fd3d", "value": 146764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251768, "uuid": "a53ec46f-5763-4bd5-90b2-9848ec6d1a71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251768, "uuid": "80b0c6e6-72ed-42c6-beff-79d65f6f003b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524d5a2c-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781301284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301284, "uuid": "df7442b5-5bb1-449b-824f-ef732e290f22", "comment": "Malware payload (Formbook)", "value": "f995f165d5d0228101edaa5832891db6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301284, "uuid": "89610de3-fa32-42c6-aab0-32b4b9babcde", "comment": "Malware payload (Formbook)", "value": "772b1228f031de8d377570c6fc5117350ee694a4b2432e35d6bcc5da351e61d2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301284, "uuid": "91d5984e-545a-496c-9c7f-c28ed3c48ca1", "comment": "Malware payload (Formbook)", "value": "ef66963faf1c5b92aa24b5d338db71a2a3f1d142", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301284, "uuid": "55b3c2d6-caa5-4edd-b9b5-98ffb158f34e", "comment": "Malware payload (Formbook)", "value": "fd6f26a6f49f31aadcb05914a329cff132bbcbe800a967f2ad585f8d1304f7f6eee6283c9941a7bd795a16e508d83c90", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301284, "uuid": "886627b4-8f4e-4a7a-8e6f-92cd5e3a0b72", "value": "T14E9269F4AAFFC9202B030D4A7D169DD7E840CE1C65F521650B52CA79E8FD1AD6F8E064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301284, "uuid": "7a2af054-97a7-4a2d-9d03-99adb3230a57", "value": "96:mf2JRWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWv:mf2cqAHq2z1seKqtx5fC97SoruTMGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301284, "uuid": "71af3f24-bf18-4b75-bc8a-27b4aaed211b", "value": 20304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301284, "uuid": "4eec9421-e281-47a5-b65e-2f16c8cf8488", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301284, "uuid": "290853a6-e161-49ef-8f0f-d2643062bebb", "value": "RFQX11062026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df230af4-6603-11f1-a769-42010a9c0008", "comment": "Malware payload (MIrai)", "timestamp": 1781230223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230223, "uuid": "4bed8043-e1a4-4779-ad12-1f03330e9d2b", "comment": "Malware payload (MIrai)", "value": "7add5f1f286999c2c36962d5c5d342c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230223, "uuid": "aca47c63-b0f6-4e99-bd98-1b7122e65a1f", "comment": "Malware payload (MIrai)", "value": "785b6f9cacf2d8d57b22d7fed7db6fed92224fafbfa2b45f05e487eae9c68fdb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230223, "uuid": "4c271000-fe30-4c52-8037-0f1de33dd039", "comment": "Malware payload (MIrai)", "value": "731d2a3d349d4388e388c8e3edf89a9dcf46d905", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230223, "uuid": "dd81f1e8-96a9-4107-955a-51f10339716a", "comment": "Malware payload (MIrai)", "value": "103b871d1a958c429e7d741a31c6340ca7ee6898b3e329b58a14ecc123bcae665597448d7b6a49f73b77e3246eb93e56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230223, "uuid": "f0c2873c-5d97-4b2d-b4af-6c161552bf3f", "value": "T16A231A80BC919613C6E423BAFA6E418D332667B8E1EF7217DD121F15778982F0DB7642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230223, "uuid": "33e9d44a-6578-4a4b-a73f-f4ecdb0371ac", "value": "768:ycUiIGmY9BIaGFdhDHbe1vprXQU4Pgw4fZ3hmHANVLLcnswt7uRFEtm:iiVTi5HbeNpjQU8gw0MQLwnBc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230223, "uuid": "cdfd6159-74a5-461b-b1bd-0bb54c985484", "value": 50000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230223, "uuid": "5a2fe5a8-c430-4188-9811-82e3564301d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230223, "uuid": "50e92c8b-43e2-4cfd-9d94-bb621de98829", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae8c8ca-6699-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781294372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294372, "uuid": "b58e98ae-6d96-4664-bcbf-a9e3e52aa504", "comment": "Malware payload", "value": "bce3e42db8740980ec94865aebaa0fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294372, "uuid": "2521e385-02eb-49ce-812b-5204eb1407a9", "comment": "Malware payload", "value": "79946062e1fd327273d571eff1fb2cc57ea5cfcb9cb73471e44ba8ce85215ba6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294372, "uuid": "54e14b54-c181-4525-9e78-fb7adaaa52bc", "comment": "Malware payload", "value": "f7ebdfc5e97371c45ebe8143226e30650e4d986a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294372, "uuid": "f74ebf80-c5fa-459d-8487-ba37afe3a579", "comment": "Malware payload", "value": "11d727a9a74d493fc5d016afca4e78ef0ae90d1c7462626b5ff75aa451e4ae2d5cdc86067ba3b5852a1819619f59acb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294372, "uuid": "492f9fea-0440-4468-9d0c-f2ad86538064", "value": "T10E24754A6E328F6DF668C73047B74A25D76D23D626E1D684D1ACC1042F2439E681FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294372, "uuid": "fbabfe35-4619-4dc4-b346-60956a6aa530", "value": "3072:nbopiWUq3bh7kMOfd3U4VJorF/0FVt/xa7/FNyiKqavKCdcQ:iiWUq3VkMFdJ+ha7jyTqav3uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781294372, "uuid": "e3dd5100-9371-4fad-bf3d-6241338825bb", "value": 218528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781294372, "uuid": "1762f803-c623-4e48-b837-f72ef5a12d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294372, "uuid": "3c897ca6-4665-4acb-a8ff-8657723a8a17", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c5b8a3-666c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781274979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274979, "uuid": "aa7c302b-4e57-4240-9e2a-c7d99293ff97", "comment": "Malware payload (Mirai)", "value": "7bda89c8bdd3e7b8b518e3388cde1a85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274979, "uuid": "35b3dd93-62de-41d6-be81-1a3924e236a4", "comment": "Malware payload (Mirai)", "value": "7b4e23fac930e2c4c3ec03c15adee5a1ed7bf69022c28916f6738f2bc76afe26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274979, "uuid": "a232b89b-43ad-422a-9c4b-276894daebc5", "comment": "Malware payload (Mirai)", "value": "c9addadfdc067661b87086c846e8acf853aaed5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274979, "uuid": "318bfd8f-fff4-482c-8d07-652bed7bf424", "comment": "Malware payload (Mirai)", "value": "88f256127c605e1f3000a5e498f448ff085e06c525d097916e7b2ad798632d26cac6f2de6487d5e6b49e9f4bada85dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274979, "uuid": "8e2e9f61-6d08-46fc-a15a-dae71af1e979", "value": "T19BD3885E1E238FADF678C73047B74A24A76D23D622E1D684E2ACC1105F6029E545FBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274979, "uuid": "932a9c02-9e6e-442e-9b90-82db2277dce3", "value": "3072:4cBtA85Vo3U3r/2nPW8GV3pqhB9ukgqfg1jBLmIskTZK:4cBtA85Vo3U3r/2nPW8GuhTjxo19mIsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781274979, "uuid": "9677a3c7-cbe0-41bc-a65b-13ce54e78ffc", "value": 137524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781274979, "uuid": "e2c11f02-38e6-4ea0-ab27-ace8872a440b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274979, "uuid": "6db3cad9-3e98-4742-9d5b-b24bc35bc1dd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723714ed-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301337, "uuid": "d0734a41-2e45-435c-9dbd-aa9642c87a01", "comment": "Malware payload", "value": "2f0715ed390fb3e46c94bd3ae880e0d8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301337, "uuid": "430c10d7-3b63-4d56-a504-87630ec3810b", "comment": "Malware payload", "value": "7bb0fe36b407cac1cdb831a237525704a3905bd67a242b01daa18f2ba0c1f959", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301337, "uuid": "4f9737b0-4c45-417e-91fc-4833fa78a237", "comment": "Malware payload", "value": "03c9a0a7381c01776adc5204111eccc70e696dbf", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301337, "uuid": "bacb69a5-3b88-4539-b351-14563da1d544", "comment": "Malware payload", "value": "7ea0652afcdabddbb765bce9d322da104b9d043ae9bdd01160f9e2e156edfc2a6318c9bf85dcd448e881769a5bd2ba85", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301337, "uuid": "c90e3ce2-f415-49bd-ac69-399044d1744b", "value": "T1FEB42363D1CC53298A0331B359A7377E0D41A0206F509CBA6F0AB7BF3EA5171C5AF5A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301337, "uuid": "00db0fd3-fce4-4617-81a1-546c2eea8943", "value": "12288:39mVUFyjQS2r4A9vQkHGvliP2HOJznV4aCwl0NY0Ahv5LyX/T2qNZ:tmVUF2QSoR9vhHoly4qz8wlF0AZtyX/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301337, "uuid": "da02fb6d-95e8-4564-832e-5c218528df21", "value": 513190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301337, "uuid": "fe40913d-ae05-4e51-ba7e-8e8bef0d9b8c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301337, "uuid": "93e31733-ff2d-48fa-8190-986bbf20c71b", "value": "RFQ-XPRX115322XNBPXSQD700XINV-QAPCO.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5b6be3-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263396, "uuid": "dc5256a0-121a-4616-9c5e-c402c2b31b9e", "comment": "Malware payload (ConnectWise)", "value": "ad0daa73f21316dfb5e2bf0dddb3b709", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263396, "uuid": "218b66b1-c335-49d3-90fb-e52258759d4d", "comment": "Malware payload (ConnectWise)", "value": "7c0cfe67c14374dce4b0211a0ee9faad6a01e2d33abe54631f1d3a72b3221128", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263396, "uuid": "ad251a46-7433-4c38-bb3d-919032cdfbcc", "comment": "Malware payload (ConnectWise)", "value": "08024a9e47e3b5074ea5e5c7c39b04f54fc4c59b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263396, "uuid": "8f1506b5-be2f-40ba-8842-821f39a0809b", "comment": "Malware payload (ConnectWise)", "value": "f58e072f6ea6f4b72b664e776ae83fd4e9569c8f42c2efaea3b630ac4b755e3489758b1ef8e3ad6889eb757a5511bf25", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263396, "uuid": "43425ccb-3643-4ab7-b2d4-039c27e8a1e2", "value": "T161B71230B64ACD36CD9605B08D7DEB6E602D7E790B2490C7B2D82D2D29B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263396, "uuid": "0f7fcb18-f004-4165-9d8d-5c2a4ca09af8", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263396, "uuid": "d102f7fd-17cd-41b9-8d92-3bf45a9a2090", "value": "786432:IStBv0ifmjqtFpttD7yBG/c66pXP5PReTIzpYpX+0C/v2+uXeTDDkKQ59pD:IStBL+jqbpttD7y0/JUDHMxyv2+uXeTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263396, "uuid": "7ff3d377-b4cd-493a-a4c9-82aa0af89f74", "value": 49433240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263396, "uuid": "8cd8867e-3bd4-4f6c-a5af-9d784c3e49e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263396, "uuid": "0ce3e497-7530-4f37-9963-967729888537", "value": "7c0cfe67c14374dce4b0211a0ee9faad6a01e2d33abe54631f1d3a72b3221128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ca16a0-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781301187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301187, "uuid": "dc4e202e-fca1-4cec-8f2d-080c30ff87f7", "comment": "Malware payload (Formbook)", "value": "81d0e55445e0d1d3732214be200d5d7f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301187, "uuid": "b35395aa-1f14-4b8c-978a-e8e37f386520", "comment": "Malware payload (Formbook)", "value": "7caff20c50d04bc06593d5ab21ac8c3b66102bc29b3e23a67278290cc7efce9d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301187, "uuid": "b84e52ad-0f11-4b8f-96b1-3611679137e0", "comment": "Malware payload (Formbook)", "value": "71590a116c64098f20fa193ac8e32bacc8a07bff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301187, "uuid": "3631939d-69db-423a-937b-aa00fbef2aeb", "comment": "Malware payload (Formbook)", "value": "6feeacb0b3b0c752069f1f2102c9a61cd48a05ab91e8cd0dd668fab3c172f88f2b5b16874b150b949739efa3cf6e6f6f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301187, "uuid": "0d9c18aa-0265-416b-bf62-26ef6a5e13d4", "value": "T114E1AF572AA4360B8403DA3804E16B6E41561B7FF70AFFF185498552A5D77AB40DC43E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301187, "uuid": "8c6847e6-625c-41ad-b40d-7b511638aa6f", "value": "192:RG4ZHh+chhVhMunxsfQTzA2/7EYfRsZcHbc4DMft3Iv6BU8Q:RGMHV9bs0jTfRsZKbc7168UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301187, "uuid": "589bb2cf-e19d-4f6d-b2f3-c0afb987ceac", "value": 7329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301187, "uuid": "32a13bf8-7313-4fb3-bd9d-743e3f588cd2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301187, "uuid": "a5f08c5f-812b-46f3-9fcc-e466843ccbfa", "value": "SWIFTXUSDX22.496,32X20261032254113.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9b2879-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301246, "uuid": "85434488-a19e-4189-a63c-86f61cd1c2a5", "comment": "Malware payload", "value": "46a07e9053aadf8e32e7a251c8da03f8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301246, "uuid": "7d508050-e64c-40f6-8165-c94faf7d4558", "comment": "Malware payload", "value": "7e4a0112d8155784870538e8d51193dd5ff70db15c40c539b19a6d5ddd485d88", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301246, "uuid": "15732736-0cc7-4571-abca-7e36f6824039", "comment": "Malware payload", "value": "6237b851049dae67e4c58a690cb094f4d7cd3cf7", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301246, "uuid": "4efb118d-eae0-45a7-8702-b394a5cec8cf", "comment": "Malware payload", "value": "00761209866d7f1604113731681a314f9041f67a030f56a0398ae7c90fb90c79c99ba2c0db59484940b15addf1951bd4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301246, "uuid": "9821d1b4-644a-401f-83ea-c35213e8efd5", "value": "T160B31205310CF0FBDEA81A5E7A38F3B29C514A8502AE919F2DA8D66509FBFD410DC67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301246, "uuid": "9d8eeab6-9230-464f-874a-be006d32cb8b", "value": "3072:iaAJaYCnKTYFbQ+GmyzaByoOG/vuG/zvMzFW:iaAJTC7GmrIzOvbzvsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301246, "uuid": "c05b2fb1-3211-4a87-8ee8-4596bf46efbd", "value": 108750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301246, "uuid": "a3861c56-9b6b-436c-b47d-c3794f47439d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301246, "uuid": "47fcd392-eaf9-45b1-ae43-d0a542c727d4", "value": "PurchaseXOrderX-XEnerzolveXPI-TP1026230XCBB237.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430e542d-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245423, "uuid": "e535e78d-e423-4eea-82d9-c19193aae80f", "comment": "Malware payload (Mirai)", "value": "04ac6beb622067a932161575a4d57e35", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245423, "uuid": "9e497a0d-83a6-4840-b37e-d5182a84b1ab", "comment": "Malware payload (Mirai)", "value": "7e84ebbf5457aa9e3753be4943ab30efc7663e25674de3000b74c4863f9f80e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245423, "uuid": "505648ca-9f6f-4756-9c31-4a5ff49429c0", "comment": "Malware payload (Mirai)", "value": "993277483bb7b659d766ca8236ffc791e879bc7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245423, "uuid": "c0afc592-989d-4494-b9a7-005cf7ecb295", "comment": "Malware payload (Mirai)", "value": "b1529b355a950c2af0c9067b9da94d730c6ed6731bbdf1b1d009d446377f418ebefe3c6578fb1e6619259f00e5b423b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245423, "uuid": "d9c956a7-6607-4f1f-bc6d-42c1ff828f92", "value": "T1206302BC72EB8474E0DCF531664F21303331DA9AA43F53DA3989B5E9F2975580817EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245423, "uuid": "468cb932-09ad-4f24-ac8f-6693e41d084b", "value": "1536:LltrI7mDmde7Lletk8cghgLFPjihgulh6DoIsJkrPx:Ll+YmdkLMk8c5PdulIZrPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245423, "uuid": "7d06cfc3-0026-4629-9739-8da6ad067ad1", "value": 70840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245423, "uuid": "a4110c5c-dbac-4100-9a7e-f09dcaeb89a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245423, "uuid": "fd6800ac-299e-4b57-a5e4-53bda1130de0", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e964f0b-6666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781272474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272474, "uuid": "43506187-07df-4cc0-8988-e29f1c115f07", "comment": "Malware payload (Mirai)", "value": "0e4ac963920363c814f392905f4fec9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272474, "uuid": "8c9d4152-9124-433d-b61b-4b918602d986", "comment": "Malware payload (Mirai)", "value": "7f07a1fb09ec75adf79dc878f15485e03aadcbe8d8b0717135c769b7d41ae7ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272474, "uuid": "d15fd7dc-e278-458f-aba8-2125022dd2d2", "comment": "Malware payload (Mirai)", "value": "90ab9a1480c581010d1db5f16424ec07e58cf5a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272474, "uuid": "5acccec8-60d7-4e32-a69f-98054e99559b", "comment": "Malware payload (Mirai)", "value": "67e583410930a77eb3291b5efd993632e30695a81b871914bbce1e2304c261d146ad38057fc57f018de10c9f27781e0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272474, "uuid": "c8b381d0-1930-414c-9123-c6e82530facc", "value": "T183B30945F8514B17C6C6127BFF4E438D7B2A5798E3EE320399256F20379B96B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272474, "uuid": "9329ecb3-6ccb-42ee-8d9d-f387dadc96bd", "value": "1536:5AZaevaETFGk0H22Jnha4VaQn9TZqHCb+KrbgY/lLWwyw1NkxstEmdy1GeOigzfY:D0aUt0HJ44P9VqH2drkJsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272474, "uuid": "fcd3c300-cfc7-4531-b887-74514233410e", "value": 113824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272474, "uuid": "bb60618d-097e-4156-81b9-dd863e520ef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272474, "uuid": "f4fe8028-bf9c-4b79-9daf-f7f4c6dbc016", "value": "CRY.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15753dd4-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263386, "uuid": "d3aa8d1b-1e2d-4dd9-8cb4-03627753e3c7", "comment": "Malware payload (ConnectWise)", "value": "9e194614d35cc4b1f9d904203a855b44", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263386, "uuid": "a4efb74a-85f4-49c8-be56-be172229b19f", "comment": "Malware payload (ConnectWise)", "value": "7fff7f0fb7b36a26a13ca26db22d86833059cceeec86e454c56e152705b86a4a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263386, "uuid": "fa89eaf2-8bec-495e-8e09-ebab149403c2", "comment": "Malware payload (ConnectWise)", "value": "e6efcfda8f4b121a305181b36c232985a8f2ee17", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263386, "uuid": "6165ed5f-378f-4747-b5cf-aaba14c12dfe", "comment": "Malware payload (ConnectWise)", "value": "bd09d8a2ce387463f453926037f9c70762bcf09db4457b3fa13e9a00cb95256ae13e37293fd11a16ee76940b48891665", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263386, "uuid": "9fb6a548-128e-48cc-993d-d8dbf16a1995", "value": "T108B71230B64ACD36CD9605B08D7DEB6E602D7E790B2490C7B2D82E2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263386, "uuid": "748cbfd7-21f3-477a-ae6b-b86899a7b6c8", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263386, "uuid": "78c9c135-797a-49f0-b81e-69a1865d73e1", "value": "786432:4StBv0BfNjq/FpttD7yBG/c66pXP5PeeTIzpYpX+0C/v2+uXeTDDkKQ59po:4StB8ljqNpttD7y0/JUwHMxyv2+uXeTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263386, "uuid": "f08ef5b6-088e-4914-8318-436cd711c9f0", "value": 49444184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263386, "uuid": "0e2bea12-b1b7-494b-9bbe-d843c2a6f746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263386, "uuid": "09d8c77f-99bb-44f6-b66c-a024dbb231c8", "value": "7fff7f0fb7b36a26a13ca26db22d86833059cceeec86e454c56e152705b86a4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660a19ea-6632-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781250207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250207, "uuid": "6c9ee09a-38f4-4ac2-bed0-0437674847de", "comment": "Malware payload", "value": "59d4664dd3bde0fc8ba59117d7a9f37b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250207, "uuid": "b7932131-eea5-4958-b335-0d63f723c903", "comment": "Malware payload", "value": "803b99558c857ab89d7639209bfe8535f9a5e5326a700209b11cbdf442ab9edd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250207, "uuid": "4a9e1cae-5a07-4817-841a-37af9bffa785", "comment": "Malware payload", "value": "ea078baba077e14305d45a1c8ef4fcf7d43091c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781250207, "uuid": "4343e38d-5b2f-4a9c-8deb-14fe64df3304", "comment": "Malware payload", "value": "459dc01d6fce4d2306cbd6ef1621d7d16b1bd3d3d9e70bc024afe7dbee333ab083fb793c24b477c498c5b6599f1ab698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250207, "uuid": "e09478dd-becb-49f7-b6da-9882ea3d9ba8", "value": "T183B319257BBA0A1FC4D4A47A61F34232F2B6C78A10BCCA177DA10E4DAFE568031577E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250207, "uuid": "c3fa2982-6229-4a18-898d-0facc7d37504", "value": "1536:DGhtjTDdNGUICN7ML4FeP8pCP/3gk3ABfrmQ0QeNd0Cy5o8btJteJpFwjRQENVBF:+jTvGUceTXeNd0CCo8bQum8xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781250207, "uuid": "9a706aa2-05b2-4e3b-a984-293d641fe557", "value": 109648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781250207, "uuid": "5872defe-5ab0-4de8-bfb1-a3587c6fe28a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781250207, "uuid": "dfcb3700-7a43-4d65-9e58-4a05a03ce511", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ea08d9-664a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781260724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260724, "uuid": "cdfa6135-54ad-4060-802f-a03e9e50c7da", "comment": "Malware payload (Mirai)", "value": "98a40c2b272896729cbe006d579e4e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260724, "uuid": "dca4f3b4-3c44-487a-879c-ff2c1372417a", "comment": "Malware payload (Mirai)", "value": "8167eb6f0c0de625ede43fb69499033770e5edfc000630cda5b3e5e2bf2e574d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260724, "uuid": "6cea1381-991e-41af-a478-8a51876a7db7", "comment": "Malware payload (Mirai)", "value": "da4e7e97a6fe6fcc2dfa967f3e1397960274904b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260724, "uuid": "2cff06f9-bd05-42fe-b67d-21be5888e788", "comment": "Malware payload (Mirai)", "value": "d47fb2dd9add6ac6996b8bc64d76f35b1ada302e8c6f018da2838c02931fdff2a96618a646520c235665b50e54372004", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260724, "uuid": "9f9ced6f-372a-41d0-beaf-586193529503", "value": "T1ABA3F886FC504B57C6C652BBFF4E438D7B2A1768D3EE320399156F20379B95A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260724, "uuid": "b7df4f4c-5cfd-4f1c-958d-c7d88e84cb78", "value": "1536:sprFPM1dAN4vO4Vx0k7M1nXL/+O/DuQ+QYnalewwyw47ntZRd8/s5dMh:sxFk1du4YkY17B+FM/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781260724, "uuid": "f008fb00-cbb9-4237-bcc4-5a04d89beac3", "value": 101324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781260724, "uuid": "914e123a-65e0-4fd0-8d74-eb5910ceec25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260724, "uuid": "2cd20134-e347-4610-bb7a-2caf704d4967", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e642e7-6601-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229324, "uuid": "714829ff-2e49-431f-8633-534ffa9c1c60", "comment": "Malware payload (Mirai)", "value": "5e500a4015b43354915b232b9ffeb165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229324, "uuid": "59955ca3-5f74-451c-856c-e100d9b1a153", "comment": "Malware payload (Mirai)", "value": "824fc416809ff8000fecba2677c3391e8361ad3ff5ae79eca6166f455d19946e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229324, "uuid": "52687f44-7eb3-441a-9dd6-1396fce79a9e", "comment": "Malware payload (Mirai)", "value": "b8256bf0d8512d637218c0eca9db283112c6559f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229324, "uuid": "0d6a24c0-5161-4ecd-ab2e-16eb478df17f", "comment": "Malware payload (Mirai)", "value": "afb72720ca67844ec6c4b4f43d4e424a7ad04f538ce3936ad98bad4bf97bf0cf28ddfd3b5374478cd384c3dd7d165ad3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229324, "uuid": "8518db26-93d8-4aa2-a5d3-dbd27c973eb3", "value": "T1E6C34C46EA418B13C0D5177ABAEF42453323AB64E3EB730699185FB43F8679F0E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229324, "uuid": "4e131655-3170-40e7-8f14-5b554eb4fb5c", "value": "3072:zH9KQDaw57L3A/xbRyPzI9FvyKinxoGM/9kmj:zdKol7L3ApbRyPzIvvenx7M/9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229324, "uuid": "034a6558-eb0f-4234-bb79-a4ebe7c47ac4", "value": 122887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229324, "uuid": "4c4dc263-5b4a-4edb-ae9b-8d1f3d8afdda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229324, "uuid": "f3000796-d058-4971-8a1a-7acab30d87d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ee6a97-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286061, "uuid": "312b8a97-b5c2-4ad8-ace4-9f81e8aae34d", "comment": "Malware payload", "value": "e7bb4cfaf050d53d49461f20e72fcf9c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286061, "uuid": "5d89760c-ee0f-449c-8f85-cbc1928b43e4", "comment": "Malware payload", "value": "857cff3658cd4a102cfefe152c101d1586a3d6aac10710163dc905ec53bc0d51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286061, "uuid": "666f9e5c-6274-42ca-8859-c92011ab0588", "comment": "Malware payload", "value": "001453b109a9a6cccadb9c20dfbf42e6bc6377fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286061, "uuid": "ea9a1b03-e76d-40b0-bdc9-7aa030fbae67", "comment": "Malware payload", "value": "582bbdd5bd22e84bb851f04485a14bc63b2abbe48d106e30bdbd5a7e0fd7e397125f79dcf2a912059c25a2d2d849a50f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286061, "uuid": "9efcfcd5-978b-4c13-83ce-2472ef353664", "value": "T13ED2DF34C4D83FBDEEAA2A1C06FA6620D7D68B1E9494860637477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286061, "uuid": "a169a666-94ab-452a-8213-d9f0ee7fe742", "value": "768:IumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Iu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286061, "uuid": "b37f33b0-8349-47ee-90a5-0f2d89ee69fe", "value": 28665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286061, "uuid": "23f48c8e-a392-4326-aab0-e9e71c873fe3", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286061, "uuid": "4e71c11c-8ffd-4bc5-96d6-86cf0543c360", "value": "194.9.6.40_1781286002565666_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273b7826-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301211, "uuid": "ed5b9bdd-a607-40d1-9d40-f6d1344ae4d4", "comment": "Malware payload", "value": "721696994f6ab4a05620c209158f0ef7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301211, "uuid": "80902474-11fc-43b4-bedf-ca87943b9232", "comment": "Malware payload", "value": "866cb294cb004d4a3e8fee3a30d262dc46b06fc4e3725314eb6bce87c9221875", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301211, "uuid": "bfaaf4e9-8684-4342-a2f4-d8392078c544", "comment": "Malware payload", "value": "fbb5579e433e37be489bc9237fa6e32d2afd732c", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301211, "uuid": "46c39a15-4608-4bc9-ba86-5ca88335d0f7", "comment": "Malware payload", "value": "413050b4475797680090fa1e4016e39f226d323bb7dbf34b6a130ace9924f3fd36cca87624e2fe643afaa9c0952ab80f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301211, "uuid": "4e6c3bed-00a0-452a-a0dd-de7fbccaf186", "value": "T129453371F1211C30E9289BF78A3F94A9F3A72A7E5A9B9FD781301186141701F9B9DE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301211, "uuid": "533c2eb9-4130-4561-9a89-3750198f4d7f", "value": "24576:l8SCJqRWfKKUK2pfxh9o3RRavdNkQ1K3VNW8xghPhBn2vB4:lxCEGCVTgkvdawK31xg9hBnO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301211, "uuid": "d651a026-8f58-4369-b127-d438ff6dfee5", "value": 1249209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301211, "uuid": "6982d464-a22a-4c09-a3ea-7fc566617e43", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301211, "uuid": "7db86c55-1e4b-4f17-bc2f-071e3292e996", "value": "MadinaX-XPROJECTXSPECIFICATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216a1113-6669-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781273714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273714, "uuid": "3b908f7e-9180-493f-9e0e-dae5749774c9", "comment": "Malware payload (Mirai)", "value": "e96b80a95ed1e3239ffd18741a1e989e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273714, "uuid": "10235550-ad4d-494e-bf0a-8c90e5290822", "comment": "Malware payload (Mirai)", "value": "87218d3a50595e89c351f16eea6b4e3c5dbb6f1251fe2ca0369493baa46f7556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273714, "uuid": "af2e19c6-8054-4456-a20c-718ef9ce7edb", "comment": "Malware payload (Mirai)", "value": "07cf5c19a071656a6e86bf63cfd4f8f2875d8b51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273714, "uuid": "6cc22c2f-07ad-45a7-a542-d39e3640d935", "comment": "Malware payload (Mirai)", "value": "e30d41b6c18941b84a7f19a2014fed850a20961dcc4a6ebb2b8f00feeaba84173fa767051f203b3ea0546814b35f8cd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273714, "uuid": "8dc6ace3-e1f8-4988-9aae-66326dbfa289", "value": "T108A339B3C8662E58D6A9D5B1F0B18F792B53A91081871FAE6573C3748483D8DF6093BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273714, "uuid": "c6966b0e-1f02-4494-83dd-5716b95ca0c2", "value": "1536:bASKWmObsPsuVU1pVCNKZ+pUQ6hMzPN36W9wW75Wtmj4/q:bH+ObAsuO171ZhhMz96WeW75Wt1/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781273714, "uuid": "190b1799-d7ea-42bb-b7d4-cd8b12f397fd", "value": 105060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781273714, "uuid": "007a2e58-6aae-41b0-ab68-1fc9a7c22397", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273714, "uuid": "e32f9116-28cf-40e5-847e-fddd595125d0", "value": "CRY.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333f38aa-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781301232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301232, "uuid": "5ec9afe9-05de-4229-b520-b0bf2a06a7a7", "comment": "Malware payload (MassLogger)", "value": "4dd991b57f2f59ce0ea471613baee4be", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301232, "uuid": "b3ab0a2e-edc5-4159-9610-58c8eb3ff88a", "comment": "Malware payload (MassLogger)", "value": "87a467019fd2a9701b00834c0bf195279b96c7e34f1823539f0d59b8b82b3f42", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301232, "uuid": "67aeb495-c36a-4987-bb6a-afd560282157", "comment": "Malware payload (MassLogger)", "value": "9e3fe67b614eb5e2d98b54a18ccb84428fe86c56", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301232, "uuid": "a0a1b459-c840-47bb-9607-d016b99b6124", "comment": "Malware payload (MassLogger)", "value": "591502b07ccb8b07753dadac1c0fd632f59e003a8268b2d8b3e485d9206078f360b6348714086b4eb6329509b2a201e2", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301232, "uuid": "1db5ded0-36e4-4179-8c30-ad17906f4300", "value": "T15AB423F25531EB30CFA2B2681457B1BD4E9D4B34F5198AF8B4D824B176F6E811C44EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301232, "uuid": "540d3822-9ef3-444f-a3c7-8375efebd236", "value": "12288:ntDMhz7+HBApq6aLU10nkmxlgULxWMaYsIn93+/NVKT3BX+:6z7nknUtmxLsMaYn93+/L2X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301232, "uuid": "fe18d8f7-c724-4e4d-b7cd-73316bbffd57", "value": 494309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301232, "uuid": "35d7544c-c965-48a8-9dfa-572dbfe81d68", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301232, "uuid": "f657333c-e1d6-47df-8af3-51e5b641fcbc", "value": "comprobanteXdeXpago.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026b6711-6651-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263354, "uuid": "4642978e-8b87-48a4-83a2-ecaadc105985", "comment": "Malware payload (ConnectWise)", "value": "cb502e55b298b5dc0b6d16e3e22742c5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263354, "uuid": "222d0f63-dbb1-4b87-8fd0-8b90aec58011", "comment": "Malware payload (ConnectWise)", "value": "883d9209b1f866445944debeb56bd6b6f4f0baa3088768b7dd5c18878c898f8b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263354, "uuid": "a63922a5-e1fd-41e6-8111-967f07b6c3fd", "comment": "Malware payload (ConnectWise)", "value": "89856cfd7470873380e0e5d1f394fbf3483c050f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263354, "uuid": "4cb07b8d-6d3c-4b8a-8e3e-d9f2b47df2d7", "comment": "Malware payload (ConnectWise)", "value": "389e6a9690763a4c3b70c73aa61516ee7f492d8b060c98ffdbbf2b4862d11669bba8ad37141aaab1435af326f8318402", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263354, "uuid": "b8314dd7-4478-493e-b16d-f862b15e0092", "value": "T1B8E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263354, "uuid": "82ab7276-e8c2-4f76-a1d0-ee618e723aa2", "value": "49152:krGLq7FVsLBe+1GVxrKlsu11g7GenGwfZVkVjOi8ifyXfKVzhI:krn/TYGVxz48GBwRVkGuyXOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263354, "uuid": "a16d704b-81ad-4d41-a639-cd328893f921", "value": 3183616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263354, "uuid": "fca0cc6d-b3f5-4489-89a9-fd88fb9b449e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263354, "uuid": "177ab9b4-d4b4-447a-af4f-d7919dba3348", "value": "883d9209b1f866445944debeb56bd6b6f4f0baa3088768b7dd5c18878c898f8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43feef7f-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245425, "uuid": "214015ed-5944-4bd4-8788-2b5c255770a6", "comment": "Malware payload (Mirai)", "value": "f889b381eb584be4f85d347c290dc539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245425, "uuid": "914db310-f054-4a2e-b69a-267401738190", "comment": "Malware payload (Mirai)", "value": "885fd0822ba35d1e9d99040353a732ab82bb43f88760745691f5c6746da43a30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245425, "uuid": "41adde23-5561-4b61-a78b-a258a7bd4acb", "comment": "Malware payload (Mirai)", "value": "f4442d181e0d0136cc6f35c5300211ef17615d9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245425, "uuid": "38c8d80d-dcba-4a13-9b9c-3831895bbbad", "comment": "Malware payload (Mirai)", "value": "8a8152b902b0a89812d13c57f5e7d5c0eca17097c6d36c49929b809baf6fff6985716c3362f167873f75d7b5823a606a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245425, "uuid": "39900385-4bff-4f1f-9037-e99c0e88d4b7", "value": "T13D233A92BDA29A17C5D0637BB67F858E332A23E5C2CB7717CD111B10368661F0EA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245425, "uuid": "be987151-455b-486c-ada2-1467c4fc4360", "value": "768:5QmXZ6kA4qFFhrg70uF3h3hwro6JE1n3RpQ7Ez5pSipKblHTOKNI:9AXhrotc213RpQ7EdptpK5iKW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245425, "uuid": "31e0b99b-7317-40c6-b48d-229b33685b23", "value": 47732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245425, "uuid": "003b704e-04b8-4a75-9a64-3b6df341dc24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245425, "uuid": "fcf2d293-d2a6-4e74-b299-44d2f733550c", "value": "kkk.arm5k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b54e8aa-6671-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781277140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277140, "uuid": "7e01b678-b6a9-4ab5-aeae-68967e754d0f", "comment": "Malware payload (Vidar)", "value": "1aa3984efa69eeef86daedc619d64eaa", "object_relation": "md5", "Tag": [ { "name": "65-21-96-134", "colour": "#173B7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277140, "uuid": "ea04b313-daeb-4604-b4fc-cf43a1c27309", "comment": "Malware payload (Vidar)", "value": "8998b6887fa8923921030df05d0f77f3e72129da4a638ebf7fef69caedfbd3ac", "object_relation": "sha256", "Tag": [ { "name": "65-21-96-134", "colour": "#173B7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277140, "uuid": "b358c0e0-15a0-4093-83e1-20b5feec5ddb", "comment": "Malware payload (Vidar)", "value": "35bcb7f7c223b64806714aa5f92839b1ee891bef", "object_relation": "sha1", "Tag": [ { "name": "65-21-96-134", "colour": "#173B7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277140, "uuid": "364f778c-3207-489f-ae26-cc0e053266d4", "comment": "Malware payload (Vidar)", "value": "ef09a9621eb7a6a05881c8309fb8944bc8e3428223ac25b1244d03dd0b5f63aaab4cad1c6dd337137d083e995c3f4382", "object_relation": "sha3-384", "Tag": [ { "name": "65-21-96-134", "colour": "#173B7A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277140, "uuid": "a7e6afd6-631f-4b66-9c9c-73fd197aabd6", "value": "T193F58C02FC815CF9C0AAA23289B3A6927774BC481F3227D76A90B7382F727D05D76755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277140, "uuid": "7e58826b-bf24-4627-a51a-7dd605bff292", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277140, "uuid": "3d24d303-7358-4e32-b945-5a8ccd470363", "value": "49152:mLUXgTRueULZpDS75j6YPtZFAH+S3oJZKn6ECDHq:mLVTR6StZGH/uoBYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781277140, "uuid": "5b06b281-e2d4-4be5-b194-650488cbf84c", "value": 3506048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781277140, "uuid": "c173a278-e6b7-4133-917b-84fbe7c0b440", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277140, "uuid": "69ddbf5c-0da1-49b4-b587-6a9c7e6618d6", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad26423-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262724, "uuid": "56851bed-eaab-4cb1-873b-07b7309db3e7", "comment": "Malware payload (ConnectWise)", "value": "d6e2ca4688120f924e09cc7107a2c4fc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262724, "uuid": "6c32d9ee-1daa-4eb5-8e81-c4f8cb2b30ed", "comment": "Malware payload (ConnectWise)", "value": "899cef500c9f09f5ec99c0496b6b1703ef4f6784b95a9b03c8deb966824b7e4f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262724, "uuid": "6920da15-f148-4855-848e-3dc5e3b6d7b4", "comment": "Malware payload (ConnectWise)", "value": "f89ca5011a5976003e39dadd79a061aaa489e2d5", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262724, "uuid": "cdcb58f8-08cd-4352-8621-0ed32c836b7d", "comment": "Malware payload (ConnectWise)", "value": "98fd87bd2487a6d87e55031a56f579771834340ecbcac960a905bbe082df54024405ccb11f734f7f6a91f65f9c7822db", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262724, "uuid": "dfa89ad1-07f0-4dc3-a22b-09f1abefc3fb", "value": "T1A1A62332A5E44136F6F61672A939D070BD3DBE246B10C85EE7C8A81D2DB198193F3727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262724, "uuid": "369f47d1-0d93-4dc1-bb02-ab555d169702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262724, "uuid": "a7533289-6c73-4bb2-ab55-5e02b9dd7d21", "value": "196608:lLZfOXtuDj+lkIbrhibcDrlC0OqatbB5bMebj1rnLYG3zrhukO:zMgKeBbcBeFLnj1bDDrgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262724, "uuid": "538adbb9-238b-4e6c-b624-70050cc73d11", "value": 10082304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262724, "uuid": "1dcded07-6169-4f26-906e-5191478d0fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262724, "uuid": "ab5a32d9-b897-4d36-8ff4-8e99772a4448", "value": "899cef500c9f09f5ec99c0496b6b1703ef4f6784b95a9b03c8deb966824b7e4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c0f2a2-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301310, "uuid": "1c120d19-2cf6-451d-94d5-94606e8a522b", "comment": "Malware payload", "value": "fc3f7db8c392360fc044d51a5555282d", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301310, "uuid": "d7865222-3d17-48a3-8e0d-e32febf61b7e", "comment": "Malware payload", "value": "8a06d0975c057a25f50d7a6ebb8740de8d12adf12cd7ae8ccde78fc29cd04b1a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301310, "uuid": "2799785f-621a-43d4-909a-6590e6d3597f", "comment": "Malware payload", "value": "c48f706f07fe4592a964826d81e4e8435a264a9f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301310, "uuid": "d4922c3e-c8cf-4f3f-b974-858eb0cc0fc9", "comment": "Malware payload", "value": "ea564644b8defcfd7d2e32e8fc118750eef684cb1d77b5f5a8e14a28e96355ae5b84d078ec2b1f9992dc8e277eb4181f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301310, "uuid": "9a95276d-93ee-4b24-99b3-dabab5d5be61", "value": "T1FFC312F841F37622C273B672E0581A6F6F9E81A0D725140E76FAA568D0B4EC04C396DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301310, "uuid": "ef450d9d-b0a0-4566-b27b-c86055a00ad9", "value": "1536:J8dQfKduGi3cyIvqel0w9SZNn2xeGsuoI7OH/2ExV+iXmwq5rAFN99sBdL8CZEjI:a4ayvX409n0ejoF4vX/q5C9tSEjZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301310, "uuid": "47654901-eb1d-4982-afd9-ff8f87f4638b", "value": 128797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301310, "uuid": "a377b239-44d0-4f38-b2fe-d523782d0acc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301310, "uuid": "c2aee41d-9648-45f6-8ff5-4941c1ceddff", "value": "NewXOrder#56901731.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd88f8ad-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286055, "uuid": "f8d68279-fa8a-4e74-a6dc-7292762f4c36", "comment": "Malware payload", "value": "16e199a3f57d1cacfc2b803d56dae840", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286055, "uuid": "7977d4e6-dcac-42ad-8638-b80bf5391ccd", "comment": "Malware payload", "value": "8a5557416ba8384a7e6142962f41b776d9a33b3bbee4934df09962d67e755b1f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286055, "uuid": "79ef6962-1b0b-4cbf-ae4e-696ca8bd2aaa", "comment": "Malware payload", "value": "6f25d695268bce708a6524b4a301bb4b0e3e529c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286055, "uuid": "76184ea0-fbf8-4ea5-adf3-835a011161a8", "comment": "Malware payload", "value": "932dd7bc86bbb2bd3b5ca647c15735b7230ac4f795a1459b4b328f16350fe88c5aec35f3fff52d42233f7607296cf72f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286055, "uuid": "e4885e7d-cbb5-4e67-812b-bb35d3b38ed5", "value": "T189D2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860B37477D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286055, "uuid": "c17be6eb-8d50-42a7-b0fc-04a2234ebba3", "value": "768:aumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:au+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286055, "uuid": "351a7540-5e2d-4cc0-a922-f719620a413b", "value": 28659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286055, "uuid": "cc7199fb-daac-4bf0-a163-22bc7db2518f", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286055, "uuid": "b3aa49b8-8ed3-4fef-b678-b1404542cd00", "value": "194.9.6.40_1781286001457097_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8f4d88-6657-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781266302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266302, "uuid": "2564c82b-4744-4ecc-ae1d-4d52fb50397b", "comment": "Malware payload (ConnectWise)", "value": "e6c178fb8619ab630d6d1756d662e947", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266302, "uuid": "ef0e6274-a34a-418c-bcf0-27fb65a8883e", "comment": "Malware payload (ConnectWise)", "value": "8b5f89e88b4028842bf0b525e17e48fdbe84ac95cd4f037d42bfbb8869d029e1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266302, "uuid": "ac879697-4ecb-40e4-9c2d-18c4ec1b3611", "comment": "Malware payload (ConnectWise)", "value": "a01837b439e4d7e9ef263ac25e4e1145bcd8d3ca", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266302, "uuid": "0a0c04fd-dfc4-4f17-8b84-960159d47af4", "comment": "Malware payload (ConnectWise)", "value": "35f74706e5e7311596a07bda9e705130967e88c8edd9c3865e7c1f4455890224ad95aec6aa28be0dbf8e7a653097dfbd", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266302, "uuid": "7e631b17-f8a6-4743-bf19-183939252813", "value": "T1BED61211B3D694BAD4BB0638D87A52655235BC148762C3BF6790BD6E2D32BC09E32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266302, "uuid": "51bdc213-5045-463e-a54e-0d74a22a86b4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266302, "uuid": "b038fce2-0fe1-433d-96f7-e49a812307ea", "value": "196608:Yc8fefP1oHQjDSOgtuPXDoHQjDSOgtSDoHQjDSOgt+DoHQjDSOgtb:Z3owXSkTowXSUowXSsowXSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781266302, "uuid": "882b255e-38a7-4bd7-9265-49fa61f33157", "value": 12803128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781266302, "uuid": "5cf4ab00-076e-43ef-9a53-0b58a55fea3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266302, "uuid": "862fe00a-f234-43f1-85de-de3bd526ddad", "value": "ScreenConnect.ClientSetup2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadc71a4-6667-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781273193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273193, "uuid": "1d295626-b9ca-4c96-9599-999bce4b54f8", "comment": "Malware payload (RemusStealer)", "value": "a97defdec56df580d77591c8e4e3aef4", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273193, "uuid": "360a7b61-328d-4290-9fec-323223846316", "comment": "Malware payload (RemusStealer)", "value": "8b6d087dc70aa52e70ddc2d7541b8cada0572ad783cd6967ba103bf158371085", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273193, "uuid": "ecfbf5dc-b427-40ca-b828-3dd9c5fa5d42", "comment": "Malware payload (RemusStealer)", "value": "66e1f2a553c42f62b07eec71243ab4081399f195", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273193, "uuid": "914362e8-b4e7-499a-9d43-aa58ba7a3818", "comment": "Malware payload (RemusStealer)", "value": "e8842d82615213dfe506639c81a3e1b3785bd45c4c63c3f6836532fb4696e68968a37b69203eed5052c92203edd801a8", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273193, "uuid": "71c2dee3-b1c7-41e8-9af7-3056f0b43e8f", "value": "T12145232A23E4A155F5669B74D4F1829A4B32BC209F6467EF32C3C8BE9F522D0953170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273193, "uuid": "fde0b85f-5147-4513-a8a4-1d889536c087", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273193, "uuid": "1e2f00a0-8204-4ba0-ada5-687730cb75e1", "value": "24576:IHnrPi/aO7VD3Q+CjfsTdBuw9ZGB52jzw1oEMtPTfAPwGXmi:IHrP+aO7VD3Q4E+AB5QzUoEGLf9GXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781273193, "uuid": "c05e336e-7395-47e8-bb35-4e1bceae3c4c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781273193, "uuid": "770720af-a1ee-4c73-b60b-04e3ba91aded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273193, "uuid": "3a7ef3d6-bacc-4da8-8368-98cc95cbf938", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35858b8-65f1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781222500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781222500, "uuid": "f85bcef1-92d2-4733-9ff8-6961da7e9eb6", "comment": "Malware payload (Mirai)", "value": "34ab905038098ca08dfc081bcc1d361b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781222500, "uuid": "de104d7d-f9d2-4f8a-a6c2-341dd89081a7", "comment": "Malware payload (Mirai)", "value": "8ce3fb88aac1ae474d01d8831e526cf80c2a7bdb69a457df8e0871ec00c082dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781222500, "uuid": "aa0cb9fa-5bcb-404c-86bc-d6cf96c9a70a", "comment": "Malware payload (Mirai)", "value": "8c0cb0d03ae8b4005d6fcab699a729dc43180b31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781222500, "uuid": "101b076f-c028-4232-9940-770b039ec92d", "comment": "Malware payload (Mirai)", "value": "66babb6ad991206b985b87354ed8ef2ab372e5aadc6ec9936d371bb64e52f08b2816d34103052aadaf77522cc3a8ae32", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781222500, "uuid": "c8d65376-aa7b-4d31-86be-b4c2db9b59af", "value": "T14FE3F745BC518F57CAC252BBFF4E4389372B17A8D2EE3103D9256B25378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781222500, "uuid": "a856d48f-e8b5-40b3-a5df-3f4f52b1e04b", "value": "3072:YkKFW3LWKb41zzoYrlFRhXk+eCfMaNRWA40qJLS8/iNQNN3n:YjFW3Lps1zzxrlRXknCfNN4A402LV/iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781222500, "uuid": "6d3e9f77-6e6d-4bea-9cb1-7239cc97fb42", "value": 156964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781222500, "uuid": "49cc7c1e-1b5a-44de-86e7-50f770023ea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781222500, "uuid": "146c714d-dc48-4d1c-9fec-428fd82938e6", "value": "SecuriteInfo.com.Linux.Bot.23864.13390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93405b3d-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301393, "uuid": "6a0ab31b-d175-49ef-9ac9-00b370af706f", "comment": "Malware payload", "value": "55c3ea4b4839a0aa3058b7ac73eaf609", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301393, "uuid": "63eff002-02b0-46ac-b2fc-52037cf67cad", "comment": "Malware payload", "value": "8d7fe98089241b0606e35c9bf47ab7382f31f4dd5dd6696f042e8914daa6261a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301393, "uuid": "b632a3c7-38bf-4bdf-a5a3-a6cc03662002", "comment": "Malware payload", "value": "c6740008e3f376a8f76a6a857ce5637a30c22933", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301393, "uuid": "fabfaca1-bd23-4fdf-a7d3-ea4015b9bf52", "comment": "Malware payload", "value": "4e8a4ad0f6e8d97b5caf3f58556dc4e3e26a1ccdd6fd3fdbde895fc8f4e8053d59fc799295d440111201b9ab3f7c3b98", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301393, "uuid": "63fcc598-6f0e-422b-8fdf-fde4fdbd4e6f", "value": "T1FDB3121EABB12D0156FDA723BEC44B4CB3E04F295C95528DE9ECC64FD1E8C75182618A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301393, "uuid": "3ddb1da1-f931-4c55-a3a2-1e8708fc053c", "value": "3072:7UoaACl9fHLssrXGl07vMK0f2l5VqYDuJQ:7RanPr6mgK0f2NqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301393, "uuid": "c09ef669-ba8a-415e-b1e7-e5753d7e55e5", "value": 115771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301393, "uuid": "a0f9a34e-5478-451c-aff9-de4cee1a1bb6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301393, "uuid": "42a9cd8f-2b32-4711-9f48-5d6bc066cafc", "value": "PROFORMA_INV_RAFEEQ_TRADING_#270427.001.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc824e7-6650-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263344, "uuid": "610bfd03-8629-4464-a526-574a6e145b20", "comment": "Malware payload (ConnectWise)", "value": "570e1654fa15f4a130a79b3575366687", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263344, "uuid": "c4515c7e-c495-4c51-b7f5-810a2f016c46", "comment": "Malware payload (ConnectWise)", "value": "8e1732f643ea782fef991bb557725a0dc45edb3d25ee8c76a8d3a1e592b9be7b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263344, "uuid": "aca5d9a3-14f5-4322-b482-c648bfb497ac", "comment": "Malware payload (ConnectWise)", "value": "20bb55a8f50c90609c85e58cd57a68f3cab71271", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263344, "uuid": "2c2819d6-6181-4f05-8374-0f3307dc4237", "comment": "Malware payload (ConnectWise)", "value": "6e4901b2c498d0226c4a98ca653253cf86777379ccaf4632b5b83b5cde8163f7beb00476d039e312d2bccc9ced03aee1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263344, "uuid": "062b4e10-3a66-4f4d-9b06-e5c1426853c1", "value": "T130E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263344, "uuid": "9b4a0528-2e3f-47ed-961f-5dcdb4f457b8", "value": "49152:krGLq7FVsLBe+1GVxrKlsu11g7GenGwfZVkVjOi8ifyXfKVzhKT:krn/TYGVxz48GBwRVkGuyXOYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263344, "uuid": "a30008ee-eaa4-4fdb-95a9-53db39291f21", "value": 3182592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263344, "uuid": "84c83fe9-a21f-421c-ba53-67866b81c1a1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263344, "uuid": "7a1c30c1-5171-4aed-975d-747c318ac057", "value": "8e1732f643ea782fef991bb557725a0dc45edb3d25ee8c76a8d3a1e592b9be7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ce1581-663d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781255062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255062, "uuid": "2d16a5b8-98dd-40fe-b3d9-9a2060bc4b66", "comment": "Malware payload (Mirai)", "value": "e54dc89fef5121f7491945f62ce309ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255062, "uuid": "02bd7d16-2c7d-4f01-a787-ebeb81363333", "comment": "Malware payload (Mirai)", "value": "8f875dec87348140eee51bb102165d01e90163c9c4c76ba796874b36dfe1108f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255062, "uuid": "d77c1388-c507-423a-b759-73529323e8c0", "comment": "Malware payload (Mirai)", "value": "3c37e09aae634c0925a9bd2166b37087ce2c74f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255062, "uuid": "7646b7ce-a0c6-4ab4-9e5f-6f40c8d9f9b5", "comment": "Malware payload (Mirai)", "value": "32cabb22aea2cefe1ed3453b42fb54dc6ca14fe155ebf0e82434f6e27263332c1ac41ce62669f91a8c014cecf071c358", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255062, "uuid": "0fc85091-c0a6-445a-88e4-4a19856316c8", "value": "T1E363954A2E218FEDF76CC73447B74E21A7A923D622E1D784E25CD6001F6434E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255062, "uuid": "fd832dcd-8219-4531-a6f2-976d85cedeba", "value": "768:L91cnwJdNRYIotrlsQtDipzggCYqRd6NceW4gYzYWs3SS9vGsWyEixeqyv3T0IOp:L9qwX8rlsQtepzggvOfYzVcneL/T0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781255062, "uuid": "e8509132-aa1f-4f07-a1b1-a98724d836f0", "value": 68948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781255062, "uuid": "b20a9567-2b5e-4b7f-a04a-d4baa35cc094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255062, "uuid": "c17b59ee-9919-4563-a839-8ace5782aa3c", "value": "godisdead.2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a94108-668f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781290283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290283, "uuid": "0deca5f4-16f0-4250-9bf1-991ca3a13f49", "comment": "Malware payload (Amadey)", "value": "76a9107cac9d97ef0919fff8f288fd1b", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290283, "uuid": "5521bd68-629e-430d-99a5-36c5489eaf47", "comment": "Malware payload (Amadey)", "value": "8fe1fed51558e70a559f372b3e27b43ff70d6375b0161a8efa966b2188937721", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290283, "uuid": "f4e4180b-6ff9-40d3-a562-0e414615b2a3", "comment": "Malware payload (Amadey)", "value": "136f7853b7382e0b0fafaee4b694ef0fa42fdb42", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290283, "uuid": "4c3b2091-acf2-4050-87db-0c0ce2f278ce", "comment": "Malware payload (Amadey)", "value": "cdf64f27ea4a01ce681a657ffefe2389620463c4db52613dfae1dfe679d24e45eb93d573489beb5026e8a4bf374de399", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290283, "uuid": "56867ed4-5d82-46b7-830f-db1c533fcfbe", "value": "T130B633EA3F625EE2E756613131BB44491BB0E0982B32FB4F4E601514DF9FA82CD3459B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290283, "uuid": "d1d32ba0-2310-4d83-802b-ac32b4f30103", "value": "753375591aacf62c29fa5daa215a217d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290283, "uuid": "276fa2f0-f7cb-4a0c-8715-c2e2dd55bc1b", "value": "196608:OFxGv5wCIZNjlw/UDbTpA7n6u2frr4Bjp5+CDnHoqXJVI93h:iGvLIZ3w/UDb/HIp5eqXJW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781290283, "uuid": "34229d08-9358-45ed-b569-0bc570590293", "value": 10696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781290283, "uuid": "b9ecf6fb-2316-47a2-82bb-792b8d729ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290283, "uuid": "bc374a17-ce7d-467b-8517-2b3d8f5e550d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7e7bc5-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1781301354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301354, "uuid": "c5d64b2a-0046-4a75-8b07-88876ecab025", "comment": "Malware payload (RemcosRAT)", "value": "8a081c0d5ef00854c8c556658bfffed1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301354, "uuid": "083aed03-bc54-4dfb-89b0-98021676bf13", "comment": "Malware payload (RemcosRAT)", "value": "8fe9ee03fbab3a4bea6e2909b2fcff0dbe824303880a25f50ba289b395b83741", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301354, "uuid": "169d2e05-d105-450b-b6b1-5c138089e135", "comment": "Malware payload (RemcosRAT)", "value": "2a6e48ffa12c070b46f7152ad7d3525e003c7116", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301354, "uuid": "83e6ea1e-5545-4d8b-b77c-c0f0d4966626", "comment": "Malware payload (RemcosRAT)", "value": "127469e53bff7ddc1c125aff18495bbc17730b0c19f9cd6ab3c5e80b17902c0a98a7b46840e97ede30b3d24fa959fb7b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301354, "uuid": "1c4f5453-7716-4f76-b8f1-24de633000bb", "value": "T1294106144BEA4314D2B38B3AACBAB31595767C55FE62CF9D0150518C2464224F5BAF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301354, "uuid": "a60452f1-25a1-41d5-b7f8-462a572c4cf0", "value": "24:8An/BHYVKVWf+/CWO3pvOyurtV5yAWBqJUMkW2pj+/QT4I02H/pGlpgY6Q:865ab3p0tV5yAWBqJHsfMIholqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301354, "uuid": "9b59c7d2-a530-4604-b3b5-04b411eb4e2a", "value": 2266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301354, "uuid": "128d8d3b-91c0-477e-896b-afcfce08b439", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301354, "uuid": "6a572d0b-87ab-40e5-8406-d949e5703ebd", "value": "Proof_of_payment.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a875007-669d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781296063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296063, "uuid": "b45c5390-4b47-4c05-84af-48c500f862d5", "comment": "Malware payload", "value": "f009d387169bafd5abd71401d1f3e503", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296063, "uuid": "3cbcc8d7-08fa-44e3-92e6-e0a7d3780807", "comment": "Malware payload", "value": "902963c00e56ae639a9106d4a6f27b671af24342cf3e5a6c29a9f01cc9868b51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296063, "uuid": "9c4a5e1c-7875-4b8b-97c1-a1e948e4ef96", "comment": "Malware payload", "value": "98633343a348875b363389a958958a0ea7dfd687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296063, "uuid": "0b760d41-6780-4b4b-aa5f-36c9ed344c79", "comment": "Malware payload", "value": "6cf86eba6f74cd6cd43dcfb0573b5e5ac6e5cf5260105bcb6f12d626898d85579b7d7e0c0c90e57c8088e9a667f36da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296063, "uuid": "f8945ff2-2823-4acd-b160-b8df64d928cd", "value": "T1F8B319657BBA0A1BC4D4A47A61F34232F2B6C78910BCC6173EA10E4DAFE954032677F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296063, "uuid": "25ebc05b-d3a3-4ff7-9a34-ab9074ec40c1", "value": "1536:NSPFsNhdV/hN7ML4FeP8pCP/3F+iABfl7TA3d8c5hH4tdte/n8N0F:IPFOhzFjNSd8MhYYs0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781296063, "uuid": "16a57054-1be4-435a-8de5-bce81b0fce80", "value": 108368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781296063, "uuid": "67710ea7-c60e-4320-a3b7-37492a6ed726", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296063, "uuid": "3264b9f6-6326-4047-b16c-b4b562252c04", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbf3b1be-6605-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781231023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231023, "uuid": "f811f1e1-38fc-4350-a887-6c6feb22f959", "comment": "Malware payload (Amadey)", "value": "ea09896ab82a8dce13e4fec8c0210b94", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231023, "uuid": "6f106c71-c0dc-4a1b-b340-1b55cb83d7a7", "comment": "Malware payload (Amadey)", "value": "920039788b3a1620bbafc5b02d10827ce68ec4bb6f9088014f76c8eecb01875d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231023, "uuid": "1467ff15-079e-4314-b6dd-d04d7025e4bb", "comment": "Malware payload (Amadey)", "value": "ed9f61a9809bcb75005081ccebc99918cc755659", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781231023, "uuid": "20287980-524a-4c05-9cac-672da918f35e", "comment": "Malware payload (Amadey)", "value": "db73b4d2896e27392953cd95f6f8a1a9fb8313b6856f547a35960e829fcb6774a31e64160719c38f6213abb33e6139fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231023, "uuid": "8793593a-c7d9-466f-8380-85b2dd7c4d54", "value": "T10555235627E8843BE8264F70CDF6169B5836BCA28D65725B22507D0E3CF21D0D936B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231023, "uuid": "cfb18508-930a-4832-a343-5e7c73edf922", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231023, "uuid": "fc3272b6-3984-4dd1-a148-93ddbc989c60", "value": "24576:ddUosNwAXibRmU6/6NJ1U6u8CW+an0P5Vv5qT4ptr2PKfcYG7:rhMwAy9T6SNLVz1n0QT4p0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781231023, "uuid": "461ea077-0e95-4eb6-aad5-0ece0ffe7941", "value": 1373184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781231023, "uuid": "8e6deb76-9e20-43e0-80bf-4b36c8e0a189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781231023, "uuid": "d9131add-855a-4c09-a96a-f684141b2799", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5e6c1d1-6684-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1781285533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781285533, "uuid": "a76e610c-0916-4378-9de5-a54b07faf13b", "comment": "Malware payload (Gafgyt)", "value": "22e825686eeca22bbffac3c05fe24ab4", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781285533, "uuid": "6c8af149-3c33-4f5d-af1d-3500008a33d4", "comment": "Malware payload (Gafgyt)", "value": "95edc958b9159ea35636552808c610837faf6336165b6758bc108451e5c5f651", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781285533, "uuid": "5df2359a-c289-422c-ad2b-b455173b02fb", "comment": "Malware payload (Gafgyt)", "value": "72b9096f40fcc07eb66a64248dbc7cc477bd4743", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781285533, "uuid": "ad038342-4ceb-4f8b-99b6-f3b7e8bbc061", "comment": "Malware payload (Gafgyt)", "value": "be7ea601ef37b7b3bdaff44a99c8b8730fa5505d161b9f598148a91d21d38ee4e8a58d3f3d9692b074036a281388a0f4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781285533, "uuid": "0c9df0ce-cd91-441e-b1b9-6f295875635f", "value": "T1D03156CA21A14A70AC94FA6733BE880875E8F9CB54C69F196CED38FD848CE047040793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781285533, "uuid": "bb203839-33c1-4c0b-9573-b43e45d126d6", "value": "12:q0FRZi0FREX0FR00FRc0FRrKfX0FRUc43fX0FREWe0FRMOeekX0FRQGaDl0FRVch:vX3qs3XJosic4kuWbmOasUOAK4aFYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781285533, "uuid": "c9f315e7-55b9-43c6-8d04-570e4eec992a", "value": 1464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781285533, "uuid": "0f7bdc93-41da-4782-88fc-045b57d3ee60", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781285533, "uuid": "531f5b77-94ec-4988-99ab-6ce1e006f4f6", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b527e39-6604-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230405, "uuid": "0ab6d579-d159-4a0d-9f6d-8f2a6ff7fbce", "comment": "Malware payload (Mirai)", "value": "5a083d138a6cf2c8eb46a57a4a01a3af", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230405, "uuid": "5a2e1c47-ac6b-4b5f-9c9a-b7defa18e2ff", "comment": "Malware payload (Mirai)", "value": "964a265b22eb10b056dab97ecf098f59cf8b36221fe8028808d9c26ccf6b6c91", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230405, "uuid": "beaa7c54-71ab-4ec2-b847-d4644bd8b89a", "comment": "Malware payload (Mirai)", "value": "3330d31433f9d0043c5c4b6a647efb26536edc2c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230405, "uuid": "2e73d757-a03e-42d9-93d4-19b848de027e", "comment": "Malware payload (Mirai)", "value": "725d71b2943fb9e0d4866df569ab8e04742778fe03fdc05af38a42793b40d3bd9334c6880640c3c3e462983dfac9d455", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230405, "uuid": "680f1988-997a-441b-a633-3c099670e174", "value": "T1B501B1C900209166101BCEC8B287922C8D859FFEA4E27FE8388FA57DA44256871E4F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230405, "uuid": "034c6147-14ba-4877-b1d6-183a39a851a8", "value": "12:Y7AlXXCP9Wbc7hZH9Xf792mOP9XvY7UXYZq92/A7lZxAE9qc7AX9q7Vb97U:tuDB2h5vZws+KC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230405, "uuid": "bd93216a-cd33-4ab8-a746-df58d32e9b0b", "value": 740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230405, "uuid": "13aaf69b-25b0-48cb-aa18-d59908fe7907", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230405, "uuid": "d95c8c5a-5075-4db5-9eab-f68ec3e0fc7b", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc527635-6653-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1781264552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264552, "uuid": "045cca27-1856-4e40-b08b-a75d7cab2c33", "comment": "Malware payload (CoinMiner)", "value": "0128eb745c78b2b11588d4ef9c4cefb8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264552, "uuid": "9d1ede20-2c82-4127-89ae-39d2d353bd96", "comment": "Malware payload (CoinMiner)", "value": "9942ad5561716cabe31db5fbed34775b5484b818b23eed484aa18cfdc1ffa0cc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264552, "uuid": "bb8f1139-ad62-4c07-87bc-b683aa258127", "comment": "Malware payload (CoinMiner)", "value": "8e4a476fe321f4da3553f857c24f695100ab8d01", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781264552, "uuid": "84d7369a-8320-44f3-b8b5-036967180953", "comment": "Malware payload (CoinMiner)", "value": "26b03ef3834172401b21858767952e6e4d6c21e13229d84985274c7debc4d94ef3e77b4448d297740eed294cef10fdbf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781264552, "uuid": "6b84def0-424a-427f-9d43-d1caf1d1ac86", "value": "T16AD57B9D6858F9CEDA24C43278353ED923E4338FE86613CE6548BB0695717A0D7CDA38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781264552, "uuid": "2ac6bcb2-3654-4e6c-a13b-1f9989774c04", "value": "24576:RM3gA/4ZNY42fXbKW5/f3sdkq2xNby2Hy6Am2iWReQX39XYiqV5zEubL5+QDU/sm:u/fnSa9il", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781264552, "uuid": "150e3412-656e-40e5-9163-41b3d3578202", "value": 2826779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781264552, "uuid": "a58f2d16-22be-4598-bcc1-5316c7b0d73d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781264552, "uuid": "1d13f2dc-a0b2-47f1-a617-548e78b57abe", "value": "IMG_20260610_final.jpg.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41be7071-6639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781253152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253152, "uuid": "9e17cf9f-f9ac-417c-8609-1d6ad82c0d5a", "comment": "Malware payload (Mirai)", "value": "2019a041b901f74df7399739e4c35f61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253152, "uuid": "9e74df6f-5124-4490-84eb-4ab34b95c9bc", "comment": "Malware payload (Mirai)", "value": "998aadeaa1f1927f7be3ceca3c7d73787d29c76b37bc0cfe62118f8903ef3b65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253152, "uuid": "6131857f-2582-4459-93c7-d78e7de8d4a8", "comment": "Malware payload (Mirai)", "value": "d4b0491670f9d81d757405ec6a47141cef6de0f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253152, "uuid": "5ed79876-eb92-4f4e-b508-3fd3ece6639d", "comment": "Malware payload (Mirai)", "value": "126845e2b2a5b32a7fe3cf8c79ee66c2e5a0ffc081603dca5bcbe5a298504e1be0078f82a0b6379caecf477f45320c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253152, "uuid": "f5252541-f996-43a0-8550-70542a689d2b", "value": "T1A0D339C7F800D9BAF80AE33648634906B530B7E509915B373267357FED3A1990977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253152, "uuid": "a467cdc7-ce29-481c-a0e4-13bd3eb0e819", "value": "3072:0mrs89QxxqAC8iV+cRPVejbigLs2k5yyKm5EPb:0sQxxqACRAcRCLTyKYeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781253152, "uuid": "ec1e6470-8d2f-4c0e-981b-c6882d9b0e25", "value": 136736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781253152, "uuid": "c7b72ab4-04e3-4b3e-bd6c-1b49830ec2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253152, "uuid": "572533df-bfbc-4216-8e1d-c600bf335848", "value": "CRY.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99b16a4-6629-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781246535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781246535, "uuid": "be5ad9f2-cadb-4b5a-a6e3-c229fd66bc65", "comment": "Malware payload", "value": "5a040be81247c7e02fcfb89288f8dfbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781246535, "uuid": "7c3e5004-587f-41c2-bd94-d7845afd1066", "comment": "Malware payload", "value": "9b63e07425549980c916561833b47ac01982c68af8f58a739cdc4e911ca4cc88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781246535, "uuid": "217eb284-069c-4987-9fa4-a980e1ae109d", "comment": "Malware payload", "value": "e0f7c988cb5f17990f6025922750d1fc2ad2d3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781246535, "uuid": "ed6c1f20-1d51-4262-b327-0eba0b95a2f5", "comment": "Malware payload", "value": "debf355cb2947dea0f32ac25f9167b55faa799a3f436a757c54a05eac63558be61655b45667f2059dd5a7d2f5e6a904f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "overlord", "colour": "#08D60A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "sideload", "colour": "#D2629D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781246535, "uuid": "0fe6da21-7df4-49e8-ba68-e9d6dc59fccb", "value": "T1E0744A21E94C4DA7F5A351BD84D34EF3966EAC04131089E782B8F2BA1D577E0A43B7D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781246535, "uuid": "61bbdd1f-1832-416f-a3f0-5342b529a627", "value": "1e213dd0166ce54b2f020f43a5987917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781246535, "uuid": "fc8e02d0-a8d9-4dcb-a3ac-dd6d2daf6931", "value": "3072:2aucGxNJ4EMFSwkg0PQPgLhRLz8MhTyNLn072G8Qto3M76rA9M4w8c7VSyXU8Q6R:7GEFSwaxH9hu+75rCM7Z5wRUgwQ2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781246535, "uuid": "d8a6afd1-0a7d-4f50-aaa9-d07b00bd7fae", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781246535, "uuid": "a9bea92a-8b60-42fa-b4d0-7cb4967c41b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781246535, "uuid": "a3d7053b-872a-4275-87c6-302b13d879ec", "value": "python314.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee39727-6602-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781229686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229686, "uuid": "192be4ac-0bab-4d16-9b54-09a5e2ea7ed4", "comment": "Malware payload", "value": "0798d38a1fa410e47df64a2cb6a25e1a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229686, "uuid": "2a33a753-dd05-49c0-9fe9-e3ef1889f512", "comment": "Malware payload", "value": "9cd535a25ac691db15eea8fcd0c304747db8f8944e890534693be79e21533eee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229686, "uuid": "f54737d9-d464-43ef-b97b-b468313f70db", "comment": "Malware payload", "value": "4e1e8adf90b04ea3494013338751c6c6e400489c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229686, "uuid": "5b915b7f-32d3-4199-89d9-230fc2c310d3", "comment": "Malware payload", "value": "0aa0ec58f9db1f5c1149cf95a8eb9269060e15b421aa222b425a3748983ebcab5f38735be184fcda2ced157451e745ce", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229686, "uuid": "26fc56f4-0bd9-4aef-b6f5-3688331752cb", "value": "T113C2E0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938421CB1DA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229686, "uuid": "86dcc097-fb63-4e15-940f-6b531b82d9a1", "value": "384:NVXud3s1yu7isjsKG6qkSgjkjV/A4UAcGM3JNRhQuW57:XQsylUMkSgjkjVdUAcR3JN34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229686, "uuid": "696e685e-3cfc-43af-9b3c-22570f6e0013", "value": 25757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229686, "uuid": "14b200f0-5419-4648-abb3-1fa65ee2bae6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229686, "uuid": "95ec504c-2d96-4285-b548-2017d5d139c1", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9774c918-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1781245565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245565, "uuid": "c241dfa8-6514-464d-a789-3ddd36bd3824", "comment": "Malware payload (ChromElevator)", "value": "3c8658c12efbebe5ab067084b7bae047", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245565, "uuid": "15f8d992-2267-44ba-8e69-ec03d89864fc", "comment": "Malware payload (ChromElevator)", "value": "9d131221d75045975839e599ed890e1e4e58631127021ef432a4ba3366fea04c", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245565, "uuid": "d5aefdf4-f551-446b-af98-0af242cb136f", "comment": "Malware payload (ChromElevator)", "value": "3b1955e3b5be4d40d5597660b6949ebba1a5c1aa", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245565, "uuid": "3e57a6ef-3ce5-4182-b135-50918e4c6b3c", "comment": "Malware payload (ChromElevator)", "value": "cf6041c6827dfff68e6b21a758b12205ea3e330cd47688198f09ae9141e6c0da1ab70bc871e64a2c844d3e4b04eaa2e2", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245565, "uuid": "ad0e4e3b-8b95-42cf-8db5-5aa2b884a8e1", "value": "T16477E943F9B985D9D0AAE5348226A223BE603C58973573E76F60B7241F39FD0A5BD310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245565, "uuid": "760c9b42-eb41-4066-b302-b35f2f00ffdc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245565, "uuid": "ce1647d0-b408-430c-9af6-2ea66b3f8228", "value": "196608:8K/vhLpUxsnHOwBhINr9amBsc21ivcMKp:Bvhcsu6hWr3x2Avc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245565, "uuid": "cd14c514-5a58-4cbb-9bc5-b0be223d437c", "value": 32746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245565, "uuid": "4c71c8a9-05a3-4da5-978c-13ecf4e4970d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245565, "uuid": "77714ed2-cf07-4b08-8194-faba5566d3d6", "value": "3c8658c12efbebe5ab067084b7bae047.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f0701-6668-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781273237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273237, "uuid": "0b28229c-061c-4e09-9429-4742c204a2ac", "comment": "Malware payload (Mirai)", "value": "1703296b963ef90afdf44c906705d0ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273237, "uuid": "9f65fb7d-bb56-4c99-8959-9a0328125fe6", "comment": "Malware payload (Mirai)", "value": "9d199918397bdc50141845165f2ae2525ad47c8e96e07c1d9d39e63eda3fd89c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273237, "uuid": "4d45f3f0-0010-4b69-a712-468863fefc8e", "comment": "Malware payload (Mirai)", "value": "0a49e72901976f8533c602fe6b532cbabc43482c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273237, "uuid": "4aaeb021-3751-4193-8fc2-10edb22ac60f", "comment": "Malware payload (Mirai)", "value": "686d523aae803c4607d310ebac7f19d38a4bab0f425e960195bf9dddd24f30a9481815adf14f3f28a6ddcf291f1126d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273237, "uuid": "a5438892-c56f-43a9-8f93-104f761e76aa", "value": "T13E635C89F6C3D0F2FD5755F6A1BBE3628772D02A2099EA41C31D9832DD62811DB2B35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273237, "uuid": "b2e53e45-59be-47f3-a1a4-8baf93364c57", "value": "768:EiMr+tqvYEv/6X+3T/NvMvxtEw3Hrs8Bfd0NL2SX69E+Ny222Ir:VqFv/6uj/OnEw3LtF6aSuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781273237, "uuid": "5a9fdfd5-1682-4fa1-b6e1-a3c885bf7399", "value": 67624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781273237, "uuid": "31f550af-41cc-417d-bacc-92fe4f9ac22c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273237, "uuid": "593a6a0f-41c1-4039-91ad-51bb2bd8d563", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bef0469-660b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781233412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233412, "uuid": "c5447a5a-3697-4d41-b5b4-3e347d872f50", "comment": "Malware payload (Mirai)", "value": "d40682b635b67c7ddf03d49739010e52", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233412, "uuid": "ec2204ee-1d22-4bab-92d7-f9d0f2cea69d", "comment": "Malware payload (Mirai)", "value": "9db5aa647700dd9b1e154e47fccc69eac570325566dfb530516f5989a59afcf7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233412, "uuid": "8b31f43c-b03d-4a4a-9f79-647ee60789ef", "comment": "Malware payload (Mirai)", "value": "9ee8c76c142d39464cad67aa835135c54f4ae78c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233412, "uuid": "71db6bef-c02e-4404-9e6b-28a1f196d407", "comment": "Malware payload (Mirai)", "value": "7a8d6ccf450252f6ced37ecbfae3d2923f8c377b139c353f1563df4cff656941068255081718eb6ca9d5a55a1cde1035", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233412, "uuid": "03fe0b75-f545-4dfd-b198-2e3fa3d23c15", "value": "T1B531A4CB1A500F71C30E875DFBB06569900A52F6FAD30BDE998708AD5D49BCCBA45F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233412, "uuid": "46954e38-6417-450f-a89e-d5cebc31a766", "value": "24:hd8ABI7oI7vNIB9cJEGcJE3EuJERElUPc9cG45kxZAgddc4O9t:EhXbiB9cJzcJ8xJSBPYcG45kYgY4O9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781233412, "uuid": "b073ebd1-eb4d-4fd0-a5ae-5b112dd15dc6", "value": 1607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781233412, "uuid": "d6f0d483-e7f2-47dd-80b7-88e46f5fa63a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233412, "uuid": "5885f447-a5f5-4b38-947a-dfe33d5da4b4", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e33ab7f-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1781301196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301196, "uuid": "ebb7ab8a-d4dc-47ba-9b16-2ddb956d8b15", "comment": "Malware payload (MassLogger)", "value": "e6016d454089ea04d39bbec1b8d45986", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301196, "uuid": "49d4d91f-1fb0-4aac-a3a1-2e5fe24a2e3e", "comment": "Malware payload (MassLogger)", "value": "9fe05742a67d1b9d42e880c738cd37893e7ec73657d8592908b88908bdaac8bf", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301196, "uuid": "590d4014-57ae-48ea-b723-99c4e1e27e3a", "comment": "Malware payload (MassLogger)", "value": "2e721107bac062725c765cda3f6561de2e12b4e6", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301196, "uuid": "9b5ba2d4-c1e3-4fbb-aed2-58ceb3774292", "comment": "Malware payload (MassLogger)", "value": "553facd7b4acaa5f2989e6d4b584ffa663759027e14857d93ce84f8416e04eb91290e36b3c7509f8b25f8dfd4bb77c50", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301196, "uuid": "608d629c-acc9-445f-8e2c-6c860a0e6d31", "value": "T189B3122B31E601D6A4AF984C79EF6313CB09326D3DE52A47ABB479E3BC02985D275470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301196, "uuid": "f976604f-ba46-4ac9-becc-9ebaa7716b7f", "value": "3072:mU3myUfrG+QSfS2Ns9PRWPyAb7K/QQ3nvK6mYx1QU1npg:mU3myUfrGlSfS2uTWPyAbd6SKni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301196, "uuid": "8bc95f78-1ac7-4ca7-8b3f-a396b742b6c3", "value": 108997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301196, "uuid": "f2fcb42b-f6a8-46f8-914e-fe6852f443bf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301196, "uuid": "6081a417-f0ef-497c-a2ac-8d8590d13471", "value": "ReciboXdeXpago.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a93f82-6650-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263338, "uuid": "55da0d0c-3c29-43b3-8b77-9a0a1743309e", "comment": "Malware payload (ConnectWise)", "value": "38fb7417bc8a92acea3a4fd65111b0ea", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263338, "uuid": "f7841d32-225f-4550-9cd5-4878c0de3bd6", "comment": "Malware payload (ConnectWise)", "value": "a18874bc07e76bcf643f9c608a0a0d55ea71c79c0bdf09ec278d69bb46883310", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263338, "uuid": "602659d8-403a-4262-8697-3cbb291a4ce3", "comment": "Malware payload (ConnectWise)", "value": "1a76ef4e60a6ff0c28ed81617cb931a5e2993517", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263338, "uuid": "8f4709bc-de3a-4aa9-9583-617b46c523df", "comment": "Malware payload (ConnectWise)", "value": "f8b9b11d67015c98a1eb8d2fe8ef77f7b723189eafc521e641fa08d21e95248977f41654b8edbac5dc171b25483a3974", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263338, "uuid": "03804b19-6692-4250-9d8a-3e73098f7b2d", "value": "T1DFB71230B64ACD36CD9605B08D7DEB6E602D7E790B2490C7B2D82D2D29B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263338, "uuid": "c34816d0-6cf3-4164-b867-4780ed1ac5e0", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263338, "uuid": "a6b04d35-d99f-4a2c-a7f4-45563adf72cd", "value": "786432:nStBv0GfHjqlFpttD7yBG/c66pXP5PJeTIzpYpX+0C/v2+uXeTDDkKQ59pl:nStBHvjqjpttD7y0/JUTHMxyv2+uXeTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263338, "uuid": "f9f97872-bb34-4328-8426-250656df2118", "value": 49431352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263338, "uuid": "05439009-3254-4e3d-a49d-6ea7b10dee7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263338, "uuid": "c414e0c4-440d-4bf1-a0d8-db65196406c4", "value": "a18874bc07e76bcf643f9c608a0a0d55ea71c79c0bdf09ec278d69bb46883310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920f31f6-6605-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230953, "uuid": "3a3116a7-4916-4405-ba83-6a050c1cdc66", "comment": "Malware payload (Mirai)", "value": "cf8b81ed866e2df28c4e92e7099f2225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230953, "uuid": "20e98b6d-e3df-48c2-938f-5407d3e0144d", "comment": "Malware payload (Mirai)", "value": "a539e7c40ef6d88b339135186e8d6223ebb4f38491c4ceb5420f13ce3841f9ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230953, "uuid": "c85b9152-32e1-4f92-8a33-56fb89e89390", "comment": "Malware payload (Mirai)", "value": "318399b06c95f843f05cc02457bbc27544255128", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230953, "uuid": "9a111573-d41a-47c5-997c-afbb6116ed9c", "comment": "Malware payload (Mirai)", "value": "067523ff73ec8fcabf7f8a10f7c90bfaf96b9f03474f081aa367ec34c9f9cb943c4e7756d6f0446f405aff388740a099", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230953, "uuid": "ac09cfc2-f540-4bcf-b7f7-c176812b52f0", "value": "T1612329E9A8019E3DF84BF67E84170A05B561776051C30F3A27BEFD936D722684922EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230953, "uuid": "6b43da44-3e23-4b43-a360-6a13e72c1f3c", "value": "768:J9heQVlj5V8DjDcVIIR/vZzoLVvOObO0XpaL1vLw3Q9/Orv8Q6x:JnlVh8Djgjv2Rv1i0XpEvLwA92j8QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230953, "uuid": "2639bd04-d0f8-4a12-b1a1-5fb7bcc4e02c", "value": 49584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230953, "uuid": "c18b34e0-802a-4eb8-8447-ab26030fda96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230953, "uuid": "68533445-2f3f-4450-9b6e-e8bdda7208ac", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06205b89-6601-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229000, "uuid": "95677f18-3f38-40c8-ba97-7cd53ed64492", "comment": "Malware payload (Mirai)", "value": "f6fe6e8fa268305c7d7a5467d1e3907d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229000, "uuid": "fc11ec3a-1957-4870-9b37-41556ec7b0cb", "comment": "Malware payload (Mirai)", "value": "a5b1402f8c180c02f6e56ee25aa62899be76c29397fadd6f90f19d4d3e1dac0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229000, "uuid": "73da2075-c6a8-49c2-8b84-4735a509ddc1", "comment": "Malware payload (Mirai)", "value": "811946c1ee25871c4e9131e4e666b6cc7bc0e483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229000, "uuid": "e4cf390d-0bfa-46d6-b09a-1672a1369997", "comment": "Malware payload (Mirai)", "value": "1a9ea2602fa7046fda919e7c517da53e8b17228a10250c723875abf6c1d49c9a20ae9ff4080ab66771db131c441df027", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229000, "uuid": "d671f5b7-8577-4d09-b66a-3bce26f07b5b", "value": "T17137CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229000, "uuid": "5e559ce0-8225-4561-98c9-bf621907f47e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ7:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229000, "uuid": "885fc6b1-7aea-4d36-8912-d986b810ff74", "value": 23625728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229000, "uuid": "725624fd-1143-4e9d-9a89-e3f9057ce15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229000, "uuid": "2e0688cc-b770-4d55-99d9-96d8d15c1990", "value": "a5b1402f8c180c02f6e56ee25aa62899be76c29397fadd6f90f19d4d3e1dac0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c3e4da6-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245439, "uuid": "56efd36f-f1d1-4ddc-b336-074b938961c8", "comment": "Malware payload (Mirai)", "value": "b263835feac7860a0c299d2e13480b30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245439, "uuid": "bfc4db77-a18f-41ee-bd03-d2193fe0158e", "comment": "Malware payload (Mirai)", "value": "a69114dfc0faf02a5d9daf0839bef0c1a22cc16296cc8596f11432a9b56bc639", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245439, "uuid": "d0487f12-9447-4ec7-9e2d-e7f97995666b", "comment": "Malware payload (Mirai)", "value": "57a9b1a60cceef825515267c3ce9aff980d0449b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245439, "uuid": "8de1e5d2-e164-4c23-a429-d4687d15d37a", "comment": "Malware payload (Mirai)", "value": "e2921b50992e5bc4e8cafaf40b7e3b8dc5e6b35b8f9a9ea9d6e7a8086d4a13faa7014d833b0148e36e4f1598ff3c2ea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245439, "uuid": "b372a293-423d-4274-8f41-b98239a6d790", "value": "T11A148120FA0663B1CC731A34A79A2E5A6E7704559FEB26312D1F533CDE628509B31F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245439, "uuid": "43ef3b5f-57c9-4095-87ca-da3b92cc1ab9", "value": "3072:BcHZcggFy1tJmajThwnKBDMOzsjJjL1lCRkUKG:BcYFAJ9/hjzsdjyvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245439, "uuid": "1b721957-b81f-4ef7-ad20-93cd9c84d4c3", "value": 205416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245439, "uuid": "716aa99b-a335-4431-ab0e-b9061cae352e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245439, "uuid": "4c95c485-ab62-48e8-b521-ce4a0f95b1e6", "value": "microblaze", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a57fb12-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301190, "uuid": "18a779e4-0272-443c-8dff-2e065546be72", "comment": "Malware payload", "value": "715c621f42a46f337e30b9c3857cc612", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301190, "uuid": "ac1dc77a-6a8f-49e6-b997-55b885259349", "comment": "Malware payload", "value": "a70e5f65cce55a00c8abdad20a0a0e50e3427f19247ba39279e51b9563b50656", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301190, "uuid": "6a17fad7-778f-489f-aa4b-58921ab00e75", "comment": "Malware payload", "value": "841816ceb00720efbb4419cfb0f26c66ed38dfff", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301190, "uuid": "9054bc7c-5f92-4447-9721-98dd4ff8f3ea", "comment": "Malware payload", "value": "3f3dac7f928ff17527bb87ae7c8bda7879a41604f3d8fab8b1e752570e16f7424abb212e87424b07cf536ed4224d8f17", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301190, "uuid": "5be92329-340b-4723-899f-2f75b71c994a", "value": "T1CF65339CA675A3A51FBFB3D6C4A6B2803515A0ED039EDD30FC071A1ED2DD0E642A1D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301190, "uuid": "fd65e948-2bc2-439e-ab32-f38593db3d11", "value": "24576:lo0KeAcaO6XFTbnBPMJgdyA8zWWa/tYCkXOi2oHhooz/80POl5ar6Q6KUVt8ND+Y:lo0K/O6V9OEybSjaWoz/80POl5IrgtTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301190, "uuid": "ae8f9b76-bb97-40dd-a62e-313c08aeea42", "value": 1491500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301190, "uuid": "dc04eb9f-9867-4872-a492-753f72753d2b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301190, "uuid": "17e72854-7218-4198-8d77-5a745605f627", "value": "po23455.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8adf8a-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245436, "uuid": "f0372aab-9294-4ea6-bf5e-d5188b463afd", "comment": "Malware payload (Mirai)", "value": "bc5bb5f343faa9ca5c2c9da8db4eb9d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245436, "uuid": "a9b1ac20-9b91-45c8-95b5-181789dd06ba", "comment": "Malware payload (Mirai)", "value": "a728de0715298df5ae6baa6993e94937ab6978f34ea5f0c417376f8d0d03f6a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245436, "uuid": "8aa07ad6-2082-4bb8-95f7-7f9b9815524c", "comment": "Malware payload (Mirai)", "value": "73ca85218601589128b727d8d672b6fbe4ccd602", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245436, "uuid": "737124db-3315-4230-a2d9-2f2fc0815deb", "comment": "Malware payload (Mirai)", "value": "3f31481142fa4abd0ecec29d84e7ec4e86bd1ea1b3d93d73fb9cf10bb3494e2403ebc0b4a0d60b163211d41b5f77697c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245436, "uuid": "406fa803-3d8d-421a-bb8d-1e51813e6fae", "value": "T1DFB3AF87B1907ABEF0A45E3FC4135E26A6259F705583273D71BDF9906E3A3503292E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245436, "uuid": "aa4de267-c239-4b26-b951-fa44c5b81c02", "value": "1536:toOxCg+uUGWkCqYUqwaJ1XqfXg5AcS5blaZeCtjHXNLdCS2T15OvhSkzd8rSx:t1xKlGWnqTUcXgZS5gZ7CSXhSwUSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245436, "uuid": "e6368065-9671-4892-9b5d-fdac887eebd7", "value": 115116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245436, "uuid": "3e1ea60d-6eff-4633-8b18-1d23e3a29b9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245436, "uuid": "cc8e6b70-fe3b-47f8-b182-5ec21aca8066", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f2c321-6634-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781251191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251191, "uuid": "047b0fc4-6431-4e3f-814a-39965a71f8e5", "comment": "Malware payload (Mirai)", "value": "3dfc0225cd0d15381b55f930e4e83800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251191, "uuid": "b9c066f2-4bed-4035-9c4e-078585931a98", "comment": "Malware payload (Mirai)", "value": "a8ddbb33054073ca1597ecb2ca5d164374d35f0695f1193bcf6131886d39ebda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251191, "uuid": "c346407e-4912-43ad-b858-fecc965337b3", "comment": "Malware payload (Mirai)", "value": "4347d430d47562f2025f19dc991b089e75960702", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251191, "uuid": "35a45e6b-3cd7-4985-8f12-368cf68c8843", "comment": "Malware payload (Mirai)", "value": "6f2ad62ad07e8e3b1d834c49b4986afa1031f8e20ce75b4400e6b8c790a3c75fc90981ba371cce08180db9781af8318e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251191, "uuid": "3d2731f1-4f8e-43b9-b0cf-ffa07fdb6398", "value": "T1DA040856F8819F56D5C152BAFF0E528A33131B7CE2DE72029D246B347B8B86F0E3A115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251191, "uuid": "2176961d-e6b7-4c77-aa49-fe204fe0a909", "value": "3072:plV9I9PPCry7EJ/rHv01TbtFX8/GalP4OKPa7REk11Jy83vLQWk:pf29PPUyQJTwTvXuGat4OEadEaJyMLQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251191, "uuid": "7da99139-fdac-400e-9409-43f2c370a072", "value": 180040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251191, "uuid": "87bef0d0-d7c5-4983-b2d2-72479c08b04d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251191, "uuid": "2eea496e-a642-49ef-aec4-153a592fa3ef", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f63e19e-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262731, "uuid": "e2afea1e-c540-4753-bc12-c7d37b373a81", "comment": "Malware payload (ConnectWise)", "value": "e72e7ac3c5050788e4d9c729e4080ce8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262731, "uuid": "1660459a-b1a3-4911-94b5-a6eca6426c9b", "comment": "Malware payload (ConnectWise)", "value": "a8ef9ab54141b34c147e77d7f9da302bf97d08e452a73b84bf6add56140faa0a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262731, "uuid": "5004e204-cc57-4584-bd5c-1f4964d7976d", "comment": "Malware payload (ConnectWise)", "value": "c81840484c0e2ea4ae8f85ff6efa592f44fe1461", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262731, "uuid": "8cc7eb84-ccb1-4b94-8cc0-c76ae95fdf26", "comment": "Malware payload (ConnectWise)", "value": "ac6e4d1d7c523731089934526840bc0811afa4c09efe8886622768f50936d30a4f06f3ba0c3ae6f660a34362790e35b3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262731, "uuid": "7dfa271b-dc2c-4987-870b-b92bbf301d6b", "value": "T1BEA62332A5E44136F6F61672A939D070BD3DBE246B10C85EE7C8A81D2DB198193F3727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262731, "uuid": "71a29039-aed9-4b07-bd65-e3ad2a18d91f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262731, "uuid": "cf995e44-5c54-4b69-bb1c-c498e96bea7e", "value": "196608:sLZfOXtuDj+lkIbrhibcDrlC0OqatbB5bMebj1rnLYG3zrhukO:QMgKeBbcBeFLnj1bDDrgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262731, "uuid": "5b33995e-3730-4484-90b2-d15ecb5d03cc", "value": 10071552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262731, "uuid": "72a31bb2-f0f5-44dd-be80-8a176eba34f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262731, "uuid": "60f3afa8-3aaf-4cc3-aa04-a176827842fd", "value": "a8ef9ab54141b34c147e77d7f9da302bf97d08e452a73b84bf6add56140faa0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a2a459-6634-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781251172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251172, "uuid": "873453d8-087a-4a62-98a3-ed2bb1e4ce83", "comment": "Malware payload (ConnectWise)", "value": "c7b4e6b9b0fb09cc65951251cccd017d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251172, "uuid": "b1968d60-b902-4b7c-9f02-b08d7d144c5a", "comment": "Malware payload (ConnectWise)", "value": "a9dc30852636d79cdf7dd24c7cff6fe82d2b1e39ed9620c9a87d6cf636735e52", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251172, "uuid": "697bac0b-895f-4a3f-855c-17370a19da3b", "comment": "Malware payload (ConnectWise)", "value": "5a39c7eedc126f8394aa01620b686b82c0324227", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251172, "uuid": "3c8a6a3f-4030-4537-b57e-2bae4d3003e9", "comment": "Malware payload (ConnectWise)", "value": "bd731790ac84cc428d1deb4d2fe28a1655f51b93a7375e575ad2db07bfdcf5faf05038331518774708a025d95a604cdc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251172, "uuid": "e72bd370-a6d4-4443-a752-c6993054bc36", "value": "T1E9646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251172, "uuid": "cb2d3c79-d23b-4b30-bf78-aa6c1899ec15", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251172, "uuid": "56919ece-de23-467a-8a19-a49d55232e05", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9O:h1iw7gryNkSV1hy1Z1u2JLu9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251172, "uuid": "19c65d8e-7605-47dc-9a66-574c97c126cc", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251172, "uuid": "e11e08f9-e06d-41ce-aafc-f329db14585b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251172, "uuid": "4e24b083-9f05-47c2-aeb8-d53cc7cc62ac", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61446709-669d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781296155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296155, "uuid": "034f2d8d-f4c4-434e-83a0-76a6749bea28", "comment": "Malware payload", "value": "8962671ad15f7ffbf0e2f207119c47fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296155, "uuid": "94d01753-1ff3-4869-bdb0-8249967867bf", "comment": "Malware payload", "value": "aa2396f3470a56179b375683fbd761eaac70f6f07d0102e9ee3151a8f3298789", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296155, "uuid": "44521370-caaf-4f43-a1ae-e744b7020124", "comment": "Malware payload", "value": "606e7ddab8a478e8abcb0a5c14137e881e68a76f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781296155, "uuid": "b3ac1754-a90e-4965-943f-0c40cf155709", "comment": "Malware payload", "value": "8da170fc29ff526da6e374188266f884453415d718a6ac07c58be887bca800a475f9085ab6dc70c4bdd18ab4a47d6d8a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296155, "uuid": "192ca2bc-8b97-4ca1-a471-f7f2b9e8e883", "value": "T198137D6966857C24AE9988371C7E2F0CB9A983E1310451DDBFCB3CF58C19B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296155, "uuid": "e83863fb-81fa-42ac-bc8a-289b75cafe8c", "value": "768:8+n9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:8+Qco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781296155, "uuid": "651339b0-6d70-4514-925f-74501b3fd46b", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781296155, "uuid": "0bccd6a6-2baa-4a22-bbbd-9057b78fafa4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781296155, "uuid": "c2b034ef-2634-4383-bbc3-58aa38ff7886", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391f896a-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301241, "uuid": "516491f9-f064-4e1e-a97b-ed08d877f2f5", "comment": "Malware payload", "value": "f869df85114d937380de804b142f54e6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301241, "uuid": "64590cd6-6e37-487a-b416-5cb879854d0f", "comment": "Malware payload", "value": "aa32b76c59366e78e8f72d23cc0bb95aaff926324117268c52f288e221517f45", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301241, "uuid": "42c02891-0f02-400f-a321-c5326ff19dda", "comment": "Malware payload", "value": "1a53de4466b84ea7229f0fed2beb55612e0cd42a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301241, "uuid": "a847e067-21db-4c26-b471-f513a71aa939", "comment": "Malware payload", "value": "22cf3978af02c8aa044929a6e2c91a7367939b1387ed5019ee3dd25f1cfd2d2d774455e64a338655f246a099e6184f71", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301241, "uuid": "46b7d437-9c75-4e48-8970-a713dfd9f511", "value": "T1CC65339CA675A3A51FBFB3D6C466B2803515A0ED039EDD30FC071A1ED2DD0E642A1D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301241, "uuid": "72c9df0e-10a5-49e8-ac86-012804a52d5d", "value": "24576:Oo0KeAcaO6XFTbnBPMJgdyA8zWWa/tYCkXOi2oHhooz/80POl5ar6Q6KUVt8ND+k:Oo0K/O6V9OEybSjaWoz/80POl5IrgtT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301241, "uuid": "aae44001-c3c5-4ed0-8740-87ab91a97738", "value": 1491504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301241, "uuid": "897752e7-3ab3-4c4b-8057-dc9053b770c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301241, "uuid": "3ed9c780-5a64-4881-b136-a2bdd4f82bbe", "value": "fedexXdoc.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4642ae2-6657-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781266283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266283, "uuid": "a8ef53b8-ba51-4d56-abad-8c161ce32b39", "comment": "Malware payload (ConnectWise)", "value": "0a4018c324d045396a6898674f04b316", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266283, "uuid": "856a82e0-14b5-45b8-a3a4-adc86a9df690", "comment": "Malware payload (ConnectWise)", "value": "abeefcbf74f4355851434e93b7f171f7d37357bba0eb2109ddd314b189578f71", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266283, "uuid": "d4e5d94f-bef7-4087-9608-14cc58c379ef", "comment": "Malware payload (ConnectWise)", "value": "1e04100a881b3587e2d9bd6176408f35db4bf5c6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266283, "uuid": "a2c3dd41-6479-4a7b-b65e-3393dbe37a47", "comment": "Malware payload (ConnectWise)", "value": "37c76f617f9689901d37f2749b87f75c41d5b1dcb761bdcccda065b62e68e1f68b823820eadd380f5772f7c7f9e83c7a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266283, "uuid": "615e3fa4-059e-483c-aaeb-bb797d9c4c07", "value": "T110A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266283, "uuid": "1d6fc45e-2f75-41a6-a586-1371e28bc389", "value": "196608:xnCtVYqI5MvbWEpKkqUIJqKonCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqWnCtO:JCXvI5MvHxIJiCXvI5MvHx6CXvI5MvHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781266283, "uuid": "ae13463b-f54e-4c70-8691-f90b18696763", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781266283, "uuid": "962b643c-23ea-499e-b29a-503032277f66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266283, "uuid": "249ce6e0-9ed8-4fdc-991a-f2d7dcf610e3", "value": "ScreenConnect.ClientSetup2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c5a49a-6640-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781256407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256407, "uuid": "8b794529-4907-4272-8068-bac7476d00a3", "comment": "Malware payload (Mirai)", "value": "2140a4d9dbcbd5bf2452be29a93a91ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256407, "uuid": "a18b595c-87e4-4b61-ad23-ae6b30ef6538", "comment": "Malware payload (Mirai)", "value": "ac3a870feb87fc821a7d6a73d1e0f435681bb3cf2ee4bf159c8586fbfd3c628b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256407, "uuid": "d76256be-d95c-4818-b875-6f575d01a214", "comment": "Malware payload (Mirai)", "value": "6f5ba394b385d6e9250145c29874eae2fad12e93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256407, "uuid": "3511e3b3-24b1-490e-917d-06e8944dcf02", "comment": "Malware payload (Mirai)", "value": "cc425ce5254188ef40d10e7581b4f4d276f9272e218b81037e611689027b1da922e11882325fdd74dbbdd15705a60515", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256407, "uuid": "8d1aaa37-be81-42c2-bb52-c2a7a5472804", "value": "T106D3F846F8819B16D5C151BAFE0E124E73131B7CE2DE73139D24AB707B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256407, "uuid": "d35ce9f7-9402-43df-899e-1a778d6d9387", "value": "1536:+YnWMbDuDztNpIfle5OHy9m4R7qFXyYtkBc1Uq/aUZYnfVXiLiSPStjo5oEDxQ0m:YEEfaKPGXiBIUq/aU5PStUqEDWbLCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781256407, "uuid": "0cdf046a-b875-406e-bebd-987c035564a1", "value": 131804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781256407, "uuid": "8beffa5c-82b0-4063-a0fd-a397deb8696d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256407, "uuid": "a5160448-74e5-4fa1-9ec8-08dca64b52bf", "value": "CRY.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa8dee5-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301413, "uuid": "f6f69df9-5572-4f8b-80e6-426a47822fee", "comment": "Malware payload", "value": "a45f74919d4e802989cd91416569a447", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301413, "uuid": "0af66f20-26bd-4b1b-86bd-1abafd0d1f6a", "comment": "Malware payload", "value": "ad541a7d57ce65d40558eb2382535d6daae8642a8164b5135e49d5081ccd268d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301413, "uuid": "214e6216-dd6a-46ef-ac70-2e9a0d1219c7", "comment": "Malware payload", "value": "99378279e423c32ecf1113bca1937e6aa0a02f9f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301413, "uuid": "86e3dbab-d5ee-4e79-af17-89ba61a69745", "comment": "Malware payload", "value": "b8ee06cc6c7433e3e736edf8f28b24831a337bf9b2be5c878eb26ab41e2918f6e9cad03bc4bdbee81d957d85cc580568", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301413, "uuid": "2bc819f9-352f-4aff-be03-dd8a964470f7", "value": "T1A1F4E63DCD54423EE432DA19C89A095FF8824A5B222CDA4790D76B9FAF7344277D232D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301413, "uuid": "4d88356f-5e36-442b-8352-9e620da5143d", "value": "3072:Jvy62jBMhqi74ZkIJkREQQikK3TtXc7MlyD+Z+5q70EcaZURhCMRZi4ESU7Trty0:vKvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301413, "uuid": "3702de7c-67ae-436b-a4a8-d461c137d1dd", "value": 780066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301413, "uuid": "14408333-c1e8-4813-8e68-a31f8b940c65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301413, "uuid": "0cb73481-f82c-4a2c-bc8f-564720f895fe", "value": "Purchase_Order_-_Enerzolve_PI-TP1026230_CBB237.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c938284c-6601-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781229328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229328, "uuid": "e3510c10-9f30-4f9d-bfc3-14e1881ea5c4", "comment": "Malware payload", "value": "f39880deb4c49b38d93ae09d3e825e6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229328, "uuid": "71475ab1-702b-4db4-ab6c-d2f21ec55040", "comment": "Malware payload", "value": "ad6cac0bf309ce791dc5afb8c5c7fbe77ddd452fa8cb9fee7995f94b20b8454b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229328, "uuid": "7ba2bc54-eeca-4c10-9c8d-bb5ca2fb5365", "comment": "Malware payload", "value": "5a0451f7528395b0e1e4b2fea0dd50ca1277472c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229328, "uuid": "df68180e-adab-42f7-8362-180a94677e54", "comment": "Malware payload", "value": "e748037d2993edf2bf9655a756832a76d7ea98fab2d6d765fa4dcd61d761c240a9261292231b549556347d8be07d3304", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229328, "uuid": "d28ce884-b0e6-434a-9044-9a2c994fb0ca", "value": "T17853A61A2E118FBDF76D873587B78E31A758339226E0C681E25CD9005E7434E685FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229328, "uuid": "ab6f8a73-0d2e-4c6c-a2e5-4743493e97db", "value": "1536:VwkXiBwsFaQQt9S/Y//9V//HdLJ48s2Vw9T:7SisFKtdq2O9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229328, "uuid": "3a1a759d-0490-4677-9e0e-045a0d80d346", "value": 63920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229328, "uuid": "6bdc21c0-9764-4385-850f-3825e0d75c4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229328, "uuid": "c4f52d5c-79bc-4084-b322-ed0fa2dc4e49", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c535332c-66b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781308348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781308348, "uuid": "aea4c5ef-922e-4e0f-b313-a551dc3bab1f", "comment": "Malware payload", "value": "fceaf8af1a6e83e0a1ae35a4a2fa35a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781308348, "uuid": "61d2c74b-a858-461c-ad71-a794fdacdd0c", "comment": "Malware payload", "value": "af71d8886f256bf2393b1bf6d44b2fcb50d7d546e49bb7b6fbe151a3cf2032f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781308348, "uuid": "7a0d80a3-e354-4454-8896-056adca79e1b", "comment": "Malware payload", "value": "f16c4398c613a78c391f2e721f95d879e9bd356c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781308348, "uuid": "c58d0ce0-a889-48b4-9f52-29d392e7edcf", "comment": "Malware payload", "value": "bcfc5b5f7ce85fe1749995381b17312ba9487939569dba07323f9cc243314dfdb1055b8b247acc9c5a6f880ec5b83059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781308348, "uuid": "b5d3fd53-b027-4e33-aab0-a8e8b40f2a7a", "value": "T1484602166187E12AF3E97A350A62E1F1073B6E216926CCEE86F03458CF354D35E3F616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781308348, "uuid": "b75f885f-8d16-4698-aa4d-bd6fdaf56ee3", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781308348, "uuid": "378cd485-ebe3-4605-b1d1-e87b6c08619d", "value": "98304:W5fgQ+yJKTKK4KKDyK5kZ1EEEEmEEE1EEEEEEEEEEEQKK1KKK1KKKdE8HrpaO2L/:ab+yv8tq4uIhcyWppzuOPCtRCSuRXL7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781308348, "uuid": "9468e4c2-d246-4ec2-978c-ceef0203b8ca", "value": 5836557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781308348, "uuid": "17b6be0d-0710-42db-83d1-2f18b7c55b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781308348, "uuid": "43a98fe2-ee13-4b24-963b-a0350d3214f4", "value": "dingtalk_downloader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef33de4d-66a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301117, "uuid": "17d1fb57-5f4b-45de-9b11-b91c1b25686c", "comment": "Malware payload", "value": "b4337a69a5c52c4a8083e71b621631f9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301117, "uuid": "8878b08c-e948-4f17-9e8e-abc2e638f3bd", "comment": "Malware payload", "value": "afd9d311792e2f66966b604642602ff735a7672cfe6b7458f9970e87382ecc46", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301117, "uuid": "010639f7-490d-4058-8435-1172eb43812e", "comment": "Malware payload", "value": "06a2a18ac710ab8266592311cb547042e43ad919", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301117, "uuid": "734b670a-f275-46ea-ae03-ecffede2a267", "comment": "Malware payload", "value": "3de6018d21e11c3392f2e4defc4941f575a49a39a3e9f61d9ab3963e273639d299e835ee3479d84fdc9bfa7280b41c92", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301117, "uuid": "7e02a764-5283-4de6-913a-4a3bf1a21559", "value": "T162B3126F83C7133C5C33CAC157CEA18905D3552F6346678AEE2E46A9EC33163DA96238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301117, "uuid": "70398dc9-72cb-4a86-a86a-95bd916bf158", "value": "3072:wp5/h4ps3tSiKjID/hqf1A8jE8okCwU6RsuS:o5metHKO/eEaCw1R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301117, "uuid": "37c6976a-a2f6-4a3e-b61b-31ded9be2dcb", "value": 117503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301117, "uuid": "30ffc0bc-7412-4320-82a8-4764dfcb17d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301117, "uuid": "2b7d1fd7-6a9a-4350-93ff-f17d8422278f", "value": "NewXQuoteX186016990.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df884a1-6604-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781230490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230490, "uuid": "61a4c0e6-2e63-48e4-8862-304959e8afad", "comment": "Malware payload", "value": "754a6f05366f8bf444089143ac403166", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230490, "uuid": "08d9b0ed-7f72-4250-b2cb-64f5a896760d", "comment": "Malware payload", "value": "b21f7d8ab483ac5c6c6580cb54d0bdbd1a2c443a1bef57d162d5c092b75496be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230490, "uuid": "1db0c779-f1f2-4185-84cc-044491bb67bf", "comment": "Malware payload", "value": "208fb99bf1fa434ed1cbce46f3798985666a20ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230490, "uuid": "5d965884-8289-4e2f-92e6-3aca0c1f9988", "comment": "Malware payload", "value": "8f6814a9cd4f91c9002116d650a63fbef27cd48b61f7cc0462f67bc0dced6a6c186737810586f88fcf7f72427341f354", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230490, "uuid": "57e9c116-c059-45ee-9254-610b9cdc42fa", "value": "T134137E7AD8AEAFD4C2994274E8618A781B13F110D2532EFA5A95C5638083D7CF60E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230490, "uuid": "b4f672c5-b68a-4be4-9f3f-9c1a4ed15775", "value": "768:PafwtYW+0hkDeRU+Vjj8M8VbrzEHaRI4Obk56CVe5MOqoCzTCRg:PafwtYVQuM4N56t5M6gTCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230490, "uuid": "dfb3b79f-7aeb-4cdb-a97d-61a2fe5c5d14", "value": 44316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230490, "uuid": "700b4a54-3626-4283-b8be-9e2b97e0ccdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230490, "uuid": "44b22c97-7831-4dd8-9123-f76d60805cbd", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175da622-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781301185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301185, "uuid": "a899dcc1-fa7f-422a-accf-6b6f2b318d1e", "comment": "Malware payload (PureLogsStealer)", "value": "ba6bb9f04700f093f3af2ce6f098a4f7", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301185, "uuid": "2e08bd60-b3a3-4c5f-8d8e-5db6d37f48b3", "comment": "Malware payload (PureLogsStealer)", "value": "b30d5775034d080b834c5d75f40b77a2dab79c56d6f32a5b1a11c1a16ea9797e", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301185, "uuid": "3d93e555-c011-49a2-864e-65573628a6d8", "comment": "Malware payload (PureLogsStealer)", "value": "61a35eea131d5656f352db4ab9bdc8649266db9d", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301185, "uuid": "279a2c65-1fd2-4da9-bda1-a8b822238533", "comment": "Malware payload (PureLogsStealer)", "value": "473f2ae7df7cf25fda08955b9e45671cf41588029cb9dd1760c2476cba3ec552419ca16dc7a013057f17ac9eb6466f4a", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301185, "uuid": "61e85c7f-b7f0-46af-9949-8dff17d805d7", "value": "T123B30260E29CD38D915D6A5941B71E3E66AC6438FD32E919B3FDA720C2332CE6C6D740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301185, "uuid": "2d52ded2-446c-4e8a-9fc6-01245c3cc085", "value": "1536:Juj6fP3awUNJy0Pf8TIaffKO5qhGn00qGa3z/hGftagd297miDMtuJGt+lVUzhfp:Jb3sNJyEfZ0ybhG5cdmUMtuJZVUNfhQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301185, "uuid": "2ba83b95-b409-4528-b34f-0a93dd17e0b9", "value": 109442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301185, "uuid": "fb452e8f-9f67-4ad0-9718-75846ed3b194", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301185, "uuid": "f0219248-33df-43b1-b736-725227bed517", "value": "Original_Invoice_USD_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b63ff6d-660b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781233519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233519, "uuid": "8809ded6-f0e3-4d14-b6b5-6fedb2fd973e", "comment": "Malware payload (Mirai)", "value": "13c57474f58c33a00fe4d967029132b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233519, "uuid": "e728a0f3-c3bd-4b76-8706-1903836111d1", "comment": "Malware payload (Mirai)", "value": "b3351653da1f1dc3006b0e44d4620e812ddc9ef6b6d916e5f6ed8bfdf24b595e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233519, "uuid": "5a3e6caf-2c8e-4b5d-b70c-383804b99c18", "comment": "Malware payload (Mirai)", "value": "61bddf10295d673e2ec48650eec248c11f4f36c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781233519, "uuid": "1b1f7ffc-ca7c-428f-af7b-8a82538d9484", "comment": "Malware payload (Mirai)", "value": "c363e78093d501dd3988bbb90c5b376190f963c8928fbb5d84f2f63e63a6a91933619a748b8d4aee08abe6aad9e1bce2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233519, "uuid": "fc99c37c-dff7-4ee1-8efe-f8b7cd085e29", "value": "T13B234E177450C0BCC9AAC2745B7FAA2BDA33F07E1235B65923E8BD267E4DE311E1A144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233519, "uuid": "517070ee-b430-46f5-826f-f28e9b0e2452", "value": "768:Pw0C10fzlU7wtTX7Q+G3nVl1V7CXUGhOFBOcrKHQ3RkSstEIS:oTyfzl0wtT7ZEl1l/qOFBOcrUSmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781233519, "uuid": "9bdec44c-ce4b-4dfb-99d8-00fd30fdeb5d", "value": 48080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781233519, "uuid": "ea4731e0-d3a7-48a5-a691-2f98ab3b3a2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781233519, "uuid": "e709c23b-8ef8-49e3-aaac-8cdd8cf143a4", "value": "godisdead.13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819bc34f-664f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781262708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262708, "uuid": "1e1691b5-9c7e-470b-b60e-369a36574cf8", "comment": "Malware payload (ConnectWise)", "value": "c8cc4581e9f8e2589e80817eed7fe199", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262708, "uuid": "d8d1f2f4-b7a4-40e3-9a1e-14182a4f221d", "comment": "Malware payload (ConnectWise)", "value": "b461e9b830451662c542ee2db836b97e4f75604370eea8d0965082bd7d3bb5ae", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262708, "uuid": "92f6b0f4-9862-4d0b-8f80-0c4227b83368", "comment": "Malware payload (ConnectWise)", "value": "69ccc3ebabe09ab6e819604e20849d9c1fcc1019", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262708, "uuid": "da4e7b17-9660-4a8e-90bf-8add63a49240", "comment": "Malware payload (ConnectWise)", "value": "86b881aa74380125ca2dba651b17f498b5bffc96d61c9ea290780b20a58254b222692506e4a2d1357f53b3f562218bd1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262708, "uuid": "cd26f6cf-5fa5-4c92-b854-0e629f09a4c6", "value": "T134F72330B64ACD36CD9615B08C7DEBAE602DBA790B2490C7B3D82D2D19B15D32736E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262708, "uuid": "bbb21329-faff-40c2-9442-55eda53b7b05", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262708, "uuid": "c45e93b7-329e-4907-bbc6-7540115c7779", "value": "1572864:XStBe5eEZjJRsMxyv2+uXeTk9mTtxbwS6YESt:XmBe5e0F1yO+uXe4w5xpESt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262708, "uuid": "b5418fde-bf4a-4dd4-949f-d21e92eeec78", "value": 76328232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262708, "uuid": "79928405-698e-426a-a625-138f9ba12596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262708, "uuid": "234c656d-1ab3-4f6a-a221-5a46b14a8754", "value": "b461e9b830451662c542ee2db836b97e4f75604370eea8d0965082bd7d3bb5ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85c1197-6655-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781265350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265350, "uuid": "4c5b94cd-028c-4d10-8885-c87902af37ba", "comment": "Malware payload (Mirai)", "value": "0ef4963f2a123189604abcaa1761e025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265350, "uuid": "37508999-dfed-4e8e-b8d1-7af34c6ccab8", "comment": "Malware payload (Mirai)", "value": "b54e8537d844730f2dcbd3d3c61fba7b6e157141f157aa251bec400df0cc3e6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265350, "uuid": "6a1fd792-ad88-4a04-b31d-fd1db8081ddb", "comment": "Malware payload (Mirai)", "value": "1495e911671ac24cfef11277a5e5152395e2e873", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781265350, "uuid": "5a2dd374-6d6a-429f-b543-6137c532033b", "comment": "Malware payload (Mirai)", "value": "b58d23a7c0e2e581990963422beb0a57eddf3355654a097f79cb2e7016c492ff821b09744f0bf124354865e24156f998", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265350, "uuid": "1dfdfca6-6725-41d4-a98d-f7bc38eb3c34", "value": "T12CA3F885F8504B57C6C662BBFF4E428D7B2A1758D3EE32039D156F20379B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265350, "uuid": "1443c13d-049b-4259-b033-7dab48b43a35", "value": "1536:Dyc6R5mF8AWvm4VxEeV7oPF3z+OQZ6bb9n/l0Ywyw1lHk8x65BMs63BGkvk:WzRgF8U4oA0PFJbBEO0ICk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781265350, "uuid": "ebbae0be-6e7d-4c38-971b-8168d255b277", "value": 105420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781265350, "uuid": "dbaf1d6c-b10b-41ba-a731-4ec5ac39e88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781265350, "uuid": "45af99f2-c3e7-4f31-af5a-34089cce5acf", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6625a136-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301317, "uuid": "efbddae4-858a-4520-bf8b-dbfa56324e91", "comment": "Malware payload", "value": "acc70cce16779f4bc8d22c1f04248307", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301317, "uuid": "1b27c942-309e-45db-961d-53e322d3a12f", "comment": "Malware payload", "value": "b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301317, "uuid": "db737b1e-48a3-4fa2-8ffa-cc2c7a5ac996", "comment": "Malware payload", "value": "28ae76790b176ae490ce7d48f84b95f6cac868e2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301317, "uuid": "155d8ab4-6458-419a-8cc0-bd152102b20a", "comment": "Malware payload", "value": "33258ece28c326870d2d58e5050339be05e7018b3ea7eca53614de1181b8196182188a7e95ce8e6837fef1ba283ce9f3", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301317, "uuid": "d80ed57f-7b92-49cc-9f09-292c72c03b82", "value": "T14D516D50AC14DFE0D5A47F3A26C8906332635F0E946C849CAA6FF26B85107682E7CD7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301317, "uuid": "6e1d3797-c616-400f-a337-d7d0ea96314d", "value": "48:pCSKxD7vPUWa7SKgKwD/pj16PISTAC15YMl+G7v7qnxSWT+ZV7KN+flajlK:pexfvPda7S3pjUjxYzGz+xp+/Kk9cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301317, "uuid": "ef863fa7-2dba-476f-ba16-0bce4344f320", "value": 3052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301317, "uuid": "bcb64347-3392-4cfe-8fcb-02e436279dae", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301317, "uuid": "99cdd7f1-bd9f-4d38-ac83-b5388096b82c", "value": "CommercialXInvoice.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f7cd47-6650-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263325, "uuid": "a7ce1689-08cd-4dc7-8111-a45fd1d2a2ba", "comment": "Malware payload (ConnectWise)", "value": "a0742ff8f066cc1f3674c6901881a003", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263325, "uuid": "291a8e87-5a4a-4ea0-823a-b33178707f72", "comment": "Malware payload (ConnectWise)", "value": "b6df612bb7d5ace42dde016306c210b819d90df44424548a2ac174e0e1c80fa3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263325, "uuid": "e1f7bdc7-3970-4ee5-8083-b22f2e2ff01a", "comment": "Malware payload (ConnectWise)", "value": "3ef701605f5b05b5e9483c6e4e1dbfde7fbeae64", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263325, "uuid": "e607a4ba-f912-40c0-b7f8-b8daf95ee9fa", "comment": "Malware payload (ConnectWise)", "value": "5b797e98c4fffdff4ac792f8d5bb43562b1a0ef8022f504f726f04b3ad49c0c89e29d31aa35a1b6179eb8ad1ff8b6398", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263325, "uuid": "fbd4a34d-d50c-4555-b218-a9ec17c80cd6", "value": "T115E5232236F88539E2F72B30AE3E91A1D93A7E605F20C54F5358242D5DB1A9057F273B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263325, "uuid": "55d486ac-e4ca-469c-a6eb-fa905898ee5b", "value": "49152:21girGLq7FVsLBe+1GVxrKlsuWGenGwfZVkVjOi8ifyXfKVzhyd:2Vrn/TYGVxzTGBwRVkGuyXO8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263325, "uuid": "96d9911e-493e-40d6-8d6e-b6b3b260579f", "value": 3194368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263325, "uuid": "c813c880-c05c-4465-be5b-d5c691574b17", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263325, "uuid": "d1b04b41-72ff-48de-bdeb-bd749d51fd13", "value": "b6df612bb7d5ace42dde016306c210b819d90df44424548a2ac174e0e1c80fa3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3b45d3-6671-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781277331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277331, "uuid": "64b35198-1ef6-4556-a40e-fc65626ab198", "comment": "Malware payload (WannaCry)", "value": "51a1ef31aed91f9490721ad9ccae5c68", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277331, "uuid": "d894d834-6ec8-4437-a23f-f6a501f005be", "comment": "Malware payload (WannaCry)", "value": "b757fe9e2f6bdf330a3e4846ed04d167b5a5ef349654568bac2bf941655b488a", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277331, "uuid": "2855ced4-09b0-405c-81d4-5c478afc0450", "comment": "Malware payload (WannaCry)", "value": "565cb81fc91f527525cab93389ed762ab816f10b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277331, "uuid": "18e0cfd9-4efb-48b5-b6b0-0c9beaca47f3", "comment": "Malware payload (WannaCry)", "value": "58727260c8cbbd867d0d35c6285b2a4847befc2e723de73b391f668545d6d4016eff7b4eedb134385605eafeccd4aa75", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277331, "uuid": "96446d95-190f-43af-a752-8ce0330368e0", "value": "T17B36238931B881FCD106197484B78E22F3B37C6A26FE5B0F9B40457A1E53B56FB60B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277331, "uuid": "27fab6cb-5fa0-48f2-9241-4efab0ecb8ae", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277331, "uuid": "7d5fca2b-2117-4df1-b23d-38227fe55c4e", "value": "49152:jnsnHqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:DMHqPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781277331, "uuid": "3b09c368-0004-4ba4-a8ca-887c980a8202", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781277331, "uuid": "e6b7b110-3b0a-4c02-b81d-9332da889445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277331, "uuid": "4c553135-2a43-4f0b-8e8e-9438cf2f3deb", "value": "b757fe9e2f6bdf330a3e4846ed04d167b5a5ef349654568bac2bf941655b488a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08535a96-6681-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781283980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283980, "uuid": "141ea083-3ad5-4cee-bdc5-394d05d082c0", "comment": "Malware payload", "value": "ca72be9aa577964415b5d5b5a8945d7d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283980, "uuid": "f203ce63-97e6-4c74-9575-0d752bb1d083", "comment": "Malware payload", "value": "b7e95a94d9764db9f7916febb5e1b0b73532794173e60cb3b2c08765b3ac38ed", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283980, "uuid": "cc006831-9e45-45af-8291-06821b1d82c8", "comment": "Malware payload", "value": "157092f9adadb5fe38fd9de0072f08f4fb8acbd1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283980, "uuid": "1cdb79e6-a7b9-4a97-90a3-6ea915746bd8", "comment": "Malware payload", "value": "331fdaa016753de11de5ce1e86c6477d400567057afd55aac3c2d88a2c2255cda1fa9d60ebfd62c28f046e095faf6497", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283980, "uuid": "0e9e1f2a-55a0-4427-87e4-6f95f3464000", "value": "T1DCF58C17FCD608E6D0AAA33289A38146BB35BC4C1F3227D32E51B7782E766E09D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283980, "uuid": "6a9c9a69-efca-45a6-983e-ef976fc7670e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283980, "uuid": "c994ec54-6568-4385-87ea-ee1e3feb43e8", "value": "49152:kkGny+aL64JrfLHYRHKQMhnxcIpreiffWnikWfYB5Awnel8IsKE6XmgehWi8msk:kS+SLHY9KQMhnFpreif+/wbkFgeWij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781283980, "uuid": "e5970420-fa10-4079-9427-c1abbeb07b45", "value": 3368312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781283980, "uuid": "fdf3a98e-dffc-406f-912a-494186c9a1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283980, "uuid": "62949d42-2722-48db-aa05-3745dc5fb041", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bca2199-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301380, "uuid": "2ad57820-118e-4467-b397-89af6e3c9fe6", "comment": "Malware payload", "value": "5afca1cc20fc64d54f67c7edc0ce75d3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301380, "uuid": "ea9850f6-0447-458e-8cba-5e5b164fd64b", "comment": "Malware payload", "value": "b8f426f3646b2be7c7e6381122f24a64b34506cce359bb7f9bc9b30988506010", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301380, "uuid": "eaff06e0-6a99-4db0-bd3e-780a97c64205", "comment": "Malware payload", "value": "c486df0362fbd24b335f9c739b9fcfef38ebea2f", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301380, "uuid": "d72c15db-88d1-4e05-b125-b7f9600306d5", "comment": "Malware payload", "value": "10ab00be83b33ce2a1b9e50f7be54ac68ee5d7549f56a5b6d7344ac5d34bc93c9b3e8b512dea64fab1867b108a456577", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301380, "uuid": "57c4459d-1e92-4de5-889a-a50db5c24fa6", "value": "T1A3A30241A566028F4E1F88772CEC8791CF6201CB45D7A97475DCFA4CA90B263DEC2F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301380, "uuid": "d6b1e389-7226-46f8-8128-3ebee423152e", "value": "1536:kVjEXDsfiEl9OCjbuNRrLwclqD7GgZuhXuJqHFWgJP7qZImltTmHPBIMPX3e:kVjEzsXOSSRQwoqo9rU7lSAHPCAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301380, "uuid": "46e16b75-2e12-40b9-99ee-5d09b85f4aca", "value": 106724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301380, "uuid": "bb7f282b-18f4-4e1a-8d74-b5d06238efee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301380, "uuid": "1c29ed64-6d9b-4cf3-af28-4cb2610eb6e5", "value": "Request_for_quotation-_ADC_JAZ-12889743_pdf.txz.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d548a6-6648-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1781259541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259541, "uuid": "5c9802cb-fabf-4856-89c8-3fb60c55e094", "comment": "Malware payload (njrat)", "value": "cf358f16d2f741ac05f73a6305b1b366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259541, "uuid": "2c0b85ee-478a-4413-9e65-2b36714431ed", "comment": "Malware payload (njrat)", "value": "ba3ae937bd1d826fe270ea22b138974749aef0401d1c51a746a4c5e7cc382db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259541, "uuid": "0384afb0-66fc-47ce-baeb-003276f59414", "comment": "Malware payload (njrat)", "value": "99b5b20f2d4abd74ae52c780d9001f85c1e83082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781259541, "uuid": "b918a190-ef6e-478c-9286-e11cfa3818f6", "comment": "Malware payload (njrat)", "value": "89635a57ed470e7d8b10c2e4fd1d0af3b961f5326e58fe927c8004a3fbfb5ba6543a503d1aff21b2480aa53314869c18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259541, "uuid": "358d416e-c197-409a-9b43-321e3785178a", "value": "T16DB35C0EFB518A8AC55D4FB78463841C43E9D8676133FB7F18C89DE14D638E8A98F624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259541, "uuid": "dc628c2f-41e1-407a-b4a3-dc7ae95b0294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259541, "uuid": "23d573ed-25ff-4db5-bc9c-fc6db4fc3d4c", "value": "3072:tPGQ73aKYF1ezKO0Wc9nklROosBobOBnA:tuQ7PqbDJnkOosobO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781259541, "uuid": "54e1bf57-d2d6-403b-8168-2ff3b2d17e7b", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781259541, "uuid": "d67ee035-d4f1-416b-9f73-441985b4b7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781259541, "uuid": "52cf7fe7-b759-4fc6-904e-520b547ea13b", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944eca77-6665-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781272189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272189, "uuid": "7da2e879-b0f6-457f-9b4f-dea350e6c1e6", "comment": "Malware payload", "value": "86b0ea00520df18438b3bbcb19149953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272189, "uuid": "620d06dc-6c31-46fb-a207-a821c796c77f", "comment": "Malware payload", "value": "bb1ef9258929bdfd05b3562d9c373f6cabae07bb716f95c07b993245ce63130d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272189, "uuid": "eb6ef534-f686-4fe3-9df6-7644aa39ac4b", "comment": "Malware payload", "value": "be39dbe6e6193cd6815705eeb3dfba68ea7a908a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272189, "uuid": "1e192ca3-2539-4376-9f3c-0d164b57c9cb", "comment": "Malware payload", "value": "79392ef677f31aeb6df5c71f89926ce22ddc95f3e76eaec222b47c1b11f11cca724f8733d4ea620e70384cbf11153122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272189, "uuid": "7937170d-108b-41a3-9458-e3ded78558f7", "value": "T1A7663891FE8794F6E4031A3101A772BF67305E054B25CBDBEB40BE6EF977A911836206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272189, "uuid": "94d59aa3-204c-477d-ae2a-fdfbda368672", "value": "5f77bccf23632019202250229664e21b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272189, "uuid": "a03972d8-d45c-404f-acca-4a59c5b87f6d", "value": "98304:YWzvIo4RvdZyG7FhSCbD2PlcNti8Ec7CEb:YAIo4RThNSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272189, "uuid": "99f94358-0673-4509-8854-082d7e7b70e2", "value": 6635008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272189, "uuid": "f9364b8b-7509-422c-ba5e-74733440ae2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272189, "uuid": "6951749d-6de6-4620-9111-f242d4f7458e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa07940-663e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781255242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255242, "uuid": "0362ea30-f043-4ef7-b959-c9b36bbd8cdd", "comment": "Malware payload (Mirai)", "value": "98bae7cf3f3366d335c5bb547fa630e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255242, "uuid": "9500e68f-3cd9-44c9-bdd0-0dc8da37f76c", "comment": "Malware payload (Mirai)", "value": "bd9f811dbdb28a9aefd9dcbf192a1cb4bf1a98b86d34dbaf94b19bef00e1635a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255242, "uuid": "a09ffd34-24d8-49ed-8f97-be090c6b5ae7", "comment": "Malware payload (Mirai)", "value": "87b0ee6a4f453122867c70a1e239d67ed9411c3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781255242, "uuid": "d85baeb2-7238-432f-8350-ccd2c509d624", "comment": "Malware payload (Mirai)", "value": "20cc0194090a6794beaac6659bbc05fc1636d09e2b826c1ca8fea6ad35c109c7053205ccef486c3d6bd21b13f406b446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255242, "uuid": "2241d625-3ab7-47ab-a9a7-7c6a9e9e460f", "value": "T1C1A35A63D8262F58C665D5B4F0B48F796F639A9182871FAE1573C3708043C8EF846BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255242, "uuid": "1e14dd8a-7331-4260-b589-c17fb1e3ff7a", "value": "1536:hA/DWrO3vrf+vC5KcY3QYipD9KnrZ43WiZk7uc2Sxr+q:hiDDrfAZclpD9Krq3W8k7Pl+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781255242, "uuid": "eb8b3822-29b8-442e-a518-a20817d2ac41", "value": 103876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781255242, "uuid": "f0777afe-ddc5-43d7-9b09-208d0e829063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781255242, "uuid": "b5e45b9c-b42b-4b32-bbc3-7e048d211f35", "value": "CRY.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36054869-661a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781239818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781239818, "uuid": "5a91ee32-8cf5-4b2b-877c-d2c401ae7fc9", "comment": "Malware payload (Mirai)", "value": "ed578cae1eb6bc093d29a222f73966db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781239818, "uuid": "2d7b336e-eb16-40a2-bfd4-660af97f7e30", "comment": "Malware payload (Mirai)", "value": "beb39fb50826f16c22650bb21d4450303ae9cebd65331cb5d2937bad7b278eec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781239818, "uuid": "719e7517-df2f-484b-b0b3-3413a47e75b8", "comment": "Malware payload (Mirai)", "value": "d327357d77765835bc12162800d9a0b70ca1d8b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781239818, "uuid": "a6b6834f-5406-4717-829c-b69c65b6372c", "comment": "Malware payload (Mirai)", "value": "2f727a0cedcc418abbadf7ba0ad9abed93b2abab00a1f3770b359b44d64fd219d0c1d01eeff6a7932e3395a8ef4dbb8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781239818, "uuid": "27003a09-a61f-4bcd-9a39-a4f402bd5135", "value": "T1A1D3AFDFB28B5550C42106F01BD79F9E3F5322658D5FE8E62C1DA23B25726CB180A7E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781239818, "uuid": "f78d73c4-6a43-4c1d-9acf-7d2d06870444", "value": "3072:KoZ3T/3DoJeA6H6tt8PvGanQYR3gDWe3q:K+b3zMLeuaNIWe3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781239818, "uuid": "42f21b83-5235-451c-96ce-692c65b81e61", "value": 132272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781239818, "uuid": "213c5203-2222-47df-a8d0-9f5f64606032", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781239818, "uuid": "e57b4e30-7c80-49a0-8151-76b4de2bc605", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c510dc-6650-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781262935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262935, "uuid": "ffce8462-f8cd-4200-a2ab-c39c73b375a3", "comment": "Malware payload (WannaCry)", "value": "d404301a5ef34d18f7caaf5f27a1c29c", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262935, "uuid": "7b037ca1-6bb7-43e6-a699-75a30c1a6b6f", "comment": "Malware payload (WannaCry)", "value": "bfbdab697dc29d622a42ef028ea48a4ebe92b753a5ce4d4873963fca6a0d08ba", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262935, "uuid": "16c974bc-4780-48b9-bec5-63f824ff2cee", "comment": "Malware payload (WannaCry)", "value": "2a58fc2c887cd64677b883fab948c08f38677f4b", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781262935, "uuid": "efb14d54-70e2-49a0-a888-65c456e316ad", "comment": "Malware payload (WannaCry)", "value": "7f319b16b2e0357c6de6d8ba096d0343922d48b3277bb32f512e57494af18de1462053e7c10af658d781d16aae05f09f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262935, "uuid": "421b0700-7d63-4601-9fe1-fde7f8be1152", "value": "T19F363358626CA1FCE0450AB844B38E1AB7B37C5967BE4B0F87C0866B0D53B57EFA4741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262935, "uuid": "6a847b43-93a9-43cc-98be-18ae8d228c11", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262935, "uuid": "cf71d2f9-13f6-46fa-91e9-3013edf70403", "value": "98304:DI8qPoBhz1aRxcSUDk36SAEdhvxWa9P5S3R8yAVp2H:DI8qPe1Cxcxk3ZAEUadWR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781262935, "uuid": "ac2754b1-7ee2-4b36-b0a1-21bf7f3ba62b", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781262935, "uuid": "e96ad951-08c9-4c6c-831c-b3d855766b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781262935, "uuid": "353e9c82-7d51-41bb-a3ce-2b7f2fac43be", "value": "bfbdab697dc29d622a42ef028ea48a4ebe92b753a5ce4d4873963fca6a0d08ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53116cac-669b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781295272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295272, "uuid": "25ec5e89-37c6-49a5-bf36-c2b232dbb091", "comment": "Malware payload", "value": "20773994a6ea53363d3b28f7082bcf47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295272, "uuid": "25baa696-4097-4311-bf0c-43e957d89941", "comment": "Malware payload", "value": "c04b25114c6f8b052dd81b8774f1461d3d4a4fc20103a4bd8fffe7a02e76bb0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295272, "uuid": "296237e4-af26-491c-bcfd-51b05550d2e0", "comment": "Malware payload", "value": "dc2f1171c78c4f0fbc1578a87a5a3a9fa64380a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295272, "uuid": "19051349-9c02-45ab-bfd6-d37a36b1593f", "comment": "Malware payload", "value": "23a337ccddf9bc4ce3a474554cbf92e76e1db12172a11af296e8af9fe138ce9fc31873d2ed85c081cc575a7c45a9a84b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295272, "uuid": "9fb96474-2fa4-4dbd-aa83-d964e229b959", "value": "T11C24B71A9F510FBBDC6FDD3706A90B4239CC645722A53B353678D628B50AD0F89E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295272, "uuid": "f45555d1-35bb-42b5-8fd4-c83b78145cbc", "value": "3072:eMrCKCtO/g7O1NtcDDE0Ugd7w3uYe0DzdcjXKKg:RCKCk/g7myD7Uc4/Dz6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295272, "uuid": "6e0204ea-889a-47cc-8457-645edde3827a", "value": 218528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295272, "uuid": "b58fb4d1-fb56-42b6-a306-68b8a9a06ab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295272, "uuid": "aaa71283-6b52-44c6-ae6e-25bf0dae9e8a", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c6a0d2-6636-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781251766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251766, "uuid": "e3ca9251-574f-45c7-b0a1-f198dd474c6a", "comment": "Malware payload", "value": "2bbd77918c83c5c9de6939c410862736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251766, "uuid": "5c9a30da-970d-48c0-9581-4ba0e713c50f", "comment": "Malware payload", "value": "c2ff077b05307f20c147a0c852ae39eaf36e4b93d828380bcdfd833c3f82820e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251766, "uuid": "ff26a7d4-5f37-4fa6-bbf7-85379d767348", "comment": "Malware payload", "value": "fbd80e0696b281f6c42a4d61e9c4e11f05ae6047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781251766, "uuid": "99e01547-2405-47e6-8c53-2e404c9392b9", "comment": "Malware payload", "value": "e035bb1c2cb34f1d6e012fff6013bbe44ad3f577d2f74d41938ae436e911061c789bc3a78bf717bb3781785f101abffa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251766, "uuid": "4fbaa420-ff1d-4754-a1db-63fa2ff3e221", "value": "T19034B70AAF610EFBD86FDD3706E9060235CC655722A53B363578D624F54AD0F4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251766, "uuid": "d2d3f308-0b4f-46e4-a967-70c6788f9caa", "value": "3072:ItkOThsQ2H5TUuhP3OGOBzoYzvkJR02wWb/:ItkOSH5ImPOV9vkJi2wWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781251766, "uuid": "59b8d94a-b247-4a49-a6ab-3492d03c5add", "value": 234960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781251766, "uuid": "bebbd20d-6045-4906-98ae-c95292421444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781251766, "uuid": "8dd83fb3-7328-4c0b-9c59-4554fa845548", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb94313-669f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781297248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781297248, "uuid": "7e50107d-f951-484a-807a-a38afe7c9940", "comment": "Malware payload", "value": "5b4badbccdc2ef4ac3d879cdf3f7826f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781297248, "uuid": "f4c8bfb2-a332-4946-8945-8abeeed9b1eb", "comment": "Malware payload", "value": "c3be19f9e63f8573588d2ca22201a8592da354f6a4da4aed7403bbaa49772d5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781297248, "uuid": "f51960a3-21e9-414f-8d68-5891fcd3d7ab", "comment": "Malware payload", "value": "337e31536a5a1d80287039f56a6f15571a2a395f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781297248, "uuid": "55bb61a6-93b8-49b7-bb96-e4120b92e2c1", "comment": "Malware payload", "value": "58901964f2db4d60d34834fd9c1d3853472c434209fca51b62dba3cf934ac5cbe0c4bdbe1e391ddbda2e9033d024ad5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781297248, "uuid": "b030868f-377b-415f-b86e-7638c001b8c0", "value": "T1A2F32A05B31D0983E2673EF03B3B27D0D3EFDA8131A4E640695FAA8991B2D325589DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781297248, "uuid": "88df9446-993a-4610-9edd-3c688444a5cc", "value": "1536:NpEyB2Fur4YtIfJuYIL8k1rtxz1LNMxG9qLbbuZg9w//+RMEihVrfcGvA1HrdAXV:tEeLHrRLNMxMuMjrs1P5w1gV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781297248, "uuid": "4d9223a4-1721-4c7f-88c5-55f791746005", "value": 158640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781297248, "uuid": "ccfefe83-f9fc-4ddd-8aad-fd206476f50f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781297248, "uuid": "183a12ae-72c9-4c54-bd91-7272f4631f6d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df85b5c6-6650-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263295, "uuid": "b3196ef1-7dd1-4921-b7ca-11975632e566", "comment": "Malware payload (ConnectWise)", "value": "31dfde651cc1a38c056faa9713fb4217", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263295, "uuid": "6841ac5d-6ada-459f-bfad-f7872745ec8a", "comment": "Malware payload (ConnectWise)", "value": "c5f145c07653dd0d7316ea84b44d7166e0d8cff406c90e1c8c9de279707b34c3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263295, "uuid": "10db6b0c-3fe7-4b27-8f72-34bb60f074bf", "comment": "Malware payload (ConnectWise)", "value": "50b6e36c577622e9d644ba9f039357c1b649cd0b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263295, "uuid": "1ef0abc2-0635-4a6b-92cd-7286cfa95dd0", "comment": "Malware payload (ConnectWise)", "value": "0c0dedf29ac3ab6dc2a93c847e969554873f31982950af96c7be296b265ccc713ee8ec5b5f0c7a52d216e0cb781bae07", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263295, "uuid": "1ad98007-6560-496d-95af-f54d62f8323d", "value": "T178B71230B64ACD36CD9605B08D7DEB6E602D7E790B2490C7B2D82E2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263295, "uuid": "11e859b1-83ef-4a10-9fb6-fdd7c2283289", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263295, "uuid": "0e2847f9-aab4-4f51-8cc5-808c6163fc49", "value": "786432:7StBv0lfXjq/FpttD7yBG/c66pXP5PteTIzpYpX+0C/v2+uXeTDDkKQ59pY:7StB8fjqNpttD7y0/JUvHMxyv2+uXeTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263295, "uuid": "182e1424-ec32-49a2-a807-c2965baaf2a9", "value": 49443160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263295, "uuid": "6d638bc0-608b-4193-aeb5-c2f57181655f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263295, "uuid": "9f4389ce-8a71-404e-9582-2a42b86673c1", "value": "c5f145c07653dd0d7316ea84b44d7166e0d8cff406c90e1c8c9de279707b34c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5c7d49-6649-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1781260285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260285, "uuid": "eb72317d-6116-448c-9d9e-05ac601cbd99", "comment": "Malware payload (RemusStealer)", "value": "f456d1e4277cbfc8ec90589f291ec653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260285, "uuid": "09e395dc-616a-49fa-9063-cc6afcae37ca", "comment": "Malware payload (RemusStealer)", "value": "c6dc62c4bad1c383518470c3156b4f38126b991450f050fb656d82db72d5c5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260285, "uuid": "c15777e9-afdd-4b2f-80ff-faa18d129a83", "comment": "Malware payload (RemusStealer)", "value": "627b0964fd75469cf3cc6c0a8cfaa93bbb033b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781260285, "uuid": "2c91013e-6ae7-48a5-87fb-344ea94ba542", "comment": "Malware payload (RemusStealer)", "value": "164684c3ddafddeed7b581c852aac4cdf18de00aa03b27b93d7d4e898fa9c1b971af7bdd45fab97b2327c271baca81a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260285, "uuid": "e03f2e90-6c4e-4d01-8f27-f2892a2b421b", "value": "T1BEC54A07FDD149E9C0AAA23189B356927B35BC081B3727D72E90B6782F727D06C76B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260285, "uuid": "c2686ff0-4a29-4b12-b74f-5423ac3a1d90", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260285, "uuid": "c0e7060e-96b3-4389-a649-1a935a9ca6c8", "value": "24576:D/4d209gA6rdVT2pxpcliEs8Igla3bqixaM2nCfHYB8HoEFT1AvA2Bele5IKDddF:D/4dHydr72TXEsyGdYBm7te2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781260285, "uuid": "3f935573-d6b1-44f2-a8b3-6979e1c5406e", "value": 2692480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781260285, "uuid": "41878cf0-d427-407e-9a84-44d6d959026b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781260285, "uuid": "06123663-779f-4dca-bf5e-b5f94817bd57", "value": "Mod Menu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67a9b64-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301425, "uuid": "f6757242-19c6-427f-ad1c-5c6ac7fdb4c2", "comment": "Malware payload", "value": "03236cd959d1c0dbe628cca3d3bdb602", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301425, "uuid": "77e72524-b215-47b8-900e-0f9a396fac77", "comment": "Malware payload", "value": "c73ce00558fd70ab673cdd385ed5b4c30a2a07227ec2035c0657a9aa3ba14741", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301425, "uuid": "dbff554f-da00-4976-b9fa-b5b0da224e2f", "comment": "Malware payload", "value": "51174b44afe68bb8db4952f6340f02412461b5a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301425, "uuid": "842026d0-18dc-455d-bcea-c05a8569cefe", "comment": "Malware payload", "value": "4c790db74d35b7fcf8e47296c93008cae848ca6f764f9103c44c5a9e2f86c3b543a49e6300626feb349ecc37d915eca7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301425, "uuid": "7f55eb82-4c89-4d40-bcff-9de315652e05", "value": "T1DAF4E63DCA64412EE176C729845A045FF8862E0B523CE84B64CA374FAF739467BD236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301425, "uuid": "57a76d31-c683-4131-9901-52dc53b52c03", "value": "3072:nEUOm9ckgqVuZxvprjhM7a70/AxPV09yN/7qS9rc43An0IvJfJc/i+RetZE7rHLK:FO5ppS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301425, "uuid": "f0993cbd-6141-43e1-8c92-593f6edb7515", "value": 787344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301425, "uuid": "48abca4e-9651-4914-9195-25aa26df3cce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301425, "uuid": "b4cd3ca8-9ddc-4262-88aa-1a2979eb9863", "value": "REQ_For_Payment_Invoice__FER480120002668256230-7134009_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8150f043-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301363, "uuid": "2800e26d-569d-4b1b-ad4c-d36b1c67b474", "comment": "Malware payload", "value": "074beb8e2d91ae5c82569e320796cf6f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301363, "uuid": "2aa31bc5-2eef-4370-9515-018288be733c", "comment": "Malware payload", "value": "c99ca313866d681329ece02da774831bbaef6d3f3d7fe6845e8e06ba530316e5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301363, "uuid": "3b73f4bf-670b-4196-a405-411d6c548720", "comment": "Malware payload", "value": "31cbd5e0fa5c7bbc58d7ba794971f333cd4a5bdc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301363, "uuid": "8de6afd2-5d5c-4be4-80a7-2f31ce96b294", "comment": "Malware payload", "value": "31225f15feb23b305eeb83819b7b6d418c4389c34b535a368583ab4d497378125a44c89c52c07fb10fb2ff639bd542d9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301363, "uuid": "86af300f-5537-45b4-80a5-80a7ce789137", "value": "T197E42378B76AC256764F52680E2D8C5D6D19FC5EEBE23747033FEF2853684E60248B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301363, "uuid": "a1e60bc9-6a7b-4e04-9c84-bd6aa3ae1656", "value": "12288:kLZq/GAECCHRdBQZtBFMnQ29fSmmr+YgwBm1G+G:kdqpCHIunp8rL1CGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301363, "uuid": "ef375c0b-844d-478f-80bf-b35333ec7e7e", "value": 686909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301363, "uuid": "7f8b80a8-b75b-490b-bd13-5cfc382116c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301363, "uuid": "362a06bf-6b79-48f6-b5f4-804b66490b33", "value": "RequestXForXQuotation_#9505ADC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e06d9113-66b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781306676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781306676, "uuid": "15a6fa38-21ee-48f1-aa6c-7987ab319c0e", "comment": "Malware payload (Mirai)", "value": "66d4a7f3a83e0e643fe615b47d0c90c4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781306676, "uuid": "b2a55e81-c2b1-489a-bc86-eb645c50df0a", "comment": "Malware payload (Mirai)", "value": "c9b6f9f76791556bc1b9835fcb7720ffccf8023c8999725313f6a16dc65ce0a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781306676, "uuid": "92e3bb45-3326-4d73-9928-cc4febc251f6", "comment": "Malware payload (Mirai)", "value": "ca7d1287ecf7ca413204a709924728323941f016", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781306676, "uuid": "ffb98d49-e343-4c5a-9c82-8299688dd274", "comment": "Malware payload (Mirai)", "value": "a68267777e0f2861ead2c3ebdc0451ab61603a61efc0432a9a1b23a45148517449f260a21a9aca0f6d9cccdb8abea99e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781306676, "uuid": "cbc2d527-a6c4-4250-abcf-11edab969bfc", "value": "T102346C43B58190FCC486C1344A7FA737EA72F1ED1235F69AB7E0EB222D46E115E1DA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781306676, "uuid": "0b0369a5-ea2c-45d5-be2c-2dc308272bb7", "value": "6144:aYTTGASN7udsPq3jLrKGHfzhdeh3IjLrKGHfzhdeh3:aYTTPSry2Gft0bGft0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781306676, "uuid": "86b41fb9-d9cd-44c0-a491-fb9b2b3bd6e4", "value": 249984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781306676, "uuid": "10773aae-a961-48cb-b04c-1c31503e4f23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781306676, "uuid": "4d1074f5-5302-4cd7-90a6-0987968871aa", "value": "c9b6f9f76791556bc1b9835fcb7720ffccf8023c8999725313f6a16dc65ce0a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b14caa0-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1781301352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301352, "uuid": "9561ee9e-bc99-4022-b368-b919e493da2a", "comment": "Malware payload (AgentTesla)", "value": "910bad7be755f0b5304e69253b16f437", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301352, "uuid": "4ec30350-f068-4cbc-a0b1-373b7dade165", "comment": "Malware payload (AgentTesla)", "value": "c9d80dd8dafebc3829c17b84238efd5c44e7b9aa206a2f6e251e0d7809a1a43d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301352, "uuid": "eb97c0bc-095b-44cc-81b6-a4b7b2563c64", "comment": "Malware payload (AgentTesla)", "value": "5678e4a894816e6c6eeb02b9ed4df533106c8069", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301352, "uuid": "784cd5c3-3595-41da-8b14-69d43916624a", "comment": "Malware payload (AgentTesla)", "value": "eb3950a3210d241c498426907a5193dfef2735bfd099ae8e4225d173b5adb65cfda6aecd00f9234ea1876ed9cc13f24b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301352, "uuid": "d81726e2-48bd-4de1-920f-d8cde0aa249f", "value": "T19176003003549671E3585FAE2AB5B128640D5DCA94F9EB053A6EC7B0127AC33E37B7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301352, "uuid": "b4c3a298-9d8c-40e6-b19d-44bf39cd4529", "value": "98304:kL8QF0S/es23hHtci8DAC6ca7F0mMy7OV2rT1iutkr6cXqCBQ+Tii/kb+1X9CS:wvS3txC6J7a9aOMnDkpaCC+/Mb+1tCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301352, "uuid": "207d41b0-93a1-4886-9fdd-ae9d5cd85054", "value": 7303431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301352, "uuid": "ef990a3e-5470-4656-bca4-56c8405a86eb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301352, "uuid": "b52c7fc0-180d-4743-89f8-118187d1c123", "value": "Invoice_for_first_payment.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817097ae-6665-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781272157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272157, "uuid": "0dc7380c-ea35-49a4-92dd-8c25a5544917", "comment": "Malware payload", "value": "72aa42ad7ab169f6dddbe747d9451ca7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272157, "uuid": "e22a245b-88b9-492b-8977-9277c6942153", "comment": "Malware payload", "value": "c9fa39ed490e5551d4616e3f892be24661b5b9850263f58c5e0bf0a7b8fb25ea", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272157, "uuid": "af1f15a5-4741-451d-80d9-a864cf569412", "comment": "Malware payload", "value": "f2d490e329211d2c1377f2c6faec546d4aadc842", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272157, "uuid": "25603c84-33b3-435c-b777-1d17b45f0b41", "comment": "Malware payload", "value": "d1570d2749d02956064f067f80f7f5b048fe198aa93e0d7035d6b4b018fb0e839c1789ab039c84cfff1fa48b44549dc9", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272157, "uuid": "408789c5-b6a7-4920-9149-34cd20b7dab0", "value": "T137C5333AA53C3F58E04793793B096F70A0E94BAF3758121CF5DD1BB36372980669358A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272157, "uuid": "7f9b2160-6559-4b46-9abc-c8db5cb087c7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272157, "uuid": "38718c51-b712-43e1-bb75-af2dc4e627ea", "value": "49152:s07/x/FD6fUOBjA2obFAls63L9Ome36QTadZvTmItucz6Typ:3/xJ6bS2iT63Lolsbbtuc6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272157, "uuid": "688cbb1f-9d0b-46e9-ab11-1d5baf7ce3c5", "value": 2635264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272157, "uuid": "444d8cba-c8f0-49de-afc9-260ed28e77c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272157, "uuid": "c0563b6e-9aa6-4467-a833-327463117b72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3feb8a12-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245418, "uuid": "7687a6be-5749-45f8-8625-f09017ab4d53", "comment": "Malware payload (Mirai)", "value": "c7adf509b0aa315edaf8c35afed1d3db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245418, "uuid": "cc357cd2-a636-4653-881b-6d89a4e351d4", "comment": "Malware payload (Mirai)", "value": "ca5f7485a5d0474576f9f108e47013cb450f13b8e853032f8df21aeb8972b662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245418, "uuid": "739ca100-c319-4ab2-8e41-ac11cf36fab3", "comment": "Malware payload (Mirai)", "value": "14febee97f37ce2efe9ac4833705fddf3573fc49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245418, "uuid": "716912a8-0fdf-41c0-aa42-e2d817be8bee", "comment": "Malware payload (Mirai)", "value": "8c0f4b103356f3e714de670ad0b19ac59ef77e9ac5c646f8360f4b7eb9078c0a98af8bc75cf7c4c0b1ab9afe3064f247", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245418, "uuid": "5f325b18-55b3-4b6a-bf73-5cec988418c7", "value": "T178735A17B88090FDC45AC178077BF636C933B57F1239B26A27C8FF262D89EA06E58145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245418, "uuid": "c47621f7-4221-463b-9783-5d8d02c19c4f", "value": "1536:7sJledQr0DDlEdWcCHtLLmEEpuvDZuuv1HQH69B5PMXfmJOL+T:Q3wQrID7hxLmEWuvDZv1HQH05PMX5+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245418, "uuid": "81bb80fa-c346-4375-a1fb-f6136913d2d1", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245418, "uuid": "a77d61cb-6644-4880-9bd6-2759df2259e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245418, "uuid": "a8434d2b-c254-4e0b-82d6-046d8f5f5c15", "value": "chromek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aebf136-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301325, "uuid": "6a6d10db-eb88-40f9-ae6b-8e068ebbdea8", "comment": "Malware payload", "value": "1ad9ea1fe2b1682a9b2c0ff8c688cb96", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301325, "uuid": "479f278f-a2bf-46c8-896b-1726d6e0ca71", "comment": "Malware payload", "value": "ca75b354c84050117c1299c1a000e1eb6b1a5de00643c815e97c2c3f8ee8245a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301325, "uuid": "2edf3dc8-9d05-4583-90ce-269c334a0ee5", "comment": "Malware payload", "value": "5d44c282c8f6a938eed0aa99f98be07ef2250dc3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301325, "uuid": "2dabcc2c-6e38-41af-85b8-4cbc082016ae", "comment": "Malware payload", "value": "70c851515aaa5f639747e7e83d7865007c00bef78534559a00b479ddcc4c1f30026f510a1386fd45dd58672e3db713c6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301325, "uuid": "c64f1f02-8613-4551-9153-48d6e345911e", "value": "T1B4A3126A1A9C7B2313E27D5FFF5E52083FE45E4E5AC4FA81AE0A8636E99000510E905F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301325, "uuid": "101dde84-7221-4b18-a73b-5b938f4cc588", "value": "1536:csErIJHRz/eCvFsacvrKBJx0nicIgXT87L3ZxzwuxdzcegVR28H+pztLW:cER7emFsaskT0icA7r7E3VwykC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301325, "uuid": "c95023b1-1db6-41bc-8da2-1f1197a7b21c", "value": 105839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301325, "uuid": "7fbb09b7-8c8e-45bb-899e-417ca3254632", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301325, "uuid": "f5e26811-fc26-4b91-ae21-d7dda4b1938f", "value": "REQXForXPaymentXInvoiceXXFER480120002668256230-7134009_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8043a4d-6636-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781252035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252035, "uuid": "056aad8c-f0fc-4a08-bf3f-2b4d10e07a7f", "comment": "Malware payload (Mirai)", "value": "c17661509e0caed22f319b0f211bbe0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252035, "uuid": "9cb273e4-231b-4003-bff4-a6f95a27464b", "comment": "Malware payload (Mirai)", "value": "cbc569dc1b472d6c8c01c9a50e28a8753289c65a57ba9c79ac79f59d958c6e1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252035, "uuid": "87bcdba3-7eb7-4b39-836e-2a9d4bc759f7", "comment": "Malware payload (Mirai)", "value": "7d3c3cd7b60df5632cea7ca644f0dcb19923a6d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252035, "uuid": "4bbe99fc-d29f-43c2-a6a4-512781578da0", "comment": "Malware payload (Mirai)", "value": "f79f8c2c1ffa8d29c3c5495c92517ac62f65519e99c592798863c0929e07b52f57425023c7003a837b02cda5b8a1d61e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252035, "uuid": "6478d98e-ca9a-44f8-b0ad-5d3092adc598", "value": "T19DF3E849BD518F56C6C252BBFF4D838D772A17A8D3EE7103D9256B20378A85B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252035, "uuid": "e3426740-610f-4059-b27b-c75361becb56", "value": "3072:6UqPYRyXPAsPvUoXsDxh2F1bjC1A9ayReO4W05GzE7pXN7NiZi6QWL:6UqPYUX4sPvRXsynC1AMykO4WpzmpXNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252035, "uuid": "d93564e1-b519-4f45-8d24-7ba7fa71b5e4", "value": 166340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252035, "uuid": "51c53a45-026a-43a1-8191-87385de50cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252035, "uuid": "4de50f43-e093-4810-b43c-caa952e51770", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7461ded-6650-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781263282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263282, "uuid": "6e0c65ae-21e0-41b7-8649-1ff8a4564e04", "comment": "Malware payload", "value": "9aea2facc07178a8c90b4f04ecdb2b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263282, "uuid": "8b057b13-8c2d-4bec-b7ee-386bfef9ee7c", "comment": "Malware payload", "value": "cc28889edc5be39ad46fe6175198e042fe41d200fd0d67a892370886035e2c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263282, "uuid": "75947b09-87ac-436d-a0f7-c956cf7c6d51", "comment": "Malware payload", "value": "bf96c5a91ea7adee09be6d0fb160738ef85d8178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263282, "uuid": "18fc9adc-fe27-4cd9-8663-0264cde17e4f", "comment": "Malware payload", "value": "d3de409cf4c78e31f88ea02d5f8d242fc779d47aa6460f3d8d808cd203a12f5345a32e8b40a7e418d7faf20ed36b262b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263282, "uuid": "fd451340-eba9-47bb-9349-446e08f45b41", "value": "T1C8232B1BA38354ECD20BD67446EB6B33F831BC2345319E7E26A4DA741F11F50676AA28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263282, "uuid": "0f3f6cf0-cb8a-4d77-b218-2e2a369784c5", "value": "40632c886934ad86aeee3d9e399fb73f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263282, "uuid": "b5cd74af-5e65-45af-8a97-80e7f5d64ce3", "value": "768:npYSjKnMt9HGn00xs+7MRx0vUNGqXFhuvg1bdPN9N9NwMiSYHjsPRhiqc:p3XrwtM88NnFcvgvN9N9Nwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263282, "uuid": "b501c869-0628-4438-9c38-6d4002a05a77", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263282, "uuid": "fde7137e-74e0-4ffe-991a-823ad074ba05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263282, "uuid": "d0db1c9a-21e8-4119-a799-5eadf6862ab8", "value": "cc28889edc5be39ad46fe6175198e042fe41d200fd0d67a892370886035e2c3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aded07a-6603-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229948, "uuid": "6b48a374-8bba-42f5-b3b1-bfece96957f7", "comment": "Malware payload (Mirai)", "value": "d7c64a790e7c128fcb452b5ef1ae72fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229948, "uuid": "4e87b155-9212-4c81-93a4-3d79c8111507", "comment": "Malware payload (Mirai)", "value": "cd9d1e2e029f8e144ad803d2e76105d8e52766a0c27d50b2df643148a0b84f29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229948, "uuid": "6e5887ee-aebf-44b9-b354-18a8c15040de", "comment": "Malware payload (Mirai)", "value": "fc9a88835ac032e5976a9ec2181436beaa39a1d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229948, "uuid": "62fe7e6c-5584-4fd5-824f-1dd7a6a13d68", "comment": "Malware payload (Mirai)", "value": "5f7a62972ac76f8e869f638cd96a73987fca6a66586e2d3389ec7076943b6fadef6b6ee66fb1d220095d61db465ee6ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229948, "uuid": "3ccfd81c-080b-4601-a7ff-44ae5c6f1ce3", "value": "T1821339C5A803E8F8EC1655742177F7379B72F036102DE997C7A9DA37B842A41E60A29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229948, "uuid": "217d520e-f28e-4e5d-8180-708bc486b4ab", "value": "768:x0fYZWJWFHN07Evfuc8dCWs5gc+1GNLPCH6TsBl49bBpBnBY9:x0fYZWJWFHN07EurNs5gcBNqTqbBPBY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229948, "uuid": "ce17b8d3-503b-47e7-a801-27a0f66852fa", "value": 43720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229948, "uuid": "4eac1e43-57f3-48d2-b8e5-943beacdf826", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229948, "uuid": "b024e6d4-7758-4363-acd0-49c656bc9a2b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f314122-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245417, "uuid": "d9f71442-2800-49dd-8add-ca189b54f386", "comment": "Malware payload (Mirai)", "value": "4e7ca892b9515dbfecf1af40b37042b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245417, "uuid": "3c132faa-4d0e-4b05-8a44-f9d0f85240e1", "comment": "Malware payload (Mirai)", "value": "ce039bf17f49a22242ab1a0b0a7200fc511db5b0848525c4f6730b8ffe508640", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245417, "uuid": "1bc6428f-bb20-4199-9e07-cf1f3253b752", "comment": "Malware payload (Mirai)", "value": "40c17c0c9eb31a2c242d72be02f35ad60b476fe8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245417, "uuid": "1c3adbde-059f-4ac8-8229-4f6a0a4d9f58", "comment": "Malware payload (Mirai)", "value": "53f07920b6a84da346bfec799d6646e4fd0262c0d47f575dbe76bea3ec975f9fb45db91002086ccce76952d1482088e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245417, "uuid": "5d491330-046b-42ff-8adb-8778051f0ec8", "value": "T184146C2BB3C39CE6C51063308C316362776FD7081958EAFFDA1B3794A99772256246CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245417, "uuid": "e33e9f89-7c11-4cc6-bbf8-48dc2544c29b", "value": "6144:zNROm5155gL6mTX7zRR1Lwt8Al7IKTtL:XgLnLzt0ll7Iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245417, "uuid": "53417574-9b2a-4fc9-91ce-6713eb45286d", "value": 197352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245417, "uuid": "e2c1ed07-4256-4923-a513-defb59f7ed49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245417, "uuid": "4429e0f3-ae85-4afb-b931-776c3dafc219", "value": "loongarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914fe619-6605-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230952, "uuid": "c96081a8-9b95-49af-ae88-d32ba7f1bdc9", "comment": "Malware payload (Mirai)", "value": "c30a4e169d33757cad282d6ff4daec6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230952, "uuid": "07cf8cb8-97c8-4a71-91da-f01b22c95753", "comment": "Malware payload (Mirai)", "value": "d03c40b283b3db7779b30e4a49e38dbba51ae49738743717098e191b936b1088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230952, "uuid": "3566a517-5f37-4406-bb54-b889cc00ba02", "comment": "Malware payload (Mirai)", "value": "a1988df7ec2ff67678c28dc42c89b0e75939cfc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230952, "uuid": "8dd6ecd0-9b6b-479d-bedf-a40fbcaa20bc", "comment": "Malware payload (Mirai)", "value": "8c6038a4902cd5235be240d42fd36d209153745a6c67f9e46eb5fe0bb780b82913e5518d235bde9cf5b0615bfb5054e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230952, "uuid": "594ac773-a28f-4318-bb4b-be66f8101faa", "value": "T197A68B51FDCB54FAE9430E305AABA22F23315C054F65EBD7EA407F29F87B6901936209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230952, "uuid": "14b519d9-88bd-4e2f-ad9e-a4a797ba56be", "value": "98304:1PVPd6aS7xoDpCDqvVEvk/H7GU7M0CpaEYBqN7iERT1X5L6QKLFlT1WRXwYVI34e:fd6akMpCAVH/iRZX5glT1YI4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230952, "uuid": "6f76d3c5-1579-47c9-84a2-088e002c6331", "value": 10239123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230952, "uuid": "eefda0ec-b0c4-4e20-a319-ded80068166d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230952, "uuid": "7a3229a5-a350-46ff-9c5e-26ca4ca73212", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6dc0fa-667c-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781282166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781282166, "uuid": "97d54109-9591-4fb9-89f8-227d8db2a6f1", "comment": "Malware payload (Amadey)", "value": "9c04ee265a82db4ce7a4cde4d89d0055", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781282166, "uuid": "9ed68342-c77a-4593-ab6b-72b042618f7f", "comment": "Malware payload (Amadey)", "value": "d13d3de76a86ab875c2acd0d28c866928c842b206d1f83eb3cc5886811fd24d2", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781282166, "uuid": "72bbc16f-acf2-46f8-bc46-2679778ee38a", "comment": "Malware payload (Amadey)", "value": "5c8c62e7bf1eee0de6d2d3e9d7caca535896ba92", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781282166, "uuid": "9a91120c-77f6-4710-9836-4bb20e7cf1a7", "comment": "Malware payload (Amadey)", "value": "e051ce266d80f44f1c883cc4684b0ef282267cfa057f14b9088525b2ca5ca2768bc11188f67a32b2619f4928d8b76dce", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781282166, "uuid": "975eaaf4-79c4-4454-bf95-91d4f5e3b5b7", "value": "T1BF034D2A67D726AEDC9286B1EBB7133BF5B8B44162245A0F1730C5183FF2C376610E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781282166, "uuid": "f01a2939-6f74-47ad-8b4f-63eda116d1d8", "value": "72d46649e1c061bb2f6f6d91d9b6f96a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781282166, "uuid": "cf712df7-0ef7-4c80-a9e0-a5fe74037a13", "value": "768:QxBpYx44vJVqtuj5QmsRJ/af9BBSUL1AEe94uCYSi5j9ZaB8+3:qom4vnqtJRJSZ9Lzem0jiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781282166, "uuid": "a7e58f9e-5542-47dd-a345-55fb257b8901", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781282166, "uuid": "268993f6-03ba-4056-abb4-a8bde16e3e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781282166, "uuid": "b6b34fb8-5c07-4265-8fe2-c6db67529f44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c89582-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301209, "uuid": "916e14ca-7b6b-4447-b26d-b9c468768ba2", "comment": "Malware payload", "value": "042db31ea5443d78aeee714556813a28", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301209, "uuid": "99e01dba-e557-4487-bb70-86d5f1cdacc7", "comment": "Malware payload", "value": "d15248555e7a2d9c279d219e6587a74fca9c25720194512a2e4b0757f7a63219", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301209, "uuid": "1adf3710-7bc1-47e2-8b63-d466e37d295e", "comment": "Malware payload", "value": "c8c80cde1ae90d6a594980e117977437de97ebb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301209, "uuid": "a05156de-0a87-4032-b85f-f7e54acb2414", "comment": "Malware payload", "value": "07d254df82312d14e01bbe02055893a98b5c99c5625e9296cbf01fb0e16c02d372c109ea3a3460cf76183fc621ab973c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301209, "uuid": "73bca436-33d1-451c-ba52-bdde5e309729", "value": "T1A66621300354D671C25C5FAEA6A97118144D5DCE98F9BB093A6F87B002B6932E3BF7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301209, "uuid": "e4d29bf4-0a42-479f-97a1-e60c3b3b418d", "value": "98304:WN0skRnKgp59g7QgAeTLF3JQ3NuZXCwkdwZb2D4M38rOEH2xf7qRQHyCzzE9CX:WNIPpDvWJ5/P68rOwRuHyC/ICX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301209, "uuid": "e5c602d1-1380-413e-933b-8b7171539099", "value": 6609631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301209, "uuid": "f05edd94-239c-4097-b557-f4b0170d0333", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301209, "uuid": "d8f02021-2bb8-4867-b022-0b14789707f4", "value": "Madina_-_PROJECT_SPECIFICATIONS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d713f14-6699-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781294404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294404, "uuid": "300cc83c-105d-40d7-a165-48314e126355", "comment": "Malware payload", "value": "44bcc648ed507ab7f67f9daff134d2be", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294404, "uuid": "9c93ea57-95a2-465f-935d-a52f4d32bfb0", "comment": "Malware payload", "value": "d15c1e8520faefb847da3b65dafcf238b7084850190ce45ef46684edf0c98dfe", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294404, "uuid": "4c3b8f35-0d35-4f7e-9474-d27071cdcbf8", "comment": "Malware payload", "value": "b2c8c966a4ef65b6ad59172de343da5fae6d358d", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781294404, "uuid": "d3eaa3bd-0799-41b1-965f-7933577b7bb8", "comment": "Malware payload", "value": "f3143943059a687c7275a4e6545471dde6f2f5cbb1ce76d608c1605f4af8e5d589872c89a00f8d6cafb1da7492d6dc88", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294404, "uuid": "e448a421-6e79-4b98-a7cb-eb088a7138e9", "value": "T13CA68CB3945324D8E1A889B4D11416527DBC3C8B5738A3C7BAC471F65BBABE48E39730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294404, "uuid": "628f6e46-a431-4606-bb73-67ca1de971f5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQt:cqYUQuVDt0TZEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781294404, "uuid": "d2e8ab30-9b0e-48d2-91c2-350246735b66", "value": 10289152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781294404, "uuid": "511159e1-3b68-415a-84fc-34c54965932d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781294404, "uuid": "cdb5d0cd-4d3d-4ba0-97db-6693f16412b9", "value": "d15c1e8520faefb847da3b65dafcf238b7084850190ce45ef46684edf0c98dfe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f23d57-6604-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230587, "uuid": "50f1c762-028f-4235-ab1a-733e07ce2912", "comment": "Malware payload (Mirai)", "value": "c1c4de09e658f656f6d15e90083e1fe5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230587, "uuid": "56cad431-6c12-4473-959f-2a17d8cbe298", "comment": "Malware payload (Mirai)", "value": "d3bd85a471b476c558e8855b3d9744c46d9556c8ae997d34a852ed65e80e1ea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230587, "uuid": "43cee9db-e35d-4cab-b189-fb73b66acbbd", "comment": "Malware payload (Mirai)", "value": "62bb63f815b73633e65a9d4f45dfe356a83f97d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230587, "uuid": "d3a77713-cf1f-4f2e-a76a-f640641eccab", "comment": "Malware payload (Mirai)", "value": "49f6e2b4f1665da855bbca01fb2988137ab847676e4fea7e6fd9a52958f045bc69605b955b253168b40ef592e8c5b800", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230587, "uuid": "1deb1bd3-8d46-4125-8341-7d414e86c208", "value": "T112231713B941C0FDC45EC274076EB57B892735BE023AB2A56BD0FB236986E711E1E944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230587, "uuid": "a40613d8-f508-43be-a4fc-5bd07658fb9b", "value": "768:lXsjz8N3UqfLc2pTNB+I3/9STlQ+/GskGSU41yLbKKsaB/XD6qrnMV+OZ++h7+i9:Rmz8FUqfLLpTb+I3/sG+/GsTpfKoBvJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230587, "uuid": "2d2f2482-d5b9-406c-a33f-0bdaba487ecf", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230587, "uuid": "d3fc837b-c06c-4694-a6fc-2f0343b27f86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230587, "uuid": "7cb1238e-8532-44f4-af81-f0a79789e8c9", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12edce7-6666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781272720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272720, "uuid": "977ef2f0-2335-4975-8110-55fd7f3fb564", "comment": "Malware payload", "value": "ac81101b84e471315065e995b89779f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272720, "uuid": "a92d7c6b-a07c-48a2-ad22-f979ba513e6e", "comment": "Malware payload", "value": "d3c71bf8f58b553bef3d9f18b9a9e6064b5706d6bb78c1e00f5e2bb9225595a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272720, "uuid": "cdda76f5-23de-46f5-a505-ca89cf338b8f", "comment": "Malware payload", "value": "730eb996a0061494b3d65a281b9f7be743a93717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272720, "uuid": "a365fea8-888b-4c19-b6ef-85b73f57d762", "comment": "Malware payload", "value": "c54a8b9d221e62847e5c27e41af21f1e391e6d1e2aa8d663c0ad7a05f8c0759f3fc8211736f98b1c579a3934f2669615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272720, "uuid": "26b76231-69a1-42dd-bcbe-55148336356f", "value": "T12AE3985E2E328FAEF668C73447B74D34976D63D622E1D684D2ACC1105F2039E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272720, "uuid": "b8ab90e7-fd50-4b1c-ab72-8d736bf8f06f", "value": "1536:qw2qc/hzcUBhtQZ0c2sNwiGFe79Okm/crTKEUwP6DDNKPslr6:t6hzf/c2sNDGa9O6kFDDNGsle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272720, "uuid": "b8c9001b-9eeb-4232-b34a-c7ee7cce7a10", "value": 157112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272720, "uuid": "e3e2cb1f-a386-4721-961a-5a0ec98de9df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272720, "uuid": "32bc1c74-c3f1-4aed-93d5-06f148c36aa5", "value": "CRY.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d13aec9-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301409, "uuid": "b60adaf0-b9a4-47da-84b7-9d35d4290911", "comment": "Malware payload", "value": "e3684fe2f3054dd8dea9361f5a015bd0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301409, "uuid": "427d7b79-b805-493f-b5d0-c4dbd7f7f58b", "comment": "Malware payload", "value": "d3f9c5b8ff087017be34c7bf55048a411553a096c5a5680894ebe628c4823115", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301409, "uuid": "171cbfbd-6a1d-4c37-adb1-0e1c779708fc", "comment": "Malware payload", "value": "dfdc1a3a7cedcc314c90e862b63279709dfe8234", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301409, "uuid": "130f5797-405d-4e10-8fcc-889a56f0c2da", "comment": "Malware payload", "value": "4ababe8761116632927a0cdbf1816638c372a3f7b9308d020f815cfc9ac486457990cbd6d1b02aa9f2e72866cb6ee3fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301409, "uuid": "d7395d98-468e-4664-9608-e4deac61c7e1", "value": "T1F9F4183DC865012ED1B3D61DC49A094FF8C65A1B623CE84760CB3B9BAF6354277923AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301409, "uuid": "50158936-b47b-4dc9-ad20-c26375d2ea40", "value": "3072:oAgj4UXCdofiti32rGVI1S0KiTx3t/ZL3TW1zZo/tTHyhTUoKTMKqrijhIcycM+C:oAnDPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301409, "uuid": "08311b66-a951-400b-a739-f5a01371aa5e", "value": 778108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301409, "uuid": "a76d1d75-a42f-45fb-b6ec-c2f7410d83d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301409, "uuid": "91e0616d-1006-49aa-8bda-dc8c0f254195", "value": "output_rw34wj07.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237c75a1-666f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781276294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276294, "uuid": "04832abc-6037-4a75-8e52-cdfd20438331", "comment": "Malware payload (Mirai)", "value": "c8713b1c9500b479ea315393b0cba515", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276294, "uuid": "b38fdf4e-db31-4f86-a985-f89293d863cd", "comment": "Malware payload (Mirai)", "value": "d77b7649bed830b5ebcb86f4952c317e99caff0ad80ea215ed1069bcd46671d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276294, "uuid": "284c35cd-97a9-4cdb-9f3e-70ea46b30328", "comment": "Malware payload (Mirai)", "value": "c271b19dc877fd7a252db633e62e5979bedf3bf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781276294, "uuid": "fe1340d8-f398-440a-bba7-49b61d57852f", "comment": "Malware payload (Mirai)", "value": "e1e8fa9d3b42fd93a067504f02812a6bb8f7a99a75ca780efc9d8212dcebbeabc7816fefe9744a93ce1c886724ce8c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276294, "uuid": "19e89991-53b5-4736-a299-c1e72cafa934", "value": "T1D1F3A61AAF650FBBDCBBDD3702E90A0139CC951722A43F793674D528F54A50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276294, "uuid": "36a45454-7a64-4f99-b6af-fe517729b84e", "value": "1536:whseEsC0nbVDzZgPPU1rRJVMn8ZTXtGWgZ6z9KMvsIAvxwhnRh7dmiVNT89v:w6eHxCudGWgGsJvxcRzN89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781276294, "uuid": "95cbdb9d-bf47-4bff-a508-0b819f91ed39", "value": 161208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781276294, "uuid": "e208e5f0-f96f-495c-9c4e-ba4eca184cd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781276294, "uuid": "82d95d99-fa6f-4b29-bdbb-5d1e447abd55", "value": "CRY.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91106301-669b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781295376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295376, "uuid": "1b0f034b-53a3-43df-b45e-052f56661f9d", "comment": "Malware payload (Mirai)", "value": "8cf95c7fe6bc49db1f8c83059bd71a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295376, "uuid": "8a41c76d-c2d2-46ae-afe7-94364c03524c", "comment": "Malware payload (Mirai)", "value": "d7cfa2477400b0ec2777794bed1d1b6510b48ac7ea85e371b850308e8751e36e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295376, "uuid": "c409b135-5d41-4814-b72f-60b603abe229", "comment": "Malware payload (Mirai)", "value": "a45783ea3a94d83cec8726c9e76f8212f9021469", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295376, "uuid": "35bef111-80f3-4454-9928-6196db98a8c7", "comment": "Malware payload (Mirai)", "value": "6a2aee41d958021f42467df2e7c092502166bb9c4eaed9bb0567b69b31adacf69a924612eeee96317aaae8a2dd5bd544", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295376, "uuid": "7e1a8a16-4ba9-4fd1-98e9-5002283e37e9", "value": "T18FC39ECBB28B5990C42107F41BC39F9E3F5321658D5FE8E76C1DA23B247A5DB090A792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295376, "uuid": "2f8d41d2-0f96-40ec-bb09-ae2e269403e9", "value": "1536:gpXSR9O7gY6qX02MMD7rVqPovJZ7lNUuwLmegfmQ0aZaQVWgpXy/LWj:gYHYVk/MD7JJRdlNUHgfmJfQVWgUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295376, "uuid": "36d668ad-9155-4fd4-870d-a4e6060dc72b", "value": 124080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295376, "uuid": "97cd4043-5ddd-4804-8146-22c3df723860", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295376, "uuid": "8099aad5-f209-4bba-9a11-e25f177843b7", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d20dcf-667f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781283199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283199, "uuid": "2add01c4-5236-4380-89f1-c4abd1bb7121", "comment": "Malware payload", "value": "3f0df9c04e8e318e276bb4fcfb16e38b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283199, "uuid": "d0606693-f521-48f3-b568-8cac62755c0f", "comment": "Malware payload", "value": "d7e4715e28a7aedea95e35ec98ffc9838f2b39804c71791c573dd2761540d536", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283199, "uuid": "ec0b9b0e-de26-45a4-805e-a26d456f67e7", "comment": "Malware payload", "value": "247e681524f5428889ff0941316bc8ece3679679", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283199, "uuid": "46d9faca-bd21-4e3f-8984-558db474653c", "comment": "Malware payload", "value": "95ee321950b0d81a5c0d7213e271a6f91b095febd1c4fbc1fce8a7f179a5335c7c9023018222b3b42251deac23a5c987", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283199, "uuid": "d2957eb1-5e7d-40ef-af0a-cfc2b2cf6a28", "value": "T14FD63907EDA945E8C5AEC53086769523BB717C495B2133D72B60BA353F32BD0AEB9310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283199, "uuid": "c61b0395-4336-437d-87a4-c0a11fda45b6", "value": "e35353effe7047db8af5e79efb1cfdeb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283199, "uuid": "b1545b0d-3d5f-4652-bc81-a2666204abb1", "value": "98304:zQSWACk8PjE4cleBDef2p0rLApEkzMq9XLUUs2RbD8iuz/D0kPU0b:z2NksDq2p+AqbyD8nbFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781283199, "uuid": "459304a6-200f-420f-91cb-c45d81205d5f", "value": 13655552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781283199, "uuid": "85c92fb7-aa8e-4455-a82d-eecb62a27027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283199, "uuid": "e5f43b00-8b69-4f3b-8515-7e25b91e4dd3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd53d2ee-669b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781295450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295450, "uuid": "875fcbb9-d0fa-426b-974f-1618db09d31c", "comment": "Malware payload", "value": "36258127c451c5f814305609e72e17c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295450, "uuid": "9e6184fd-c347-4198-bc48-90f72093f037", "comment": "Malware payload", "value": "d8354ef0ff5f1dc69439eb89a7595e7751813c3f5bfc271f16347f5bcd4831bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295450, "uuid": "b4af553e-b4fd-44b9-9d95-9013d93947c2", "comment": "Malware payload", "value": "c71f2c7abcd996fb25f5ff605356e307994aa66a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781295450, "uuid": "126dac87-ef20-4077-8fcf-c8537874bde5", "comment": "Malware payload", "value": "e7c24b9769a86cfaa74c378e11d73bb07cb4a6b6a5e2bf195dbe93fb1a759b7b0b82d5f2a7195af9ec8f2c5a7cb2f528", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295450, "uuid": "8aceb6bb-3c5f-4ba7-a301-cb176b2c4c92", "value": "T141F3F846B9819F16D5C152BAFF0E528A33131B7CE2DE72039D246B747B8B86F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295450, "uuid": "e3841dbc-85b4-468d-a073-de99f693b4cd", "value": "3072:cWjbwB8K+S02Q8Hm7AAA0KXwBgU7MDywAKaWJL2qXUc+MLN:cGi9n02hHaAAIXYgU7OywXa0LzUcxLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781295450, "uuid": "5fbfbb8d-4d92-49db-96fc-12c11379021e", "value": 170536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781295450, "uuid": "f0be90ae-11d4-4905-9e8e-981608ce2607", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781295450, "uuid": "94e04836-dc63-4132-910d-c394fa4f7d4b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538fb164-6682-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1781284535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781284535, "uuid": "147abe58-0bdd-47f5-8a67-3f122cccccc1", "comment": "Malware payload (WannaCry)", "value": "29a5139d7d7544cb510d63ad1aa7d1eb", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781284535, "uuid": "0b43fb2f-ef0f-4dbe-8b2a-c76750a88601", "comment": "Malware payload (WannaCry)", "value": "d8473014004390230839cf2dbe6b97940e63d3c73c1779cc1f7f9922695f2075", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781284535, "uuid": "423dc5d8-8ba6-4197-8b5c-448467227129", "comment": "Malware payload (WannaCry)", "value": "e610e6cfbf2a2f1b91ce1efc4229172d48837942", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781284535, "uuid": "22e1027d-d996-48a7-8686-ca80e713c26a", "comment": "Malware payload (WannaCry)", "value": "a5b416f3d2b754282329140657b9a149e7c77c652622d82e0a069cd38518ba5e1ccc7ec35ff85daa2c095efffbe6d3db", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781284535, "uuid": "a5e1792d-b280-402a-b4e3-91c5d76d798e", "value": "T10A367C01D1E51AA0DAF21FF6227B9B10537A6E45C95BA26E1621A00F1C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781284535, "uuid": "8fdcea1f-3616-4af3-afb0-f96ecdd5a789", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781284535, "uuid": "0b3e7c55-633d-496d-9fec-7e9204bfc48d", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAArR8yAH1plA:DXDqPoBhz1aRxcSUDk36SAGR8yAVp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781284535, "uuid": "bd027e2c-6390-4e7e-9678-99b0f55259d5", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781284535, "uuid": "b7be01d8-1f4f-492b-8aac-f49808037de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781284535, "uuid": "60e6dc6f-3ce2-46d7-9e15-c253023e30d0", "value": "d8473014004390230839cf2dbe6b97940e63d3c73c1779cc1f7f9922695f2075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd279506-663c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781254701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254701, "uuid": "3673fbc5-adf1-454f-b2bb-85d901c29c8e", "comment": "Malware payload (Mirai)", "value": "78bedd3b7a8d99f2480d24d13e08e266", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254701, "uuid": "c844ed07-3ade-4c62-bf1e-eb6674bc3d29", "comment": "Malware payload (Mirai)", "value": "d9b2e0d00540d1bc0ea17a07ab7dd2c3c5a9be0f90514261a966bbc936a6714f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254701, "uuid": "10488741-ecb4-499d-8c18-7b4b31ce1787", "comment": "Malware payload (Mirai)", "value": "b23c4800c6639f1770932525f00d7ab05208ce52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781254701, "uuid": "d65b80c5-aefe-4b94-a710-432ae9df593e", "comment": "Malware payload (Mirai)", "value": "1976cecd161b335cc2d6b3517ee820eb8699a40beed23b8d9b39d09bd83b1b737ca54dae81d815eae0ecd5c2f340542c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254701, "uuid": "8c26c5e9-f68f-43b4-b830-343428948cd6", "value": "T1B9C30845F8515B27C6C212B7FF8E438D7B2657D8E3EE320399256B20378B56B0E3A542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254701, "uuid": "de31825f-cadb-45c7-83ae-406ff79876b5", "value": "1536:3WL3QNk4Yhqc2VdLu4Vil6QTJGRf9f2dJXl4O6wywON+NB8Otidpm+Ob4vl+f:3W2ehqc74a5lGRR2sH/l+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781254701, "uuid": "a29b69e9-9e62-4383-9dd3-e8753019e66f", "value": 121408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781254701, "uuid": "634fcc7e-fd6f-4aa9-af00-32b1ede9370b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781254701, "uuid": "c21e1134-cf92-45ce-8a53-d68049b8fffd", "value": "CRY.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8e8a494-66a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1781301134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301134, "uuid": "5f419ea5-8609-4664-9a11-a0ec32e986af", "comment": "Malware payload (Formbook)", "value": "9eb8900aaa5c306f7080009e5c37e781", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301134, "uuid": "4583ab51-d781-4e4d-8c0d-dc273f4504db", "comment": "Malware payload (Formbook)", "value": "dcea95d8021d391a16c8e1fcebbd55ea8eb65f0f9dd76bac1eee7af1e2b4a4a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301134, "uuid": "e24ce7d5-d787-46fe-b733-fa13b64b2d4c", "comment": "Malware payload (Formbook)", "value": "2b2f4d9b7f58ec397faa33468bbf12fc42b8c070", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301134, "uuid": "a0607540-04f8-47b1-92bb-d6ceeb4b7ff6", "comment": "Malware payload (Formbook)", "value": "316dcb24acefc668e7f448c79adcab9fec1f33c89c5714bb48332c7fcf6605aa9e180e4edafa4ba4cb83192d4b88ba98", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301134, "uuid": "c41609a0-74b9-48c2-995b-f7d2d63f6573", "value": "T1B80533F91B73B221897867ABD8EDCC22E331DE5824E93E38597C003844577F98276867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301134, "uuid": "865069bf-6f81-48a4-be77-326e3cf5367e", "value": "24576:X4A26I860EDOqHqndvOx6OceGR8zZcJYt2CLmlC6A1:XRV56p6tdvI6kG2zyYYCKlU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301134, "uuid": "0338b147-996d-4b8e-90a0-972eda524203", "value": 822159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301134, "uuid": "dc32e31c-19cd-4fe3-af4d-3881def11114", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301134, "uuid": "a1e092d4-f521-4693-a507-e5dcdb430188", "value": "NewXQuote.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64c0054-6660-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781270098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781270098, "uuid": "3ec91ca4-cec9-4c2e-867f-36aee473b43d", "comment": "Malware payload", "value": "84cc41a209b9b5600d39f350fdc7e272", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781270098, "uuid": "3000c45d-d222-4d6a-ba8f-3a77fba56eb4", "comment": "Malware payload", "value": "dd5ed15c9f04a25f2675f65ae5447dde4dead123a907c52d4b4ed87084274081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781270098, "uuid": "54d6bc32-9a11-4359-ac7a-16624ffe8f41", "comment": "Malware payload", "value": "df379f9f4ddbcf944bde485a05cace7251297a14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781270098, "uuid": "ebdd0c11-5344-4c0f-a04c-549825aee1af", "comment": "Malware payload", "value": "dcdc587db1486da262e9deea312b92f799f2c38bc978dd97b75a9c4bd3ef2bec37f4a4cde7c838bcbb1e16a858186016", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781270098, "uuid": "7dac31c7-87c7-43de-ab26-4396d511f538", "value": "T1B407AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781270098, "uuid": "2a7b073c-91c8-43ed-b7e5-fe4cc537e4b6", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ3:cqYUQuVDt0TZEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781270098, "uuid": "39a56b08-e2bc-462e-bcc5-2551623dcac1", "value": 16941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781270098, "uuid": "b7c09056-74fe-4f88-a09b-21a87bd5bec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781270098, "uuid": "41bc7494-cad9-4675-96ef-197bde964f61", "value": "dd5ed15c9f04a25f2675f65ae5447dde4dead123a907c52d4b4ed87084274081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481f1412-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245432, "uuid": "991a0e1b-3c1b-4177-97c9-c7ab1de8c4ec", "comment": "Malware payload (Mirai)", "value": "04a0cf7114667773f70767508a157b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245432, "uuid": "c8406bff-6e19-4bcc-ab67-167b53c2a014", "comment": "Malware payload (Mirai)", "value": "de18f7b2b5146893c8fc45001920b5b1b7fd5796545f238b4233b23eda60fca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245432, "uuid": "f7a4f549-b6e3-43b8-af65-77056a6ae60c", "comment": "Malware payload (Mirai)", "value": "e22d3a1ef81dfd15db995af5083a9d1f6b357fd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245432, "uuid": "55cf0978-ff2d-4455-8bd1-0f64d370d6d4", "comment": "Malware payload (Mirai)", "value": "107a2aded38e0c5a6398d5e7529125e850ef1419ae1f65527c287a63709d9758a8dcf2d1afcd86cc529057c8dab94459", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245432, "uuid": "ab9f77c3-0b8d-4756-afd5-ed6f8f36ef39", "value": "T12BF33B56FB418A13C0D62779BAAF424533239B64D3DB33069928BFB43F8679E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245432, "uuid": "c8a12838-3634-4a48-b11c-9d9025fbb687", "value": "3072:WOSe6nN+6T9vJvfKca/kK6cU7hg6N7o9WTrI+vbkiM/9jyk4n:WOSe6nN+6T7Xta/kK6cUdgPCI+vb1M/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245432, "uuid": "881d8ae3-0d57-493e-bbb9-2fd5337717c5", "value": 160366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245432, "uuid": "f0831af0-f2e5-45e3-8824-63aab1a281a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245432, "uuid": "c557efed-35f4-4c22-bef0-267d0bb324ff", "value": "kkk.arm7k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f8bbcb-6639-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781253151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253151, "uuid": "55f45317-fd43-49c1-b5dd-be624a7c818d", "comment": "Malware payload (Mirai)", "value": "e10406615a560e83bb8358ce36110e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253151, "uuid": "aa615eea-6820-4658-bab4-82ec0338117b", "comment": "Malware payload (Mirai)", "value": "df3b97624be8f3181d3bd18ed0aadf7095ffaae40fc1e9e01f9f1a742bdb5eee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253151, "uuid": "c6befbbc-4940-4105-8551-c68a65bd18e5", "comment": "Malware payload (Mirai)", "value": "f76a42f523e8adf7ac47adea0f92d86e2a973ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781253151, "uuid": "33fc5b79-b6ce-4cef-88b5-c0a510f4b6be", "comment": "Malware payload (Mirai)", "value": "7343e899760101ae6e8bc909f82c778394a6ac6f14a372871f6998f5e4af031396d030d5d96b8ca398351cabfec73f96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253151, "uuid": "d74af12b-819d-49d4-8ac0-b0008b8d3b50", "value": "T1F7C34C17B4C0C0FEC4DAC1744FEEA526E973B0AD1234B11A27D86E762E5AE311F1EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253151, "uuid": "f02fff72-173e-4c8f-86fd-f1381a8093b6", "value": "3072:DUmcl/7/I1s082Sa1f11+MLgcmwzwBDDpEZ:eLIRdRmlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781253151, "uuid": "3ea734f4-326b-4e01-9644-c19abbc1a4fd", "value": 126520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781253151, "uuid": "afef8161-a41f-47e5-83eb-814c2526b4bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781253151, "uuid": "5a60acb0-6cb8-4f9b-9929-2f5161bb93ab", "value": "CRY.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05029d5d-666b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781274525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274525, "uuid": "3da5070a-9047-4fce-8a90-ac14676f24b8", "comment": "Malware payload", "value": "b368e04c219fa63c6b1b62742413043a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274525, "uuid": "e014d7d0-0492-432b-88b9-e57924e7888f", "comment": "Malware payload", "value": "e0af8120ae1851877279605aadf2ea8a54cf014581ad63118bc641eaf8ee5d88", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274525, "uuid": "c92ec551-e0bc-4a3e-bf6a-be90c99a2598", "comment": "Malware payload", "value": "f26b6231c386b6acf64e28be31a16e3e10ffadc6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781274525, "uuid": "16f76961-cd49-4aff-a143-1978c5fd8390", "comment": "Malware payload", "value": "f5f9224f8ba4760c29fc3ee312fc5962bd5538c1bc2c74bbfdad84382ecd61fb3bc393dddecc38be945a4f60ee918749", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274525, "uuid": "c524297c-09d9-485b-a164-a36bf95e9139", "value": "T172136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274525, "uuid": "46cc4280-88a3-4d47-b163-8019b7467e04", "value": "768:ar9NyXsZztCf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:kHusZhco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781274525, "uuid": "784e5e12-aee8-4598-a9ea-77429ed128df", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781274525, "uuid": "b11920ff-c469-4f2d-9252-111d213e8077", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781274525, "uuid": "1d698506-e9a2-4185-8b42-2019ca4a4e70", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d96e5a-668f-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1781290306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290306, "uuid": "f501fc38-c216-4bac-a73f-adc5bc3d8943", "comment": "Malware payload (Amadey)", "value": "29349fa22c5a69236b9429e7751d646d", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290306, "uuid": "62d36281-4137-43d6-9a0f-58077f607c42", "comment": "Malware payload (Amadey)", "value": "e0d01ef897fc50b5c3dc3a613d48a4c32c4cf6d973628773336d23c26181f3bd", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290306, "uuid": "2bee5797-104a-4899-8562-333930fa5e56", "comment": "Malware payload (Amadey)", "value": "f84fbbd984d09303fef818628a5a057e14338628", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781290306, "uuid": "c1681c22-c0fc-4fa9-aaa7-c492dc1f423b", "comment": "Malware payload (Amadey)", "value": "ca1aed5fa7bec96d33e2ada8d168c764de54addbf5ccfee25defcb50d9e532c8454b3e077c485735e06cd0a39ea6c1e2", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290306, "uuid": "f32966bd-2239-4591-8b6c-81fc72cd3409", "value": "T1A0046B10B1E2C4B2E673053114F89B75597DBD310B224EFB67D80B7E4F342D1AA35AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290306, "uuid": "7a07edbf-e1b9-44f8-8193-e7746ebc9de1", "value": "44fecc80f9b0222c9a3ac23b1cc2d9f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290306, "uuid": "dbd8a77e-c6aa-4647-a7a9-eeea6940d4ff", "value": "3072:TVDsj3PgRODbw/Z7jmlArERSek01tGrrP/lOAg0FuD0kkqMef5:TVjRys/Vfw8eV1tUMAOJkpeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781290306, "uuid": "4a3837a5-13b1-4965-a375-5f9a6db672c4", "value": 174592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781290306, "uuid": "28a70375-4249-41f5-b729-7698e77b0ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781290306, "uuid": "b6900b1e-9e15-4661-be68-7dd1614bc2c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9864c63a-6676-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1781279497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781279497, "uuid": "5ab4e2c7-cd1e-4252-89c6-f14dab84b74f", "comment": "Malware payload (ValleyRAT)", "value": "acea6691de464a36a70b6fdef57a1937", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781279497, "uuid": "fb40f555-59e5-4671-9e54-2e0e7047fcd7", "comment": "Malware payload (ValleyRAT)", "value": "e20b42091753d09fe648892e8af6a432764a75def9638413b05a3a26adc1d089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781279497, "uuid": "6762bd14-98a9-482c-81e6-1792fca10ca0", "comment": "Malware payload (ValleyRAT)", "value": "98a21f8762f7252c7d0f206c6049b50a3c1dd2d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781279497, "uuid": "686593a7-1d3c-4d7e-bd0c-ba1b42e954c6", "comment": "Malware payload (ValleyRAT)", "value": "713abf84f7feebfa2c9e971ef5282b68a07a7c5747a50fb333fe5b690b7d71b702f8f5416caeee2ce105b87e75c7ad3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781279497, "uuid": "a7eed90a-61b4-4807-bc08-c1c55fda8605", "value": "T1E2F7C74A7B00D989E4279234A0979F50F336ED719B71932323753F586EFA35DCEA2098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781279497, "uuid": "179ff223-b22f-43fe-b24c-fa319850dafc", "value": "a5396d0e3a0b90f35cda230c0314ce27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781279497, "uuid": "47c65329-9a1e-48c0-b627-16568784a141", "value": "98304:DPEqhFI6q65OY/Y8oDmkZOWBMaEj4cEX3fpuGtT4Z0UT6F86c910T12Wn:QqhTcKyhBMHjKXcU/+9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781279497, "uuid": "dd07ce4a-0085-4601-a499-a09247eaa096", "value": 73556992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781279497, "uuid": "fbc84e08-29e0-48fc-abac-7ad9f00ed999", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781279497, "uuid": "735e8bc0-5582-4a9f-9a09-6496e893f6f5", "value": "a_instapp83356008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "203f94fc-6660-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781269846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269846, "uuid": "e64e47e4-3ac0-4c64-a151-f0eaf61f2107", "comment": "Malware payload", "value": "695692321298bf047cb6bbb2a62be417", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269846, "uuid": "ed4a13e3-2b91-43fb-8756-4761c9b31298", "comment": "Malware payload", "value": "e2e594d05dcb2542d100985f6f7d48b227c078b27b83e2cc225e855d6b7c4676", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269846, "uuid": "5cac1fef-5738-4475-96c1-9ee0c7058f0e", "comment": "Malware payload", "value": "8216f8949d9e25e4542414ab708caefe432d007c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269846, "uuid": "97cad30e-5d64-45f6-b94c-deeb4225c2fb", "comment": "Malware payload", "value": "b17ef5210b8501fc181e2f684f3a10deb474b307019b7cbda8ac91e9a7d2a31ae8931d121402670f74e0c527e21903bf", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269846, "uuid": "c1cfb747-3705-489b-b916-42f97eca84e4", "value": "T12D8523257095447DE7F91A3BE83AD7614E2CFD74072088AA93987E0E9E344C06BF3766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269846, "uuid": "34376529-1822-4bb1-8a11-8f647d26fb2e", "value": "24576:hNdMebX0osS8KHGT4QHf1gZSuXSUFTI7/4r1wN8GbmmR6x92m4vauq0ORG0wnfrs:9Ms0oYMT7zUA97VhR6nmdS58x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781269846, "uuid": "497af312-b38d-4e0c-aed3-62e93b570458", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781269846, "uuid": "21e9e790-20fc-46f8-95a7-e354d38dd6e0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269846, "uuid": "27a6a588-70c8-49e1-ac0e-d7b6503b0325", "value": "php9EDabU.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2879d8d6-6666-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781272437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272437, "uuid": "dae16675-b67a-4b1e-9c5e-3686da759278", "comment": "Malware payload", "value": "e5f3900a22ebf200dca3a1671217a3b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272437, "uuid": "b02f7ca0-6eea-4515-bbbb-cd396366d36a", "comment": "Malware payload", "value": "e429f53e6d06cecc08b607ecad21ed098272f6e89c381db6b5005ace37455c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272437, "uuid": "a0bbaf76-7f08-414f-8dc7-ee04d29c05cd", "comment": "Malware payload", "value": "da96770e7317edba6f3ea3a1a2fca20aacbaded3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272437, "uuid": "c07f1edb-2f26-43b1-a73f-e9ff32f6a05f", "comment": "Malware payload", "value": "8c7417867fec3703ec36c5d8f89c2bc8b725185326a349addcc010b5eb76488748bc4c844708800ba03060aba5a36501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "RustRegion", "colour": "#D0C9FA", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272437, "uuid": "22ecb15e-2c0c-4c7a-b4c7-32bd554c5d70", "value": "T180868E43E29940ADC16EC1798726A732BAF57C8D0F21B2AE07DDE7203E35E646B1D714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272437, "uuid": "5f821769-2a42-459f-be33-2d8bd5b08ba7", "value": "097640058575a5edebfde2139293375a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272437, "uuid": "84ab87cc-bc00-4669-a97d-8132bf958f73", "value": "98304:vK+jv6QTFJO3lOehoV/PucUWEavPHY+i+IDgaC:7WVOehoV/1nHYNlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272437, "uuid": "57a18415-71cf-4c14-a5eb-bbf279630a6b", "value": 7991808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272437, "uuid": "69d03b2e-aa76-4cc0-9101-fe6377f33c87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272437, "uuid": "43583dcf-be63-4f1b-8f2b-897f86c76bc6", "value": "\u5173\u4e8e\u201c2026-\u5f3a\u57fa\u201d\u8981\u6c42\u5168\u5458\u7b7e\u7f72\u201c\u96f6\u5bb9\u5fcd\u201d\u5b89\u5168\u6574\u6539\u627f\u8bfa\u4e66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5848738-6666-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781272647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272647, "uuid": "92e397c1-ff07-4e32-ab4f-252465eeb728", "comment": "Malware payload (Mirai)", "value": "34b3bb00b0fd0b883a3473a318bb39b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272647, "uuid": "fdb2c058-1acd-4f21-94ce-fceb30809761", "comment": "Malware payload (Mirai)", "value": "e62822e77456614d85c60eb0d0eb80f100511dbb2969013f443a79dd60c04128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272647, "uuid": "1fed64c9-b427-432f-b734-9958e34cf2ff", "comment": "Malware payload (Mirai)", "value": "129609035af4088a2c7d83e8a9d6996dec0b4163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781272647, "uuid": "e9ea2ac6-89bb-43a3-a544-7fb530993232", "comment": "Malware payload (Mirai)", "value": "37d7fa580f40219f8221c42119f858e99aacbd1c16356816b4a90561b73ef058c199d6574bcb9d0070d13fd0ca229e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272647, "uuid": "e00c3c17-437c-4096-a044-31e86eb9f86c", "value": "T1F3D3C91A9F950EBBCCBFDD3702A9060139CCA55722A43B763674D538F54E90B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272647, "uuid": "76eab2dc-d50c-41fb-9988-87623747de9e", "value": "1536:bkaFnC0bm2xWmz6nNd2MdJccW/241zT0KP2oUPvJFKsZxwDUpR:pF7HxWocByX2o2FKsA4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781272647, "uuid": "404e2d75-ff03-4858-a46c-d7b785f639d0", "value": 140404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781272647, "uuid": "450e192a-df20-4836-97e8-0778b1857cc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781272647, "uuid": "ad36841f-fea3-4776-bffa-a5a0fc42cc72", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e119354-6641-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781256502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256502, "uuid": "94562974-59e3-4432-b27b-f10381cdbe55", "comment": "Malware payload", "value": "f81b61b83af8df90d72bdbb249948b4f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256502, "uuid": "06b687a3-bcc6-4a17-ad7f-9e468de4dc5f", "comment": "Malware payload", "value": "e68fa32bc597f446d92b7f9a3e103acc07bc3f57984ddb21e9535ffa49264d8c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256502, "uuid": "2bfbe88a-9946-4310-932d-8a6f86e8b89f", "comment": "Malware payload", "value": "cbaea5a2ce7341a39649e6da64e98648418119e7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256502, "uuid": "96d18c34-9f10-4bff-b6d4-7c9327f7b4d0", "comment": "Malware payload", "value": "1bda5dc82eddbdf70cb6cc8b70a52ffde8b461c800dc664544e18543abed3d9cbce8af4c5e110ab99f3292892cbe89c6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256502, "uuid": "a95186e8-f65a-4aee-9680-dafe08d2af38", "value": "T14CF06288FA22B952092CFD1DB67759DEA452C3CC4C0757EE2CC10C3AB058D4CB029A44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256502, "uuid": "2dd15c33-b9ba-4934-87a8-4ecd72c4437a", "value": "12:8VTNXGcm2Xh5PeX91eoXQiNIbMXv5P7XI:8VTFGcjh5PI9hQiNIbWv57I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781256502, "uuid": "463bfa2d-2ddc-463c-825c-358aafd3fc10", "value": 529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781256502, "uuid": "ea146014-2c69-46dc-bf8d-cd41d82302bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256502, "uuid": "6b512496-4bbb-4166-86af-8429edd0b04c", "value": "cn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ed5443-667a-11f1-a769-42010a9c0008", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1781280991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781280991, "uuid": "fd58858c-009e-46aa-9483-f459b3fb7f48", "comment": "Malware payload (Spambot.Kelihos)", "value": "df3f1cef58cd2e87df0bb3ed78fd2783", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781280991, "uuid": "f72668f6-fb4c-4cc9-b7b6-2a99165b290f", "comment": "Malware payload (Spambot.Kelihos)", "value": "e78c9ae5665e07ae98e33f202737f135f1930d8e1b0dff868ba2a1aa48a41f93", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781280991, "uuid": "ad85bd7f-3cc4-4bcc-9e30-785c4d3b62f7", "comment": "Malware payload (Spambot.Kelihos)", "value": "c5b8be4bb80e59c463e1894a84adf31f043b2e73", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781280991, "uuid": "18a1c9a0-387a-4118-90ac-90d0c657ff1d", "comment": "Malware payload (Spambot.Kelihos)", "value": "5607c0f2eac40bd6796d1610fa31da3e9f0eb50d12e7d5c6f106a2b06fb3835a8dd91b2a99465326b5fe818ee92e3175", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781280991, "uuid": "ba40e0cd-a1d6-4c14-9b08-0835499da164", "value": "T112B633CCBB5D32F4D4E94A3A8C34228C5238F9721AA08B2706EC5B3D7E56B755C2F552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781280991, "uuid": "509618a8-b94b-40c2-b349-736b7512dcbf", "value": "753375591aacf62c29fa5daa215a217d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781280991, "uuid": "7dcc8633-5b6c-46cc-bdc5-55d340eb35ba", "value": "196608:PjE3uvGNFR4x2KO/CoAf8wDCgSGq1eYDh7vkanq7i09DRo:lRi/C7fHCf/eSRv6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781280991, "uuid": "916d2c1d-de96-4e67-9010-7bb54beae331", "value": 10696704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781280991, "uuid": "d1a98076-deb1-46ca-be9f-fd1271bdf50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781280991, "uuid": "96306cc5-70c8-4729-8b0d-d3630fe6acda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a6e338-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301239, "uuid": "2f15ac37-bb9f-412b-83a3-428db42e70cf", "comment": "Malware payload", "value": "5ba9d1efcba4413cf39844ae5d4d6d88", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301239, "uuid": "abc26856-45f6-4d5e-bbfe-2c32d948bccf", "comment": "Malware payload", "value": "e8475cc9b309e3c118f77238a24247ae16aa5a9df27097ae8b43eaed71eaeb9d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301239, "uuid": "7e43fbb7-350b-4ce6-aabc-e739dbdedf13", "comment": "Malware payload", "value": "391ef3a42e7561cf14ea30ca2a84e49567967f30", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301239, "uuid": "49de0f35-b903-407f-b841-cb163dc4a53c", "comment": "Malware payload", "value": "0410d68bb6bd014ce8254360af04ae862d6fc9c6683d44e7c5c7098439d866213b4d480218552907e3ae188572634714", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301239, "uuid": "a2704e32-f0c7-42b6-8c04-f81b542c4d79", "value": "T10AF42352FC8157A7E893D9720CC1D2E28B147C829B8A851B7D02732EBB7377C5E8645E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301239, "uuid": "5b030da1-4cd4-4b95-b871-6281d704a543", "value": "12288:j4FRRUHEWAXXcouNh6cGY0HS2FlPGAH00oHLhnryi8KXeAdTORjjiE3RMyTM7x:LExXciJZ9Khrhui8KLtORCEBtTM7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301239, "uuid": "d24dba68-73b4-4d37-b576-9d7bc6d85d0d", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301239, "uuid": "40116b56-8e7a-4c4a-a5cf-6ed846c0fb2c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301239, "uuid": "5ce117dd-04bb-4a93-bdc1-89384e9a2690", "value": "0000154364X-XPaymentXAdviceXNoteXfromX10.6.2026.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eee95d9-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301251, "uuid": "c068b37b-7ef3-4a7d-aff1-aaa5a847eec7", "comment": "Malware payload", "value": "7b366343756ffd795367d8af619d53b0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301251, "uuid": "e7fcfa35-91f8-4222-b3e1-ba29342e6ca0", "comment": "Malware payload", "value": "e86561fa4b45d1187c684b8d021ead8e432efd84c5a15d59070d03c248509d23", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301251, "uuid": "ba9e1a20-bfed-48ce-9950-7b0cb62379cf", "comment": "Malware payload", "value": "4aee3f973601c3c410cafb212c86065b36cb324c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301251, "uuid": "1f09f570-0a1b-41e1-9691-51880e5669e9", "comment": "Malware payload", "value": "44c3e5de23de493db28f144c79c02512f9bbdc0344e25a2e68202efdfa79e9744a8c7f8c6868a17d71adaa36f3bba0e3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301251, "uuid": "c3c57537-612b-4e49-925f-14ccf433a87f", "value": "T169326C63925CF70F50D2FCB4598EB67B993C945C85235141EDAE4A9FA20FEBC12E2870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301251, "uuid": "17fa697c-c1b9-47a4-88e4-7a9f824f6be3", "value": "96:1y3jXA+ASO0h9rkMHWEXLFPLTBz2fTF5m9:U3j+Gk2tX2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301251, "uuid": "73bdef8a-f4cc-4f99-84d9-8555eb047a70", "value": 11642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301251, "uuid": "a84cd6e7-c306-4db9-b06f-3380eeaa0ec6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301251, "uuid": "0d268638-fdaf-41fd-9d4e-346cb83817c3", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de691fd7-6637-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781252556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252556, "uuid": "a7a13434-a29f-42e8-9cff-af22743f17f3", "comment": "Malware payload", "value": "5e1f1cf4aea5a39f4c19e0bb619faff6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252556, "uuid": "37ea541f-1261-4af8-95ec-e3b288c7fbb5", "comment": "Malware payload", "value": "e9c924c170332d42cae71bb9113ed9556cf91d5c50257b316eb433be9a211fb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252556, "uuid": "6d018fcb-d94d-4d27-b2d7-884b6797a16e", "comment": "Malware payload", "value": "0e3a08059aec848fd7a05d6bfa1fbe0e3dcd2f84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252556, "uuid": "b792c543-9d70-479f-9d94-ecb7fcf6de44", "comment": "Malware payload", "value": "8bc9606c77f3876d2afef5da4354599305821258b2976158b0139926f40de33ca66e5bc132d8ada11b2b132ec8b5d699", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252556, "uuid": "7f5dcdde-f691-4aa7-92c3-a6012a5f4e0b", "value": "T1CE22131FBF02966FC8351B38C8BA4732CDF0146C6C694AE3850D18D46EDE5D86BA96F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252556, "uuid": "d7419b2b-1cdc-4abf-b134-f09133f3ae95", "value": "96:RuBSmcR+8/yUblpMRq9Ppmvj0b0xLu27EZH/PXd3aA:RudA+8/BJSY9htwN77EZHEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252556, "uuid": "b251539f-205c-4ef2-a1a4-a65fe3044ac0", "value": 10072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252556, "uuid": "4e95f9bd-0b59-441e-a210-0ec3f1374c7b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252556, "uuid": "5bff6888-b1a3-42e2-b8f7-688f7a682391", "value": "exp_e9c924c1.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72255b32-6674-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781278574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781278574, "uuid": "bb001876-30f9-4352-a4b0-ffef30055490", "comment": "Malware payload (Mirai)", "value": "0569ae1e43911b034493a23963b1d587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781278574, "uuid": "126f08dd-96ca-4b08-b0be-ed925e253260", "comment": "Malware payload (Mirai)", "value": "e9ff395fae2a972f98bd9ade7ccb3e2c040b74f816a7a9dedf0b84763aa07e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781278574, "uuid": "8c6446ee-4223-4a99-bbde-d4cdc8fef703", "comment": "Malware payload (Mirai)", "value": "a5d7e8ac3448b946696511d01c9956f3ec3a210d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781278574, "uuid": "74fc666a-1e59-4cdb-b6b3-47e163ecb06f", "comment": "Malware payload (Mirai)", "value": "86b5e5de9b860aa0c5580881b0d935334d9e057c3c789e5714093e1e78f9e086738d00392ee8802c4c8ed2b2a4529692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781278574, "uuid": "f0471c48-1bc2-489a-ac41-3d04ebf15a18", "value": "T111A3E885FC514B17C6C661BBFF4E429D7B2A1768D3EE320399156F20379B96A0E3B102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781278574, "uuid": "d0fc6148-c5ac-4694-bf00-4778c19470e4", "value": "1536:MpLvBM1hANihTI4Vxme7w1BXL/+O/fKQ+QgnKlm6wyw477TzR3qjsJxUr:MRvq1hvW4Kec1Vx+lS7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781278574, "uuid": "d7cf3c47-6aac-4a66-b51d-bdc0e037c117", "value": 100812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781278574, "uuid": "8054af6e-c0b7-44ba-9660-9e52be7d8d33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781278574, "uuid": "b21815a2-de6b-4871-aed7-ccad948633a5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab6cc7c-6697-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781293513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293513, "uuid": "6840de3c-51cd-4948-bba7-9d98cbb52471", "comment": "Malware payload (Mirai)", "value": "f6c4fd8d9e2fe7b41520dfefdb9b5aa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293513, "uuid": "f8619f4c-cee3-4b96-8438-ccde23a19e5d", "comment": "Malware payload (Mirai)", "value": "eac670f129e2ab51f655eab66637da1d16001a55e86f4b05b6f5b11eb3fef170", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293513, "uuid": "b1abdb81-6ebf-4843-ad8c-f75568c2c7a5", "comment": "Malware payload (Mirai)", "value": "154ef375f843f05b5e4eb631f305c95c227f1b6a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781293513, "uuid": "d79140a6-d173-48be-ac8a-7f4852f7af79", "comment": "Malware payload (Mirai)", "value": "34196209b2f14ebd1e6f2233665f331cda180bac82290c5c24ed4113c49234390b6e95d47a2776e92d90a6017190f8cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293513, "uuid": "5c658b43-ae5b-41ba-9439-54df71583c2a", "value": "T10D257D637721DF69E315CA7004F3C6618AE620A21AE25096B27CC718BE50A1D6D5FFFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293513, "uuid": "1a76212e-2044-4760-af42-9215a03dd230", "value": "24576:Yxohina5b0+RyBhv1VTX65tQ4sDG3o2fb4+2iYbQ5W5TYYgEiV:8Iina5b0+RyBNT4suo2ki4Q5W5TYzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781293513, "uuid": "1be869ae-f4b0-4b60-8a81-f2500faef289", "value": 976652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781293513, "uuid": "14b55fec-8b3e-4c38-b7f8-fb92915fa015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781293513, "uuid": "3667054b-1e90-4528-b8d3-6ed27e93c7d0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df78b567-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286059, "uuid": "ed30a93b-5a14-4e12-91a4-6fdaeb23e75c", "comment": "Malware payload", "value": "c66cdb340e7910d3f2ea84ff8e5367b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286059, "uuid": "abf0260f-8599-4452-ab04-4f279a26e0bb", "comment": "Malware payload", "value": "ec0fd364d7bf6d0e65af1d962e4524a6a30a0d65f7d0acf26712a8b8c794a032", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286059, "uuid": "1f3039f1-d25a-4b5e-af5f-2a417dc8b0ca", "comment": "Malware payload", "value": "a3220e7eef291e09d27df6cca7a2899e7308109f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286059, "uuid": "2af07dae-2153-4b1f-9e98-9b0f1552f143", "comment": "Malware payload", "value": "b75690119869bf7a44faa5e7e55e743ab5d89e7f6df41042300535fd937247f6d949a0e022e34dab04b2b5fc548a89ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286059, "uuid": "d3bd06ad-2544-4ae6-8bb0-237ea49c924a", "value": "T14BD2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860A37477D9B4F37D80442751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286059, "uuid": "005f451c-594e-4b72-b1b9-aaa65bbddf33", "value": "768:TumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Tu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286059, "uuid": "a3c86ee9-b28a-42cb-b02b-17f1d667a39d", "value": 28662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286059, "uuid": "03bcfc31-6cc6-4ada-852f-59bbbf0a8c18", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286059, "uuid": "e73a398d-b2fe-4fe4-ab13-31fd55e76d52", "value": "194.9.6.40_1781286001912699_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299ff5fc-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781301215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301215, "uuid": "0e60a1ef-6a74-4ac1-a1fa-d84af76a1d1b", "comment": "Malware payload (PureLogsStealer)", "value": "2fe02003bda5ec631a91f8413b2c47c3", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301215, "uuid": "29cb381e-b7be-4182-8a92-a2884508eacc", "comment": "Malware payload (PureLogsStealer)", "value": "ec58efce6d4d8e30f4100c0b38defd36b7210b1282ad6a0a3e4d167a9751b9db", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301215, "uuid": "2d5c9123-3f94-46bd-82d7-904de22102db", "comment": "Malware payload (PureLogsStealer)", "value": "903eb6a92f31223c734803577ac05c1904dfb5a7", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301215, "uuid": "c0079ade-c405-4f08-bde3-268f2abaaa25", "comment": "Malware payload (PureLogsStealer)", "value": "3309efdacdc8c42e7230892da691a8fcc0ca7c43aceb5338be7efcf5e2d93b44fc2e15a5bc38a9aa12e333ec853acfff", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301215, "uuid": "e46ee245-3457-4cf4-8467-0bf4f85535c4", "value": "T10DC312577BC14C90EDBDC838B9C1F2BAA85FA44A844E5EE79856871CB66012F21783DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301215, "uuid": "b6de38ae-d98a-4de0-ae36-ffcad658b41c", "value": "1536:cYZIHDtAU7q12DCpP8cWi8kWfFUuhJ9qA9K8Jb3f01jUBXnJE8rj3oVt6PEu9Xaz:FZ+Ol81i8kWfXhv9KOyUhJEyD7kMbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301215, "uuid": "2f1c8e63-c693-4862-bd8f-5990b417d4a5", "value": 118726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301215, "uuid": "217db249-b32d-4a5a-93f8-2b255f54dee0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301215, "uuid": "4b3ddcb3-4982-4f50-ad46-43e0a036ae9c", "value": "ShippingXdocumentsXOrderXNo.X1010036193.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fad541c-6646-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1781258705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781258705, "uuid": "1e0f8fed-8442-4905-bdea-068f3fbbac5a", "comment": "Malware payload (NanoCore)", "value": "a6fcdcbf8b46d92b126a3548b1baa78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781258705, "uuid": "4fd1ebe0-0d3e-49eb-a7b3-b41ef25de3f3", "comment": "Malware payload (NanoCore)", "value": "ed5ae89423928afe713782205febe526b52cc7f54e314ee7e691ad575953f830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781258705, "uuid": "abc471c4-5322-4643-8dee-f1718e3a06e9", "comment": "Malware payload (NanoCore)", "value": "44e1670f12ce0e960904fd9eb952cede0a4a9a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781258705, "uuid": "e4501e4b-e286-490b-9017-cf49094b1ee2", "comment": "Malware payload (NanoCore)", "value": "c443cb55e78d597d8253fe48e04d36d3285e85eea05f11be4aa08dd172da88d417e70f97ef5447ef55035efa3663583f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781258705, "uuid": "2b00707e-ebbf-413e-8b76-25fcf5146ed0", "value": "T1F114CF5677A88A2FE2DE86B9711251128379C2E399C3F3DE58D464B78F227E107071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781258705, "uuid": "f966950e-951f-417c-85c2-6c2934856fb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781258705, "uuid": "66b43bb1-270b-457a-8c29-e13d6945da5b", "value": "6144:MLV6Bta6dtJmakIM5P0cFHkf8wa3PNMGdV:MLV6BtpmkIrH3wKlMGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781258705, "uuid": "5e78d218-60e4-47da-88ca-84cc6e95ade5", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781258705, "uuid": "95e1da72-c632-4f64-979e-2439d8c799dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781258705, "uuid": "519e4e14-6708-4bfb-badc-a0724c2ded33", "value": "yessa.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422c4523-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245422, "uuid": "44103045-5b98-43cc-9df8-755a17d01d68", "comment": "Malware payload (Mirai)", "value": "bfdf5e2474aaa92a240e434fdfb50a13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245422, "uuid": "a46073b5-28ab-4e9b-b3b8-3cda3a8a9181", "comment": "Malware payload (Mirai)", "value": "ed681172a2c3102df39c63a0a0f7f3736c62d73e2c16be223b765b1917e2d77d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245422, "uuid": "63290743-be74-4be4-b0ae-f6be453028e3", "comment": "Malware payload (Mirai)", "value": "5d753b2d27f52dee5c0abbb566445815109ff286", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245422, "uuid": "68884ca4-dcad-42d0-b47b-fbc8cedfe5a5", "comment": "Malware payload (Mirai)", "value": "3fadc35e92122c7fca9cf31e8355a0801c2adf02916aae3e38eda25c8a3158d32e82345b890f62165f24a3774a2e98e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245422, "uuid": "9abfad1d-49d5-47c6-a5f0-98d5bd2e37fd", "value": "T1BB6312FA963A7D4FCECCA7385C5012BAA089C2D1F3B3A550709AD58D572A22FD40C793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245422, "uuid": "8263e4a8-7a28-4ce4-89d8-94ad990b2580", "value": "1536:nVUQ0TcrWCT3gcHB+cyepg1k/zJhw7nWAvnQGUgJViXZjbRe9NL:Vp0T2WCbgc8bm/gCAv3JwpjbRe9NL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245422, "uuid": "af330bcd-d48c-4714-90b2-8ac7210bdeda", "value": 70428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245422, "uuid": "1b9f86f4-fe4e-4db3-8085-807c982bef6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245422, "uuid": "52e2d9bd-4555-473a-a1e2-376f7525ee1c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc56b99c-6637-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781252553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252553, "uuid": "e7e55c29-5254-49f8-bcbc-f3a2b8281c7b", "comment": "Malware payload", "value": "05a4e6262d4fa77bdcad7fa282091b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252553, "uuid": "4677f42e-f9fb-46cd-b1db-b98d3680f720", "comment": "Malware payload", "value": "ef9a91a7f3423d779353baebed34aa1f3b6104e7e4730c77fe8457b42a576ac5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252553, "uuid": "e36f716c-5b69-4615-8968-fe2d7c613913", "comment": "Malware payload", "value": "0711104963c4c95c1977b6a05dd9f571006ea298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252553, "uuid": "d327660c-fc35-4c99-b711-06d054cd979b", "comment": "Malware payload", "value": "1375eb05801e5bd6d570a5c6109224411f2e4c800f89c3b1cabbfef75f4d9d6d22a4a057f1a40529c8d923429e529d8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252553, "uuid": "60e51524-be23-42c7-9c09-1e105f1729c9", "value": "T1EAC1382FCF16877ECC766B30C8BB0472CEB16469A9550573910C58D429DB2E8AFDA2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252553, "uuid": "923297c9-b78d-4553-9341-51a72b302b73", "value": "48:RkbuH5AS+EnAcdVi3jQ8rsZcFebcE/kwtaVCFZOWmUWF+q5A61A+M/XNWSGTuo:RuBSmcR+8/yUblpMRq9Ppo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252553, "uuid": "3840c64c-83a2-495d-8aba-d77624652704", "value": 5728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252553, "uuid": "94d917f4-a065-4edb-ab55-f2de04dcc1dd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252553, "uuid": "51373ad5-f65a-4c26-b5ba-69152b5f8fc8", "value": "exp_ef9a91a7.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741934bd-668a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781288026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781288026, "uuid": "23bb793b-9c6c-4147-be8d-1bd6918708eb", "comment": "Malware payload", "value": "a6a12dcfe1356fcf16d7e2c8df0ede4c", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781288026, "uuid": "32bacf24-5542-40b9-8f3f-dec8b3ec55eb", "comment": "Malware payload", "value": "f0869eca792d24c421ced7f32aaac21ee3f3151c6616fd3caf4d0bb2d3b998c6", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781288026, "uuid": "d4cee66e-5e72-4baa-8f52-765c3bce5adc", "comment": "Malware payload", "value": "e9c99221f52bce9dcd30f3b7734e0fee5797989c", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781288026, "uuid": "1cb3e15f-ddc4-4a1a-91ac-f90a8d34f723", "comment": "Malware payload", "value": "91c020b2f8f0724a197adb98ee083841c649019a8d91ef1eec36921a2e43a27b4f05db547b35d62338ef8172433a6397", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781288026, "uuid": "f3afd355-5c45-462a-8142-877436925c4e", "value": "T1B886F107FCA508F6C0AEA272896261967B31BC451F3167DB2E50B7782FB2BD0AD75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781288026, "uuid": "132ff23d-eaeb-468e-8acb-6e234d66e8c1", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781288026, "uuid": "2aecb959-b940-4baa-8d7a-42d326a7c601", "value": "98304:Q2wHQSd0N081rp6hu0Y2YBaEjcs4Qkuk/4+Oasdj4T7wW+e9guB0sQM+f8z6Ufev:QDHqN0rBYXkQkukU6Tl+/A0sQnf06F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781288026, "uuid": "d727db80-8ab5-49c5-9e4d-094ef562b9ee", "value": 8602920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781288026, "uuid": "65f7fa4c-73c5-4c2f-a80d-f099936e6bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781288026, "uuid": "2867da6d-679b-4efb-ad02-bbb2fb616cbc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e981f91-6669-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781273790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273790, "uuid": "2ef5b296-6e55-4925-9c99-59bc64ca06ae", "comment": "Malware payload (Mirai)", "value": "6981f3a1eca3cbe39b2fbe880f725e4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273790, "uuid": "d907f18a-7a50-4ebd-8940-a863cb6dd55b", "comment": "Malware payload (Mirai)", "value": "f173c120ddaf68276acf21fec4770dc80faaf45b8c4065960c0b6c934bf2982b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273790, "uuid": "ebbc220d-ad64-4234-84c2-3946ea8bc74e", "comment": "Malware payload (Mirai)", "value": "1ec62c5e2f080118a73e10cf35b3ae5eeeaa466d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781273790, "uuid": "566ea826-60f4-4f71-90f9-67e3b2c8256b", "comment": "Malware payload (Mirai)", "value": "04be1d26c4721314b794419e941b144dd1d0c547220e0003c8fcc5879331cffcdf9da22070eca41294f3edcaa98fd8a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273790, "uuid": "a36ae3c5-63e8-4f84-911c-9a431e03534a", "value": "T1F7C33B27A4C0D0FEC8D9C1B48FEAA52AD933B46D1138B51B77C87A275E49E305F1EA14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273790, "uuid": "c4570cb4-9f9d-42ff-bf75-cc9967ce56d4", "value": "3072:BW06x/Xv+jOW6HVXuiG0i0Cp79kClWJP:Yp/9gvpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781273790, "uuid": "c8d89bd4-1b03-452c-86b9-fec6ab04fb70", "value": 125240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781273790, "uuid": "272818ba-f25b-48fb-89bc-fcc272cdc051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781273790, "uuid": "00a1cc80-2747-4e9b-816c-0675b86c29e2", "value": "CRY.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e37bdac-6680-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781283721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283721, "uuid": "5eb8d2a4-9543-4955-9d0d-41521e57a1ff", "comment": "Malware payload", "value": "f628bd4d17a086cd4ec9c37d977fad76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283721, "uuid": "1ac61bba-2092-47ba-b2a8-3d662f8e4cfe", "comment": "Malware payload", "value": "f1743c85c03a153930f20798ad002acc377e1c32224a6633e45af272e08c9ea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283721, "uuid": "cf6f6b48-fa57-4b73-ae51-521d59116961", "comment": "Malware payload", "value": "14a5aae8f6909d2bf2a3ec83857d493ca84c5266", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781283721, "uuid": "41a67ea2-7c4f-46c8-9c3d-917cf9b07e02", "comment": "Malware payload", "value": "90cc76e9e87431bf4bf8caaa5c1def3b139ab81b2f1a72b3c8dd6293ab59814c43ec2ffcbab2f6bed758b5a8d1e08661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283721, "uuid": "eb26460a-172c-47ec-90a3-f5705100887a", "value": "T1F235F757E89590F4C1FFD134C626A213B9A13489073867E36FA187F11B26FE866BD318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283721, "uuid": "32483e0f-e4bb-4883-9207-fedac710d78d", "value": "24576:ci3nHRD3wC7g9rb/TBvO90dL3BmAFd4A64nsfJ7FOQzjFyaW+:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781283721, "uuid": "8665abb5-3715-419a-9963-732f103b15d0", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781283721, "uuid": "88279d71-d6cb-46a7-ba85-44201bca7ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781283721, "uuid": "e5cdd867-307c-47b4-949e-42d4af835485", "value": "f1743c85c03a153930f20798ad002acc377e1c32224a6633e45af272e08c9ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf0b134-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245413, "uuid": "c27a4769-b15b-41d8-a0f5-6f22555b9a15", "comment": "Malware payload (Mirai)", "value": "aa1d2a5a4567f7403886f7bd4c4c96ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245413, "uuid": "f699c092-6a8a-4593-99cc-f5cbd7afbf6b", "comment": "Malware payload (Mirai)", "value": "f20e9cb64c911d936cb23ad97403590d8b76fe9dc4decd58f8807a7dfca03eca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245413, "uuid": "a2dba0e6-9b54-4832-bd6e-5dd98271d6ea", "comment": "Malware payload (Mirai)", "value": "b1aef20540f03755381fa1b92a5803d45411d94d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245413, "uuid": "8cbd26e3-d422-4a92-853a-363cce570238", "comment": "Malware payload (Mirai)", "value": "95487c8efbcff976ca35caf47cf6ad10054dfaf29340547c60ad6733f4535e573554d2fdbdc45427498d4190eae3a780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245413, "uuid": "5cbf6ba3-0f7e-497d-a87e-3641188aa8d7", "value": "T120832A56B8819F11C5C512BAFE2E118E331717BCE3DE72129D24AF20778B96B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245413, "uuid": "afa29079-6a08-42a7-b0a8-9f1c9f7b64fd", "value": "1536:Z+nxKZeiJ46YsK2Wijisqc8olptzFwpYfaiSf7zQlM3iIEFux5GYE7wp:a2eU46YsKnijvfIpYfaisEFuxQep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245413, "uuid": "3143f5fe-e95c-4e0c-af2f-0b98630c7c1d", "value": 87984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245413, "uuid": "946825e9-3c8b-42df-879e-e331ae953867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245413, "uuid": "ec3bdd28-f094-4b41-b6e5-bac15ec7ac7b", "value": "kkk.arm6k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b1bd77-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301343, "uuid": "263906fd-65a9-4daf-911b-cc9311ab5143", "comment": "Malware payload", "value": "b579f26caa603c2270ad5c0823567dc0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301343, "uuid": "71a500bc-1eec-4567-81cc-43b3505a5519", "comment": "Malware payload", "value": "f28b648214c7c333768c792ccd6ee741cf7bade528aa6367acd645e1ce195e11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301343, "uuid": "4d12fdf5-5d04-4e60-bda1-76f264269376", "comment": "Malware payload", "value": "824f646e62bfbb41013285e6e013ccfc58c76720", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301343, "uuid": "34a55682-c5d1-4a66-84c5-7ecd5e740e98", "comment": "Malware payload", "value": "b1702506dc389f6b24ef93defc3701bcfd474a07605f801fcf283b2891f6cd98a6ac8da2fe90067d9a2978fb430d88dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301343, "uuid": "2d18e13a-9b03-4bbd-832f-5053f32aed2d", "value": "T1B805D53DCE14412FE872C519C899855FF882659B222CED4794CB2F5FAE7288277C325E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301343, "uuid": "cff852dd-5d32-489d-9ad7-f1051eebfb17", "value": "3072:OpyriYBZ9c7/YSNx/PiCxspM8i+iPyCM1tRxnr2CoYLYW9Iw/RbEQA55amMnPhdF:UXy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301343, "uuid": "b22e7168-e9bd-4939-bb93-b2efc5351d23", "value": 798044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301343, "uuid": "f99c1bb9-6c8b-4a79-9eb4-72fc1f2ded62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301343, "uuid": "b5c03403-28a8-476f-b9ff-e556f9838025", "value": "REQ_For_Payment_Invoice__FER48012000266666230-7134009_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f88b63-6601-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781229329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229329, "uuid": "f28c1c5d-2c80-453f-a627-08dc9af61f8c", "comment": "Malware payload (Mirai)", "value": "50c610fdd08acb837f6c15dac2ba844c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229329, "uuid": "986d12a3-0371-4cd5-a598-b1e59bd95fd9", "comment": "Malware payload (Mirai)", "value": "f2ffd8c6bd84f2af333fde081c598a9770676fd36b7cdd644d077724d9a5ac1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229329, "uuid": "d68e8b7e-fc40-49cf-b2a2-bc549f970526", "comment": "Malware payload (Mirai)", "value": "eda64e5dfa3d1a2b05d865965070457b93df8bd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781229329, "uuid": "8b43ec65-749d-4572-8969-5fc0d85fac6e", "comment": "Malware payload (Mirai)", "value": "31f18e969f327bc61acd40aad90d3a23ada5450169f2ded16ac03251bb9c8715828577aa780006b64ffb98bbafd286e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229329, "uuid": "739fb04f-9ff5-410e-8cb9-9041721e75f1", "value": "T14763A50AFF654EBBDC6FDD3706A80B4535CC541A12A83B3A3574C82CB65E54B46E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229329, "uuid": "27a80425-b52f-469d-8697-71b01ee62c29", "value": "1536:4LHIet8Pbd7i9vBOibVd0Z0oo3v7AIxvb4:4LHIeX9vIin0/svb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781229329, "uuid": "a41ec33c-d78a-49cf-af8d-db1a03b4299e", "value": 72516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781229329, "uuid": "95cd7049-8641-417e-b9ea-e6fff9937cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781229329, "uuid": "fd2cfa76-9cfe-4d13-9736-5d9dbabd54cd", "value": "godisdead.3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08de148-6637-11f1-a769-42010a9c0008", "comment": "Malware payload (Kinsing)", "timestamp": 1781252560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252560, "uuid": "846c31d9-d0cf-47e4-99a8-7be7b26fd5ea", "comment": "Malware payload (Kinsing)", "value": "302554ff37bd27951d202b48cbee2f02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252560, "uuid": "2b2d8070-5ec8-4754-9b61-9c3f22554248", "comment": "Malware payload (Kinsing)", "value": "f32b209d33c4194f37dbbf2a677c4faf78cf6b24cf2474bf1c14aed17af40b2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252560, "uuid": "d2acf6a6-d5ab-47b0-9df2-12a324dd33d0", "comment": "Malware payload (Kinsing)", "value": "9806a9ee0d8c973845477a669194f4116a255285", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252560, "uuid": "10a34602-0342-4863-9d29-9c1a07557e16", "comment": "Malware payload (Kinsing)", "value": "b5b34349c1a91f8c4e123f9a4e4324a37d00ff4dd9ff35480ff49256ac92ee4e09aa3dc00058a65c8bc515f4ae642dd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "Muhstik", "colour": "#274C00", "exportable": true, "hide_tag": false }, { "name": "rce", "colour": "#8F4647", "exportable": true, "hide_tag": false }, { "name": "redis", "colour": "#5488BF", "exportable": true, "hide_tag": false }, { "name": "redis-module", "colour": "#8D2B67", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "so", "colour": "#94E363", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252560, "uuid": "c6bf5ab3-7769-4b92-a0a8-83279513506c", "value": "T17292141F7B02519BD8695B3CC9BA8523CDF0186C6CA85AD3851E48E42FAD8C4377CAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252560, "uuid": "f14e3216-7bc9-48d8-9a6a-a0b714006c6f", "value": "192:RudA+8/BJSY9htwN77EZHE9O1LH23cmyMS4pq07Ke1qhN9zp:+58vB93e4hwON23byMR77KAqJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252560, "uuid": "e7f999a1-b98a-41b3-8213-beeda7d5a4c8", "value": 20208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252560, "uuid": "6acb6104-7830-4a38-b73b-859e552d415b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252560, "uuid": "81d56e03-6211-41f5-aaef-3dabebebeef7", "value": "exp_f32b209d.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319a36f0-665e-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781269017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269017, "uuid": "f967827c-9562-4f8a-9b54-443d425cbbdc", "comment": "Malware payload (Vidar)", "value": "497fe235b25d5715d31a39aabc540aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269017, "uuid": "3efc8200-2ef5-4049-abfb-67f5b07d88a5", "comment": "Malware payload (Vidar)", "value": "f332b8851b0137ab7fc02a7c64a8b82e62e37b61fc5abf588f25c9797b7ab005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269017, "uuid": "14277b1d-54d4-4b77-a8b0-4a03312fcf1b", "comment": "Malware payload (Vidar)", "value": "a7bdc8fcefd8f4b19300673bf4a041b5596c6190", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269017, "uuid": "569e146e-1dd3-4758-83e7-fb68e13f799d", "comment": "Malware payload (Vidar)", "value": "fe4a610acc4d2b29564f1fcbab2b1bb037e70c7bc22d86c87310aa5bf64874a419a70c3228adb0889a31592a03b66b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269017, "uuid": "4f1f6eb7-7026-46a0-83d0-7d838f27b979", "value": "T118F56B0AFCD209EAC1A962B289B75252B775BC081F3227D72E5073782F76BD05D35B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269017, "uuid": "ce2d7079-9084-4ff1-a254-343fdd4b9e63", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269017, "uuid": "c5259a08-e593-416d-9a67-a5eac509d32b", "value": "49152:qPnugDG8nlwyQmtnonE1NitV7F7ffEMxrOfL8JSX:q72LmtnonE1NMZF7nEMxrOfLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781269017, "uuid": "55842c7d-6292-4a02-8690-961d2c4a980d", "value": 3370856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781269017, "uuid": "7a8d1f21-822f-416b-a133-e2ac9f03a094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269017, "uuid": "2538bb59-3417-4e0b-a30e-4f2ceabb8933", "value": "0k42jece.15x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94bf00a-665d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781268815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781268815, "uuid": "a08f5e17-8116-4784-a048-77a5940d430c", "comment": "Malware payload", "value": "b267acd1b7c15b18178ae9fd4974f3f4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781268815, "uuid": "24df8bbf-488a-4050-88d4-8798a22fb5bc", "comment": "Malware payload", "value": "f53fd0626404a129dcddb8ee7589387dd7bda7999814e0df46c670af6b3da5f5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781268815, "uuid": "24db943c-4d90-41a8-98a7-45d46be6ce5d", "comment": "Malware payload", "value": "8aeba3c711eaa0116807c66390284dfa572d2cc7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781268815, "uuid": "4585fa93-e4cb-4591-8ada-db51436a9a68", "comment": "Malware payload", "value": "55c171ad5d7e0db5eb512b162a32de5048651053c004dd1cdaf3b5211cd48a7e473b7a8468e7989a14af69aab00243bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781268815, "uuid": "a2ff9e34-1f48-460e-bf54-4d9b1c52d2a3", "value": "T11FE533B4E680AC47CFC4BDD6B30D3D68EE2F9E4A21CB94594121F52204C6ADD929DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781268815, "uuid": "8e908441-e6a9-4f39-bbf5-4df3d12ea03a", "value": "98304:kJgyONYo5CjaEKz/wJ+IN+LbgkNLJWra/h:kJj2VDwJ+5LbhNLJCUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781268815, "uuid": "cd41630e-5044-41e5-b626-e678e71f2d85", "value": 3300714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781268815, "uuid": "1e298c16-66ca-4abe-803a-40de753576c7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781268815, "uuid": "c35694d3-ddf6-4c5e-b00e-08bebdc324a1", "value": "MOU USI-INDSR, TAIWAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e8cb98-6650-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781263273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263273, "uuid": "f5b1edfb-fa4e-4202-9608-88c0e73fbef3", "comment": "Malware payload (ConnectWise)", "value": "3baf79e40b192798176e8320fbda62e8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263273, "uuid": "47222258-da63-4c11-b6ef-819b95fc67bc", "comment": "Malware payload (ConnectWise)", "value": "f585e4b8388096ea2d397126a774976b3a61d18470d88a64e5f5fdf8857513a6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263273, "uuid": "a68b8a75-2bc1-46d0-a3d4-821b1dc8b53d", "comment": "Malware payload (ConnectWise)", "value": "3f3d3f5925cb6c95b686d878c04e3767e3bc49ff", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781263273, "uuid": "9fdfb64b-0357-4144-b93b-1b10da611dc5", "comment": "Malware payload (ConnectWise)", "value": "921f5043e34e8839d4e2b7ac3daf8f98f1f1fa2331198e2a5a0f63f23b39d925a2c95d964a9e6db5079d7563938ac229", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "frreliny-com", "colour": "#464A10", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263273, "uuid": "5b2e3c9c-d0f0-47a7-a73b-aa42d26beb84", "value": "T1D6F72330B64ACD36CD9601B08D3DEBAE602DBA75076590C7B2D83E2D19B15D32736E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263273, "uuid": "7f4e7f38-aab7-412c-a25f-db74ae49d7b6", "value": "4c2a7f6992efe6b526115bc1b752d764", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263273, "uuid": "8f9d9882-1a06-49d4-9a4b-6b08c63f661b", "value": "1572864:CDuwreEnjK1Z8shpCNc4xkHt4vrGm9X13588cns06b1O4v:CywreKW1Z8s9FSvr1P358Q06b1Ok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781263273, "uuid": "1b40081c-a4b2-4ff4-a54f-3abbdff5ae45", "value": 76203704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781263273, "uuid": "1889ef6c-d603-4f8d-95d5-52e212cc9543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781263273, "uuid": "e01eb76b-3dac-46ec-b15c-dfa9caf5b480", "value": "f585e4b8388096ea2d397126a774976b3a61d18470d88a64e5f5fdf8857513a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5313e83-6670-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781277049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277049, "uuid": "b251bc02-46f1-4904-a1c8-254ccdbec5c7", "comment": "Malware payload (Vidar)", "value": "cded7ebdeebcd37cce814de6bace2614", "object_relation": "md5", "Tag": [ { "name": "eclipse-cheats-net", "colour": "#D2E65E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277049, "uuid": "7efe6bd6-27af-4655-b42b-883b2b348fdb", "comment": "Malware payload (Vidar)", "value": "f74990b4d3b673261affd00db879524ffd98c60d4df9e380e70f90ffd92b859e", "object_relation": "sha256", "Tag": [ { "name": "eclipse-cheats-net", "colour": "#D2E65E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277049, "uuid": "61f8c895-990e-4afa-a311-98e89c894cb4", "comment": "Malware payload (Vidar)", "value": "b47948f9cff0237c3e48480cbfba6d952529e550", "object_relation": "sha1", "Tag": [ { "name": "eclipse-cheats-net", "colour": "#D2E65E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781277049, "uuid": "b46f406b-df11-4649-aba4-b8712b60e537", "comment": "Malware payload (Vidar)", "value": "891e76accb99509db9c0068238f1c596029330d7add3de6e73387be8b268e264692d2f79fcb1cdf3755faebde8497cf4", "object_relation": "sha3-384", "Tag": [ { "name": "eclipse-cheats-net", "colour": "#D2E65E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277049, "uuid": "34eddb57-506a-40c6-b717-8ef45aaa409e", "value": "T188E57C42BCD006EDD09DB33189F6A592BB75BC090B3533D32F926A642E32BE46D76711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277049, "uuid": "4b584092-c574-428a-99bc-064cf514c225", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277049, "uuid": "fd205c60-f294-422c-9c48-7bdfb2e2d0c1", "value": "49152:92ln/ZyvUuBVH/jta3cnOAHGsoqV1a2gnaeoO5unK:9JXbQAHD1agK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781277049, "uuid": "5cb0a451-a28b-42bb-a57d-93cda72c86ef", "value": 3290528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781277049, "uuid": "9416f168-8a23-4112-9ce5-25cc4d47db28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781277049, "uuid": "3b9b1558-7d8b-4773-a004-5f6bb224dd47", "value": "EclipseV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e2e8eb-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245427, "uuid": "9f4bb404-1929-430b-ba55-05b96481705d", "comment": "Malware payload (Mirai)", "value": "b994903b4a706ea5d1ae205294d1c7e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245427, "uuid": "4b18e870-9ea1-40a6-bce5-31ef1480f067", "comment": "Malware payload (Mirai)", "value": "f8ad8802e481435eb7838560b323ad438165b2c4428638e75f3888458dacefb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245427, "uuid": "326505e6-a4ea-43c7-95a7-27580b1d1fe4", "comment": "Malware payload (Mirai)", "value": "e2523f25b28464a0f7e642f4cffaa4f7c9844740", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245427, "uuid": "393d0e72-908f-4326-8d48-b8e5871b0a45", "comment": "Malware payload (Mirai)", "value": "280d2f226525308b0dd187054fa58b96bf5e9923df3fb231c1796da9651529a0924990dbe0cc7d93b2b2a81f050a2d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245427, "uuid": "d38b917a-c3b4-411b-acb8-e56597ea895a", "value": "T1B3736C91BC915A13C5C1127BFA2F428D372A17A8E2DF3217DE256F21378792B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245427, "uuid": "7e2e1181-fb79-4101-9568-63ab1ae1350e", "value": "1536:SKxihZFJjEZ+4Tuhhp8HtZ+HcHDvOxg2MpCK27vszOP:SKKlBv8HtZ+HILgXwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245427, "uuid": "f3b63ae8-91a5-4fec-84a4-e9958f2609fc", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245427, "uuid": "ff6ff892-ae0a-4966-8f50-c5c658652611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245427, "uuid": "b8a3831d-84a8-4baa-8388-a8b7ccfa616d", "value": "kkk.arm4k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b66a08-6657-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1781266290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266290, "uuid": "974fbf76-1dd9-4936-bc7c-ff7e97103537", "comment": "Malware payload (ConnectWise)", "value": "dccb584b7dd95f1cce70f65d3764f88a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266290, "uuid": "1a68c9d5-9c18-4c4b-9002-2e3bda29e2ac", "comment": "Malware payload (ConnectWise)", "value": "f9501813f25940668b8b48e08d75f73d183d36de9bc000404796c85b156ab35f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266290, "uuid": "5bdae9b1-5a11-4e14-b2f0-9a2313e32152", "comment": "Malware payload (ConnectWise)", "value": "f6e85c277fad645d6741327a450f5e7b670f5836", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781266290, "uuid": "3154f4a9-f855-46fa-adb4-90bf6f8146dd", "comment": "Malware payload (ConnectWise)", "value": "85aab252dfd88e6fc26b59e87661911f76bcaba0addb68f5541d3641059bb9cd9b040690a5c8d69b36f0a7f91ac9ceab", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266290, "uuid": "4731bb4d-861c-49c6-b16d-ae72be9748de", "value": "T1A0A6233123E5C46AE4F21A36E9B961B0113ABCA4D953C25F5364BD4E6E71D80E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266290, "uuid": "f3220785-5af7-421b-af6c-ce91f459ade7", "value": "196608:boHQjDSOgtzPADoHQjDSOgtSDoHQjDSOgt8DoHQjDSOgt:bowXSlMowXSUowXSuowXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781266290, "uuid": "e489f58c-54d3-44fd-ba16-1c80b493efe6", "value": 10223616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781266290, "uuid": "11524f85-77a0-458d-9529-1f0ce2a0bd7d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781266290, "uuid": "d0a7bfb4-66e2-4149-a5fc-63a38f982cfd", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f657fbc-6640-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1781256262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256262, "uuid": "698a1705-8cef-4e77-988e-1efc5af63e95", "comment": "Malware payload (PureLogsStealer)", "value": "1a3b94d8cb6de1f25bdb6fa92b41cfbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256262, "uuid": "c41022dc-fed1-432b-8e70-5d2b95f33600", "comment": "Malware payload (PureLogsStealer)", "value": "f9d3a34e0f5c126151e61f1792d585b60024cd194d0acdc5aa4962a35d4cc397", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256262, "uuid": "06006bbb-3a39-41c0-abb3-ea4da3e0db5c", "comment": "Malware payload (PureLogsStealer)", "value": "465e2d694d41cf461281e6b44a779dfab7b4a0da", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781256262, "uuid": "3ec462ad-aa36-43be-ad6b-a04751d9baa2", "comment": "Malware payload (PureLogsStealer)", "value": "33c7ad76d3dd32ede57d6c23effecd1534c2e0bee7cb3cbd744cfce1e5149332ac172b698d75af5a9c6fdbd0c0d62ef9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256262, "uuid": "60e9c8a5-f953-4280-b274-e365ab059075", "value": "T169F4F83CC958422EE172D729855A084FFC922A0B523CD84B65CB274FAF739467BD236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256262, "uuid": "999389a9-98e4-4c73-8911-3f77ab5fc0ff", "value": "3072:BV/eSBFRKnbmtFLsSv5pDnraxEs5f9AlrLLy1LGYz3DbQsu3+KbTMErzT6pAwiF8:aQvbWdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781256262, "uuid": "a16bba6e-7415-4b2a-8ef5-38131df6ece0", "value": 792030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781256262, "uuid": "1b32d6c4-80d3-4f6c-9c9a-93868debccb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781256262, "uuid": "8b07646b-e2f3-4379-9c0f-c623a65983a8", "value": "Purchase Order - Enerzolve PI-TP1026230 CBB237.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23207cdb-6638-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781252671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252671, "uuid": "e2060c02-eff7-4ec3-b440-09f036c4f9c5", "comment": "Malware payload", "value": "08f11e8e6433ffc17fdbd6a79e1eac6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252671, "uuid": "9ecf1b89-e4b4-4aef-9be8-5b6b1fe5f7da", "comment": "Malware payload", "value": "fa6c075c4db25d379d4f433890f766feea38e0e66a5b50d13ea3c57e30aad106", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252671, "uuid": "7ac83497-696d-4fff-8848-1af9c354a6b7", "comment": "Malware payload", "value": "82ffacfb445de776dd47ca2fe5bb074da86f512d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781252671, "uuid": "557d9f90-578a-4a9d-98ea-2b89beb78260", "comment": "Malware payload", "value": "2e724d59a41d8035fd03ff870b9404d3d58f100fedbf675a933d99f07d1c1cce602c3f067ab1cc5e428a808cc6b6e68b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252671, "uuid": "2cd3a39e-c231-49d6-a063-cac1bd91c57a", "value": "T10AF34B01771D0943E2672EF03B3B27E1D3DFDAA231A8E644390FAA899172D325589DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252671, "uuid": "8bf6fb6b-5ed0-44d6-96bc-cc5e17e857c7", "value": "3072:iYmX4y5x8B/fx35dxXPbcet2s6MoQWNs2:3mX8Rfx35dxXTcPs6TQWND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781252671, "uuid": "ddfedfe2-71ef-47aa-9678-5a33dd865cd3", "value": 169200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781252671, "uuid": "b8865616-c503-4b64-848a-1ba578be7872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781252671, "uuid": "ca0b0111-7d40-4a79-a935-46897344aa12", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c181ed-66a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781301335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301335, "uuid": "18b1ca1b-65d4-41e1-8d5d-bc4bd0ae7a03", "comment": "Malware payload", "value": "e73daee32a5e95b3e9a9efb820021f4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301335, "uuid": "f6486d91-647b-4774-8c1e-5d3476757878", "comment": "Malware payload", "value": "fb005a55c2e8592a5dd49008274e6dba1f6ec66b597e505f9548e98e2b41d440", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301335, "uuid": "b6999a39-d2d0-423e-8c72-1ca2720f902d", "comment": "Malware payload", "value": "9b6c909abbd47bf3f5487ea2199309e37b4126aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781301335, "uuid": "a32632b9-3913-44d4-9ace-9cec55f94ff9", "comment": "Malware payload", "value": "c87e1d04eeb707a60567cb56f688e315d484d5ac0094f5c58a3c49aa76a57feeca9c30d2713d848f5b3c857eab385a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301335, "uuid": "10685081-aa78-4bb8-944b-10823876a361", "value": "T1987512182B6AE607CE1517785AB1F27526FD2EEDB102D21A4FEDBCEB7836F111C04252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301335, "uuid": "4b9fbfa9-74d2-45a2-ae68-f7615a86a24f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301335, "uuid": "554e9b3d-f1c0-4e3f-9564-a3e0a69b111e", "value": "49152:ry+jygQnHwt4eZOQxtWK8ioeTVQqC2QdJdGz3M8LK5/w:rtjCQqzQ7wibBQ52QdJwzbG5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781301335, "uuid": "844e6dfd-de7d-413d-8d88-ac77d889f34c", "value": 1583616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781301335, "uuid": "27d77a57-2d34-4975-8855-11e2eb4650b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781301335, "uuid": "a0133408-24d8-4931-9db8-8c526c841463", "value": "fedex_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f282d5-6605-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781230767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230767, "uuid": "b8b8048c-dd7e-4cf1-8f3d-3fe0b00e744c", "comment": "Malware payload (Mirai)", "value": "5407384f34687734250113bb3fcbe1c8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230767, "uuid": "af001b6d-1a1c-4a8a-983c-e531812f23f1", "comment": "Malware payload (Mirai)", "value": "fb7bf29cf7d0939729e0215b070fb59866afd35c802b8309148b5a31f9d63b67", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230767, "uuid": "001d7109-9928-4d0f-b595-99c9ad1a4c3b", "comment": "Malware payload (Mirai)", "value": "2eebfda65ec368069505c4b8ccb278886a4c6bb1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781230767, "uuid": "e9d7cb7e-7404-4e49-b201-65e01d20eb8a", "comment": "Malware payload (Mirai)", "value": "082d9857aec269f51f07a360d059c5b66ea442868e76621addae163f6cb3dcf42d2a56ea44b20edd99c01cd773f6637e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230767, "uuid": "829a91c7-4fe3-407a-92df-979e1970fa87", "value": "T142014F880075925B211BDE8CF287921C8DC19AFEB0F27AE0B55BE63CA85615430F479E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230767, "uuid": "78229b39-8148-4f91-b9ef-ae9cdce97418", "value": "12:3J3j7AlXXCP9WxjhZH9Xuj92mOP9XvRjUXYZq92RjlZxAE9mjAX9rjVb97U:3J3KzDQ2h5vMwDfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781230767, "uuid": "59e205ca-45aa-4d85-b60c-e256eb7c77bc", "value": 684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781230767, "uuid": "7f6102ef-a1c9-4ade-bea8-cc3902f0c64b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781230767, "uuid": "21158617-c575-48b5-9e83-43a3a9bd9db5", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ed5bd6-6627-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1781245433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245433, "uuid": "b97cf7d2-e53a-4bee-9397-c088789a1558", "comment": "Malware payload (Mirai)", "value": "3da4651d182ad43dd4a5e1af85e0421d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245433, "uuid": "cbd05ca1-2bc1-4931-8e1e-a4d8c66e51e9", "comment": "Malware payload (Mirai)", "value": "fc6775a6e1d6c019e84aa71a849405ba25089e8c9b314daf96ac0f833c369bd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245433, "uuid": "a89864c9-0645-4bef-ae21-8137fd1290ba", "comment": "Malware payload (Mirai)", "value": "335159ff47ddab1f3d13844c9680ca928ddfe1dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781245433, "uuid": "bbc79e32-02b0-420e-ad92-05e640591fd7", "comment": "Malware payload (Mirai)", "value": "20ca32435c045f21701e4eee69aba06b754ed49c0e49c504a38ada236e6978c1792ca07d4e1fdabe23fa512b0275d474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245433, "uuid": "8641dfc1-60fd-43e8-aa8d-70bfa04304a4", "value": "T1D4B3D085B210AE55C02272FCB1870A90D3B16D7B4B9A150B44B3F5B46DBCCD47E1BEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245433, "uuid": "d668c0ba-a0e3-43b8-921b-79ca5b261e36", "value": "3072:X5Apzl9NOvXoVLAE375lhYy5SkOXNwum:aevXCLr59hmNw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781245433, "uuid": "e1b0b9d8-07e0-44a3-bcb7-a4d783db9b98", "value": 107680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781245433, "uuid": "2f2894cb-dcd7-44f8-b9b9-7f0d1b50a6d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781245433, "uuid": "4188a226-e8d1-4eb9-baee-614698cce459", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307f82a2-664d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1781261713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781261713, "uuid": "1c2653bc-09a5-43d7-8eb2-ad95f2602bdd", "comment": "Malware payload (Vidar)", "value": "2008d575a79644d95722ac4a2001e715", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781261713, "uuid": "6c7ae160-4a40-4bd6-95a2-20a3e9f1b593", "comment": "Malware payload (Vidar)", "value": "fd1b2dc911be109d2fe54c5c20ef527412bb49552dae38e1626d60ec35f2914e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781261713, "uuid": "a88bc0d2-4130-4817-923a-dc5916c51e1f", "comment": "Malware payload (Vidar)", "value": "868d08e8a0b5e5c9946bd12c78e2a0ac19a46555", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781261713, "uuid": "132b75ff-f3e8-40d6-b7af-cd9f35e39b28", "comment": "Malware payload (Vidar)", "value": "e74fe54f7807b6ab8636f0aee584d7e4188a2bb1e738ce414d9d9021e481ed3c3dc832204947a5aad755414a8e900542", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781261713, "uuid": "c68fa4f8-9e3d-4b1b-9df4-417d4fe16a33", "value": "T160F58D47ECD908E5D1AAA331CDA69195BB39BC481F3127D32E90B7392F36AD05C79309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1781261713, "uuid": "9b10bd39-aa77-4fb4-a103-ac4f8b57f139", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781261713, "uuid": "368da153-cde9-4fd8-8001-ca3bea5cb38e", "value": "49152:ZHaQ6MopAAz5eoy/h3cYlj1udt6huWTXSAYRJaBKe8NtR:Z12ry/hZlUPAPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781261713, "uuid": "03173489-7b97-47a3-b739-03499d9bf9c6", "value": 3366264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781261713, "uuid": "4eb2d233-70f2-4e79-ab98-2e892b41b246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781261713, "uuid": "037ebc09-c938-4a32-b512-1e4cc40853f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa4bdc9-6685-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781286051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286051, "uuid": "d37c12aa-b49d-4209-be44-3ad529d07837", "comment": "Malware payload", "value": "172296d06fed15a0760f15e7391168b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286051, "uuid": "d9f462ac-0bbf-4d17-84e9-62ffc4acd221", "comment": "Malware payload", "value": "fe34dc9f16bb70deca28685e8dc281289a4e8732752885ef208c693a7998af57", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286051, "uuid": "aa8439f5-ced0-406c-a87b-d0ee46773a3b", "comment": "Malware payload", "value": "92904838a8931cb8a35b73d759f9e0b1c390841b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781286051, "uuid": "5f417e70-5aaa-4798-b1a3-156285d20441", "comment": "Malware payload", "value": "035e3440489df7105d9706b337a65ffc03339cd264a663cc1b3b379c7aded0c0a47a5e7a64cb80f3d1bf22785dec6e7a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286051, "uuid": "9ce9e9b3-5704-4e3a-9211-c58c935cd55e", "value": "T1D3D2DF34C4D82FBDEEAA2A1C06FA6620D7D68B1E9498860B37437D9B4F37D80443751E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286051, "uuid": "a6628564-fc40-4823-bac1-0428b454a34f", "value": "768:MumWOXcTmHBBGUUO5/sCY4kSwULlhgQXtIAUONhKk4E:Mu+ImH/GnO5/RY4kkLkONX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781286051, "uuid": "b693dae0-4211-4e92-9548-0fa4ded0f9b9", "value": 28653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781286051, "uuid": "feac9964-47fd-46fe-aa3c-a5e96c020151", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781286051, "uuid": "c18b2313-fcae-44f8-b1c5-f8cdfd7b3bec", "value": "194.9.6.40_1781286000469926_vendor_phpunit_phpunit_src_Util_PHP_eval-stdin.php.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657eddcc-665e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1781269104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269104, "uuid": "6cb66d97-1782-4699-b5a1-62243a449388", "comment": "Malware payload", "value": "e118ee2427f83c48756ef9122897dead", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269104, "uuid": "21c38331-cba8-47fc-83e5-0fcb09fd8c1e", "comment": "Malware payload", "value": "fff17bf4642d06e934a068d3e114e2693d45b2e2bbe4e4014e542c3dd49f105b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269104, "uuid": "69997d64-f39e-4ac0-9e2c-1fb9ffc96f65", "comment": "Malware payload", "value": "2ce0fa08e07a722d518ebb5e13c8ac3b24741a74", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1781269104, "uuid": "476c3dea-7848-430e-aa86-eecb4f2c6931", "comment": "Malware payload", "value": "12612cc78412fc5612d830c8f5523552271a9869529825d7bfb89cfa0e7baa1828c2a5898a064bca9f2d4a735977255f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269104, "uuid": "0ceabc04-087d-4011-9592-8e712e2022ea", "value": "T1A09533603CDAC4A9D45DE17F46BBEB056BCEEDE948660226F30AF7850F31A171EB4214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269104, "uuid": "3928954a-cb5a-49f3-a603-89b43de1bd30", "value": "49152:OJajcaHZ1JpjuM/c3rDzVMzS6Pq7blDXmsdiHprcZqa3p:OJyca513jkD6PqPlDXhd6hUH3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1781269104, "uuid": "038f78fc-0a91-49dc-bcf4-71a7c280c767", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1781269104, "uuid": "589d08f4-83ef-4204-917f-c6ca640a8338", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1781269104, "uuid": "01412ea5-c97d-4f4b-a18b-4fa0abc66a57", "value": "6r2yc3bOs8tqcVQ1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }