{ "Event": { "published": true, "date": "2026-04-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-09", "timestamp": 1775779382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "62ea37c7-0be4-47fd-9242-2de79bf9ff1e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4d54c6-3425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775746938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746938, "uuid": "1db93199-3fc8-44d6-941d-ca2efb2ab9ac", "comment": "Malware payload", "value": "415d02c4dcef5fc5a5d29fdf13d40b4b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746938, "uuid": "97727dc8-7c1b-41e3-96e4-7d826214bfcd", "comment": "Malware payload", "value": "006fb82ad22a757119e0ce8f35800134090d1407e3b9b53e020fcc48edb4db1f", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746938, "uuid": "24e63ead-3e73-4dd7-98c9-a7fe15426eff", "comment": "Malware payload", "value": "f68df548dd5f323ddafc26906fc017bb4de6b08d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746938, "uuid": "25a54bab-f95c-43ac-b1ef-b8f06a6515d7", "comment": "Malware payload", "value": "947ed7ee80d5cfdf9c0111b3225188defbc3835434dabf1c1d8713e58ec1d5f6f9977822479cc8f8b3be229fb410cca2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775746938, "uuid": "04679386-418a-4de8-a6a9-e8c8b5282807", "value": "T1AC64233256C50FA5B7419A6066A33A083169072BD208A5E3F16CCB597FCFF03E75BD1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775746938, "uuid": "07606415-d57d-4df2-996a-8496371fb10d", "value": "6144:HKfA+DP7ZeGYjE9fM64kJQLHOBt6eUuUEZzg1JZup:HK5DzAA9fM64YA1huUYz8Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775746938, "uuid": "cb387482-90f2-4cfd-905d-82a9c15fc401", "value": 322156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775746938, "uuid": "5a6681ad-7926-41de-8cac-fb42b14bce72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775746938, "uuid": "417f9874-36eb-4ab8-a0fb-c40afc87621d", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dd69c7-33e0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775717431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717431, "uuid": "710d20df-25c8-4e47-b4a3-aea110a01f89", "comment": "Malware payload (AsyncRAT)", "value": "ab6f1d06b37982036c9b73a46482c4a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717431, "uuid": "01748e81-6b81-4459-913f-3114be444d11", "comment": "Malware payload (AsyncRAT)", "value": "00823f9a400139cf09885081cfa1115fe169df77dc01fe600f1393419fc5a5d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717431, "uuid": "458aec45-7a35-480d-8a09-0d4e577a6d44", "comment": "Malware payload (AsyncRAT)", "value": "296f44c1384b684f7d6466881d21d7c85e12e1cf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717431, "uuid": "cca1e575-7249-4cc6-b40b-7d66681be30a", "comment": "Malware payload (AsyncRAT)", "value": "5f938a0a8bab960f43452767453814accd1be23255c87fbdd3320de376c9ef6f5b8a78269b5bbdb81bea156954bc97c1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717431, "uuid": "09741073-75d8-4131-9220-f9dd25e0846d", "value": "T1FD2542022EEB3B45AEE6D70390792974C46E376B5B371CFA6672471E5C5FB026C22C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717431, "uuid": "728081d3-b68a-4764-b545-682cd1de48f7", "value": "96:rmmmmmmmmmmmmmmmmmmWmmmmmmmmmmmmmmmmmmPmmmmmmmmmmmmmmmmmmWmmmmmh:hKD250Bwrh0rM2IemVlb4DOLw+FS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717431, "uuid": "ff475221-30b6-4fca-a890-ebe98d59d258", "value": 1038522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717431, "uuid": "bf526b02-3751-472a-95e0-c7cf4f9ad8a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717431, "uuid": "ecc6fca1-eeba-4528-8505-480d2a76f70c", "value": "00823f9a400139cf09885081cfa1115fe169df77dc01fe600f1393419fc5a5d6.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf868247-33cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775709419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709419, "uuid": "e785f9fc-9a33-49cf-98bd-de096a730977", "comment": "Malware payload (Mirai)", "value": "5c3d415d976b0dbb11021f88ceba502d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709419, "uuid": "0ec28b74-a0a4-4432-9c94-5f99df7710d3", "comment": "Malware payload (Mirai)", "value": "010e9519a33344bc8d60513baa0f8751f1846a7f1cb69712f10c25cc66ebff95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709419, "uuid": "69c992aa-153a-4fb1-a4b6-dac36d5c3728", "comment": "Malware payload (Mirai)", "value": "b76697e951cce363cfefcb5bb52beb238d07b5b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709419, "uuid": "9e2c461f-46fe-4f82-812a-91d5a0911927", "comment": "Malware payload (Mirai)", "value": "deaffb364ae72e323a52dff2368adf6efc719c1463c6e90f2553686b549a54e9660e0933092676cbbd36cd758f1205f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709419, "uuid": "78f3d7ec-8f80-4bb9-b5fd-2c13db0b362c", "value": "T159040A52B991CF12C1C212BAFB5E414937133F78D3EE72129D246F60774A8EB0A7B616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709419, "uuid": "757bbfcb-7f5e-42d0-963e-6a740e7fe805", "value": "3072:3UQnXKTeQBvZ6OxCX7MQ39aC2irlVaaSPRky/kIN0f:3UQnsVx6XXAQNaZMWtP3/kIN0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775709419, "uuid": "03b9df93-27dd-4654-be94-4e37bfdf110b", "value": 186576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775709419, "uuid": "d10813a8-4e04-4908-8f80-437e65b31a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709419, "uuid": "dda0df2c-34b1-4ac0-96c7-54ff26b4de5f", "value": "narm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526a35d9-33df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775716967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716967, "uuid": "42f2cbea-cf6a-4222-bee7-e066373eec3b", "comment": "Malware payload", "value": "e422f88e281cf0e7aeeaa843a2516eff", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716967, "uuid": "3d234c36-72ab-4a9e-9872-fbdf02608df7", "comment": "Malware payload", "value": "0174c85be5f92b840d498119815092d7875fdaf7085121333807e3c5cc2bfbf1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716967, "uuid": "23858cc4-bdae-4c70-9d49-4896959bc582", "comment": "Malware payload", "value": "e8592f158fa2b78f0f1e25a5af9d843224687245", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716967, "uuid": "7859bd48-d7d9-4fd4-ae7c-b5d629e87f6d", "comment": "Malware payload", "value": "e0c09bf5301a73561b5266943b20061e54de619c97235e6b309eeb81d644f0f7c4f0cb80d8615b06f3170abbc0f21cf8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716967, "uuid": "07de0346-61ef-410e-9723-f967f58a1000", "value": "T149433C0CFB98452AD73D8E7F9871230583F0E195E543EBAB9EC561F5B4AB7D40201A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716967, "uuid": "0d8c06c5-4849-47eb-8e38-57833fdf9920", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716967, "uuid": "db90087a-f4aa-4f69-8ef7-7381cea663f0", "value": "1536:JJAqBSa9UjiLVO6jFBybAlybpOCig9k9bJ4YKiF:tBScUUO6jFAyCig9ktWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716967, "uuid": "62c66547-eaff-44a1-9d9b-07fe52fdb573", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716967, "uuid": "2d56d6d0-76ff-459f-9391-eccbed7886ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716967, "uuid": "7dcbe726-2424-46d7-bf9e-3f6b22145f2f", "value": "0174c85be5f92b840d498119815092d7875fdaf7085121333807e3c5cc2bfbf1(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a911ebe1-340d-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775736870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736870, "uuid": "1041a35b-0cc0-4adb-a537-49629ed0e005", "comment": "Malware payload (AgentTesla)", "value": "0d2e420b55d1693dc3234b61c229d058", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736870, "uuid": "ab8857fc-528e-4e2d-a372-1ef133182325", "comment": "Malware payload (AgentTesla)", "value": "028024acb1f34b3b0ec221c79a9e8947fd00c8ae858142d671782785d3d54362", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736870, "uuid": "b86c4c00-0b6a-44a5-8c57-8404fc28aaef", "comment": "Malware payload (AgentTesla)", "value": "72d8925e2f2377ea486dde0b2c0bf7cb39ea03b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736870, "uuid": "341cbdd5-4d40-44ab-bd70-6a5a8144ceeb", "comment": "Malware payload (AgentTesla)", "value": "7ab6641cb07a67fc3112b0f2d99070ad7c0010dd721eeb984d43e58c7d8e02f2a9563692521c6a27724cac56b55161d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736870, "uuid": "91b6e7ae-cc31-4184-9d10-a1438b44281e", "value": "T12A14123D91903C2D8638A37121B2F5962733C5676C47EE84E6BE8A85EB9FF10BC46117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736870, "uuid": "f7d1329b-3955-4f7d-a502-44a082e6799b", "value": "6144:cfMlpF62gyxoHyp6w9rFWwcznDHBLw/WSuqA:cUIkoSpRRofzndLhqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736870, "uuid": "94216e9e-778c-45c8-b477-153589048e3e", "value": 200658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736870, "uuid": "4cc01e54-f9bb-4254-9d34-eae24c1eb08e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736870, "uuid": "097f639c-d6b5-4520-900a-ff6d1e95d3bf", "value": "PO-05870.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eef941e-33d9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775714411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714411, "uuid": "9824d9cf-0fd9-4dbf-9400-32413df2dbd6", "comment": "Malware payload (AsyncRAT)", "value": "97704db15c26e4ed3f565df0652798d2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714411, "uuid": "f5e324c4-1e9f-4bfc-8012-e44c6775184b", "comment": "Malware payload (AsyncRAT)", "value": "030967003eace6864210b5ac969bd55e91eda783aa60869fe6ff6dae00ee9c96", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714411, "uuid": "8c59d748-dea8-4478-863a-bde33cae52c7", "comment": "Malware payload (AsyncRAT)", "value": "7296fa448813fb7d5e041bb9c69ba46420f79092", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714411, "uuid": "c5e83b30-d0d0-4a58-b94f-244258531e0d", "comment": "Malware payload (AsyncRAT)", "value": "d5a272d132090e33255283ed313689f1e6c3fcd9bfdba043b86c2675e56138a5e966ff5672eac3e133778a940b9ca92a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714411, "uuid": "63b7d01f-a7af-4e65-be3e-724f6b5d8b93", "value": "T16025E0432618CF46D43657F56D23D8B40BBA2F4FA411E6AE4DC22DDF7D66B200888A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714411, "uuid": "8e1d7e77-08c7-4255-9dbf-42a05f97e619", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714411, "uuid": "9baed537-1ed1-4f95-9d05-07b63956d0a8", "value": "12288:0beJeJlSNSkchrJiW5CEcVLNZY322HzZoeSO5K/ciqssEv19RXHhifwydr3jmH8D:DJs08kch1mVBvynSL0HC1HhiTXo9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714411, "uuid": "6b499a16-920f-4dbc-9492-d97ceab737eb", "value": 986624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714411, "uuid": "e8a422a2-f028-43d9-9bd3-686ddd095d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714411, "uuid": "00bfcaec-ef87-4d55-a422-f4d90436654a", "value": "z1PAYMENTCONFIRMATION03_26.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ccc5e8-342d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775750663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750663, "uuid": "77123975-dade-4010-9910-ffadc56796db", "comment": "Malware payload", "value": "8cb44f150d690eea0dadef38eca9569f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750663, "uuid": "18faf875-d435-4516-810f-064c9761e7c3", "comment": "Malware payload", "value": "03f48ca747db8e2aa6a18cb5234bffd89014714d59483ddc8df7b3d3be08c368", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750663, "uuid": "4989cadf-8989-443c-9989-d7097e582161", "comment": "Malware payload", "value": "4462c602e863d7549dfa926232a8f9feaec527fe", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750663, "uuid": "94286a44-cda9-4f38-95bd-67a9bef280cb", "comment": "Malware payload", "value": "cb2336b17089d8afb9fb573d9eefb285aaa8844f275ed0239ff7ef8b77b5b43d60b7bc7809b5617585da190f127bb063", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750663, "uuid": "b48781f0-efdc-43e5-a383-eddfec79b0b4", "value": "T1CEF3FDA88E8A89B4CB1FF065056B5D8BC7ADE123025DC590BFDE9F453F529A038BD5C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750663, "uuid": "3bed6224-923b-4415-a14f-2b7007426941", "value": "768:a5acUh2FBOY3Ud4g+vRoDNYFHTs5pnRzvg9/OKx9g9ZLs36Y6Y686D6L42RUZPw+:hhoUAvOAjzZdo+YwVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775750663, "uuid": "870da2c6-67f5-4b35-b104-32381bb4c8c2", "value": 170514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775750663, "uuid": "53f2918c-32cf-46a4-abce-481b59a3b29b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750663, "uuid": "d1bb0d43-89f5-4cc3-9ff8-5ba9bd5fad8a", "value": "Research_Beta_Images_217.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b84b66c-3402-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775732042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732042, "uuid": "72116c96-fd55-411f-b49d-4573c745430e", "comment": "Malware payload (StrelaStealer)", "value": "c03539ea1351c9026f0e54d6f9d4c1cf", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732042, "uuid": "ff22f34a-9393-4e24-b9ad-4009f0f7c752", "comment": "Malware payload (StrelaStealer)", "value": "0464a153095ca27becc740b81fe862a22fcb2b8988492d0e93c115dff45ea480", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732042, "uuid": "2007e7e9-c6f4-4e00-8985-03410c08c99e", "comment": "Malware payload (StrelaStealer)", "value": "74e2c387e5723f9e30727800df70b35d64724b52", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732042, "uuid": "8f085540-829e-4059-89f9-9e6aaa439677", "comment": "Malware payload (StrelaStealer)", "value": "dc60a77df4667b49820e1f3612640804641ec61f82ee6707869fa81a6bbc2b7667f5761ca73bc584b565952b3424254f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775732042, "uuid": "f2029c85-b74f-4a2b-ab6f-30172ac15718", "value": "T14E14123BCBC5BA5ECA051B7420F5C894227EEA878B13E34EC54C7AA527AC4C531DDB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775732042, "uuid": "210e2e35-f3a6-477a-be33-e6570ed3e4a3", "value": "3072:vDMZbUktBmyB/HHW/PCCMSmTbs1EOygCWqk21kMTA+hq+DwZNWoi9BTnCMoXyE6:vDMZQktBm0/HHWnCCMfYEOCazD+pkZ4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775732042, "uuid": "1a9de5f1-7ca9-4eef-9690-c96dcb09b8f7", "value": 196423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775732042, "uuid": "1a27192d-6ba3-49cf-bf0a-aabd62b47a9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775732042, "uuid": "70402ab0-ebec-4126-a097-6ec063f03c35", "value": "PO#MAIN450000000227897_Sraco.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd79d80e-33f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775725844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725844, "uuid": "9bed0f68-a67b-40e9-b115-24391966ca6d", "comment": "Malware payload", "value": "84b097aea8f10f412e2638964e10c226", "object_relation": "md5", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725844, "uuid": "813b59b6-1252-4507-9c4f-02a0bec7a767", "comment": "Malware payload", "value": "0483d4e289cd96ef112e77c98ac26d8bde1fd5bab7962617b07682b54dafba6b", "object_relation": "sha256", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725844, "uuid": "059aa8a3-d9b3-4c44-8be0-86e0c1bebe23", "comment": "Malware payload", "value": "9e2f1a1b3c5d16d744864f1ad2e8aabf94097b28", "object_relation": "sha1", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725844, "uuid": "11c8f492-92eb-4d42-b29e-1e46ad9e2f45", "comment": "Malware payload", "value": "72562e5bf3b578f98864771c023ea2fdeccd20c59262e36b80085f612a1f8fb21cb3344c617e55c29a4d38239ff6564b", "object_relation": "sha3-384", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725844, "uuid": "cbc5b6ec-461f-4e58-921e-d57e505023ce", "value": "T16D246C16B2D408BBDD678135C8D70E0BE67278A39B30DB9F039007A69F6B390556EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725844, "uuid": "0f099aa0-f6f7-48f3-8135-2d553b353723", "value": "90d642f597b8983215e1f1e4428efbb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725844, "uuid": "05812d2f-5855-416f-a8c7-a1b319d4f1be", "value": "3072:YH1LEIZfwGOw6xYLW6dDLgH/SQBy/Zw0GteARQt9NliMI+S4XC/rHkeovy:1IKMaCCqhZw0GtZ0li3+S40oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725844, "uuid": "4a7e0e38-3ec5-4cf2-ba76-7868ac5b9276", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725844, "uuid": "b79ba9bc-f644-4007-946f-f365deb84779", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725844, "uuid": "0a86489b-731d-498d-adc6-56d6ef2331fe", "value": "0483d4e289cd96ef112e77c98ac26d8bde1fd5bab7962617b07682b54dafba6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e82dbd-346c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775777499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777499, "uuid": "4aa3415b-7cd7-4528-95ae-5cf84912d743", "comment": "Malware payload", "value": "8891858d91bdb6c3fef3b11e2b099fae", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777499, "uuid": "71611ff8-d6ca-4bd7-81a3-ac1f6cee87fe", "comment": "Malware payload", "value": "052ff826f594640830e8785073dc5d34567029fb085984b8aa72ef04fd24c9f8", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777499, "uuid": "cbbb4d73-1602-4b73-b5f3-51077c7fe6f8", "comment": "Malware payload", "value": "daa8815e03fce7b927263af338378dbfd69dfe92", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777499, "uuid": "7a1cb0d4-4cae-41c3-ac78-f7b155f11b84", "comment": "Malware payload", "value": "11d68285deff5aa72d9925effed5040a2686d81304a9822e86856a7007e511b2af283375bfba27505c194725037bc321", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775777499, "uuid": "ba7a2b76-4ff1-40b3-a005-93545db2fac1", "value": "T19EF3CCC84D6D80F8974F6424695F6D036A88A3270B5FD525BB9F9B812F23FB4604FAD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775777499, "uuid": "83c34017-8e1e-47ee-b6d6-e468f3525bd0", "value": "768:f2M1et6+uPJM+bH0uPJ+UhHiuPJ6oEHAuPJ7nMHP1oJEOlHb1oJKKDHv1oJj5UH/:eMM557jJM4hKk+REY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775777499, "uuid": "1c2867a3-e656-431c-9e5f-a4264602b977", "value": 168391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775777499, "uuid": "48c95d03-646e-4dcc-a9ad-106a44fe5639", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775777499, "uuid": "6e710333-de17-496b-89e6-19b179972b33", "value": "Archive_Main_v8.8.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a80a9b-3469-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775776436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776436, "uuid": "6857be44-6d79-4daf-b0b0-28480c598aa5", "comment": "Malware payload (Mirai)", "value": "ec3a0ffae3dd691a059db53319f7b6cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776436, "uuid": "969bd1cf-29fc-4647-a340-244425228a4d", "comment": "Malware payload (Mirai)", "value": "053f6bb6d1f489b79554b5f150fe390b27f7611a13033d1745a1ea6aaa1c0c4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776436, "uuid": "d6daefc6-41e1-4381-a8e9-5bd4d6c462bc", "comment": "Malware payload (Mirai)", "value": "4f8f5f76cc706868d746ccee4fb52aa8d51cec59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776436, "uuid": "d5dd6666-187b-4ae1-86bd-0f4700565016", "comment": "Malware payload (Mirai)", "value": "505719f75b9ef74e1192dc6843c991af7b0fe8ff0d77e09e33e87a089940d1fed62ebd7e59712790ba3492a6cde9f43b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776436, "uuid": "762d1bf6-8179-4282-99a4-a763eb0e70cf", "value": "T123E32B81FA47CAF7D4470AB502A3A73A8632EC190A2BC695FB2DFDF59F175C47109218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776436, "uuid": "9c80ca8c-c7ef-4457-bb8b-c775e73f17f9", "value": "3072:2Qaw4A8/H8uFH1CigkJ1MpU5H7+YTv9nUtv:jNncznYU5H7+YTv9nUtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776436, "uuid": "16cff108-0f61-4953-bc8a-85320179ee49", "value": 155807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776436, "uuid": "312531a3-ffeb-4c1f-9004-9f6c6cb957aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776436, "uuid": "d88bd470-8ce3-4989-bb79-0142544e8d6d", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3beef3-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717090, "uuid": "aa83712a-3840-48f9-a289-95a7d0858981", "comment": "Malware payload (Mirai)", "value": "c79e4cfa381607d106df709a77145931", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717090, "uuid": "fd347e41-3e8c-4ddf-b262-f5b710e5751b", "comment": "Malware payload (Mirai)", "value": "054484a4c3356f32348e18bf0c0afd728f10e76a3ebb2c68a2fb833422050cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717090, "uuid": "c4986143-2747-4510-9cea-6666c42f5496", "comment": "Malware payload (Mirai)", "value": "df157fea4c8540ab79a5d0e41dac94147c3fec5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717090, "uuid": "5a43a9ac-3f3c-49cc-8310-a5503265ce32", "comment": "Malware payload (Mirai)", "value": "9b326d56aac31551272a453af95d5aa6ffc86b8b0ae6bf86d9291c1e6c81f988dfa815340ac432c571853ff3fdc4e064", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717090, "uuid": "2d669b9b-bcf2-400a-9724-0806faecbf97", "value": "T147934B45FC919612C6D5137BFB2E228E372663A8E2DE3203DE156F22338659B0D7B741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717090, "uuid": "585ba81b-ac34-428a-bfa6-23998aa899d8", "value": "1536:9ObuOZ1SDp7u1rGmF/fgcPrnyAsWkJ1/j4oYkv1m:9Obu0QpKhB7PryAkDd1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717090, "uuid": "360835e5-3d5f-49a4-b110-30f6459aa2d3", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717090, "uuid": "a5a3b262-1e99-4e0d-bf84-ca9dfbb82c59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717090, "uuid": "a4f8b867-b7a0-44da-87e7-aa9ace15f917", "value": "Hammz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f980bc-3460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775772424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772424, "uuid": "c1810bae-061e-4036-98a8-d9184b390981", "comment": "Malware payload (Mirai)", "value": "d13dbfc760713ffaf31a9354c5befa8c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772424, "uuid": "f34e5575-df6c-402f-a3ae-40796f289512", "comment": "Malware payload (Mirai)", "value": "085236350e442440a2cf5d98de2408ef1148500e948b9ec410238ef94cc7b438", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772424, "uuid": "0d658ad0-016e-4ef2-8260-d8d473c58d58", "comment": "Malware payload (Mirai)", "value": "07f110ea174a6704a5857314ef0102ca8f64e3a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772424, "uuid": "a94e05d5-64dd-483a-a688-4bc75e5f063a", "comment": "Malware payload (Mirai)", "value": "b24b27fd4123716731593d3f2018b557493d7784b54a5da556e70562f74a4a12f5edacfa4a913aae77d6ba214c423cde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772424, "uuid": "18f04e0c-a4ee-4979-8ffc-de474c255eda", "value": "T1B95168CA16D264396CBED91E72F95424B2C0905B34EA3E589CD83DEB8E8ED1C7440F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772424, "uuid": "9b326ea2-9799-4048-b212-6eebe1d4e883", "value": "48:vpjkVpMdMyepRe3pKvupg5Mp0FYp6OcTpznMJpM9opl6dpN0NFqhp4RKppW7pvYo:vWVSOyey3YusMcYeTWJMoudQ22KS7uj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775772424, "uuid": "e9a7b9e7-c004-466c-90aa-fb806241fad8", "value": 2715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775772424, "uuid": "23c424cc-b4d4-4231-8d2c-c6b34285e74c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772424, "uuid": "1cb9a809-83fb-4e12-8822-2639204dcc74", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031992ac-3450-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775765367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765367, "uuid": "0a980f7e-3fe0-4ed2-a16e-340cbe595e51", "comment": "Malware payload", "value": "0410fec78fcfff9f7b40e425b77b1742", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765367, "uuid": "c7f490e8-4898-411e-81ff-73b5fe72b8ed", "comment": "Malware payload", "value": "090166709700fb725345e25dbb2c14b99e50c9ee5007780999b27c96db7f6ae8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765367, "uuid": "9aef43ba-2098-4c18-9989-89894032341d", "comment": "Malware payload", "value": "fa3f70bf390e81a38d2fe99ddcc2ffdfb7b6af5c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765367, "uuid": "65f04c9c-6baa-4bcb-88e5-08a675515182", "comment": "Malware payload", "value": "d16f9db7999292d2f20272cea2d75589e9290f91a2e4395e3e6e60fe01ebbcabb1d9790cd1cbcd53dc014f9aaf4c3fea", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765367, "uuid": "c1a73f72-5ceb-4c20-8c8a-037edbcecc74", "value": "T10DE0D8D4105B44D690D81C5F72B7A408A9CA9F4ECD4A6FB8BCAD70A7A768F15D0C6094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765367, "uuid": "25961a82-e717-4c50-b80f-cf42bb2a6054", "value": "6:xLgLW4Mv+iFnT7vZsfuaIuOA9yDB2/vXUgoDu/oz+Q7ZYL4qy7:OLWDvZWfIuz9yd2nXeDuir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775765367, "uuid": "5de9afcf-1763-46f0-832c-712b12c28163", "value": 408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775765367, "uuid": "ff4139ec-6154-4e82-b4e1-b65f5e2f0a6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765367, "uuid": "444d573b-831b-4ad4-8e6c-ba9822c46982", "value": "gpon.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1479dd0e-3436-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775754230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754230, "uuid": "c74b8a57-040e-4937-a0dc-37e132780be2", "comment": "Malware payload", "value": "7e10170a60f55b3a80687cd2c88206f0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754230, "uuid": "caa232aa-6ce4-4a34-8de2-9ed5c18ee9c6", "comment": "Malware payload", "value": "099278ac5b8a413aa0d5a870552a0626c0b875948eb5cf9bac62244b372e8569", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754230, "uuid": "dffbea82-b09b-4ab3-88aa-fd42d3c3bea4", "comment": "Malware payload", "value": "309e52d43ceb671197ec1cd1d8a610562d12af04", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754230, "uuid": "3d5788e0-b6e2-42ec-9a4a-9714f28e75d6", "comment": "Malware payload", "value": "a7aad8795c61640f094048595b098e7571f617f91871809d27a0e451970e5775c65b9ac2bf6778af346973e4b88f3469", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754230, "uuid": "9fd3395d-2434-4bfd-b25d-8f737bcca31b", "value": "T1922623A9C421F095C1A0092BB8886D20D342DAB895447F34909757B67FFD7DA2FFA60F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754230, "uuid": "c43f1351-bbfb-4920-be9c-40f989bddf8f", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754230, "uuid": "49a059a5-0a88-411a-b6be-16782b8258fe", "value": "49152:K9kPnu3kr8UXq1p6sefYPJhxvsxrCTXWabQHsAhApCEEsvHddtGc7+uelAlUTz/C:K7kQFZOYjda+K7hTEEsv9d2tKlI2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775754230, "uuid": "d1feebb2-3b0f-4ed4-b8d0-4793be736540", "value": 4505600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775754230, "uuid": "8e3c2951-6f70-47c7-bcbc-c8e81f6304cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754230, "uuid": "f0416b7b-04d9-47b1-a799-06fde8dd840a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad661c6-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713894, "uuid": "a570e441-0f16-4665-b375-097f8e8ed9ec", "comment": "Malware payload", "value": "dc46b9524c1934190330cdb70702b59c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713894, "uuid": "ac19efbd-9860-4d92-980d-2e50128e8fb3", "comment": "Malware payload", "value": "0ab26337ef9b0f330001540e66c814a556b9434ccf1bea1f3dc7cd7f7158b2d6", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713894, "uuid": "0647118a-dada-40a3-93a6-adb665f53a47", "comment": "Malware payload", "value": "62462f70f2c18e06feff8448ef32dca0b0b3d1c1", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713894, "uuid": "ea3ef3f2-34ef-4217-8906-108c0ccfd663", "comment": "Malware payload", "value": "bb4bd4018b1a3ab3a1eba25f7163588817c02ea764ddf530b7d62d16ff66196291c573cce9ea4b370a8b31e055b7a328", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713894, "uuid": "cc893225-3728-405f-82c5-8cf216dc6412", "value": "T1AC6251A753CA0DAE97918AD7C246FA0558BEC0BF1C1E128CF1E14647B03EA60B355F78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713894, "uuid": "94adc752-c37e-485f-8bd3-d1ec1eb704af", "value": "192:sKOUij19XaR1j4Z+8HVDdmg7bqf6XT7cqTgtZJzdg1VPHssUK:X7ij1oR1j98Hhdf/qG2/g3PHse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713894, "uuid": "06be9e4e-a38e-4159-8c11-921ec37e7091", "value": 14918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713894, "uuid": "ce64b3f4-59de-4433-b216-04b893b6897f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713894, "uuid": "520a48b2-0702-42fe-840f-643d56d11d21", "value": "index.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e534812-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "30a50978-17e1-4ebf-a4d0-7da9fc33df83", "comment": "Malware payload (Mirai)", "value": "7696b48a6b3c888e410ef006f346f40e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "9686372b-f32e-46e5-8af0-b76778b25b95", "comment": "Malware payload (Mirai)", "value": "0bc7209d06b3177b451f080d061e58a2d5e0e902b85bc9e01170377dfb798ef8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "848f5c79-feba-4fc2-aea8-e30e514e786c", "comment": "Malware payload (Mirai)", "value": "bbe385cf812a6f90d5becbf97b7a3cb4c34c1d6d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "caa5d25e-a9dc-483e-b728-f60338b872d8", "comment": "Malware payload (Mirai)", "value": "e1ae858bbcf0f70180525525ca9d40465622e7fddafae96d28b51607e0ae5abdc548ada6388b5ca700e262b5e57b54fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736315, "uuid": "9ecd61ba-0f17-476e-8848-12ea4b4b7ed9", "value": "T1A3E35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736315, "uuid": "91c72d2e-1276-479a-a447-be58fbccd767", "value": "3072:7oDlIyA+oy+ZGiTp/lZoEhH5lgLOoe97dlJ8jM4:1Dy+ZGPEFxoe918jM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736315, "uuid": "43a60466-e41f-422b-8110-e64a4846ab9f", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736315, "uuid": "cb618df3-a929-46fe-bae7-338d493f0787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736315, "uuid": "89b1045d-b9fd-42c7-b711-919fc3ef0055", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93d8020-3416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775740762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "303e4804-6855-4570-a80d-c7047642abbc", "comment": "Malware payload (Mirai)", "value": "586af034ff78c07664f2bd56f04c5b39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "c0afc748-78a7-4387-b06e-dbd5e6107d7a", "comment": "Malware payload (Mirai)", "value": "0c0bc0c3e4f3d6067ab7d3945f7965d97c180476db277386bb1cec93dc0d5a2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "9f2b6a21-1967-4757-aaac-886935152699", "comment": "Malware payload (Mirai)", "value": "6346b16acbc84a6c6677991f89580625e519bb3e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "3f1360f3-8cf6-49d9-b3ec-c4dea371690b", "comment": "Malware payload (Mirai)", "value": "a8d5d45ce5d481c03c40e81aa68f84a9c8429ea1d186e281f927b66b29dd0def1108d3adceea68083b4dad8c89bf2418", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775740762, "uuid": "30a3297d-b2aa-4d77-b790-205509c12665", "value": "T1D4057C9AFE5E3C47D2D7E33E9B8AC3B1622BB590D31341537581022CE5C6ADCCBA1A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775740762, "uuid": "878a47ef-1f9a-4657-9e25-87cadf2b9a68", "value": "12288:vnfzDIEtQhZGowNJ1fibugWrvaNDrgXnlcs50Vqlu3vbKn9FZo2SO2O:vnLsEpoqfibobaNIQqAGDZXSO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775740762, "uuid": "91d658bf-d665-4575-8752-94b1e5b94e53", "value": 805280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775740762, "uuid": "ead4011f-050e-433e-be42-64bab16b6635", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775740762, "uuid": "e37f485e-f136-4468-9a02-919056bbf16a", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef5664eb-3434-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775753738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753738, "uuid": "55ea02fb-7fc3-42f1-995c-16463b05b98e", "comment": "Malware payload (Mirai)", "value": "4b0f835bdfb88fd777302ae14da1268d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753738, "uuid": "3d0989b2-1ab2-4bc5-a714-3644b7f6fb61", "comment": "Malware payload (Mirai)", "value": "0d1569dc05f6dfade49c252984a04fe373242badc6abce425f9feefc297f602c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753738, "uuid": "a16f038f-a8fd-4ec9-b07c-c8870c5c91ac", "comment": "Malware payload (Mirai)", "value": "19b36a1bb3db8287e9af3b395cd304c449688940", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753738, "uuid": "50f00b2d-1ff2-401f-b472-ea9431a28758", "comment": "Malware payload (Mirai)", "value": "8023aea8e25def128513fcd598dec20967d3fc7b8eea0c1749fb2a04450a9b315df6d24e907208e648b4752781d6c7e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753738, "uuid": "92aa94f3-968d-46f9-b60b-8a0f3ea40b36", "value": "T153055B06BF405FABC4AFCE30492EC35B11EDD9C746D1A62A71BC4B8CBA5D65A0BC3548", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753738, "uuid": "85431de4-df3b-4791-9498-c523f4e7bacb", "value": "12288:loltINVHMQEMLlVVH2KLSEI9jplVKeB4XZKBtheMqwd0ErU0dvNPE9F9fcmt/HBr:GGcrvrUX4n5ex6EWUj/qVJVXaLaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775753738, "uuid": "f4b4947c-db11-4c1f-8360-9218df58f7bf", "value": 826620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775753738, "uuid": "41b4c81a-c223-464a-927d-483e66bcb3a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753738, "uuid": "25f0e93b-67b7-4929-97a5-cfbe1e174aab", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a997ca-3443-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775760027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760027, "uuid": "931e00b4-3342-4f3b-b27b-98db54c00e36", "comment": "Malware payload", "value": "9ccbe38b131171c1902b02655a894a0b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760027, "uuid": "1c945747-9e45-41e7-a32d-f80e87b573ea", "comment": "Malware payload", "value": "0ed362ef5b074fe3bdf3fdf1f13600c6044184dbaae11562cbc7389779f371e3", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760027, "uuid": "2050ff5f-0f6a-4326-9ce1-4ce2027d6c1a", "comment": "Malware payload", "value": "be6e2c24ed029eb15c87210f09a78978beb7f224", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760027, "uuid": "7ab961c3-24ea-4dfb-a02d-cbc93c7010ea", "comment": "Malware payload", "value": "18e0bc05e2bf620487845867c4b83c5a5e31e1bb059ebb30ab6e2d715d206b65d3f2fd3058313cf0fba258bb2b33e6b9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760027, "uuid": "bbd09436-a51d-4097-9c7b-c3a1a7d5fc2b", "value": "T1500723308F30FDD60B6C7114E06A2E1E2ED01F938E6656EDDA443D970A2EB91DB1F568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760027, "uuid": "ac0efd31-1b58-4290-a8d7-cd1ab283eaff", "value": "49152:CaslKqQ8lA9cuRh9xPHZbEaD1zLz1/ULn6o4ANbWnlzGB+xF023j6imRzbwIaslT:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775760027, "uuid": "7cc53e2f-ed60-41e4-9b90-0aa12931fd7c", "value": 18071225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775760027, "uuid": "0dae5c70-89c2-412f-9cd3-60546a1fbf02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760027, "uuid": "4ddd14e8-cb13-4a94-9c3b-2b62d2d3ba17", "value": "Microsoft_TeamsApp_Installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cc4889-33f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775725638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725638, "uuid": "456902c3-8934-44e6-8e56-0ff47c044ec3", "comment": "Malware payload", "value": "080011f3c7c4f0b19444ca3f7199b6f7", "object_relation": "md5", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725638, "uuid": "0c5e6493-237e-4634-bf5b-a6011129323b", "comment": "Malware payload", "value": "1044fb4210e5351d25e6d8ccb30c0bfeba2b34c65f72390fcfa5ed531bb94bfe", "object_relation": "sha256", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725638, "uuid": "f293a71d-502f-4aa8-a2e1-4f2d1fbadac3", "comment": "Malware payload", "value": "ee1c6f778363b0395a08e1d918a96a2123a51110", "object_relation": "sha1", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725638, "uuid": "2bcfaaec-06cd-4bf8-b6b2-3030d616e7bb", "comment": "Malware payload", "value": "6af3db66e1b583c10798acb219d6e5dce486b27d94871ffbfead57cdd1c420a28eb5d1f5889ecdcd703d5974d1bf01e5", "object_relation": "sha3-384", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725638, "uuid": "b0db5e29-f0e9-4671-93f8-fed57a499b1e", "value": "T1A8249F1272D508BBD9638176C8E70E1BF6727853D738EB6F03A406959F6B380522BF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725638, "uuid": "cb2ce52a-f348-468b-9bba-409571da56cd", "value": "90d642f597b8983215e1f1e4428efbb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725638, "uuid": "7bae6345-bb12-4f73-bf0b-39d3e46791e5", "value": "3072:eiLM8CMxBNaby4Nk8A7wFOPVLCY+gSgUWStQ2SNvUxs6AaoOBSSbVVjHHeXC:edMqnk8A7w8IkSgUDevUxlJoOB9SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725638, "uuid": "d9e0aa36-bda7-4a40-b93b-ada6c346c461", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725638, "uuid": "25abec90-791e-4ed1-9f6c-167d12343cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725638, "uuid": "7abfd4f6-cb79-438c-8dda-1a02c4e19c57", "value": "1044fb4210e5351d25e6d8ccb30c0bfeba2b34c65f72390fcfa5ed531bb94bfe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a8be16-3438-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775755388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755388, "uuid": "4e057c2a-1335-4d93-bad7-07fbed895ae8", "comment": "Malware payload (Mirai)", "value": "907c9f0cb9b0d3948ce435ae514a4ba5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755388, "uuid": "3dc4a652-39b9-48f6-8409-d407f450d8e3", "comment": "Malware payload (Mirai)", "value": "116d97a2f9e0794c34f9d1ec859cc9f7e8bd3cf6f449a6e7266409b02d31fefe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755388, "uuid": "73b06ba9-0b54-4fd7-b869-7d858659680f", "comment": "Malware payload (Mirai)", "value": "74ac23a3aa91bac4bbc0c96cbb2e7fb071626f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755388, "uuid": "02ae0a25-3017-4cee-bfcd-c3c5a5e36da1", "comment": "Malware payload (Mirai)", "value": "d44cd1ba6110aea1aaef3103a7baae7ce69ea7de33ad8bf35f79863279579b0de3d3ff67a9f7204115f16c2f654d44ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755388, "uuid": "0558407e-99f7-41d0-999a-04fdfb461c5e", "value": "T104358D5AF2B374BDC067C030839FDB626936F46941322D7B61C4D6342DA6EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755388, "uuid": "8604f660-6b28-40df-82a2-c379c95bab07", "value": "24576:t/D/KtsaueJ1fGrjyy3xkIeaWqLLLgFkSuuPZLZ:B/8HueJ1f+Oy3xkIeaWKL2EuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775755388, "uuid": "f6151c81-b113-4d28-b4c3-c81149aa5119", "value": 1145784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775755388, "uuid": "31175424-1c91-462e-a0b6-c8cbb89de268", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755388, "uuid": "b46fc0e7-3bb2-417f-8cc0-4de218f3af6c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344c21f5-33e7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775720353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720353, "uuid": "2af8a4cc-6919-44ed-8126-7ee895a6e30d", "comment": "Malware payload (Mirai)", "value": "1e36a010c4333dce5429c14e41164814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720353, "uuid": "16b541ee-132b-40e3-aafe-de172dd9a14f", "comment": "Malware payload (Mirai)", "value": "12187d368f11b022c2899bd61933670f30131eee59c5124125eaff4b818f3d63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720353, "uuid": "8ce5e0e2-4bd9-412d-918d-cf18ab6777e2", "comment": "Malware payload (Mirai)", "value": "e83d126b7553476520b83783a7fbb8e6c9d0e8d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720353, "uuid": "2823fe3f-c818-4dff-8170-eb2e6bd196f2", "comment": "Malware payload (Mirai)", "value": "1d13d8eb770fab0cd91dc7b9480ddfb20ad5814df0a05a1ca483af02bfc83faae9c0b03c8f6ae9b0d12d96fbffaf825f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720353, "uuid": "f5502d60-0eac-42b0-8898-b21dcd8e797c", "value": "T132935B22B539193BC4E4947722F35326F2F6438A14B88B2E7E710E8EBF156D026477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720353, "uuid": "494980e8-ae6f-4606-af4c-7f417a7bed31", "value": "1536:08RsLd2/48pr4LaYqPoQatmjKtHw8Ym5owAtQItt+B:0USjsxOR9YOlW+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775720353, "uuid": "85e0eb53-5d10-45d6-9195-fb7b6dec4f5a", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775720353, "uuid": "eb788edf-a9d2-4031-88b1-cbb7cf6d57b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720353, "uuid": "1ce4d019-6619-471a-97b2-0cdd1c1ae229", "value": "Hammz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40d16cb-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775722312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722312, "uuid": "6624c185-3764-4552-b623-107c6f65205b", "comment": "Malware payload", "value": "f69e236007fbb7b8a34aa46e931d5d82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722312, "uuid": "b9ae2e00-8831-49e2-929d-41aea1eee580", "comment": "Malware payload", "value": "1331a0872ab744c4078a6680989c6dc1ea0c35dd4a8bdc446d42dda57f72714e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722312, "uuid": "19f93507-3452-49cf-9370-0401cae9336f", "comment": "Malware payload", "value": "4c05de154d71756476fd36f1905cb6e9b4df543e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722312, "uuid": "074835c9-b20c-496f-86d4-196d71503b02", "comment": "Malware payload", "value": "4dbb84677604a79f0a155fbc751bd687374ef3e4c6cf23ed35f4ad138876e6545f20419a21ac2579d9849db6e55db5e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722312, "uuid": "3a0356b4-6695-46fa-a2f5-14a3f17b3e77", "value": "T11464E012E7FD8056F1FA0E41C5FA08412C7EBA62690FE8FE09590E5D17B194C9AF3762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722312, "uuid": "439546e2-a7f0-4583-8cb0-f5da94a76eb4", "value": "6144:VPXGJ96pPjMCpTrpCSU0vvSKTgAY1eDwQdcstlhtVtGaeusFsFDOHLJz6jfL+:FGJ96ho2TrphvGv1UwYtf/86FoYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722312, "uuid": "bbb77219-ba56-4d42-b29c-ccbf8061a3f4", "value": 318334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722312, "uuid": "48ebca7d-d7ec-48d3-9e16-7ba317a4f077", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722312, "uuid": "6d7d0d04-0eaf-4209-96d0-775fcc870a2c", "value": "SKM-952738100.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77085499-33de-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775716599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716599, "uuid": "b0857540-5a64-4def-97a6-5327b9599152", "comment": "Malware payload (NetSupport)", "value": "3ce15c568eac603263704345ec7301a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716599, "uuid": "6cbfb7a0-1b7b-4dff-936a-29926d3ba177", "comment": "Malware payload (NetSupport)", "value": "136251575ff9ab9f1381efa349213a203dbb05d5de596a6c3dd726e660c7785d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716599, "uuid": "e2951a01-3390-4739-a1e9-2b0d0188d409", "comment": "Malware payload (NetSupport)", "value": "568c7d51c2a600d0ccde147eda66d37693a46aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716599, "uuid": "081e2632-8072-4a31-a162-0a7fb1bc0a9a", "comment": "Malware payload (NetSupport)", "value": "2a1e0751983fca47c0803fa74dc8b99f5014a0b02b1fe5f53407f1d07364147525082a72c7e981f3a35b38f76a9da386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716599, "uuid": "f2c80730-136c-4fa1-bc92-df58fca84559", "value": "T1E4065C07FCBD8CF9C4AAA2348533A1577E6478405B2163D72AE0B6682F73BF09875B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716599, "uuid": "7d63ced3-607f-4a34-89b9-5b1914049ad3", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716599, "uuid": "bd286a99-5f37-4dfa-aa74-200f22c60ba7", "value": "49152:trhRkmC/qhSUyzNMf3GwtRxRZJ8KvjvQc2fRCPpUPq:tVRJBRb8ZDRCSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716599, "uuid": "ce6f2e15-f433-4670-b5c2-08a40eda9422", "value": 3939840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716599, "uuid": "e3dcb673-a6ae-4a93-b7fe-63005361768a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716599, "uuid": "a6d89b0e-2149-4616-8744-ca15e312358f", "value": "SecuriteInfo.com.Variant.Ulise.596178.20468.17538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4329a78-3458-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775769208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769208, "uuid": "73af477a-2442-45c5-8093-70c8dd91705e", "comment": "Malware payload", "value": "5dacb10f69b2dadc51d8e8254e1b85d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769208, "uuid": "e8fa3d14-6ae4-4eb8-b88e-47400b8694b0", "comment": "Malware payload", "value": "1482c4b91b1d5993eb4a1e4e455c68a2e6aecf660e7317d4ca1d0c5432d6ce8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769208, "uuid": "8700803c-8114-409e-8d84-c1b7edfc7e21", "comment": "Malware payload", "value": "66772bdaf3af583483a0d1e6673b9b416f1d2fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769208, "uuid": "f2d92872-996f-4034-a0f0-dbdb1bceab97", "comment": "Malware payload", "value": "5040b4e0d0b1002f4bd1196c4cb70a53c073d0594daced755aaec22698427e235db5a222d0dcc014dfd328d1be8b04b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769208, "uuid": "2d63e1f3-b3d5-4d1d-a3b5-efbf3c84c88d", "value": "T1E7767D43F25291ECC12AC0749355A333FA72BC894335B6FB6BD44A313E56FD06A29B19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769208, "uuid": "33f49541-50e9-4795-8fbc-11a49109f0c7", "value": "ebcedfc4d303532ab251787cd19f9268", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769208, "uuid": "87161bba-51f5-48dc-ac18-e356431fe6b6", "value": "49152:5h53JG7OJVwzV7N0auKM8DI5NBq08oYihQM5oImuKvOCyOUvAgsEpCRKh3qRHkUt:vzozZNlxVIM0tJaQL24JpuLvLb+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775769208, "uuid": "e6dbaff1-817e-4b69-ae86-05f5f0223383", "value": 7784448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775769208, "uuid": "6ab64555-e08d-4ab3-8cd4-70ea45ee86d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769208, "uuid": "fccbf166-68ec-4d40-98ab-b9967ed6f711", "value": "tideview_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76496c4-3408-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775734773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734773, "uuid": "c2ac42e9-ca4a-494d-a184-23fb68f18586", "comment": "Malware payload", "value": "299b6e4e61ede097805998a7f6503d81", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734773, "uuid": "deeaa48a-7cf8-4494-86ba-df3b73167a15", "comment": "Malware payload", "value": "14fc24fa961ff8c278ae48921bbe8cfca6ca66183c125350582798c5fbf5a064", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734773, "uuid": "8e87b8a1-2a31-4787-8e46-3edbe2a25499", "comment": "Malware payload", "value": "0f9aaf2d556d7e6a8aa930f888855dc44148e62d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734773, "uuid": "bbd830c0-2035-4837-871e-604ea2a9e8c7", "comment": "Malware payload", "value": "cd0bd32056ea02e0e3e18fbcbdb83d862812bcd1951d8b0acf4d9484391940340199c88f2e87132ec73af3603e85bdde", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734773, "uuid": "62f8a511-42a8-499c-9068-1541dca22141", "value": "T11A07DF02F2FD01E8E5BBC178C6675517EBB27819172097EF52648A692F23BD06E3D321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734773, "uuid": "ce0771c7-48c9-4def-ad58-295bfe2ae030", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734773, "uuid": "86577fcb-3458-4a5d-b310-45c6459e7acc", "value": "196608:rdvIyQs3CY9eO8OwcPFGUeTZId/NN5+c9rhJtvtp+ebma6EwumUpd8MaKc7eLVmL:rdrz7whrlId/NNFhbHd6tumqd8wec3pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775734773, "uuid": "b09c2d28-73ce-4659-8741-20552d660ebb", "value": 18332211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775734773, "uuid": "ba70f154-2856-4490-b676-7227e2934854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734773, "uuid": "2db6c2f7-45f4-4d34-9862-cb6511559f14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99739078-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736414, "uuid": "4f39e998-1aaf-4185-b16e-a21e1592b5fe", "comment": "Malware payload (Mirai)", "value": "cbdb861b98fa9b643961985e0145730a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736414, "uuid": "38374108-1a8c-4d13-a5cf-a72435c19ba7", "comment": "Malware payload (Mirai)", "value": "15526d9238ac1e1e6d1cc334b8bf3ccb62793ed2974de433e2c19357674f6dc9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736414, "uuid": "68b5886f-2535-47f1-8731-3f55dfe697ee", "comment": "Malware payload (Mirai)", "value": "eaa66b43cbe2543dbc337ff526eba8d3ffa01bf1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736414, "uuid": "89232b98-3157-47ad-b896-0bd08fa27c52", "comment": "Malware payload (Mirai)", "value": "ef95502beb31889d26188b3c41aae2da00ee24c3d7b2e3f340f0a1dd2373655b86db406f29696ce01f96411b7067165e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736414, "uuid": "91cfd90b-f32f-42d1-aff3-28a1dbf6c95a", "value": "T175C33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD0AF123E4AE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736414, "uuid": "1bef73f1-cdcb-4cec-a478-cca8a46409c1", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmbGHzNzQSRN6Fpjygbjc:jrguLRkHQo8SsGT74p1oB4n2pvalnBzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736414, "uuid": "9f2930a5-cb31-4b46-8c44-5f2e39e1cbbb", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736414, "uuid": "a1bc1005-0033-446c-ba12-ee80b8e66326", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736414, "uuid": "74332a71-3351-46f5-a5a8-0d0a538f6d38", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baebc771-3446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775761381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761381, "uuid": "3e7acf53-1a37-46d1-91b2-9753a9a9d110", "comment": "Malware payload", "value": "9961f8b9115342fc16d115cd2eff8e61", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761381, "uuid": "6b86dc2b-7bb9-4137-8cdd-97ddf6491a9b", "comment": "Malware payload", "value": "188217d6cd6b249ca00a04b5e080dcfa450b19712e382812b12937bfcbfbd810", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761381, "uuid": "1fe7f2b4-aeff-422f-89d2-e394807620fd", "comment": "Malware payload", "value": "579cb59494a4a458937ee95aa96cc96186c0c2c4", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761381, "uuid": "6a6e401d-af36-463b-8a5c-f7ca3f8917d2", "comment": "Malware payload", "value": "df02c24cceda6ac9c22a7fc42c4d7ad092ecc981a12a97d42e3c0da01aaac4d5df13ace61c8fb28010d9178a1e8a3517", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761381, "uuid": "d90ca4bf-7202-4b81-8791-80ccb4825198", "value": "T13C630179CAE8A856FE2239B532F0F943537EB5610CD8E386C221C2DE5B223C27D49416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761381, "uuid": "969dae4f-7bee-4e17-8f17-e416ad24f52b", "value": "7ca411b75593c37e3d6ed29ed4ec30d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761381, "uuid": "1be94f45-a4c3-4480-84ce-72fdc9d78566", "value": "768:qqFpKIOTHZYbvP/kljS+wgidzY5Mzua+BMEKgcTznl8+y1v40g0RWl+dMUTcl6eC:dkIOMvP4BidzIUqGT10g0RJWlt8YrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775761381, "uuid": "195dea70-96a3-4e06-a2e5-c7c366afed03", "value": 67296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775761381, "uuid": "7ff99a13-4db5-47dc-923c-c616c8214d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761381, "uuid": "a7dfb904-be44-4915-ad83-1a1594d572ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "357329f8-33dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775716060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716060, "uuid": "7439f4fe-eff8-4182-a867-8c09b5900ae3", "comment": "Malware payload", "value": "13bfc18f6296c7a0eba4371fabd4f818", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716060, "uuid": "75a88d75-70a3-4bf3-886d-e2b5d252fa69", "comment": "Malware payload", "value": "18996b3867667a26d543360de3aa752679fa2b91c96539cfe702e60c5325da15", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716060, "uuid": "8fabe81e-856b-4922-b603-c73140220722", "comment": "Malware payload", "value": "56945fb51f4c142a7ebccb6704e58c35d743ee75", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716060, "uuid": "91cd6aa0-844e-46f2-9351-0d5fdb697074", "comment": "Malware payload", "value": "78b24a83e29c48e7ebd8de4860938c65ea83aa8b16b9aa1c5cd34dede3edb9777c2f5f8765009aab940565dab655c4cc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716060, "uuid": "ba407a07-d698-48a0-937b-66e3e33a46dd", "value": "T169828E6C09BDFA5893D9E207EA99F7276D461CAFC1B875172AF38C6CA0024C045EB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716060, "uuid": "7dcdcec0-963b-4d34-ba38-3b6a1cf9bdfa", "value": "384:xnQKfGFkVALPGTZmRPAr32cKPNgJFjfAA2l7Ns62rgpJH5nsID1IORonlTyKdBHC:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716060, "uuid": "aaac5a95-1d4f-43d1-b9b8-14270cba1ddc", "value": 18195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716060, "uuid": "07069dda-962c-49dd-8e52-7e0dfc226133", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716060, "uuid": "f0768892-d65d-42cf-8f19-af67410a1ec2", "value": "MaybeWorking.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85106413-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775721777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721777, "uuid": "f25c986c-d7ee-427e-a7ba-b290b01cba56", "comment": "Malware payload", "value": "cf8acc4639b38271b0dc9b09524b50ca", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721777, "uuid": "9b374d2d-75b7-4764-b3ce-94d6166df509", "comment": "Malware payload", "value": "18cdf8f1cdf373ab4415273a8db460188f6de89301227bffa681dc874d781e9f", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721777, "uuid": "eeb1c225-4127-44d5-b3a2-f4dcc6ac40b0", "comment": "Malware payload", "value": "182da96c34e8f72b289876df23cb3246def4bfa1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721777, "uuid": "2becd28a-30a7-4abc-a4a2-452c12476012", "comment": "Malware payload", "value": "8c1194dc9e15939ba5b71c221fb77ac7400aab572a9027f1a5a11deb1d232fa0dd2d3ef61de01b093cd5b934e50fd7c1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721777, "uuid": "623c6f59-0ce4-487b-ba9a-372903c3ad2e", "value": "T145C5FE546C10503A508B238168F08CD95931AF1667B9FEE678AD4DCB8F4E93BF5CBE60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721777, "uuid": "7a70cf14-c0ae-4c91-9438-ad2e2d25dd2e", "value": "96:ZAqzA8qhwVwSU6hwEeYYDvD/hxcYmwVw8Wf1+Czn2S2xul:bzqwVwSnLi98l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721777, "uuid": "7361ae92-939c-4da6-a99d-0b8c103c7cd2", "value": 2725240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721777, "uuid": "0074eb0c-7746-4f4c-bbbd-0980bb085ae2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721777, "uuid": "bcc2a180-2c43-46e6-a97e-de9e1c35d9e8", "value": "Contract_0902_717.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af162d3a-3420-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775745040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745040, "uuid": "c217b3e0-0206-4e02-b9d7-21440c57fc01", "comment": "Malware payload (njrat)", "value": "057f2aa175054b47c34d052bf466d6ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745040, "uuid": "af8812e6-1f8d-4ef5-947a-56c8975c177d", "comment": "Malware payload (njrat)", "value": "1b72bd4af0ebae9f4939c1a0d3d8f4d95f0a17575d8ef882334018e5b080ab10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745040, "uuid": "59b31bd8-a330-4eb9-b223-190d38aa1418", "comment": "Malware payload (njrat)", "value": "74009dddca0e11bf8e152c45edc801da1932dc23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745040, "uuid": "7012d1cd-4977-497a-81ad-01a892e861c4", "comment": "Malware payload (njrat)", "value": "c3fd788bd0dd7a07848f84f18749e15dfb074426c183f6887408f37fa4a9c5aaa1701e6389b59fd3ba4dec72d67cfb5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745040, "uuid": "c72e17d8-3219-4948-8f66-dba8b6b6bdea", "value": "T167E44C44B649DEA5E8064170CC29D1F21914BDAADA50614F39ECFF3FFAB3749100DEAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745040, "uuid": "06cb888c-2359-4cf1-ab20-13286114ac23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745040, "uuid": "24779c2d-dd02-4e0c-a9b0-6312a3803342", "value": "6144:QRbUNURygiHV0LkNjejZd0MMu5yRbUNURy4bSIIozksYPL4KJlsLGW4fz:xUROHVMkydpMupURZbnzWDw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775745040, "uuid": "1384ae3a-e5d5-4333-a95e-1c4332c77fbd", "value": 677640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775745040, "uuid": "b0da1546-073d-4112-87fc-f4677cc997ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745040, "uuid": "b660caeb-ba4f-4f80-b3c6-de5265e17b77", "value": "057F2AA175054B47C34D052BF466D6FF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f70edea-33e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775717446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717446, "uuid": "7ff461d0-91d6-43a0-abab-58bda9afe2bd", "comment": "Malware payload", "value": "d14957073353a23cc73907e4ec4d8746", "object_relation": "md5", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717446, "uuid": "a6a4cb01-e4e0-4c9e-9665-adcf5bcaca24", "comment": "Malware payload", "value": "1c4f83621ccbfd33ae0761025f53b04e921d40ab323945d1c13b509a1b88dde8", "object_relation": "sha256", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717446, "uuid": "e09816c9-b7be-4de1-a6c1-b6a049b37f0f", "comment": "Malware payload", "value": "f420931766077e6bf24cdf278a4d77f4dbd76bc4", "object_relation": "sha1", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717446, "uuid": "864f21ef-b3be-47e3-992b-22c02bddd941", "comment": "Malware payload", "value": "15967a039dca015a382976e5cf56d163f00e9dbac57939d73114b6b4b0a64c83a6673a77359b4d3d5b2616b2004314ca", "object_relation": "sha3-384", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717446, "uuid": "3d91feba-6bb4-424a-8103-3ee5b2fca7af", "value": "T18E716D1067F95708B5F3EB099ABF90A1483BB86DEE72CB4C8159C20D07B1A008967F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717446, "uuid": "ccd27905-89d4-4deb-b1d3-37ae805f8439", "value": "96:rsgsZ5KO30RkoH6Cx9Hx0RGuMxN7Lj5HjFpI:weOoE8MGuMLT5hpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717446, "uuid": "18df014a-dee2-4907-9334-cf580bb11072", "value": 3694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717446, "uuid": "36bcd0f9-b713-4dfa-92d9-c94c81cf0c99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717446, "uuid": "a8ffbdcd-cc8e-4f4d-a12d-a06e706e9256", "value": "1c4f83621ccbfd33ae0761025f53b04e921d40ab323945d1c13b509a1b88dde8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6217b2-341b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775742893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742893, "uuid": "e8303618-8cc7-4a2d-ad80-389448453598", "comment": "Malware payload", "value": "883dd0d1a098c1d0364285dffca8eefd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742893, "uuid": "07dadec2-1f58-4c13-9292-0f144151dc9a", "comment": "Malware payload", "value": "1f9f074e6acbd72a3f7610100b42a15807bcab71e397002132e73f745cc30951", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742893, "uuid": "fbadb9ca-0e31-4f20-8bae-4fa296a2ca0e", "comment": "Malware payload", "value": "f8a395877db672c2fabed113ff8fe2ebaaad980f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742893, "uuid": "cc79d8e6-647e-42a5-96eb-540eee25d6fa", "comment": "Malware payload", "value": "2840bbe4c39e317aae899a393e92ffdfa6183650fafbb1122757a278b24d007a46a0cdae6572f44a384152097a994b7b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742893, "uuid": "799e85bf-b23f-45f8-8963-57a462cce21a", "value": "T1D515294D511487DCC47E813188DF215AA4203629573C5FEFA6B25EA06F3ABD03FA6B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742893, "uuid": "2a025491-bf48-42cc-b424-c126d4913b02", "value": "7d8299715eadf6468fe2aef13e8e9971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742893, "uuid": "b974c251-9e98-44b0-ba0b-db908d69db59", "value": "12288:JPtxov3B05HEv2xqTi8e//l9u3Wmw1Ynm5kPLrUcj4Rr:JPTov3BRe/XYm5kgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775742893, "uuid": "266047ee-45f0-47e7-a471-b6a983d12414", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775742893, "uuid": "629ac754-9971-4a47-95ad-3745ff536bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742893, "uuid": "a151f196-66d3-4103-82e5-6c75815cecd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c5f6a5-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717028, "uuid": "bf332662-f133-4b55-b3a6-2296d0c38cb7", "comment": "Malware payload (Mirai)", "value": "32e5b87fcf52ef024c3179f0d3d53ed9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717028, "uuid": "ea1e417e-d5cb-4ffa-a407-000b1c8b2732", "comment": "Malware payload (Mirai)", "value": "1fc7b6e40eded1b3244db00fdd10eedfaa7d404102142dc1095df10bd547284f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717028, "uuid": "21e19331-c1a3-4e25-8b36-6619f348cb01", "comment": "Malware payload (Mirai)", "value": "e4a2a5bf3cdc2d4aaa68d047815479adda79772f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717028, "uuid": "b8b54350-cb40-49c4-99f3-91bc88c85ea6", "comment": "Malware payload (Mirai)", "value": "bc635cefb80ee7679f5a6a43f03ac6d6ccc211a09d626518be86186d2ed4874ec792af443ea17995fa0f50b97323ef12", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717028, "uuid": "0e9caad0-0386-432b-91f6-40fb7eb9b499", "value": "T12E03F112E6AAE282EBF86033E1DE75464991E52162EDC076DBD0903F5847F61EF3E610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717028, "uuid": "b3d05528-1018-47d3-b106-5000e964b17e", "value": "768:d2HJeRRzOfGyM21RgGW1Gz0kclnnKwHgLf6QjX4uFTI5wvqnbcuyD7UHQRj1:YCRzGGyDjbWP7nnKwAT6Aouawynouy8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717028, "uuid": "16626d64-7f6c-4bd7-9923-640edb74de97", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717028, "uuid": "bbecb3a5-dc33-4927-8140-a0757f0ab3f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717028, "uuid": "945f9254-5a9d-43fd-aeda-493823c54841", "value": "Hammz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e6e6de-3401-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775731819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731819, "uuid": "229bcf81-9625-4293-a42a-3e872802466d", "comment": "Malware payload (PhantomStealer)", "value": "bc670c44c70f002d11c87ae6150d2b61", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731819, "uuid": "b20b2bf1-cbf4-459b-88f4-1cdcf9a096b6", "comment": "Malware payload (PhantomStealer)", "value": "208d14cdd544485986e784e7d8cb29f7e0725a335cf2143b41ca8ddaa548d722", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731819, "uuid": "640e7972-ebbc-43ef-a381-e98c6344ba9e", "comment": "Malware payload (PhantomStealer)", "value": "6879ad7670a2e226615991533e21c45e1d0e2582", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731819, "uuid": "6634afcd-48bb-4fa0-b313-6339de261a0c", "comment": "Malware payload (PhantomStealer)", "value": "235c1941c0a38ca6868509e8e23836fc32c08da910138242dee6b07d0a618efc46a500e17adf2c1fb74309cc81118ec6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731819, "uuid": "81a99750-bc2c-4d9b-ab0d-b24ff2ea17b2", "value": "T16AF405541852BB6C4DA3D19BFA97ECB4A4C32E4E4F2D85C58081FCB21D98D81AEF3716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731819, "uuid": "4d7df359-3ec8-4706-8fe5-ec9b6e80eb66", "value": "384:Sss3sSC8BOCSBqVCss3tstss8tqVCHCvCHsLBtLqVCLLvBvCCsCCOt3LCtts9CHG:y4jxCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775731819, "uuid": "e98ac83f-d77f-4276-9925-f8440810802e", "value": 726895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775731819, "uuid": "6598b9b4-8607-46aa-9cbb-0d97a2b8cadf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731819, "uuid": "5505c065-4e34-4798-890e-a60e5d91dd68", "value": "cheche.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abf0760f-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775719265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719265, "uuid": "91022305-afab-4338-bbeb-f884caafdf62", "comment": "Malware payload (AgentTesla)", "value": "94cca701d5aee78f9d8c029c9b3b1664", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719265, "uuid": "eaba00bb-4ce8-4384-96f7-e57ffefcc51c", "comment": "Malware payload (AgentTesla)", "value": "20ad64d0aadcdac600fcbdc261f2d5ba2cc4ef327e04ae6ba65ed19328086cff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719265, "uuid": "db2c3552-7aff-4582-a3a1-b02ae54d1b4b", "comment": "Malware payload (AgentTesla)", "value": "7906812720cda461a185b1dcbbc831a7f2c52158", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719265, "uuid": "c2871e27-be34-4583-949d-eb7046bab312", "comment": "Malware payload (AgentTesla)", "value": "abb667c585a9193fe31401be4d39fe9fb379fef2a18f995cecde7866b32af5fa49c5f3f9811abc1288289c6a7a1007c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719265, "uuid": "6e3456f4-7c75-44a9-86aa-111c38612a77", "value": "T11E64E004F6FC1018F2B26F4968F429B24937BE622D1EA8FE16285D5D0BB2544DC7673B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719265, "uuid": "288d8fa4-9276-485f-a93b-a35c3af604a3", "value": "6144:dxQoAjEjJXHeX3rLUb0rLAgl8DOUvMPQ5IoQLfK44OdYjvKzlL:39Z6Ub2jl87Qm7wff4U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719265, "uuid": "33ec279a-ebc5-4854-b9bb-1319ef9e78cd", "value": 324136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719265, "uuid": "fe355885-e001-4acf-80ff-b23cc3be7e75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719265, "uuid": "a3c7084e-e1e4-4778-bd8e-b0a6e464bdab", "value": "6Kv1C4MS24fVFPcc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbaab92-3421-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775745363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745363, "uuid": "15faaee6-b90a-4872-b637-f84f1e572236", "comment": "Malware payload (Mirai)", "value": "f2db90a23e9c5945f14b8a1f1487ddea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745363, "uuid": "9fa37c83-1a94-461f-bc17-b1287904bddb", "comment": "Malware payload (Mirai)", "value": "20cf96138291997b047e72d275496731a13fc97b4243d61cca7e3914d5e15284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745363, "uuid": "9ee3987e-7a07-4e33-b079-117cb10637f2", "comment": "Malware payload (Mirai)", "value": "2fb78a3273230f2cab776b5a402f1547fa7a32f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745363, "uuid": "e5e07770-63ea-4d1e-9946-a29946ec94c5", "comment": "Malware payload (Mirai)", "value": "ff30eec5fea00df892416c89d2df1dd1b867d9f14c14bdcd589d1022dadf184f04aaf684c3db48f604e40de2176d5cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745363, "uuid": "7c5bef2f-c717-424a-8fea-020d3d7b5aa9", "value": "T168D3C021E4006DD1EC2129F578BA97B80350EEB00BDE5582EFFDE95E747BD94386D2A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745363, "uuid": "bdfbedba-ed75-46d7-9bf4-cf873e3c3fc4", "value": "3072:P5i8TNkAgcqyGp8l1CpE6AKUjqjVbyAEUbd/xe:PoS0yGp8l1gsmxbyjUF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775745363, "uuid": "26ff3177-4b89-4576-b797-6b1aabc41b5f", "value": 131664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775745363, "uuid": "77f29b80-f41c-42b8-89d6-aafa01c5e4b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745363, "uuid": "6ce141f6-4f53-4935-8810-1bc248699246", "value": "xnxnxnxnxnxnxnxnsh2xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562581ac-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775716974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716974, "uuid": "6f77e4f6-f934-4fd7-acd6-f7bc645ea439", "comment": "Malware payload (AsyncRAT)", "value": "a1c0d2899cab26e5a5c7b736f1326a55", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716974, "uuid": "4df042cf-9e01-437e-a5b0-4835270901b2", "comment": "Malware payload (AsyncRAT)", "value": "21117a9986e6c46e6ded575f875b254218d4d9b9588c1391fddf3b8b7cfa7e61", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716974, "uuid": "a1e2d4d6-c3f6-405e-9351-e0c754d62cee", "comment": "Malware payload (AsyncRAT)", "value": "3bbe522b62b3ccce38446a09decf093b684b03a2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716974, "uuid": "28295052-1be3-4eca-a54a-bb158b5a33bf", "comment": "Malware payload (AsyncRAT)", "value": "a9533381586066893cb048c81ea8b29a38aba3da9113bcbf24dcb8b1915cb088b9e8d8bda1d055be49075b9a226d93d3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716974, "uuid": "ceeb5ca1-53d1-4340-87a1-3d3dc8a3ce78", "value": "T117234C0037D8C13AE2BD4BB4ADF396058275D6675E03C6896CC864EA1B13BC59B136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716974, "uuid": "c60e2472-08d7-42c5-937f-8576ff054a69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716974, "uuid": "8006c8a5-1ec7-4c0b-ab7c-c720de238d38", "value": "768:gq+s3pUtDILNCCa+DidInovike8Yb1gesiR7zlEEvEgK/JHZVc6KN:gq+AGtQOdInXzbSPiR7p5nkJHZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716974, "uuid": "05ea3450-1070-48d1-a1e8-d18aa4459b97", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716974, "uuid": "fe85806a-ed5a-47b3-98fd-66b45e2f1142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716974, "uuid": "6c388b80-cfb4-4534-9499-4003e4653af7", "value": "21117a9986e6c46e6ded575f875b254218d4d9b9588c1391fddf3b8b7cfa7e61(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a04b96d-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775736254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736254, "uuid": "7deecb8f-1c32-47a7-94dc-e8b6f020470a", "comment": "Malware payload (Vidar)", "value": "21bee21556c81425c80e4aeae2ff4b62", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736254, "uuid": "82edcc33-7092-49d0-b7a7-69ea5c8684b8", "comment": "Malware payload (Vidar)", "value": "232767e3b2a84bc3a906a8eef2cccffcf9d21cf1eda388ed2b805ff90b4922a9", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736254, "uuid": "894a2107-bf86-4a1f-bec1-946c80404520", "comment": "Malware payload (Vidar)", "value": "4c0c21238e9fffbd0dc03c906f2c297c2f321b9f", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736254, "uuid": "8fcbaa8a-7c2b-45fa-9ac8-33be51830327", "comment": "Malware payload (Vidar)", "value": "72505434e873dd136c517f08957622da345f5089a1cc0c0b9f2c76ea0a9dd85651e350377f9a704c0a43a712d78d8657", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736254, "uuid": "2a01cd5a-7720-4d34-8eb1-a105c6b0efe1", "value": "T188651240B368CB12E47B4BF529A1E03017B62D8EE521CA468FC47EDFB573B509A99343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736254, "uuid": "57bd1fbd-7598-4748-b3be-477a2dd273b8", "value": "24576:cGgXrQa9O0RHr0cTvHh7jjRHhVtVDJzMkLKyvb8PYSoMtDVx+lyp69f6UbcIO:g7QawwH3JnVlMkmY4PdDD4DQscI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736254, "uuid": "e9eb8241-ae18-4b0b-9078-1716a5d90aa7", "value": 1443328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736254, "uuid": "5f1b3169-3661-4d1e-a78f-4b01c26e8945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736254, "uuid": "b0579813-8b24-4839-b438-821358c8fa95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bd1069-33cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775710269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710269, "uuid": "fea613d0-bd08-4f52-8d99-7a1c0420cea1", "comment": "Malware payload (Mirai)", "value": "2a710262a9649c0d1e6f3f0fdf6447bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710269, "uuid": "6e92eb01-9eaf-401a-82c9-4d5c1811a83d", "comment": "Malware payload (Mirai)", "value": "23e4e5a25b2ea7c3a014f6334581cfe8e996d6eb4447653a187aba94846daa03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710269, "uuid": "77a6bcf3-def8-4ffb-9120-e780b41e19d3", "comment": "Malware payload (Mirai)", "value": "83d5cc5836e56596bce92813aaf329f00b75410e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710269, "uuid": "3d51a53e-3f6c-4c6d-82f0-ee1bd2df9e34", "comment": "Malware payload (Mirai)", "value": "efa94f0a5834061b2929d605f929b6cc033cbfbce0caaba24109510944d2c5e77070d71c8da157fb599b01200344f681", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710269, "uuid": "e79a061a-551a-40f6-81d7-0ab6d3177f4d", "value": "T1FCF35B63E926AF16C152A1F4B1B28E741F53BC6A49571EFA64B6E9F48143CCCF2043B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710269, "uuid": "9698eb64-a51f-489e-8f4e-ec5c9e948d82", "value": "1536:R7a0wtulAFMLZlRZRs+YLhLCWKW9P9g2gcXKguBh6zCW/+qIQ0gNFxMI:xH5AyLZnPs+YLRsWXCgUhECWWqINQKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775710269, "uuid": "06ff31f4-23f5-42d3-a310-1c7e3d9da7c4", "value": 160348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775710269, "uuid": "b605b11b-31e0-4b7e-bcd2-68f19a7ae899", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710269, "uuid": "0e751aa8-0e45-4576-9e15-2e413d5db4bc", "value": "nsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f806bb49-342d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1775750746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750746, "uuid": "a88111ad-4ae8-4316-b9a0-777e16da7cf6", "comment": "Malware payload (Stealc)", "value": "72642a977bbee49088905bbe14851f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750746, "uuid": "45d487aa-b78d-4514-831d-b03d587b47b1", "comment": "Malware payload (Stealc)", "value": "23f5f8fd679564492dfb32bd3b34ba78ef5934d7535d0656d36bcc485bc2ba55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750746, "uuid": "d2e8fe37-25ee-4bf9-a376-7dac19f73b8d", "comment": "Malware payload (Stealc)", "value": "20b6346bdbd8ca5deb1a0c5b0475ee70d037a31c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775750746, "uuid": "3cfff03a-600f-43fd-901d-f69fb7ab74e7", "comment": "Malware payload (Stealc)", "value": "ff47da4759c7504a189b7a343f139a88ea5b060edc8c9502cccc568b88d4ee1dbf2f58735a41b3c19f9f7c37f7f31f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750746, "uuid": "1a6a4d67-c3f5-4a67-a5d4-a11c1fa8cd59", "value": "T183C32A3FE35253B3C85281BC330D5AC6F63E8474711EC182BF945A4A99F15825DEABCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750746, "uuid": "87a7ab71-1975-4499-8a4a-048e0785de5c", "value": "35571faf847f55722e8dab6e2b957528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750746, "uuid": "8946658f-22ad-4608-b51e-ac0484956e62", "value": "3072:xMTJ5iHi/67keMf96BWV3dNripIuvFRjoyOoGF:xWYk6/MsB6NIpLfjMoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775750746, "uuid": "e19d5eec-b522-4262-80c4-bd58784580ec", "value": 119278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775750746, "uuid": "f7f1c877-1f47-4c67-9f7f-b7f3694a70cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775750746, "uuid": "7ac2b966-84e5-4fdc-819c-786b6b9e356d", "value": "72642A977BBEE49088905BBE14851F61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37ba081-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719331, "uuid": "03fd638e-3384-47fa-b95e-9ee7dad6d83a", "comment": "Malware payload", "value": "49d58b2f02e9896ad2d08c80b9597329", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719331, "uuid": "299c8af6-1d8b-4acd-a575-ae24ffec4dc1", "comment": "Malware payload", "value": "243b31a71a46b9ded1d0638efc977466a149d61833be30cdf3593b17c95fb772", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719331, "uuid": "306bf500-f703-4f71-9739-1f5010b15320", "comment": "Malware payload", "value": "846c3b1361d274a4f8a6785d7bdd99fb27dc5749", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719331, "uuid": "6db5407e-d3e9-4328-8ea1-6c94b2f1bae4", "comment": "Malware payload", "value": "8d2cee3a007aaddbe2a9148f6105f7111ffc6feca7421c8d4ae182d8b7ce510f0c96a57f1617b9333b9de621391a7a2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719331, "uuid": "2f5f0d3d-82e7-400d-bc02-ca6b497e03b8", "value": "T1BD64CF06D3E59618F2B35F51AABD099818673DA36F4E90CD0C141D4E1DB2E28C8F7B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719331, "uuid": "62830669-f3d9-4a84-99e9-f56ff03bc9ce", "value": "6144:+aMUnTN7JqYBUu9LrjKloVwL9eUhFSf8vIMy+zjnqBaIXt5vewkiHq:XMUnZfGuKloVgeWSfpj4IXap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719331, "uuid": "fa200a77-8871-40b3-8557-e3c6a262882a", "value": 328226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719331, "uuid": "c649856e-2008-47e8-9e28-75b5cf6b2741", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719331, "uuid": "4808778b-c0d9-405d-9511-8e8ac56e35f8", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91aaa729-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736401, "uuid": "58b5deb1-b15c-4e1d-838b-fa1acdbb0054", "comment": "Malware payload (Mirai)", "value": "6d5f01d18fed9fd4b11a3b1d714d11d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736401, "uuid": "eaf1391a-69a0-414f-8bf9-8a64a9bd178a", "comment": "Malware payload (Mirai)", "value": "2462c317721481f28ee6a3be9f204472bfa3ee5e76e66d8ff16a1ae55d784c60", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736401, "uuid": "b0356bd7-6726-46bd-81f2-d20d31418164", "comment": "Malware payload (Mirai)", "value": "fb818cb50815c98b2dd7b684367799d27dbae92f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736401, "uuid": "8d13bfbc-492c-4fcb-a544-27ce98baf64d", "comment": "Malware payload (Mirai)", "value": "525099ec8256f2a2447c0c9a315c917d167fe0cff4ed88f7f7a7e13526ed163c293ca07d86374022f2cf493842ed4452", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736401, "uuid": "5e9e1ae7-e085-44c1-988f-91b9c5fcae03", "value": "T130B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736401, "uuid": "27d391db-ae00-4c39-b961-de3e65a67403", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhBohHw0pJbLy:XFmzY5mXBypzjYYZ/5+JklHLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736401, "uuid": "1c2438ab-53bb-4361-bc15-7073cf0ee7db", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736401, "uuid": "adef6401-77dd-419d-a7ca-1801c0286417", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736401, "uuid": "129bc5fa-e07a-471f-9e03-ef4a12f01e6a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f708d70-3445-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775760664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760664, "uuid": "4f4243c6-b823-455d-96df-50d6797026a0", "comment": "Malware payload", "value": "8cc73d3316b761a28f6307fc8ecbe004", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760664, "uuid": "8b07c3f2-1d5c-4a42-bca3-09a81fbc6530", "comment": "Malware payload", "value": "246650b4596f201ea17cd6071a96f7ab97dd62363fc206162d95c5ce8c38ea14", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760664, "uuid": "8dbd9da5-d59e-4ccc-876e-4484f5ee839f", "comment": "Malware payload", "value": "34db1d03290440d3ce2c05147f11fe51204c07d6", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760664, "uuid": "affa463d-65b5-427e-8a94-c6e0bdb6e5d6", "comment": "Malware payload", "value": "f3b52bfbd340725d29add684e79564b42362bfa7da03f7d6b0b2bf383f52584b1fa4058b3bc9d8885627ad40f64fc03f", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760664, "uuid": "9cc4d937-30d5-466d-a36c-ebd1fdb9715f", "value": "T17AC59E0B7DA545FAD0AAA7328CB351927B71B8090B3233D72E917A782F753E05E79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760664, "uuid": "97b5286b-fe0d-4209-ab07-c5a4b70e97c9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760664, "uuid": "806b696c-07af-4192-bfd1-371fdc6a8d05", "value": "24576:RqIYxIIcsJy8oYbwkSKfG0xiMBSAcxFuAnOywiUVeVU0KlVvBoHN0hheleh2Kmhm:RqIq2srbwkS69nI0VeVUTVvBoHfTHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775760664, "uuid": "00d26668-3355-4017-a14c-b877d4b841fd", "value": 2640088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775760664, "uuid": "29d066c3-f8af-4e41-9bd6-d858bc890572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760664, "uuid": "1bfbd67c-f4e4-4180-8333-0caad6fa46af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac0bbcf-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723665, "uuid": "5bb31135-552a-4ee9-acdd-75bc2109361c", "comment": "Malware payload", "value": "efd811a81ed3adc17e045d087a730462", "object_relation": "md5", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723665, "uuid": "153decac-aeb2-4465-95ec-ba3c2ae683fd", "comment": "Malware payload", "value": "24bf2a6c23ba7fbdc28bb230e2def67fa231dcb1212e23ef2e5364cf819960b4", "object_relation": "sha256", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723665, "uuid": "b84c72cc-a4f1-49b1-85eb-9d626e42acb0", "comment": "Malware payload", "value": "5928c5d3f73a49b65d1c9d5ecd4a5425e8ee703f", "object_relation": "sha1", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723665, "uuid": "5c21eb29-11b0-458f-b285-19ccfcdb7728", "comment": "Malware payload", "value": "7d44a686aa96b9cfc09c6edf7b54ef33aff2ad08d2ea1069bc5c2456c1dfd111a7e4035cb1fb756b718d91f066179fdf", "object_relation": "sha3-384", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723665, "uuid": "f859a1f4-19fa-4b3d-b8d7-70049efce8ba", "value": "T1C6C1491866E95308F0B3EB0DAAFE91A3553BB91DED71CBCC5169D30E06B1A008516F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723665, "uuid": "f0108b4b-37e6-446e-8f9b-ec9582bfe036", "value": "96:rsgsZ51d30Rr0Rr0Rr0Rr0Rr0Rr0Rr0Rr0RkoH23x9HtKaZom7LJtJm4q:whdo00000000oB3ZjJm4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723665, "uuid": "6e31ac24-ad79-41a0-b6a7-7dc51912fd1d", "value": 6046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723665, "uuid": "ef4e1cc5-ef7a-4e63-8f69-003a59f44ab9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723665, "uuid": "92a88e88-8bfb-47ec-9429-fb4adeb8ab42", "value": "24bf2a6c23ba7fbdc28bb230e2def67fa231dcb1212e23ef2e5364cf819960b4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d059f858-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1775719326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719326, "uuid": "193092d6-1d3c-49d7-91c9-42740d86e941", "comment": "Malware payload (DarkCloud)", "value": "dab015b7a7bbe1ea7497b702ecc176ed", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719326, "uuid": "c24612db-4a89-48fe-b160-16593b9737d7", "comment": "Malware payload (DarkCloud)", "value": "2593f1f466827aac609ce0a0975c49ac2735befe683ea7e8d5a32172db0c0880", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719326, "uuid": "a5b93e8d-e082-40b0-85d4-a8be73db3ec5", "comment": "Malware payload (DarkCloud)", "value": "95613aaf1accfb40cd7b547fda8113f4797636e0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719326, "uuid": "1a1ca1a9-5227-4d65-b6e8-c618820ae28e", "comment": "Malware payload (DarkCloud)", "value": "ad0b7aae818bb75418626e4ba4e0195c3678028421de940820412295a29b2aa9423fa2934e6686fa4bd0d4926a0fc93d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719326, "uuid": "7bb8cc43-aff9-4f88-ab48-42570cea90c8", "value": "T1FE64D020E7EE2544B277AFA6ACF96D604A3B7E72421DC0ED09145D8C0B76B084E53B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719326, "uuid": "30b4add5-5b31-4a36-b517-2af28327794e", "value": "6144:sQNU9eX1Yfqyzzrp7DdEWrElosLG4JPmcnUmd10DFCYXz80+:jGCyPrp7ScvMXJPmaUvgYjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719326, "uuid": "02b0ab03-593c-412e-b5f4-6bbf729e9e6d", "value": 325112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719326, "uuid": "0188ce8e-04a7-41ad-ab63-96c77cd3c2e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719326, "uuid": "aafaf74e-ee98-4cd6-997b-1c6497f387ad", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ae2820-3402-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775731874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731874, "uuid": "a9e445a4-91a8-4fd2-9f78-37943d442309", "comment": "Malware payload", "value": "ffb67ff369a8f97ff5bd82534792dcee", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731874, "uuid": "9a368fbb-7b9c-442b-ac48-092cd117b41e", "comment": "Malware payload", "value": "26ded320b6306c6a6d7dff63dd0f4e7d3407f223c038b7b8619a5378599b9b4c", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731874, "uuid": "abc4096f-0193-4a7c-8b8e-165e78a90989", "comment": "Malware payload", "value": "d7f1732d11e000ba71b7568cca8bf4125446cdae", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731874, "uuid": "e6c9e13b-9d70-45ed-9d4d-fc51a3eb1aa6", "comment": "Malware payload", "value": "723cca41204bfca40c263663f229d26075f0ce34d52dc6f13f1a122a14083850306fc7582bcfb507dd523a82477a4c6e", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731874, "uuid": "9eac227f-28d5-478b-921e-6288aae8a3b7", "value": "T10054226243C179A8B25B4FD76625A3D5E4F9D8383A440059EF752CF2EAFBA20C1B0731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731874, "uuid": "59589a5e-1ae0-48bb-b7d0-dccae39940bd", "value": "3072:JEwYQ/LMiAqyVne9QQB16gjRmEYUZPwXpbwuneBBHXX7IwcFLZel:xePpVneKQB16gjRmEYUZPwiun6Bn0Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775731874, "uuid": "69ca628d-d435-43d2-9a6f-6118540d6329", "value": 286700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775731874, "uuid": "de0f2439-310d-499f-be78-33f2a4940f6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731874, "uuid": "b654b408-a1c9-4261-98b2-0ce4c96abfab", "value": "2D Drawings List STP.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee2e074-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775718921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718921, "uuid": "b8ea5c6e-c595-4635-93b5-59cdf1b2cdff", "comment": "Malware payload (RemcosRAT)", "value": "23d6167325549c08f90bf7d1194e8790", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718921, "uuid": "0a708e76-99f5-40ab-ad7c-54a69e92aad0", "comment": "Malware payload (RemcosRAT)", "value": "278f4030a23f3482e099f08701890f9d0dbf21612fb8493ab663bbf911efe982", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718921, "uuid": "06bfdb18-d8a1-4f6a-bd9d-629d5f09349e", "comment": "Malware payload (RemcosRAT)", "value": "bf00b2ceb6217aaff4ab4188f5ff973cfcbe9821", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718921, "uuid": "983424f0-ea32-4c99-a5a9-00cbeb88220f", "comment": "Malware payload (RemcosRAT)", "value": "b433ab42b5fd4de1a9e41b21990e0396677c4e96729cfcba39149771c22c0a28faf92c89379054888b05a60ab8e3960d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718921, "uuid": "8864fb10-490a-406d-a661-825d73f9ca5d", "value": "T11D85731DF52640BE534E6A5A5000EC1A4368753FFEAC05BC7C7A2AB88537DD106B9F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718921, "uuid": "994827c1-6576-4af6-a477-192b46cf04e9", "value": "768:Gs7mc75q0s7mcweCipTMT8i5qnQmyQYr9fHa3txpDfgs4ggwL+D1eReCipTMT8DZ:X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718921, "uuid": "47d9bee6-95a7-439f-93b4-c91906447260", "value": 1796500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718921, "uuid": "7d4a81ab-36e9-42bb-9f22-2bb4911e6c81", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718921, "uuid": "efc419ca-c9bb-4b01-ae6f-7727e3047208", "value": "ACICO_PO AG-0407026-001_xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd42118-33e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775718245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718245, "uuid": "3f71573c-691b-4eb0-b290-3932004a44ff", "comment": "Malware payload", "value": "4976d03381654bed2d6dfdb8bc84c00b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718245, "uuid": "5b3352bd-2a1b-4c7f-a8d9-6128cd2f907c", "comment": "Malware payload", "value": "280bc36453dbe67957bf95915d7db2bbc563cf1b6c9d685e1a24f1bfae796290", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718245, "uuid": "17574f73-46be-4bad-bbff-c2b5247181ec", "comment": "Malware payload", "value": "4e9a2ab4e2dd5214838f1ab787d7f6dbfe3363f2", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718245, "uuid": "683b8023-6c48-4a2f-b75f-f63a1b703ff9", "comment": "Malware payload", "value": "a120faf3557e27eb3cedfc4ce822618e6b450feeab36494ff2980d6ce8f72c76d5db92eae5da0eb5cfebd407e52bef6d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718245, "uuid": "7e9f429b-39d4-46d4-a75d-d26327e025d3", "value": "T1ACD54611DD6D2E477B8264DED0DA6E765A8FCF5F03298CC9E07A3BD048240226DD7B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718245, "uuid": "5341cfbf-9542-4735-a4db-c01d26143a0c", "value": "384:t4ut/YaOfXovPSSL4ZnxXMCuIF97Wp9Ik+aqM6aHZuPPGQkLMvtGLQjGebUzlgQ1:9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718245, "uuid": "aafd69bf-24d8-4616-8432-d909a668c41f", "value": 2985959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718245, "uuid": "ef32ac59-9cda-4f47-aa51-eeb1767573eb", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718245, "uuid": "cfa35e92-0030-442a-a16e-9ba0358a4069", "value": "Request for Quotation-RFQ 08042026_YSB.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c2f93e-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775722268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722268, "uuid": "dafeaeda-2afb-482c-8767-bc95e0e0c286", "comment": "Malware payload (PhantomStealer)", "value": "d73fb4bae2db607a20ff0bd48fd54cb5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722268, "uuid": "7fd2e604-6fb3-41e9-b491-135cc862cb8d", "comment": "Malware payload (PhantomStealer)", "value": "289faa3fc9883495a43a049a2202584a422dc9b259750a4fbaf418c3d8cf5798", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722268, "uuid": "f6924e59-d43e-4b76-be9f-5df1af16077d", "comment": "Malware payload (PhantomStealer)", "value": "f8db86f4bd5ba7ae3338f9c5e574d6dd35aea133", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722268, "uuid": "c9ba92a2-0d2f-4ad0-90a9-0635ccf853b0", "comment": "Malware payload (PhantomStealer)", "value": "c1ef2edda4146c99f5085d2be6bba91810db3fc55d7edc9a9dcdddc5fc365a2c1378d492a0ee2947b695a0a825ff6405", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722268, "uuid": "20fca9ce-228b-48c7-87eb-d85dcfde8ecf", "value": "T15264CE14DBFA402CF2F25F19C5F999A5893ABD135E1EC8EE05040D0E46B6A94DCF2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722268, "uuid": "f7e1e71e-8da3-42ee-8d36-96484f5da2e7", "value": "6144:B4V05lBUZtwUSxYV6YO35c6MlljzUYQHW68jGaf6ofkNh+ZIc/s+e:Bq05wZtpU2Nl8d2rjpioIP15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722268, "uuid": "006553b1-c575-43a5-98f3-01a0818b29f4", "value": 330280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722268, "uuid": "9487c5cf-e5df-4584-b43a-953fd5658604", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722268, "uuid": "27fb61bd-3c2e-41d4-9032-2bfc2829a4fe", "value": "ROVqdjAxWYBmm96D.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a699dea-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717008, "uuid": "96a762b9-a585-4150-8d46-5ef30a2b16b2", "comment": "Malware payload (Mirai)", "value": "f140ce7eae2fcddf2dd217ef0c436237", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717008, "uuid": "154802e9-04b3-427a-b58e-033b3260f4fd", "comment": "Malware payload (Mirai)", "value": "28c82f066f09fc5dde84e0ac582313994bc9d737483bbeb5c31ecf7a5c99ed82", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717008, "uuid": "85304250-e65e-4450-93f4-1941c03dc5c7", "comment": "Malware payload (Mirai)", "value": "ff9f3bd4c1e72e2c19653b9f2f02fd20911e7d41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717008, "uuid": "c7bc8630-9617-4913-a8ac-8993705566c9", "comment": "Malware payload (Mirai)", "value": "45c63f65e0a2cd1bb9b287bb462d89a13acd42072cc5e798a38dd428199a7a0e0ed8555efdfc20150f41a9aebcac33ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717008, "uuid": "6a5f6921-6e94-44ab-aa49-da9fda255d69", "value": "T13151F6F510B107396CD199BB72B9851CB391D99B34C69E3DD8D874F444ECE0CBB52A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717008, "uuid": "c036d0b8-c5c8-4625-80f8-9fa9f632ee48", "value": "48:irIhIgrIkIyrIPI63rIQI1orInWInMZEsrI6I2rI+wI+VrIJIQrIiIULrILIGJro:iaJcWoYJMZEsPouzL2JCUQgVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717008, "uuid": "130dfa7f-f6a3-41d2-ae77-5012132c54b1", "value": 3044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717008, "uuid": "3f908bd8-9980-48d9-855a-0b1232f26ea0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717008, "uuid": "325e7a91-6e9f-4f38-9228-f28750daad47", "value": "Hammz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49036ff0-33e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775718240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718240, "uuid": "ca600c0c-c376-49f7-957f-ca155ea42b3a", "comment": "Malware payload", "value": "255a58b1be0525342a57926268b86be3", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718240, "uuid": "434655ac-b20a-48f4-ac60-8926628e3487", "comment": "Malware payload", "value": "2941d37b59ab71e459e58326d76b2f3855081aae576d2f7d01102f83a2616553", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718240, "uuid": "6c9a2190-b4c9-4468-be58-26e58de0a65c", "comment": "Malware payload", "value": "a0c34cfae3babb0a24677d28f1222a33c799c349", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718240, "uuid": "56b69073-49d3-4cb5-801e-81f6d5fee910", "comment": "Malware payload", "value": "9b4a8ae9b4a9de968e45bffa8ce9104ac4f1652c8f28eb94cfb70a577d3acb5e7b4a621788692491067de28f7c75c5a6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718240, "uuid": "3e2ce362-5e5e-45d1-ae88-e5b617612358", "value": "T135C52141A51148E8714CB1F0E850B5B5B11DA8096616F9CAD7A37CFB6E838FEC6B0C9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718240, "uuid": "50f72d30-8f81-45d3-8f3d-a1f64f68deca", "value": "192:fG6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6G6C:52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718240, "uuid": "7ea4576e-ea8d-4f75-9cb2-0d8d446a9eb0", "value": 2646215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718240, "uuid": "7239d1de-34d9-4838-863a-46815d209bc4", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718240, "uuid": "bbcf8341-cdfc-4fee-8bd0-d45a348d0be7", "value": "Payment_Advice_0977_08_04_26.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9c7b28-3457-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775768603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768603, "uuid": "f672fc44-68e7-4e7d-aac6-5d8f5a033623", "comment": "Malware payload", "value": "c0b73ff43312d442260328a8cefdf3b6", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768603, "uuid": "fb5a5605-cb15-49b6-aaa2-e07e75ac0ccb", "comment": "Malware payload", "value": "2a8ea9f1ad8936fb302243faa64b91c5767df411923715cbdb1a869e3bfd7e6d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768603, "uuid": "96c56163-9f7a-4db9-803c-d793da670af0", "comment": "Malware payload", "value": "4528d5cf07bf0e1ac769b390236cab1bf34b938c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768603, "uuid": "5a6da826-b718-4c16-a09f-d4d33e41f734", "comment": "Malware payload", "value": "599b38a7d33a3a28bea59779f15cac2858137d31b9a813b2c1e03eb10639d5da5021fa25473f2d2b506fdac3a13f76a0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GIFTEDCROOK", "colour": "#989EB9", "exportable": true, "hide_tag": false }, { "name": "UAC-0226", "colour": "#89F3C0", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768603, "uuid": "0e25e58c-cce0-4908-9879-97008c0c66df", "value": "T1CC35AD5AA3A411A9D16BC138C9574217E3B2B09557B09BDF07F48BBA2F23BD2173E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768603, "uuid": "663165ec-5274-4a5b-8426-e305d6dce0c1", "value": "9cc0896569982bd5caaeacf72c8f6f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768603, "uuid": "fd393cfb-4094-4ee3-8a9c-b8acd66456c5", "value": "24576:bPAwUTHcrdwpcqHbCof0fAY1PDtTS1BJk+aVCK9o9y2rht5qJRX5DVgvJV6J:rJUTHcJwpovAY1PDZS1BJk+g8trZq7/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775768603, "uuid": "6b358c14-40fd-4d81-a61b-cafb0fd5e17c", "value": 1117696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775768603, "uuid": "10278022-a932-47bc-a8dc-b343a8a229c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768603, "uuid": "e1b98586-0665-4d79-a33d-1064a371d684", "value": "decoded_arj.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0b5342-33cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775710273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710273, "uuid": "72ef5357-c0da-41b8-82c3-2c8973fb7470", "comment": "Malware payload (Mirai)", "value": "0ec02e392287789c6f424831250c6be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710273, "uuid": "3f8d93b8-f871-42cf-a894-a205a15b143a", "comment": "Malware payload (Mirai)", "value": "2bbb387226de2faa8f60eaa2988e6a9a05c6d41b191ef0f24f029b184f260677", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710273, "uuid": "8b71bb31-d601-49a3-81ff-1eb926798f6e", "comment": "Malware payload (Mirai)", "value": "5a2a2c89a627d25df9013c6d8e9566c51bd09a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710273, "uuid": "aee28595-5a3c-4f46-958e-eec2c9510a5c", "comment": "Malware payload (Mirai)", "value": "82a901779fadd089e26d07cee4e148c27fedcc0a5f8f29f9bf0d03b059c3bce92fe30f1536f89a58d5b68eecbad6f8ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710273, "uuid": "ad702cd4-3462-4bd4-a186-25edcca3c7e6", "value": "T155E31781BB43DAF3E85300F011B79B314A32FC3A582BDA91E3797DA1A9515C1E61A77C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710273, "uuid": "45f2f2b6-abef-4dec-ab4b-f4473ca90ce8", "value": "3072:jWI5PyDWnIhlSa9vsGJhYrBA6NWvY3yjXyHmLhE:B5PyanIhlRvvBw38COhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775710273, "uuid": "27c6a5a5-f4a6-453b-9660-4935c76faeab", "value": 156176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775710273, "uuid": "59b7a3b3-8c6d-441b-842c-c059f10f603f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710273, "uuid": "8d566189-ee7d-4453-9ef3-81cb9b71c74d", "value": "nx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc59bb9c-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775718890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718890, "uuid": "ee9688ef-d2ed-4f1c-901d-9377c9a512cb", "comment": "Malware payload (ConnectWise)", "value": "86a55c67a44858807aabc6f689437bca", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718890, "uuid": "24c2e5a0-bc83-4c90-9079-695d37e5ff7d", "comment": "Malware payload (ConnectWise)", "value": "2c77b540f0cf1f8bfe3f3668c2c47df775924619f7d9a2762d69b86faca0957b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718890, "uuid": "5e22016c-b51f-4fd0-b1ce-64f768a7d827", "comment": "Malware payload (ConnectWise)", "value": "8955a22ca642e1304fb6c6a8424b1cbf45190d3b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718890, "uuid": "1cc28e28-68d2-484d-b2fe-702050ee5fe1", "comment": "Malware payload (ConnectWise)", "value": "2ce06970dc4ae6f20a81711dbfcea7f1d3579b72651a2b95aa3cf58230e2068dec29cc7e97f1e9452388979331aa2bfa", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718890, "uuid": "0a610468-887f-4ded-a77d-e7fd1f135385", "value": "T1D421BD8FA307B2249EB2661596C72828EF916F728E5070755FD8955CCD21378B3BD087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718890, "uuid": "b523250b-e11e-4580-ac8f-c950cbaa69db", "value": "12:KY/IQmYh16GK2BXNjcC8wGKg5NjKDjaczp9TB8XI1kwbGJy5jGw+KjpGZsDM0p5N:1zdzPK2hNANeltZ6BI56w1AZUMaFSOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718890, "uuid": "3c906e61-cf7d-4531-84c7-e3e100a27db6", "value": 1268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718890, "uuid": "5ccf5b71-f471-4771-b492-3b99f3ac9fae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718890, "uuid": "22168f32-98d3-4eee-9b74-3cebf53b55db", "value": "Installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1ed31b-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775718757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718757, "uuid": "adbb7d1f-cfd9-45a9-9541-6b584fc723ad", "comment": "Malware payload (VIPKeylogger)", "value": "18a8b038a9f1018d67dbe51cdf85cefa", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718757, "uuid": "c6e4ac1c-c754-4cdd-9be5-cdbbd5651371", "comment": "Malware payload (VIPKeylogger)", "value": "2df582bb41d1e6f0a6d44e8dbc1d8bca8e3d332bb268685b9dfc381a566c63a6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718757, "uuid": "f55f5e46-abc9-4bb3-8d1c-cd164de427a4", "comment": "Malware payload (VIPKeylogger)", "value": "b1d9de4023b242ac4cf4450a224e01c57b89d1fe", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718757, "uuid": "d0ab8225-3a41-49be-bf95-b650c3911221", "comment": "Malware payload (VIPKeylogger)", "value": "4ba431912d02916de88e1e57db0e50546ff1255f2af4a9c296aea803a246e4d28f2b49c694de0020a6eaafc609b2072f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718757, "uuid": "ceeaef33-3a04-4626-be7c-ab0893e77e3a", "value": "T15FD5812050FBB7C0E661F9244F06311B162D0D49DBA6207E96C8FED8CAA265FF9C49F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718757, "uuid": "1f805b86-c216-423a-916b-0637c0c246aa", "value": "192:K23Oj1dFj0kdFjNrrj68gFEAYRjL0Xmuamumq:H3y1dpHdp8TSL0Xm1m3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718757, "uuid": "b2937930-432c-448e-afad-a139f5d63056", "value": 2755699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718757, "uuid": "4de9fb27-eb53-4416-bbf0-ef1c4e54079c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718757, "uuid": "c0b84d45-68e6-40af-8ce5-5b71e95dd5c8", "value": "_Quotation_042026KL.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424ac6e5-344f-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775765044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765044, "uuid": "408efc75-960e-48bd-82e9-cf6336e25e8f", "comment": "Malware payload (RustyStealer)", "value": "cdf9ff22142a50bfc398bcf36209eb18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765044, "uuid": "746e7628-ca9b-4b1e-bfe7-75dcd5bbca1f", "comment": "Malware payload (RustyStealer)", "value": "30803b05d6ff1fbf9f15831af1cf50e210b0ee6679badd8daf3f0e00aee90b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765044, "uuid": "fe86967b-f0f8-4c48-b0bf-15593634a440", "comment": "Malware payload (RustyStealer)", "value": "512412815866e55699ffeefa1880e6144fb8490e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775765044, "uuid": "b5739130-c48e-432b-b376-9f5dacda7e10", "comment": "Malware payload (RustyStealer)", "value": "8d0992331a9372618715afbe1f50583a994aae3dfc4fbb709de43bf8c8039babc239d88e2130afd629ad579750f3fbce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765044, "uuid": "cb3593f0-1b7f-4a82-a8f6-ac45e8be40a0", "value": "T143C502ED2C92B876CFCC0976C544006F61757AFA5AB0A2AD34E2FBD5142C908DB859F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765044, "uuid": "c289e92b-a32b-4f7f-8ab7-ea88560607a1", "value": "eb3d37cae5b55ff788a6ad9ecd9d46f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765044, "uuid": "bb30f22f-b308-416b-8923-ba655e5b1fbf", "value": "49152:APq50O84FtW4cgDo9c7P2J2CKKJguAt87Y15XHdfqwP5CYN14t30X:APq5ljFtWTr9c7LKquAt8s1BHtq+VHU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775765044, "uuid": "0daa3b1b-46c7-4afa-96bd-790a3787a6dc", "value": 2700288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775765044, "uuid": "60f53f8b-69a6-476d-b010-6a37f4114ad9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775765044, "uuid": "ba890443-6eee-4692-9b0d-96b7831b083e", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1486f081-33cb-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775708274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775708274, "uuid": "9ebdca66-a3b0-45a3-95a5-62dace35ac4c", "comment": "Malware payload (NetSupport)", "value": "85425de806a7373a22ce968eef1a561d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775708274, "uuid": "aec97930-42a1-4e5e-9360-d8802f6e5a9b", "comment": "Malware payload (NetSupport)", "value": "328e097831c74290f102dcf11c41bc4b7b82a37681d8df3690783ea8a9e3bebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775708274, "uuid": "ecdb2f03-ca79-431f-bb80-482cd0e18b8e", "comment": "Malware payload (NetSupport)", "value": "8930835f206921ae0db300f2ea7c69655e57523a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775708274, "uuid": "f7a74978-252d-4b1b-b951-17cb0ab043e2", "comment": "Malware payload (NetSupport)", "value": "1d72fbf456c638d7d548dd49e4e8e8d1c16e0f8f3bd83a1950d951fbfe2861048b0cdf0c1ffc46b0d15f2c6e7f707123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775708274, "uuid": "38eea847-f095-410c-be78-409b7b5ee9a8", "value": "T1B7F56C0BEDBD4CE9C499A234843362077F647C401B3163E72AE5B2692E737F0997AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775708274, "uuid": "42fbd01a-222f-4198-8e9e-201418632fc5", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775708274, "uuid": "8d20d9a3-9eb5-49e2-af12-b21d5c5c330c", "value": "49152:QFUvlQeN78lDKCU5gFZmCi90ZrP4B+YklsFj7Qc786:QFO447XCrwuTP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775708274, "uuid": "7ed431c3-fa08-4d65-a7cb-8747f1fea5f6", "value": 3566624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775708274, "uuid": "e0a1fd1b-c7e9-4b2a-a502-e988305eec76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775708274, "uuid": "d412b782-8c83-4c73-a96d-dc8d3017c8ff", "value": "SecuriteInfo.com.Win64.MalwareX-gen.71844241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f797ab4-33df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775716962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716962, "uuid": "a879c401-bcdc-457a-927a-c10e7b2f2c76", "comment": "Malware payload", "value": "b06aa0bd2ede643a03ddc75bf3447756", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716962, "uuid": "29f4a2ee-6044-4eed-b767-6bbdfbb5c076", "comment": "Malware payload", "value": "3412fe1fa2cf8c2ec7e13b036cc490ab6200d57efc69b149b6cfd46f8ca8c5d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716962, "uuid": "d08ffad4-d954-473a-90bc-636ba86b8e2a", "comment": "Malware payload", "value": "6f257e8e3ab1807c81e3f9ee4aac36c6a39d5f88", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716962, "uuid": "feeef4f4-bd55-43b8-a08c-62bc3655d6b3", "comment": "Malware payload", "value": "c909818197f6e07ec83a4adb24446c03831beb9bdeffbd5fce759855fd5c55cfd668a5f5cc6b93275c447d62510a3057", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "update35630-duckdns-org", "colour": "#8A67DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716962, "uuid": "53607a70-21f7-4aad-a859-3c199cf2316c", "value": "T141434C0C7BAE4A3AE3ACAA7DD871130453F8E5666103FB2BDEC86DF550A37E40111A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716962, "uuid": "6d6aebe2-52ee-425c-8cd3-96c70c5480e8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716962, "uuid": "33e9761c-7661-4b45-a392-85aff6e1584b", "value": "1536:J4E4eUnHK6NlR2x45/YfDJf3LUVbFebbErwsLU/:BJilMx+YxUVWgtU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716962, "uuid": "5c29918c-d2f4-463a-ac36-521ab145d4c3", "value": 57856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716962, "uuid": "0a788229-bdee-4516-9624-0af356eb5697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716962, "uuid": "d6e128ae-fb80-4dc6-b8d2-6fe9f4e53242", "value": "3412fe1fa2cf8c2ec7e13b036cc490ab6200d57efc69b149b6cfd46f8ca8c5d0(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a03030d-33c5-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775705733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775705733, "uuid": "8d2829f7-c2ac-4616-8828-da7fc597ce41", "comment": "Malware payload (ValleyRAT)", "value": "180a53a4ed9fdf37d68f57f722636a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775705733, "uuid": "7421a7eb-59fc-4d97-b776-633a123eda4f", "comment": "Malware payload (ValleyRAT)", "value": "361a736f60e1524fe013b5006539fc846c8797e6e58f8eeee34a7485181ad54e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775705733, "uuid": "2814395a-cab3-44d3-adf1-2822a6e4e9a4", "comment": "Malware payload (ValleyRAT)", "value": "c046cb258b32c2037440f3b703b34b34ec76acb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775705733, "uuid": "dd93ed4f-fef4-4fda-9196-af2f1b9ba8fa", "comment": "Malware payload (ValleyRAT)", "value": "c7cc83af143cd5f525a8b886f251dfd2b205786e6cb9cf7ef90b932b955abd06697c6361136dc1a4e5e0d367cbe0cc21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775705733, "uuid": "09b518d7-14cb-4d3c-99ab-1dd020592dba", "value": "T18064BF43B2A120F4FAA2C1B984312965D7727D741BB0BBDF0761760A2F336D09D3AB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775705733, "uuid": "47fd4007-03be-4b97-85d1-2d403f2c4963", "value": "98542742d40ec559c0b2be1029d43198", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775705733, "uuid": "892b8851-a3cb-487e-9e0e-feece78938b1", "value": "6144:FQ1LRWWYzODHbIk0a/7hsUgOhWZ+y9HViQzP1WoBoqMZb:FQLRdDD7Ik0mG5ZT7P1WIX6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775705733, "uuid": "1262761b-6bc4-442e-ad42-d1690f85b306", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775705733, "uuid": "5d48fd1e-3e05-4551-b67b-8dcd7907876f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775705733, "uuid": "db4f7f0c-e7a3-4e69-97f9-57ea17c0ad5b", "value": "180a53a4ed9fdf37d68f57f722636a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65980d39-33d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775710987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710987, "uuid": "53f68457-e169-41fc-86d2-e37dc697772d", "comment": "Malware payload", "value": "e54ee758c629b05d30c4dd10da197f72", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710987, "uuid": "6e0db02d-fcfe-412d-9531-3b43a8569fbc", "comment": "Malware payload", "value": "37f65ae6fe3e957681b184a67d6bd1df61a0fe97f69bb18f19896cecdcbe3c04", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710987, "uuid": "2a9c6fe4-f6a5-40e9-8101-a0281c5d2282", "comment": "Malware payload", "value": "017ff6b007f7a231e79ef055443b143b9f979d30", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775710987, "uuid": "f7154eff-afe6-4f14-b964-8d1b18d59f04", "comment": "Malware payload", "value": "cbc7a7f3d3950a753e783da8c2847e4753182a14ca8077ba84a9e1570d1aed29108aaf74616757f6a298af4ad7ea7ecb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710987, "uuid": "9a1a3798-2b4e-454c-81d1-d98e0ad837b4", "value": "T1A6137D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710987, "uuid": "5a3bc081-863e-4c29-87ef-398d5388f2a7", "value": "768:bm+89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bm+xco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775710987, "uuid": "212f7300-751d-4e55-847d-ef89a181488d", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775710987, "uuid": "23010ef2-229d-4999-b564-526057da3b87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775710987, "uuid": "0f54f3ee-4f23-407d-924d-ccd118486f5d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a283f3d9-341b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775742872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742872, "uuid": "285964d8-9dca-40bb-9ee7-835d448d01b6", "comment": "Malware payload", "value": "c1119e925e1350fac855bbfada288b10", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742872, "uuid": "2f5a4075-a6af-4707-abd5-f7e4c579af44", "comment": "Malware payload", "value": "38abef984eb4a0e55036ce9f1a925b0fd02885cfa5d2ffdec5547ec093c9f8f0", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742872, "uuid": "8201ba5f-6027-4d79-8a28-34357464811c", "comment": "Malware payload", "value": "ad0d9d7a97c81812431049d29283f6158a0d9ddd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775742872, "uuid": "872aac4a-185e-4137-b33a-d29e5f9d185c", "comment": "Malware payload", "value": "5b209ec0d29c314f5de35a94164d93b4f64a9d914f4eb3ea714f1e0cd90734e139605229724cae5160b15feec1fccf8d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742872, "uuid": "2a64f30a-e5d9-4be7-8835-bac0957ac47c", "value": "T140B58D217586C132D56F03B01A2DDA6A517DBE703B7744DB73D8AA3F0AB59C18232E27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742872, "uuid": "4f9d87e8-90d3-4dc5-9844-64c869a1a851", "value": "49152:BCqYaZrf5jSTUialqJrMf+7UVZDEFeV4vLNgmUESIEjPMN2lv+oBzYHMV3eVougA:3jSTBBq+A4veHjPMNaXYHMV39TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775742872, "uuid": "8445bd45-7a32-4101-925e-d411a91c7a14", "value": 2363904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775742872, "uuid": "b856a841-6265-495b-b2d1-7c6180778f3d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775742872, "uuid": "99a285cc-6395-451a-af33-87b8bc5f4f88", "value": "GuruguruSMF4.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc95e90a-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723615, "uuid": "4a881f4b-3494-4d66-bac6-92ae86832931", "comment": "Malware payload", "value": "8b4f563cc2cf98440ef3834869e88b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723615, "uuid": "708e8115-aba6-487a-b6b0-4e3fb8f0cb09", "comment": "Malware payload", "value": "38c2bbdb43b98874de2de2a084662f216d9bd5920df4b41fd10298bdc0feb7c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723615, "uuid": "206deaa0-7f9a-4096-b5e5-6d0421fb01aa", "comment": "Malware payload", "value": "681a56b66e14fc3312451d07d7cd54594c62b724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723615, "uuid": "0e329ff0-10f2-4624-b2e0-f6ee1faee274", "comment": "Malware payload", "value": "049d9d08fcae9638a84818898abfe6532c618ca1834e976e4f1dcdec001ece53b533a597031f0696256935c99703f2c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723615, "uuid": "f66f8025-ff30-4ce1-b54d-cca1feb7bbd9", "value": "T15AE6AD02B3F842A9E5BFC278C5625517EBB27C491720EBDF055495A92F33BD09E39322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723615, "uuid": "cb8e2fe3-7a1a-4c7a-a07e-66efdb5c5ede", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723615, "uuid": "8401c468-b8e2-4736-9f60-79b44ba2ce89", "value": "196608:7dvIyQs3CY9eO8OwcPFGUe64I9zlxOxoBFDuUswlYQq:7drz7whrrI13OxojGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723615, "uuid": "c339b0a0-4cfe-4a3c-bc99-c09c9d3548da", "value": 15040367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723615, "uuid": "e4d8b08f-1ef6-45a1-bc42-3a600a4feb24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723615, "uuid": "c6bbcb36-2710-47fc-9a4a-d7b1fb345386", "value": "agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a427f1-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775718796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718796, "uuid": "27c46e39-d1b0-41ba-9317-d6ea06af6c70", "comment": "Malware payload (AgentTesla)", "value": "c84da87a147a5d65e7a0dce83bd5c01f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718796, "uuid": "4370f12e-c683-40ed-9c5d-75c0ce2a607a", "comment": "Malware payload (AgentTesla)", "value": "3a3d2ed1e6bf9cd0de129fcc90e0acb5ae4deb39f6f6269e6e4172edeaa6ea70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718796, "uuid": "b6c8089e-75af-4a03-9a69-5889a1cb4293", "comment": "Malware payload (AgentTesla)", "value": "d1336c48df3c92a9e357a82385a85ad0f587a886", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718796, "uuid": "a421466c-140a-40e2-9814-1f18bafad5b9", "comment": "Malware payload (AgentTesla)", "value": "26fb521b9b82697fe303348e672e6cc71983d0db6984885a351e2f63055144b7bf91397dd8f93e6f3075974749d36943", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718796, "uuid": "a660ff87-f905-4a4f-a7ce-018a959e768d", "value": "T17382B51A890ADFF006793551BA6B6816B9500323A934394DBC8FC6ED3F3A654CBE05FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718796, "uuid": "ecd6eb27-a4f8-476b-946f-a94bab5e85e3", "value": "384:KKp73RBalLxSnVnJCiyH4VFvFlOIhVjd7MxkJuQpqq3ftcc3iCdo+U7zVoWrc:KsB4Qq4jimTnjXc7zVoWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718796, "uuid": "8852e738-fddc-4698-8305-2f5e939d8e42", "value": 17640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718796, "uuid": "16d6ba56-8c88-418c-a477-126053a8021f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718796, "uuid": "7426be25-9685-40ab-8773-1052cf715c81", "value": "Doc_0122_04_07_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deeb6a96-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775714197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714197, "uuid": "54f6fba6-0da8-444b-8687-f718f8ff62a2", "comment": "Malware payload (QuasarRAT)", "value": "ec42e237b45f0c1f64a26471c2af052b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714197, "uuid": "4d58c4ff-b5f0-4861-ba10-e29df4c18ab0", "comment": "Malware payload (QuasarRAT)", "value": "3b26ce148913d262afb47286ff168053598036121a560f77e585d42628a8eeae", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714197, "uuid": "a5045688-793e-4032-a119-c6bd709c493a", "comment": "Malware payload (QuasarRAT)", "value": "a331896ca0edbe7590457790c4ab74604aca14e8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714197, "uuid": "c8d47604-936c-4499-801f-fd7259df5bd4", "comment": "Malware payload (QuasarRAT)", "value": "d27b756a2d96617698e90302413037aeb7bd8d9a844df8c31a5e93bf7736376383c4ea4a68620a499ab166b6468203bb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714197, "uuid": "f44a185d-81f5-4344-9cd7-0ffa05d28633", "value": "T1FB31F04B2A1026264D31C7F987AE1351E24B03975C001AC772FD84576F7D6EB97E198F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714197, "uuid": "16797bab-a177-410f-9717-5ea9ede2f15c", "value": "48:JD42oYDuw6cSqtt7zhwOkSw7t7sahUcRKRgm:Evw6qniOYRHacYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714197, "uuid": "ac0bc8ee-0189-4fed-b8f7-3febc4e7930d", "value": 1646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714197, "uuid": "d594597d-c8c6-4e53-a7ab-71603ab6c4b7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714197, "uuid": "cfcc76d4-4a0e-4038-9c41-14a8c76656d2", "value": "go.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6a3841-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719321, "uuid": "0e07173f-d6c1-491e-9dd3-856081df9a54", "comment": "Malware payload", "value": "5708f53185370f718b47893086e85f87", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719321, "uuid": "562b3418-f765-4f17-9d04-f37e46a7d49e", "comment": "Malware payload", "value": "3b292243889555f80a18041cffaaedb09764ffb957ac1f9b5060233c8431c15f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719321, "uuid": "21cdc031-7cf9-4aff-bceb-acd3f2d6d5a3", "comment": "Malware payload", "value": "d822f1ae697c4bcbfd218c5c8a12d1a78fee11fe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719321, "uuid": "d2791d3a-a122-428c-89c0-1053f135cb8c", "comment": "Malware payload", "value": "5e89f48ac54954e86801ea574525292924e9581a40025a8d4155747461b400423394cf789d29bee5ee5f5f0d24d6c0ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719321, "uuid": "32050387-3962-4396-8ce0-8fd645919cd1", "value": "T1ED64C011F7E89114F2F20F41A7B91A41C86A7E97AD3D94DD09290D1E4EA2F08D8B7E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719321, "uuid": "4d9b3028-6e0d-4525-ba0e-d50ad86b0564", "value": "6144:WI49y2unwQVXv9u1VPEIc/ILgsnnp7a0kEGgk3Z2Ck35vmHg:WItNwQVfMX5cAla0rkNk3xmHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719321, "uuid": "0d33c039-8b76-4c47-99a8-ccd2691195d8", "value": 330450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719321, "uuid": "29ea013e-2659-416d-aee0-b27758dde992", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719321, "uuid": "280e58b8-9cab-4829-88b5-070f4da672f7", "value": "01_RFQ.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9067ee-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713874, "uuid": "22a56d1a-0644-44d6-ad87-d6b24c4c75f3", "comment": "Malware payload", "value": "32c6c8dc15b164f51814a1b9e0c69fb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713874, "uuid": "d59381d1-b6c9-4c3b-a5a9-9ed850b02b6f", "comment": "Malware payload", "value": "3b74dce5e65c483c8f435ba6dd8105e35353176a8bafe2420d99d693373abd46", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713874, "uuid": "eb3bebda-28fc-4a5e-a2c3-449ce3d10e97", "comment": "Malware payload", "value": "dd89729bee7ec3b9636346f34657eb1465be194b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713874, "uuid": "f8ece109-dc05-4581-8695-b329167ebe4b", "comment": "Malware payload", "value": "66e18cd90f0fe327aafda60ee5efeea758d7553a72f0cce4268073ec34de7cdb0622ae3b2089facfb80cc7cb7e6b77e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713874, "uuid": "cb2c5f0f-3f08-48b8-bbdf-8681c62e5abb", "value": "T11A5352E4C7660F65CE0BF9F3BD8CE88738CA8D85D4A38D25A61940AA9C57C1240F6F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713874, "uuid": "eae64f55-8dca-4a8d-b353-fce108f3b04b", "value": "192:qIF4BATDCGb0btNtxQ1UroG86ToxHjRDm7AiyQ2ZBQ25zsLj6MorKxAN4oY9WELV:qICs1UEGjTkHl+r4i/ezBRWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713874, "uuid": "ad0e0c58-9c12-4b42-a774-8708b171984a", "value": 63391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713874, "uuid": "53efb721-2fdb-416f-9cdd-68600dc6680e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713874, "uuid": "1b2fecf6-e481-4eb7-886d-738c0502b150", "value": "SOSTENER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42afc820-3454-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775767192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767192, "uuid": "4a61c129-dcae-41a8-8d55-ba7f09da79c6", "comment": "Malware payload (Smoke Loader)", "value": "370db96eca99c717d9e9c94799d3b82e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767192, "uuid": "f2d76445-7de8-46d1-ad1a-4e4a12b0ae9e", "comment": "Malware payload (Smoke Loader)", "value": "3dc8f13b9da9dd37e7d722caabc38f2e8286b959c5e7a34a7e3f55603724ce6a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767192, "uuid": "2e7706bc-6cc0-4304-acb2-6fb8327505fc", "comment": "Malware payload (Smoke Loader)", "value": "a47c13f1c8b5c2671b96ee2005fcb3cc44a6aaae", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767192, "uuid": "3aa0334e-5a89-4abe-b9d2-6f20914b0a81", "comment": "Malware payload (Smoke Loader)", "value": "2c65a41a9aca5541dae2c3ec0b3621aaf916ebc96e2e72e129b4f5c23ab6506bd29f4adba7599c2d7eadad4eec37f130", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767192, "uuid": "924ae23c-4f46-47c8-a257-b002fdfe8cb8", "value": "T122A57C0F6C9548FAC49A673288B31592BB71B8090B3233E32E91B6793F767E05D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767192, "uuid": "b0ed5291-ead3-443d-99c1-55c94dcd06cc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767192, "uuid": "8af77302-e0b1-419b-91dd-172b07bf2ad2", "value": "24576:x3ZHwFjSmpQOnxTKxBQCmAfl2ZurDDFhheleh29mhPzrbz:xpQlS1OnxeFm+2oDUs7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767192, "uuid": "0136be16-4925-4046-8d50-1068650dfb72", "value": 2121944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767192, "uuid": "38feaf6f-8926-4f7f-9d2c-17dca26fcdab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767192, "uuid": "16a80187-3bc8-4e0a-9c2c-50eb5bb10cd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab62fd5-344b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775763609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763609, "uuid": "1b4ac516-73bb-4d3a-acfe-a0d94f9e23ca", "comment": "Malware payload", "value": "7f913eb4b551dcbf6e832313c6fc9817", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763609, "uuid": "16d7d693-5b2e-46f7-98a0-903c5a798f9a", "comment": "Malware payload", "value": "3e122c324df994af9664b2e4e3381d57b3ff67778b4be008bbec3e6519cfefcd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763609, "uuid": "60719a9c-3c3b-4862-8728-736db36c18a9", "comment": "Malware payload", "value": "2656c0320c2b64c957cec3c3d2eb66a05773ac19", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763609, "uuid": "19f1a9ba-3f51-45c4-afbb-ab1d6e25d2d3", "comment": "Malware payload", "value": "eea85efaadd252fbfbbdddffb4ee96a813d843c9bb64bc6cc12bb5ddf840ffb0ce8989d43c694f967d2cdfb8e665d589", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763609, "uuid": "e1d45cf7-e1d7-4f9e-9445-2ebf16b541c3", "value": "T1E936E102E2964ADDC46BC0F8C5112E67F4BE78310B28AB367AD84B646B53B3057FD746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763609, "uuid": "b5e84f77-4837-40b0-8845-6a31cdd88711", "value": "c05cf134dc19034ad65ea00a44098560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763609, "uuid": "143b57c9-3c1f-48ff-a650-0e7442f4ae45", "value": "98304:aGTAOXlFsdbScEH7fA+wwn9W2dtG0MFUkr:3TFWmcEbfApwo2dtNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775763609, "uuid": "9c66081f-c374-403f-b0d9-dcd2ca8fb460", "value": 5273616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775763609, "uuid": "e2f4b1ea-b2cd-4696-897e-696353607eeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763609, "uuid": "11ffa5d4-5363-4856-894f-384b4e0c15b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6fdfa7-344d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775764366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764366, "uuid": "d710167e-0212-4e25-a700-29e5247b4042", "comment": "Malware payload", "value": "08e8a05b09adf35cb438095454db4453", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764366, "uuid": "111fe3b1-94b0-41dd-92e7-463d8092f164", "comment": "Malware payload", "value": "3e986c92e595499a3f56cc562bf7ca29d60c368079905791afc6f5547b23a43b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764366, "uuid": "d22b493f-c399-440d-a5be-75b15b11eafa", "comment": "Malware payload", "value": "107bb24e7bbbb2064f825d7b4c31a3aa4a8cda40", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764366, "uuid": "61a240a0-7de6-4f31-86e0-551c16490b07", "comment": "Malware payload", "value": "da754eea1c540b77c05da861f866176d5b903ec325195a40b5966655205184d11af2acbfd11dff812ac2e870e4573579", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775764366, "uuid": "7ffd384b-ae45-48d8-b144-493539b4d8a0", "value": "T16B6733DDCD5413CAF9BF883144AD768BA66ABC269C428D7726B9F22200B779034F4C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775764366, "uuid": "50c720b8-9818-49ba-95e9-0f94fa9d21ac", "value": "786432:Jq12+TJcV5jF8L4kYjZ7vUqa7hlAPAsTmC+jw2lu7CH:Jq12+TYUWjZv0lKZcwmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775764366, "uuid": "3c41efb6-58ef-4625-a10c-579ba5690bf3", "value": 30027776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775764366, "uuid": "0ac6594d-d8e5-4a97-8e48-582c114ea63b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775764366, "uuid": "1ce1afe9-49bd-4cc7-b4cf-afa6489a9c63", "value": "Deep Sleep 2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0bf95b-33f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775725199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725199, "uuid": "23507652-ea50-4d9a-b887-daf0f7ee4902", "comment": "Malware payload", "value": "6da4c3d6c852aa5ec8ee54211b484e27", "object_relation": "md5", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725199, "uuid": "057291b3-b57c-42db-a652-f7dd0b12d7fe", "comment": "Malware payload", "value": "3ef35cdf980d818e3868bbdacccad9c0eadb57bb57dfec5d1582e9ca0e517f62", "object_relation": "sha256", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725199, "uuid": "97b0bd82-c445-43e8-9444-fd08276917d8", "comment": "Malware payload", "value": "681f1d27e391dcb54dfa9805e52a6b6f76d549e3", "object_relation": "sha1", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725199, "uuid": "248a6882-6df2-4756-a09a-fc037966f389", "comment": "Malware payload", "value": "667f8c2656fee0a2b8b73758f0246479d5d65d8b5c0cc79fea69cf6865b640b92bd9b0f07f3d74e7360c5b32b3d7cb62", "object_relation": "sha3-384", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725199, "uuid": "803f4fde-1146-4a18-ab7c-326335547081", "value": "T166249E1672D508FBD9638176C8E70A1BF6727853D738E66F03A406969FAB380522BF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725199, "uuid": "83e4c261-2c96-4356-aec8-d37192606b73", "value": "90d642f597b8983215e1f1e4428efbb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725199, "uuid": "94218ef0-31c5-4991-9ff8-d7cf0385ccf6", "value": "3072:wViLM8CMxBNaby4Nk8A7wFOPVLCY+gSgUWStQ2SNvUxs6AaoOBSSbVVjVHeXC:wVdMqnk8A7w8IkSgUDevUxlJoOBbSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725199, "uuid": "49004e50-aea7-49cf-b8b6-e890f16f0fb5", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725199, "uuid": "f3efcd5e-0fef-45bd-b307-b337730a169f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725199, "uuid": "9d709b2e-19db-46c2-8e7b-0636839d401a", "value": "3ef35cdf980d818e3868bbdacccad9c0eadb57bb57dfec5d1582e9ca0e517f62.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799f7182-3454-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775767284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767284, "uuid": "892ce352-932f-4e88-913e-2c30bc2a6340", "comment": "Malware payload (Smoke Loader)", "value": "c90cb6c12c523b64252a783e33571dc7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767284, "uuid": "089e4ebc-2e0b-4963-ba35-cb2b016612b2", "comment": "Malware payload (Smoke Loader)", "value": "411712111b8de5ea3f989ee113069f6ed4dd8881e05a76414322cbcb0e36f5e0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767284, "uuid": "94ce428c-3b10-4a1e-86ab-979aaeafd6d8", "comment": "Malware payload (Smoke Loader)", "value": "228cef48bae9e59f53f9abe4d995974f41a38e0d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767284, "uuid": "8f67287d-1b9f-4b39-b56d-0c5b80aba329", "comment": "Malware payload (Smoke Loader)", "value": "b8efd51b5bb1578b0991d89bdd942b2c182458cb939edc210af93255c6a818a9ae68c1d52ebbbf193429f7e4645cc903", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767284, "uuid": "4319439c-b419-4b5e-a6a1-bbba0cb0932b", "value": "T13BA56B0B6C9544FAC46AA7358CB75191BB74B8090B3233D32EA1BA743FB67E05E35748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767284, "uuid": "94d947e5-a797-4a4d-90b0-e5c2e4bdcb86", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767284, "uuid": "76448352-528d-4015-92b6-1f551675bd6d", "value": "24576:KqFqjVz2m3SB9RwEJyncRrMsoOiakdhMNnqU9Fhheleh29mhPuqU/jR:KsKVzn30RwEMncRXaMNnVasG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767284, "uuid": "7ea4d97d-009d-47bf-a0d2-230780420f15", "value": 2169048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767284, "uuid": "2130e60c-d2d2-4893-9e58-b1230e176793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767284, "uuid": "44032a89-8421-4c39-ab4b-1c0830d076a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f905d97e-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723689, "uuid": "b99490a9-ed77-4118-8c21-60e2b9da5bf2", "comment": "Malware payload", "value": "5d9f3b435e46e3232e6f4cf42d424ccd", "object_relation": "md5", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723689, "uuid": "fd25dd36-355f-40c0-b942-6991f5559e2f", "comment": "Malware payload", "value": "42360d2f8b46ebc55acf64c2ab77a603ee6d1eeef9f56f2f0b90f6a6632a9d83", "object_relation": "sha256", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723689, "uuid": "0b398713-4e66-44d4-a3ce-03622393e5d3", "comment": "Malware payload", "value": "b7e96849f1b45e8c6c3692fd7999eb508ba67760", "object_relation": "sha1", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723689, "uuid": "c95612a1-de5e-43ce-be8a-5d23d142ed62", "comment": "Malware payload", "value": "414ec695be12b5090621b24002b55645b94672ef61e5556a147892a96b1193e96fee1e5ab9ef3b73a15cfe07514bcba7", "object_relation": "sha3-384", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723689, "uuid": "f8392810-cf64-4ece-a063-4fbbf0b24aca", "value": "T154165D1F6F4E2045AB1F41F6ECF537D1813EAFADA3484840A0F05E364AEA54B3BD19A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723689, "uuid": "e76a2375-10aa-401d-967e-7d6cde2d61b3", "value": "96:xPxOlMilRlbY8X/Q8EsbM9qoIJWpO7DD7N05XLzNArSw+cZPqJolAtTrdpk:5oZDNRgmWp0DD7mZN6SwlZim0Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723689, "uuid": "bbff1b77-fdd3-420d-8c4a-fbfb0344c567", "value": 4353622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723689, "uuid": "086a89dd-8390-4296-ba52-183a3e77bcf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723689, "uuid": "cc9627a1-0761-4912-9b0d-cc60ce6760d2", "value": "42360d2f8b46ebc55acf64c2ab77a603ee6d1eeef9f56f2f0b90f6a6632a9d83.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18c61f1-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775714201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714201, "uuid": "3f8fe44b-9bc1-45fb-9c35-42f0cae0ed10", "comment": "Malware payload", "value": "0fa79ccfca619448a4365051def33e1c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714201, "uuid": "a24a0bea-fe16-4b9d-987d-d517710475d9", "comment": "Malware payload", "value": "447d222e7bfbc06da7890915dbdcb7ffc8a513749b95853263551cd836bc2572", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714201, "uuid": "97853799-a69c-4fae-b0fc-2d853bf47c10", "comment": "Malware payload", "value": "2c3df255532e08cec64cd108eaba610cca3ae99d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714201, "uuid": "6252d7a4-dc14-4731-a316-795b969ad252", "comment": "Malware payload", "value": "ef5aded26267604673872ec7bf834fe50d5d02f549363e7981e5d6cfc999e9467e45dcb763f07fe96afa1e03ea31d825", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714201, "uuid": "aa2c9928-b072-4bd9-9645-e5f023c17ffd", "value": "T16E5221BDC5D1BCC48B6B32C079ADFBD2104A9B137A671BACF1CC04610751799ABB968C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714201, "uuid": "53f4cc3c-2e61-43a5-bf16-e1b695fa71bd", "value": "384:wsjhRyhNrdwRDBr9LU9cLj19pw7YYbKoHKZZ3h8ReUTSSkXFGMnD9acE:fC6d9IySYSqZbK5SEM7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714201, "uuid": "28671b5b-2d3f-4d5a-bdb7-9a45ae415b15", "value": 13505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714201, "uuid": "8ac3585b-3d03-4e81-a5ee-580d16d1eee2", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714201, "uuid": "f9cb20fa-8af6-42e9-b9c8-0febf720d05f", "value": "SOSTENER.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c036a092-3465-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775774704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774704, "uuid": "615a79ff-34e6-4af5-9114-89643915e5a2", "comment": "Malware payload (Mirai)", "value": "618620da711377eeb09e10f1f15fc858", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774704, "uuid": "dbd32b70-f045-4874-ba45-9d9455f1a238", "comment": "Malware payload (Mirai)", "value": "46f66ead0d83052945e8965de7d5e3146785bb01618c2ff2487fa8fe67cde293", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774704, "uuid": "2a90e12d-3b96-4b51-abf2-0d96291d696f", "comment": "Malware payload (Mirai)", "value": "ea35da42574272b44da5364824ed282e9e2d08fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774704, "uuid": "be0a3171-6df6-4736-bc9a-e09389ab2f57", "comment": "Malware payload (Mirai)", "value": "f70e04bf88786a32a52740a87a5b6cccb9f5bb30fe5a004a31f503c5fbcb9568c183069cc219e56c4d0b8b1db7815fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774704, "uuid": "cd8f5ca9-f5d4-4f70-9999-6aafbe83cd86", "value": "T13F243B46EA408F57C4D227B9BBDF824533339764D3EB63068928AFB43B4769A0E77501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774704, "uuid": "b3ad4e18-5e30-4e2a-b78d-01d22347fe6a", "value": "6144:8L10nvm6UVYyaoaigRYb9lTkmoHVHzpOWM/9+z4nR:8L1IYYyaoaigRYbTFAVdOX/Mz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775774704, "uuid": "ee229bc5-a499-4627-a99a-467731c27e06", "value": 213013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775774704, "uuid": "00df680c-26d0-4520-b60c-7dd5f23b4294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774704, "uuid": "7a52d304-fb34-4241-9d86-6b7b384c2460", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff167dc1-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775722411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722411, "uuid": "3ae467ae-09e5-4b22-b517-97cc8bdbaf27", "comment": "Malware payload (PhantomStealer)", "value": "32289521f7abe969aba9ad65c383b133", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722411, "uuid": "12993365-4636-4606-a6a6-bfa82c2329d1", "comment": "Malware payload (PhantomStealer)", "value": "47499fafe309fe64ca6707e1c1a2e59fb4be2446e4f1655cee8cfaef764ba439", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722411, "uuid": "96f092c0-0fd0-42c7-93ac-d2e1886be2ac", "comment": "Malware payload (PhantomStealer)", "value": "4deee0fe91fe6c4a5eb19d1c4b6dcbba20725b56", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722411, "uuid": "0206dbe2-76de-4d6a-8eba-37dcbcd1a69b", "comment": "Malware payload (PhantomStealer)", "value": "da845c5cbd313faa68f9d30280236f6ddcabce6defe65eb61ad477345cdfce40511be2f0b4abe5ad6404136d79c9d593", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722411, "uuid": "ab6ce41f-5c80-4255-abfc-33adcf232adb", "value": "T13064CF01EBFD500CF6F39F19E6FB1910096BBD565E1EC8EC04265C4D0A36A4889EAB77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722411, "uuid": "63c15a63-bc3f-4905-a2c1-17027baebb95", "value": "6144:raw5oWeeueVlwilpBBIk5rDp35F64G8KSkl45v0ulM85Ghy9:uPFed4ilmO5aVhl45n5Ghy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722411, "uuid": "98bf5d20-e9e3-4ce8-9a53-8166aeb1f778", "value": 328448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722411, "uuid": "c32fc58d-c34c-4713-a19a-d502faee345d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722411, "uuid": "9554de12-921c-4bed-b443-5fd43a705e36", "value": "PO SCO-20260407.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8113f83-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775714185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714185, "uuid": "b971386c-1057-406d-93a8-ca4fd1719bb7", "comment": "Malware payload", "value": "6bed869d5ce681ec735e087c84107689", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714185, "uuid": "6c46403d-fe81-4b1e-b3cc-540a0cf9151b", "comment": "Malware payload", "value": "47d8113a537e43ae6b27862dced3f3ab858c0212841f8c223dfebf00201da3ef", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714185, "uuid": "563ccc13-5ea3-422f-b9e8-e8c3d44ec458", "comment": "Malware payload", "value": "43ab3faed9eab9412bb7778a32d4f1a3b9917f25", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714185, "uuid": "7b577c47-7732-4c8c-8af8-8896e044fb8c", "comment": "Malware payload", "value": "26b60e367cbde8b0d6dee22f13062d08cde87ebf2e4e6f25008e0f80b64ca9beac69c756a3ad4a711b9287d74227a4c5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714185, "uuid": "97deb792-686c-415e-bbd6-3cd16e340540", "value": "T158421A26B975D235D75A1E708CD6F2469524BCD68E87912F3A41F33F64303D0D92821E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714185, "uuid": "31d81c9e-ffc7-4d6b-a740-90d7a3c1f411", "value": "192:fp9DTUZmPXhKde7yEdIDaXFSzV414G4EC34Vsb:frnb5KszVSB414G4EWesb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714185, "uuid": "a58f16ff-6fbd-4ffc-a816-e09a39956758", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714185, "uuid": "88a0933a-eec5-41ca-b5e6-38fc1d22bc5f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714185, "uuid": "da072f03-ad3f-4a88-b05a-e9a8aafd5192", "value": "Swift S6076122688-000008133-CN300.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d025085-3469-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775776229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776229, "uuid": "ad0c8b99-104f-4074-ab22-9277d509c9d8", "comment": "Malware payload (Mirai)", "value": "12aa392232ca71fa5da2f646e78176e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776229, "uuid": "88edb103-e14b-43f6-a4a9-338bc2adb2ae", "comment": "Malware payload (Mirai)", "value": "486a7037d7e708400b88fd7db4d70e94e72a40e2593775cc48a6ce7ca58ad1be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776229, "uuid": "623a648b-892c-4621-95f1-38082573b9fa", "comment": "Malware payload (Mirai)", "value": "61c5d70abcce7759d153b8808a00294cd3de6d58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776229, "uuid": "a7d8b1ff-b76c-43cb-8d88-7115beb2b47f", "comment": "Malware payload (Mirai)", "value": "648abb1d809c9ea28f27ddf8542f5158545ddced429046a97c350807c30ea6c5e5ccd86a67023b7165588570c03f6bb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776229, "uuid": "ef3ba479-f4fa-4190-ab43-bdc3a94b2bd4", "value": "T1DC241B01BD518F53C5D32BBBB79F42993732672887EB7302DA18BE742F4669D0E29211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776229, "uuid": "371b8357-1b73-4b22-ac7f-612c8ce07a16", "value": "6144:NFRCgUuNf0jskrAKQ09sb823Zyo4KiKH3vtZmLE1SMyV+lH1:NFRCbzrAoGbl4KiKH3vtwLE1SMyV+lH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776229, "uuid": "76cc1253-6e29-4ec4-ba2d-9516fd114625", "value": 226599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776229, "uuid": "33d3cf69-80cf-4bf0-8e30-774d245c797e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776229, "uuid": "52853583-1655-4735-b93c-4990d0f68bf5", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb4af5c-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723588, "uuid": "10e65844-f000-451c-8d44-972ef5c17446", "comment": "Malware payload", "value": "3d5274a6421abb42b26545272ad9b3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723588, "uuid": "fed3d824-b16e-414a-88a6-0bb04cd35c64", "comment": "Malware payload", "value": "49af17975dadf1063915fc892a4c87ba7ef8a0a52018dd32e3493ae74a0a54b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723588, "uuid": "52743f63-b3d8-4227-aeee-266f056cd802", "comment": "Malware payload", "value": "a4ca9a372779ef9916dc2f8c9fad1c5d5a344b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723588, "uuid": "3fdcef35-f110-4fd2-b578-276c7cf6a638", "comment": "Malware payload", "value": "e322a15f0ccfc338aa67f30f63e51056aab3f349a161dff098c924321fc12595aef97a653fc3a2f995a06e105b66b64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723588, "uuid": "714965d8-d792-44b4-925b-f1c5a4ab2b34", "value": "T1C4C2924677E44258F0FE9B7A98730204463ABE5DAD31D70E1DEC800E1DB3B0499A6BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723588, "uuid": "9848c481-6127-4776-a0cd-19950fddb3da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723588, "uuid": "5d029bc6-8c90-4f1e-960d-ea82b6fe78a7", "value": "384:jSemQnmGCt/mN9XGA28Loe3CNP9RVaCT+ld/rBXdDOME1B7JnmOSTQU+4nWekVxx:jSFQnmGCtmpoeo9R4sor3EFAh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723588, "uuid": "db4d78dc-2912-4f29-92e4-1545f2cf324b", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723588, "uuid": "b89fd75a-ee84-47fe-91c2-8599125f4f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723588, "uuid": "0a9e89ef-cf73-41ac-9347-d6cac28a3f91", "value": "hvnc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4e4821-33e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775718194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718194, "uuid": "c9b2af3e-7282-435a-af31-a2f8ecdd0f36", "comment": "Malware payload", "value": "f787606424b4b797702c17b42e15e4ca", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718194, "uuid": "0a1fde41-fae0-462e-b448-fea97f779c2c", "comment": "Malware payload", "value": "4a6a5bb52e97324c3901deaa666a91328eece6f2381ec7e0a72795debf57ffe5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718194, "uuid": "ad48cfa2-288a-482c-a8e9-407eac186638", "comment": "Malware payload", "value": "e26508d1f90676b8c2910f9a40951847fc6d3fa8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718194, "uuid": "6aad7b52-1f86-47c9-8303-20f0e6148006", "comment": "Malware payload", "value": "dfd21a5be83cfa502e6e854d8021f998bfec233059f8633ddff8ee1e955b83d3d9a67cd6a8f68b211159fbb3a1ce762a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718194, "uuid": "f6503741-6fe7-4266-98b9-f1913025a1d4", "value": "T174D573870E3E1F41C1ADE91D8A8F5AC6BC7C1BD332A8ADA78C750C617E365E0462761D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718194, "uuid": "373f52e9-4b59-4395-88e2-8642608798f2", "value": "96:5AsL8iV6hkuYPehx/kuRHrMRj19VXlq1g7zCXT:pQhkuYExrRHEt4GX6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718194, "uuid": "b3219966-d37d-46b9-8f77-32e341f298ae", "value": 2984067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718194, "uuid": "18ee3fa4-c77f-4c11-ab49-699f3692db98", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718194, "uuid": "815e693e-3bf9-4518-a487-9ef9230ac537", "value": "Request for Quotation MK FMHS.RFQ.08.04.26.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369ada79-3414-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775739684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739684, "uuid": "7998f6b4-9827-417b-a2d5-3c6326d3391e", "comment": "Malware payload (a310Logger)", "value": "49b475958577e429675c11614181824c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739684, "uuid": "45e0a7c3-448c-4182-bba9-4c858b3888c9", "comment": "Malware payload (a310Logger)", "value": "4ae5afdea39b3fb5897b6b799476ce6c419cac926de811d3844e1779750f7f42", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739684, "uuid": "099708a5-33e0-496d-8017-25585e213ca1", "comment": "Malware payload (a310Logger)", "value": "bb4d56301272c90b70ef2fd7943351f9051fccc3", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739684, "uuid": "0fc39f0a-3745-4579-bc2f-ed9cdfcd6b2e", "comment": "Malware payload (a310Logger)", "value": "1e7f3beac2dbb0b0c1318dc3e1d4e66bea39ba11364ed8766b0b294cb08b6294f4de5204013fe838575ea95795460cec", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739684, "uuid": "eafe7669-4fca-4c8d-a53e-f2eedd2c71ed", "value": "T12B451290B2A8CB02E8FF4FF50AB0D17503B6AD9DAA21D2065EC67DEFB53A7100555783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739684, "uuid": "5b35cf29-6f80-4732-b989-37af72664df9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739684, "uuid": "0bf85d3c-6e69-4e6f-b406-ea689f387583", "value": "24576:zGRX1f3Oim2pjcBEThuJr/QKq2bKkcDB2QTxDwj:SF2/26qE9/QebKkct1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775739684, "uuid": "b8c3f7ab-930d-4812-8586-1a986894d7fb", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775739684, "uuid": "0c17286a-b8cc-47cd-8136-88ee28049258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739684, "uuid": "987c8977-373c-4afe-967c-3d809080f1f9", "value": "TXBsouVeX93UBWU.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e05f0a-33e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775718236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718236, "uuid": "f84edc84-121c-44f4-ae75-e2e9426522e9", "comment": "Malware payload (Formbook)", "value": "8a76a2ced525edff8f43f8301dd903ad", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718236, "uuid": "34e72593-a811-4377-bb97-1e7dc2a465ac", "comment": "Malware payload (Formbook)", "value": "4af155941c33440f41066c2921cf11751dec770659ea2addcdbad749ccbc84cb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718236, "uuid": "8775b0c3-bc48-4bf1-be09-19113d59644e", "comment": "Malware payload (Formbook)", "value": "7ec8aa8ddc6f2e8e9478720c4154f32a1dc06d10", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718236, "uuid": "0d779c36-c743-4e43-a380-d6cf58f2fac5", "comment": "Malware payload (Formbook)", "value": "a439855f27b676df4a522fbd348b254f838072fc840ca563f900c1c398f70d147952e5e9b78b877a4b5d9ebeda6189d7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718236, "uuid": "b408d37e-cc0d-4f9f-8394-9e00b5156c60", "value": "T1D8B2313ECA85DFF00B2B31D1A56F7916A9240327B5382A5D79CFC1993B356508BB00EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718236, "uuid": "976e9289-16e0-4aa2-ad05-fb1ac488eb2c", "value": "384:K82bJOQ5Dv/TijpYActBf5eKVBsJhc0xu1ZFxx5KbS9+Su7djmWY1C2KwTrWC0s6:KxJWYntJOGE4tlIiJKT6TGXuJjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718236, "uuid": "760355b7-40df-44d1-a3f9-9c430ae0ded2", "value": 23705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718236, "uuid": "9c154589-14e1-443f-b4b3-0e8285358249", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718236, "uuid": "dcffbd0e-2179-4c64-bb55-49274d53039d", "value": "MT103 PAYMENT 67839900290.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2c4065-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775723564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723564, "uuid": "d0e794d6-6f7c-444a-b26c-9b248259ca6f", "comment": "Malware payload (AsyncRAT)", "value": "4802915c0890f7eb300d6bbb01ae5e93", "object_relation": "md5", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723564, "uuid": "fb63a8e3-aa90-466d-80e9-1e5bd4c2b290", "comment": "Malware payload (AsyncRAT)", "value": "4b3b9e2e24a56ab342bb517e97acbd203d37a090b0159401bb6a54fc11230b88", "object_relation": "sha256", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723564, "uuid": "99846093-508d-4c62-ad83-9917d4c87a87", "comment": "Malware payload (AsyncRAT)", "value": "893636c4b0b0ac0fb880c65b0ea66c8c5a04226b", "object_relation": "sha1", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723564, "uuid": "d24e13be-3a11-4924-aec0-99689f970e9b", "comment": "Malware payload (AsyncRAT)", "value": "1d479c03047c69da09195af61a9964bf9319930b9ac9b270cffce0a048cdf90798d9401e7ac3cd3ad6dd77f8a1918fff", "object_relation": "sha3-384", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723564, "uuid": "e4e8e538-aeb1-4bae-8bc8-87048b17f2bd", "value": "T1E5236D4037D8C136F3BD4BB5A8F3A2058279D26B2A03C6596CC851EB1B13BC596536FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723564, "uuid": "1edb1693-fa3e-4bff-bf4d-feb91d90d3d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723564, "uuid": "419437be-fa16-4d09-9591-2d8ee73e5c81", "value": "768:Eq+s3pUtDILNCCa+DiPN/aZjVCZiWLbiYbDgeKQ5fEbvEgK/JDZVc6KN:Eq+AGtQOBScxLbBbc1Q5fcnkJDZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723564, "uuid": "feae7ed4-d489-4a76-9ff5-0380f6a04974", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723564, "uuid": "2c6ef5dc-e9af-4b17-9f6a-6b66665c7f40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723564, "uuid": "521e98b4-7601-4e62-bfac-9b5777220cf0", "value": "4b3b9e2e24a56ab342bb517e97acbd203d37a090b0159401bb6a54fc11230b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce49218-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775714193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714193, "uuid": "62d4a7da-fd13-42f4-90d0-030927a53829", "comment": "Malware payload", "value": "d4daece32268202e4c958a1262f35877", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714193, "uuid": "d770ae5a-2f5d-4ef8-9d3c-aa824a194ea9", "comment": "Malware payload", "value": "4b57ff1fb792e2c017d725f7152985613d1ff34613d518a0368d9add945b66e7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714193, "uuid": "a55555fc-2ff6-4d94-a162-4303e384b073", "comment": "Malware payload", "value": "99384708e06264322957ab5700e257795a79db2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714193, "uuid": "b4bccee0-bdb9-4a0e-9de6-58b2e9405094", "comment": "Malware payload", "value": "fb61ad39c073e1f74027282e421364c8be97def3c62f7380b9012e7180fff77ade8fe32d578d050c2729db13d53dee82", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714193, "uuid": "b5182903-a381-432b-959f-0601da686372", "value": "T11BE02B055B24D1C0A8A5E7D35568919581FC41937C15E1FBFE818BCB1EAFAB443C4C8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714193, "uuid": "281a58f7-7a4a-4de0-84f1-25903f630225", "value": "6:hFqrTFILwCfLKzd+2iN7yeQjMtIBuyN5L2fPSAqoUF045:rqrGEGKAHNJQAtIYynL2fPSAnUFX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714193, "uuid": "6a9c509e-00bb-433d-b7a5-b4b763b2a82a", "value": 294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714193, "uuid": "20dbacf5-2172-468e-8070-1b52f2837c00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714193, "uuid": "3f90f30b-0328-4736-8394-3cae99cbed15", "value": "ccv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0f26e4-343c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775756984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756984, "uuid": "f6b29c19-dc26-432c-a8ee-f349f9686e72", "comment": "Malware payload", "value": "660efa6ef10d3f575bc3fadc207da050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756984, "uuid": "6d62e4d5-09d7-4565-b2a7-ae312f6afbf4", "comment": "Malware payload", "value": "4ba0d3ae41a0ae3143e8c2c3307c24b0d548593f97c79a30c0387b3d62504c31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756984, "uuid": "57efef9d-97cd-4760-8c1f-21df6c1f990b", "comment": "Malware payload", "value": "6d504e6af3124409d6c86b50a89a8c2e83f9ce31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756984, "uuid": "d420f895-e3df-435f-9225-fc53ffedaf2c", "comment": "Malware payload", "value": "cac28e45ea1c839a7fd77487fb390534e91259bc7d32f9942bb8cee9bd0487b162ab09ba8fb3685300acf5c816ffdc5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756984, "uuid": "7c076663-0d17-41f8-bc6e-0f7c6ae9ebe3", "value": "T103D73356EBC39151C8C483F6080E8E7169C3ADA3520B5B3DD0A7763A14A919BB875FFC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756984, "uuid": "a8a492a8-3c0e-4ddc-8ac2-9ac5e421797f", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756984, "uuid": "81bd2eaf-1340-40fc-82c8-142da8773cfd", "value": "1572864:dE83khQpeHV6OaYcMEFoIcelQPWN8zjnY9Gl2BKtD9NgwL:dEWkKCRX4cpGml6KtzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775756984, "uuid": "db83217d-1fc7-44e5-ad19-49f81e15e278", "value": 61810400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775756984, "uuid": "9415d401-e728-4b1c-afc3-7e016d1d043e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756984, "uuid": "7efec436-193f-41cf-aa8e-13151e5ec93d", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d4b8a2-3464-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775774022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774022, "uuid": "127abf1f-18b0-4d0e-a53a-a81bd91337ed", "comment": "Malware payload", "value": "4f3477dad7f9c356a8917fb23e2dc15e", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774022, "uuid": "617c0843-4568-4460-9fc0-0dff40aefb57", "comment": "Malware payload", "value": "4bcbb3d7a3a687fefb0c848711e334645b3df2700cdf751a74d30dc101c601d4", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774022, "uuid": "e3010b94-5747-4aa6-b96f-edbf6d8b1145", "comment": "Malware payload", "value": "c3ec0392a7a684cdbd3ac49fa3b067767e5a8149", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774022, "uuid": "b394abe7-23fc-4384-8843-e71a942f6592", "comment": "Malware payload", "value": "8586d46eb7d8c05e9b71de04868c40320dd086a76f109d9923414611359f84abe88f8a71c6365b82bad3864d0b996cb0", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774022, "uuid": "16fc7e91-a8aa-4ed5-a01e-243bf64dbcd1", "value": "T136876BD4396DF826E2CDA77C6F75239C7324BC041B91E31A24057FAA9DB22D897331A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774022, "uuid": "52b5c9a8-ead7-4e31-9ef6-a5eaa3ca7971", "value": "393216:6D2stzCctTPIx2eO66cocE45fpv2VKs+xgm8zMZUW8n:6D2stOc1PO7kM8zMiBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775774022, "uuid": "55c7eab0-8dec-45e2-8ce4-c084871ce4e0", "value": 36619056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775774022, "uuid": "9aca1c89-7983-42a9-9ede-3d6bceb394a1", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774022, "uuid": "c8f0606f-f7e1-45f8-b6df-86a605a7ee6b", "value": "SoftwareUpdate", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df57c07-33dc-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775715671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715671, "uuid": "0fafbf38-ccd8-42ba-a6aa-4973efd628e8", "comment": "Malware payload (a310Logger)", "value": "282589748e679410909b0079eb97862e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715671, "uuid": "599a0bfe-6ce5-416a-9599-027512157ef2", "comment": "Malware payload (a310Logger)", "value": "4cee7b23a41ca8f37b9a5c931f883952ba8404a6704bfdf415ac5e13ea5ef1c3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715671, "uuid": "e30e5604-27a7-4193-b9c0-e380282e7139", "comment": "Malware payload (a310Logger)", "value": "15cb89eb8687e4b4bbdf4ae6f3a333389b64045a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715671, "uuid": "54f1123e-d12c-47fd-a2d1-8cdaf97f2a5b", "comment": "Malware payload (a310Logger)", "value": "95f6f9c0bde59a6d0b1519e2a48c36afcd433b4c83926dfe91b93497366af9ac1451ba9e2ce494222738f9b28e9ea997", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715671, "uuid": "fcdb7e63-e58f-4952-a791-0801a1a1e4f4", "value": "T193B5021589C42FB9DFAC561840FE160E53F04E8E5016B98AFB33FD4ABFA7A04521B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715671, "uuid": "68045762-8567-4d79-9af2-b0454060059d", "value": "24576:ISh17whd97/uioN/mlNXonLwfVq1k7WmndEaYcEiOqHpAckbYMoKRPla1gHoboNN:I8EH9K/K44q1+2QEdBcLgpfsST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715671, "uuid": "781f0922-8548-4960-bec0-16261eca8e64", "value": 2402034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715671, "uuid": "9eb3e10b-0c9c-48f8-a4a5-55a445bfd0fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715671, "uuid": "87de1b34-f9e0-426b-8d7b-7c7abbaff63f", "value": "Dekont_____________pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd75764-3461-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775772793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772793, "uuid": "8a7b053c-adf4-4947-9665-7bc81a879ca3", "comment": "Malware payload (Mirai)", "value": "4ce26acf496d98452ef12f61efb01af5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772793, "uuid": "8351151c-8470-40b2-8fa8-f95093fab933", "comment": "Malware payload (Mirai)", "value": "4cfa07a995eb955543c60f62e076e4f42c6789762724400e23f657a4e7fb7a34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772793, "uuid": "ad8c6a58-d2c6-42e7-8b99-4b968e0588bd", "comment": "Malware payload (Mirai)", "value": "9ceecd1544f258270fc8614b2ba36d00f3296ac0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772793, "uuid": "8fd62117-dfdb-4e22-b56a-b77c03ba0ecf", "comment": "Malware payload (Mirai)", "value": "0faf60f1b1761201d2cf196cd67f90f42393c6b9622cee60b30054820b80f29e0157f4a8629a632a98611fc0a56ad446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772793, "uuid": "9f2b98a7-8e29-4c9c-a44a-855412750beb", "value": "T135143B02731C0A83D1576EF02AFB17F183ABED5119A2A544F62EFE846332FB15509F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772793, "uuid": "0e690b3a-fea5-4c46-b920-2f1b14bce0e3", "value": "6144:P8f8ooaFmz/xKsNbQjooSAbFtZmTK4+Ehj681A2hNNmt1:0EooaAhQMoS4lmTK4+Ehj681A2hNNmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775772793, "uuid": "cc79cc5b-cb42-40e5-8dcc-bc6fe2c0628c", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775772793, "uuid": "bbfd8562-e5ab-4296-80d5-f921f2f9e3df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772793, "uuid": "b11abb71-410a-4d22-8181-7b2cb16fce19", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55a3985-33d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1775713295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713295, "uuid": "5eb68b04-4d00-4ccd-b0ba-914dd6454143", "comment": "Malware payload (Vidar)", "value": "f32396dd4324f6feebdb4122f7a4e80c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713295, "uuid": "5b13d6ee-952b-4b09-8c83-4e6a33fe0c6d", "comment": "Malware payload (Vidar)", "value": "4da1efe7994b85d1b6591c17fd223bd79486bc19570eba66c3f07012e5f6524f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713295, "uuid": "d788ca76-26ab-49bc-87f2-0f0f437a9525", "comment": "Malware payload (Vidar)", "value": "d86d2a0653f79a5a77125e8b6332562ee60a3533", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713295, "uuid": "ba56b87c-8a0e-4e6d-ae29-9408c20e1278", "comment": "Malware payload (Vidar)", "value": "9b5bc519eb1b5961dcbccd6f1865f72120e4d2d5fd7f4bd646e7f196e3f0a95fe533a4d1f823935cc17773c1f609544d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713295, "uuid": "3e1a1943-9ffb-447d-914f-d4946671e8de", "value": "T187759E30A9DD4DD1F197B0F12E3661EEA2A3618353F4668B12D68F0A1B2743D47E3AD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713295, "uuid": "6608cdd5-5d4b-49ff-9626-dc117e7ddfb2", "value": "ea54e4894a303b4ac278980d4a4a5608", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713295, "uuid": "b078667c-15cf-443c-8b94-dedbe6343a45", "value": "24576:X1jEwWjAHjti2nv2yoI44PZjNDmg7bkbUTVgKs+bRg:FuUHZBvvPZHq2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713295, "uuid": "97099c02-acba-4d58-a8f6-dee94448bce2", "value": 1640960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713295, "uuid": "075df3e8-170a-4119-8aeb-509232a658f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713295, "uuid": "7ea5cf57-4740-4348-a41b-36557c9ba479", "value": "4da1efe7994b85d1b6591c17fd223bd79486bc19570eba66c3f07012e5f6524f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f07f5b-3446-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775761351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761351, "uuid": "b3fd252b-6f73-4374-be8f-4f7055f2b48d", "comment": "Malware payload (RustyStealer)", "value": "c674343a04792a40de62abe2efeedde1", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761351, "uuid": "30460747-36b6-4229-a8a3-d7715fa27ec1", "comment": "Malware payload (RustyStealer)", "value": "4e57a67bf5a1dfa198bafc192ed47016f1a043c0c8ae0349f32c02ed17d296d4", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761351, "uuid": "a54fa3ea-7b7e-456f-b248-cb2b8285f061", "comment": "Malware payload (RustyStealer)", "value": "571893d4cdd68706d8cbf5bcd1b4db66aa283e05", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775761351, "uuid": "bd3f9857-47f8-445e-a47d-b42a216c59ca", "comment": "Malware payload (RustyStealer)", "value": "047b7b990c2879c276bc246e4171199f9a85ba8f535aa43b6b0eda2f35535031fa2bdd17ee131aafd25bd0449fd3b222", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761351, "uuid": "d302defa-c981-4249-bbba-0e8a5e26cd3a", "value": "T1F574D022FA4599F9E505C07883145A737B7674CE1B32A6FF02AD51352E69AF22F3DB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761351, "uuid": "43959d55-fbfc-4d2e-a791-27cc1250a68e", "value": "6bcff8328581a4a08123a99be868e27c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761351, "uuid": "63d437b9-f642-4603-a24b-23f4c3b0fc6f", "value": "6144:+1E5KRdy6tt8hFZqq3681Yo1m1rj1jY2aVZWSAVMfprx+ISag:8cKu6tkqq36YEn1jY1ZBlx+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775761351, "uuid": "39d3c949-1c97-4a61-ba59-4addce181e1a", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775761351, "uuid": "e03a8e29-ab01-4ec6-abbb-db12a5edc4b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775761351, "uuid": "5983217f-0cda-4e37-8f77-f2a00ca96c26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529b5df8-33d7-11f1-a769-42010a9c0008", "comment": "Malware payload (BrushLogger)", "timestamp": 1775713532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713532, "uuid": "ef6bf00a-5cad-4349-9afc-8d85e254ffe6", "comment": "Malware payload (BrushLogger)", "value": "343f12d0fd0198d038756263d39ea80d", "object_relation": "md5", "Tag": [ { "name": "BrushLogger", "colour": "#0EE8D9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713532, "uuid": "cab296c6-3903-45cb-a27c-f1c49e743408", "comment": "Malware payload (BrushLogger)", "value": "4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cf", "object_relation": "sha256", "Tag": [ { "name": "BrushLogger", "colour": "#0EE8D9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713532, "uuid": "df6e12be-6837-4bb3-8413-5500bdc1a2b0", "comment": "Malware payload (BrushLogger)", "value": "8edb8c714150ee194ed0e65740c42d9e3171a855", "object_relation": "sha1", "Tag": [ { "name": "BrushLogger", "colour": "#0EE8D9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713532, "uuid": "c9f74f2e-cef5-43d2-b9a4-032ebe781aa4", "comment": "Malware payload (BrushLogger)", "value": "fffb59af3ea9f6e8811fb378a37149517b0609e55ada8574093518151ef8f534886fac67b9354dce81a11e02af22ccb7", "object_relation": "sha3-384", "Tag": [ { "name": "BrushLogger", "colour": "#0EE8D9", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713532, "uuid": "feff75be-1ed9-400c-b314-b8642d38911b", "value": "T1A2B39D0175D0C4B1D4BE19384870EAB19B3FB930EE646DA76398267A5F302D2CE35D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713532, "uuid": "7e5bd095-8f66-47b2-98af-6a97ac08bca5", "value": "add8e1919edf968cbe25e4ae82ebc04b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713532, "uuid": "7b94afee-e000-439e-a8dc-b3abb64a198c", "value": "3072:epFQszI2l3NOMsJTEsZ+clIL2PNI/JN1G/nrhURIF:ejzk8NL0/Z+AILeNDhURIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713532, "uuid": "d7a5bb51-d9b2-4c06-8afc-26e4102f957e", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713532, "uuid": "08d99cf7-80ff-4f7e-adc1-cad427d1296e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713532, "uuid": "726e84dd-db1b-44a2-bc56-a8102b029c37", "value": "4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627e26c7-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736322, "uuid": "30050955-2d93-43b7-902a-83f8a8338e83", "comment": "Malware payload (Mirai)", "value": "8f13612fdb86b11930d950738bb23c17", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736322, "uuid": "5841b7b0-cd62-43e0-ab0d-ecad132a94e3", "comment": "Malware payload (Mirai)", "value": "51ff554627be538909c240c936f855bf9638b6c1862bc20e79f0a883f16cc706", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736322, "uuid": "cd1b6b8f-28a7-4116-b024-8f9e69aee8a5", "comment": "Malware payload (Mirai)", "value": "6bcb8cf27bc77533f18bca94b5cb90f911e8233c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736322, "uuid": "90ae383e-981c-4518-9047-6389090df481", "comment": "Malware payload (Mirai)", "value": "6685b50ec0e080f1453c8c35b7b57fddfa9d27dc28e99a5a4360a6667201c194f9d62d1f886987958abe24a09db3e01f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736322, "uuid": "5c5730bc-6331-438b-bbf4-40e04dfe9b1a", "value": "T136D33A2275791E2BC4E4A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736322, "uuid": "bac94cf8-59c8-4d08-9d96-12200961fc02", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyhOFe30Hi09lshKwmh:ZUH+FD99IVWFt5OgEmhPmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736322, "uuid": "2bab38c2-dd6b-4609-9095-f1a7a5182942", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736322, "uuid": "b05dae91-0a55-473d-aadd-eecc946f8f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736322, "uuid": "32e28be6-6ee2-4903-9f78-e97eebdb3f7e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158644b2-3401-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775731468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731468, "uuid": "aac27c25-7d1d-4e8b-a959-6099e6982770", "comment": "Malware payload (QuasarRAT)", "value": "a71c9c9b77cf401a7f9a3a2e8a72f1f5", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731468, "uuid": "1587d2be-a697-41a5-b1f5-b01ee8e3147a", "comment": "Malware payload (QuasarRAT)", "value": "525f29f1529cd9dfcba262b012e9170e32b4ddb184e1367e2d503733710b5ca2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731468, "uuid": "61f96e58-8ae2-4cb8-a134-9565982d41fb", "comment": "Malware payload (QuasarRAT)", "value": "634cbf76119c4a9b9fb9153639c1877e46a6a480", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731468, "uuid": "05dbc87f-952f-4397-94be-590daf013932", "comment": "Malware payload (QuasarRAT)", "value": "9781fcbb195064a5ba5de7a265a8b7ff9ef306430abb4c42a2254e5d8df4f97e60c467843e12190b7681a50bce539dcd", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731468, "uuid": "699d32dc-7549-4a5b-8249-27000d14e934", "value": "T1CD527A2C09BDFA5993D9E213E699F7276D4A1CAFC2B875172AF38C6890024C045EB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731468, "uuid": "559a8a46-ae17-41cd-a919-82d756fdcd1f", "value": "384:Z0YYnMV3udrO+lGFk6GHX8TIU5Le9SbArVZ9tM09SsHZvlkE4wkLtocNNtOrEPJ8:mKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775731468, "uuid": "6cc27191-219a-4aab-b080-9d772940cd52", "value": 13844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775731468, "uuid": "f7de132e-dfef-4483-8b6b-e0aa5eb6bc28", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731468, "uuid": "e3783e90-da01-4ee2-8ca0-d1f97eb286d3", "value": "encrypted.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a06792-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719301, "uuid": "2852a97b-0e68-47a2-9c02-dff29bbcc386", "comment": "Malware payload", "value": "522cda0c18b410daa033dc66c48eb75a", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719301, "uuid": "92b1f920-5d6a-441e-9f33-3b5675ee6cfb", "comment": "Malware payload", "value": "54077a5b15638e354fa02318623775b7a1cc0e8c21e59bcbab333035369e377f", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719301, "uuid": "7e69095a-05c6-4c30-b996-529659241a4d", "comment": "Malware payload", "value": "dafd571da1df72fb53bcd250e8b901103b51d6e4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719301, "uuid": "b8706177-5851-4c00-a327-e38e7a91a7fc", "comment": "Malware payload", "value": "bd7d2758a4b643630efe99bfc0c96013270ab117533bbd3edea678930267daf7a0a8d1b0caceec3378e1a2deddf0cadb", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719301, "uuid": "99b0be92-95ed-44b9-97f5-b5aa3266cff2", "value": "T1B96439E32449B584D929D536E61F6A7D2303BDD5DA62404302DF0CCD356A0AFB98CEEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719301, "uuid": "277deeea-deaf-4904-9f04-24c1fd2b4320", "value": "6144:JeSqETXrhj1xWuSpMRdZKoEWmyduMPWG73E/eN2zpf6O:JeSqA5WGZKv3eOiO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719301, "uuid": "395a4617-39f1-4233-88ce-2c701c6524cd", "value": 320066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719301, "uuid": "903a507b-d936-429f-82ee-7235c836ce50", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719301, "uuid": "d2c2b114-b909-4433-b8c5-5a52ab14f5f0", "value": "522cda0c18b410daa033dc66c48eb75a.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77b3a02-33e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775718023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718023, "uuid": "d12323ce-7817-4585-baa0-92b812bd70a0", "comment": "Malware payload", "value": "12347e7747da4ff6f48460e8de98aa48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718023, "uuid": "e1da079b-6a0f-4fc6-a7db-57461538b623", "comment": "Malware payload", "value": "5437464633b890e0d39dde5e5df38fbff99629f4e2c2f8a6d313ddf9bbbfb7a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718023, "uuid": "702378de-f8bb-4334-8496-363938dc2922", "comment": "Malware payload", "value": "a5d55c195b06f5be7f7abda1bc240622cc08a544", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718023, "uuid": "19c6d042-ef09-4315-8bc1-72b02b40c3d6", "comment": "Malware payload", "value": "cd4bf10f19ed39306379f7171368dfc99bd8d17201c7a7a0d5f7c72e183b093f47d6144efe51cd3fab66fbd0b7770eb9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718023, "uuid": "a71619f6-3176-40db-8942-12c331e10782", "value": "T1DD94D539D979513F98BFC569CB93424EE092D823772FCC06949737CA8479AC16C3262E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718023, "uuid": "de007a47-bcc6-46ba-b795-e55b13ad7dfd", "value": "6144:KQTgBSsn6nwwHgNq3rnpIAo02038wb+wJV1zNTbOVR7QHDJ7:KegnnVmg0bpyEpJzJbuWj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718023, "uuid": "b5f4b35f-2f1c-48f4-9d74-03e0cc6fed5f", "value": 411342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718023, "uuid": "35b2e880-0297-40ea-9fb1-8b7d87758905", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718023, "uuid": "a3110d15-ee2e-4850-a1d6-68ce9ea64b21", "value": "Datos bancarios.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e67e0fe-340c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775736315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "5033c0ec-334f-4b03-bde2-e49090607b50", "comment": "Malware payload", "value": "822f9894ff5c18d06e66a1e8ad0726d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "e1f1cb35-c84b-4ebb-ae47-c3e952f001a6", "comment": "Malware payload", "value": "54e0b8bdaa8ef83171b29135e5320c88342a15b6980def1c7fad4e9207c3b78a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "b16345e4-0714-4f09-9444-5826985f2eea", "comment": "Malware payload", "value": "0dd4d5151d4994bae451c12d3313db61cea79f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736315, "uuid": "d76c8500-f90b-4d76-877b-97db8414502b", "comment": "Malware payload", "value": "3a9fc65c30405195bac482fecf6e034832c34ca367473c20217a4dc45a32da3ea09208675aa1a995c594e9a7e3fa097e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736315, "uuid": "fb305b91-a01e-4d3e-bee0-e484fc18923d", "value": "T1FF849F69CFAC423AA0B69750CB92C707F66369137B5CFF0E85D1374B84B7103687A61A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736315, "uuid": "b504cf0d-1f9b-4c3e-9801-fbf16e1188a5", "value": "6144:YCeBstZlpWZYfPCSZfp4+53GS0LVswbkSagg0EaNf2XMrbiZqghQ1p8:YCxtZl8WXCSBp4cOLWwbklgg0v12/qTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736315, "uuid": "9f52313f-30f8-4e35-93e5-cdfc684387e4", "value": 392210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736315, "uuid": "6e872374-391b-4b48-be58-f6b7c677f8c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736315, "uuid": "6a959786-ec97-4a85-825a-fa5c342d6338", "value": "INQUIRY 2026-SP07289172.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6180d4c6-33f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775726442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726442, "uuid": "c7a7d40c-f7e2-47be-a6c2-7e7653ad37e1", "comment": "Malware payload", "value": "f113221694a306d49b88da10c7633555", "object_relation": "md5", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726442, "uuid": "6cffd390-c01c-4e52-8346-0a1fe96d9897", "comment": "Malware payload", "value": "54e59a0b9ee97b47e69f64afd495dbc192fa212703f03b7f8396d5b2247fb089", "object_relation": "sha256", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726442, "uuid": "edf476f4-a7ca-487f-a77e-0db9902e9072", "comment": "Malware payload", "value": "b717cdd66c5e7c99788ea9fae56100719c653bc4", "object_relation": "sha1", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726442, "uuid": "e7b867d8-c2e4-47db-a470-96ba43c236a4", "comment": "Malware payload", "value": "58ffb84be33034167c13cb990a1677eba1fb74d83228b3f77c2a6ccc16802bdd0430328a2f8e0afd1362d3653f23caab", "object_relation": "sha3-384", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726442, "uuid": "7a6ebaf5-0280-42f5-ab9c-6a64c93ef0e9", "value": "T14941F20C57956A7F48E77418E995CCDEE55300B122BB18117DFD93325FA7104E23A73A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726442, "uuid": "35e5bce1-141c-46a2-9f7a-21a97dcaebbd", "value": "48:UYn1oDH+Wm5IFEtfgVadiTDkrFcSRWE4TYLtt2yRwF1RrA:UYn1oDKcaihEiirSfRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775726442, "uuid": "6a63cafb-7c70-4eb3-9265-e16161007e7c", "value": 2182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775726442, "uuid": "e783f0d9-374a-4b73-8bcd-4b0156cfc364", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726442, "uuid": "14e92fd6-9e83-47dc-a5bf-940a7015b082", "value": "bypass.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a5ccc5-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775716996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716996, "uuid": "0c1d3a2e-640b-4962-9897-66f6eb368616", "comment": "Malware payload (Mirai)", "value": "16600c1ce6bfc04b07db3dc24c6baf0e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716996, "uuid": "18be6f7e-acf9-4561-ae8a-cee6c0721292", "comment": "Malware payload (Mirai)", "value": "54fe80b7112d11fc5414f7bdbcd5d4b60b96fad21fe43567f6f10b58b10cb63d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716996, "uuid": "c5b1da8e-d49c-4447-ae62-b0350602cba2", "comment": "Malware payload (Mirai)", "value": "e16ccfc94600b9a4400699e41b71d1be6a259b29", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716996, "uuid": "2e283c68-3b4e-4514-a187-b816877a25f3", "comment": "Malware payload (Mirai)", "value": "4a2f0dd2839ba08d6e376abfaf30e1fbde4fe06f6474857924a8754a50c4f8177fa9c540ce187e367915c1b3672fb176", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716996, "uuid": "0a1f57ce-5e2c-4dd2-a6c2-dec500989be0", "value": "T1F32302D0126127C89361DA7938AD302F8134666F32F92D403DA7918EF54B71668B7EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716996, "uuid": "20bff235-faaf-44f3-ac75-8a7afe8f18f6", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGU1DkKpZ:87vbq1lGAXSEYQjbChaAU2yU23M51Djf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716996, "uuid": "50b5606c-04f9-49b2-bc63-87838a123c4d", "value": 46068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716996, "uuid": "5db9f59f-11ef-4fed-8870-145881d9ab7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716996, "uuid": "d7696462-6bb5-4216-9e46-21eabf87ecec", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b38688-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775722181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722181, "uuid": "40d33b91-a61d-44be-9bd1-469af549f99f", "comment": "Malware payload (AgentTesla)", "value": "76235f665b3d29d4056b2feafa68f942", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722181, "uuid": "f2bd0b6f-f59e-4985-a8b3-ed2d767916bc", "comment": "Malware payload (AgentTesla)", "value": "565f109e265be6d6d9ec37b4ab9eb4e03a1aa060bf891568029eb2b39235dc83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722181, "uuid": "669d4925-efcd-4b7b-aad7-8cc96ecc22ec", "comment": "Malware payload (AgentTesla)", "value": "d41029901383f19d5f2b1fe6b1bdbef8dede4399", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722181, "uuid": "e9e0b0d9-b29d-4703-a605-a7bcc720d9b4", "comment": "Malware payload (AgentTesla)", "value": "e5c3375deac2b0c7b5922e8599cdeba4ca5a451de66fefd9878f8219130a9085ae83fbc1fb3e7f62c5f2729c2439ed0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722181, "uuid": "9ccce1a3-72ae-4e4f-8497-6c4fc6f67065", "value": "T11755015046C83F69CBEC561D80FE161EA3B04D8F9419B98AEB63BD4AEFB7A0441171DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722181, "uuid": "a86af4be-3989-4ccc-8137-a5c0981063f4", "value": "24576:Jsi31bltJ0M8AcbnSIOrPK/yVsc/b7hTFNBxVcymv3glm+3+3A:JLxdzhRNLmvmqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722181, "uuid": "1175d792-b798-4d0e-8fdb-70ebdb4a723a", "value": 1316202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722181, "uuid": "754d549e-a9af-405c-bdcc-de407781c172", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722181, "uuid": "cb69736a-ced3-4199-a966-82620550b0fb", "value": "offlinejs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612408ef-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736319, "uuid": "a4bb8b07-7b7d-4d21-bbc5-3c65e9d27744", "comment": "Malware payload (Mirai)", "value": "23e393eea7b8871568ffb1ca9d33b86e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736319, "uuid": "2e1a162a-0406-43ee-88c2-9426496d403a", "comment": "Malware payload (Mirai)", "value": "582bc36a6fd5527342b1d65f8c51f73a3443db35bdf550e99c50ec25c4be873a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736319, "uuid": "21efc53b-77da-4f20-8287-53215f2a626a", "comment": "Malware payload (Mirai)", "value": "05e0adca6e2926459d0b208d9edf41fd1fe3c4b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736319, "uuid": "704934ea-3ade-4bfd-9157-ad65459e8e4e", "comment": "Malware payload (Mirai)", "value": "31b32670c0e5f126b0770fb6b4a5ce48a47c65ad68692481fe4e3701f5dce7b062a014f65608a4dd276aa25594e5cb99", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736319, "uuid": "b4796403-ae52-4968-8df8-1e715a086c55", "value": "T1FCD35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736319, "uuid": "dc713f9f-ca8a-4b6e-aac3-15827abbca9a", "value": "3072:oWGIf1/UwfhJdU80rntbYUaDGMsMA9TK4t:oWxN/UUDGtbYUaiMsMApK4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736319, "uuid": "8b4f7bc3-9010-47eb-9a72-b50eb768e111", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736319, "uuid": "9cfe4b1d-2231-4bd8-856c-c30e6d0f3dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736319, "uuid": "36811204-05ba-4316-846e-75ac8f31528d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aab0212-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775721813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721813, "uuid": "c43de3c6-c0dd-428e-85ce-72faa5c229d9", "comment": "Malware payload (VIPKeylogger)", "value": "c35ea33fcc6749ace5bd80c9baa8cc27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721813, "uuid": "627670b4-7184-4402-93e1-cf5b12ac46b9", "comment": "Malware payload (VIPKeylogger)", "value": "5856e9e9d8ce52b684a4f1bd1133a52bbe1359d930ebd436efbc59c532a403dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721813, "uuid": "39a8e95c-33a5-418c-983a-84964a1940e2", "comment": "Malware payload (VIPKeylogger)", "value": "d56b7a865374d55246f3f8472437a7f2e34985e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721813, "uuid": "72eb59b7-58b9-4609-8a00-f2fa2cfa499b", "comment": "Malware payload (VIPKeylogger)", "value": "9828db733c2f9ccf3df3e5da83fef6faa169f190d92b3d4cbf3dc0413d9aeb32e74c39f04a3e6fe6b036ec0af6a891bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721813, "uuid": "d27e31b3-92a6-44c4-a4c0-d495b7b02ff2", "value": "T1075351D9DA7814CB15B9DC72F825CCFB283E8A896940E77FB519F6EBF2492430252071", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721813, "uuid": "fbd874e8-b6bc-4637-bb26-c99d8555dfa4", "value": "384:qJzNvpjwss1SgqICkn+aqJ/1HEWdWXdKTJhBZo6rfOyRJ9G2pZFx6d:MRvaSLPKdQoeOIsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721813, "uuid": "91792aa9-e503-441e-8ef8-9058a577d789", "value": 62399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721813, "uuid": "633c00d1-e21a-4674-95c3-a4c807bce4e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721813, "uuid": "cc7c5ed6-716a-4f13-99eb-16c7b2629b68", "value": "_Product List 4-02-202655574223.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dc5a07-3456-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775768248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768248, "uuid": "fc808cb5-d1db-4a78-8370-bfac1aee59dd", "comment": "Malware payload (QuasarRAT)", "value": "ddb6c8a783b96a6014eefaaa3aba7087", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768248, "uuid": "f0b5bea5-2536-447c-b2c2-618b808c90d9", "comment": "Malware payload (QuasarRAT)", "value": "585c1c3e0c92f1ded8d57fc754c884b0cc59fb918753f1bc46387284dc5df079", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768248, "uuid": "32c18028-c6c7-46e0-8b44-cb6261d09371", "comment": "Malware payload (QuasarRAT)", "value": "bfa3874e86491b15cf89929b7bf124b238324506", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768248, "uuid": "0041d390-4ab1-4550-9247-c443b75f0ff4", "comment": "Malware payload (QuasarRAT)", "value": "66e04a7d6822b68cbd19080aa1012944a4180c30cc11a3b37e4fdca75bf88d7022bc1a288da3669a0e1670a1ceffad27", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768248, "uuid": "2791c741-0e7d-485d-be1a-98b3a6ea1da1", "value": "T1AB26330A37790599F5EEA738AC967F4662D5A9D913EB29F4B9D113A840C0830FB710F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768248, "uuid": "a794d58b-59ed-4cbc-811e-4fca926c313e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768248, "uuid": "bbc55c7d-2a21-49fc-88e1-bb9265458593", "value": "98304:1jwRSdSBzLGkyyBYqYc8TRB+Pkl34dr1H3YlBvbCzxkwr1zJG:1CSA24BYBH+Pkl34bo/bCzGwrLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775768248, "uuid": "c6e1649b-a455-42fc-a5b8-3a6c4a0471b8", "value": 4808704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775768248, "uuid": "1a677a59-a6a7-4147-a0f4-d31ad2e5a2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768248, "uuid": "e42c4d2e-38fb-4fa3-af26-449bc471c5e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8da7220-33e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775721488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721488, "uuid": "dfe5b47f-e2b6-45c2-abdf-68745a9d605e", "comment": "Malware payload (Formbook)", "value": "eade27bef2bc21e3d9e9eb8a908e3cb8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721488, "uuid": "4c41a6f1-5af6-437c-8fe1-b8269a8050f7", "comment": "Malware payload (Formbook)", "value": "58d4089e9f0cdca9c5ae58c5befddd0c8cebbd81bfee49cb2efbdc4c279a7963", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721488, "uuid": "ce38aa46-31d0-4e2d-8005-feb6e9c7aae3", "comment": "Malware payload (Formbook)", "value": "351e4381514b7692e6336b1d63a14164532ab1ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721488, "uuid": "537f71d9-e45a-4150-9775-8c630577a3c5", "comment": "Malware payload (Formbook)", "value": "0c51a4a341aa731748a71ada68c4bce94ec4610188a8e2d4149885b9e24c761699c4b4c9064af6bb4cd75615aa56ff40", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721488, "uuid": "15aeb62f-2153-448a-906a-7b3059e66048", "value": "T164B22F3EC945DFF00B2A31A5B62F7A15A9540323B5382A4DB9CF80993B39650CBB51ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721488, "uuid": "d3ad0ea5-edbd-4796-9f66-66e6ce4fe567", "value": "384:KEPpP0L4oTaU697QDuceSmQQOjqzhpkNTjcyPFp2TMGAxUp7Ffcw+n5SyCNs1INa:K3KyhFgz27/2T+5Sw4ooYn6Em5tvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721488, "uuid": "80996b2a-86f5-496b-bad1-44dd7f4bde78", "value": 23609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721488, "uuid": "a12aec42-9888-4fac-bf36-2d4de8954a24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721488, "uuid": "2487996f-2391-4d34-a89e-6ed777c5128d", "value": "QUOTATION #45468709-96570-01.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58db6d24-33dc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775715690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715690, "uuid": "5949e3cd-601d-41dd-8065-df3b7e49c7a0", "comment": "Malware payload (AsyncRAT)", "value": "f2ff4d4c11c11c8bcdde03cac90a1947", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715690, "uuid": "74ad3ac2-ecaa-4b17-b1ed-0ee0cfa6cef3", "comment": "Malware payload (AsyncRAT)", "value": "595ebb854f6512804b3603ac8b63670531bd2c477845fd8b08d3411ae092cc38", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715690, "uuid": "9fbcb02a-c83e-4d6d-9fd6-b73d49f5c0c5", "comment": "Malware payload (AsyncRAT)", "value": "9d8a222ee267a38aad666d4102b7ad4bf94c82f3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715690, "uuid": "9974877f-fa47-4cb5-852a-0b763bbb7d9b", "comment": "Malware payload (AsyncRAT)", "value": "3829c6df12d0efea27f45351630c0de42fef2bf104afd2d32d2dfa63bf1edb3778d3bd682d7627512fded14670c356d3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715690, "uuid": "a43abe6e-8353-4dfe-8714-d9736119f81f", "value": "T10AF40166A798C901CCD5067409B5E73213B6ACD9E810C3174EEDFDFB79B9B52381824B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715690, "uuid": "46e8504d-a2ad-44e9-bbc9-aaef8820c827", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715690, "uuid": "9822d09b-1d9d-4050-9b7c-d8043d2558db", "value": "24576:xYYDlj8+v99cfMV7ciLQw4mPvxglvxHeo4+aYGSNC/P:xYYDLv3FLLNPSvJ/aYGh/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715690, "uuid": "d7feec0a-1d1a-41e8-a965-ab9e6fd78cc7", "value": 794120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715690, "uuid": "83be5517-a327-4143-bd34-451b889aaa1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715690, "uuid": "1ff66496-3f9c-478a-8b94-5afd4b3b1753", "value": "Yeni.talep-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c6bab8-341f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775744377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744377, "uuid": "830852ee-86f2-4e17-9a6d-21b211f7a70a", "comment": "Malware payload (RemcosRAT)", "value": "cb822efb4fa6c80df230c1bda6a873e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744377, "uuid": "e3d3e7d5-4b77-4be4-a7fc-991528c95774", "comment": "Malware payload (RemcosRAT)", "value": "5995619538451240522fb723981483537c1d8d0b4bd6601bc1574c0bfa4acd18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744377, "uuid": "6c1a76d3-0268-44a6-a96b-752e35ca4a75", "comment": "Malware payload (RemcosRAT)", "value": "af6e91b6ab0551a9b281e8a7bdeb08193bfb41d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744377, "uuid": "f147358f-51be-4e96-abd7-315b0a69f325", "comment": "Malware payload (RemcosRAT)", "value": "089cbd8b76278b6b5bcc7376023c91dec089ffbd0b034a5c342582985771d4fdc674ec7fddac9d8f26ab9f9a98740015", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744377, "uuid": "95e6868d-7114-4958-86ad-4fab6c4fc23c", "value": "T17576F5331313B5723A7B5B9D80B599401D5B381339CDCB08F5DA222972E6E53EB7A4E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744377, "uuid": "1f6d4853-e508-401f-89ce-45d72b3ed48e", "value": "98304:UNwy/U9XG3DRk8MC7CgnC5IqLsakWdPAwxqIjP/7sIl70R82R:w/U5mRk8xOgC+qLsahFXjnQISF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775744377, "uuid": "b766384e-3090-40b6-ad58-e5b296148301", "value": 7233314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775744377, "uuid": "d44c93ed-ab82-42eb-a32b-57aa786e83c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744377, "uuid": "a6b6a04c-5508-4f2f-be74-cb6f2410374a", "value": "Intesa Sanpaolo _Bonifico Bancario.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e035c317-3469-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775776476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776476, "uuid": "9a3d0eb9-c611-4639-91ff-bdef13583ef8", "comment": "Malware payload", "value": "c503542d2c124bde6b4e3c30ac08b43b", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776476, "uuid": "3e8c96fd-472e-4243-8b5a-531568bb3c65", "comment": "Malware payload", "value": "59e26d28d25f4e771df6f9bde05b9c421ba81981d4f0f930bf560245251b4092", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776476, "uuid": "4f9c6f93-e633-4227-9b5e-7b59b59df19f", "comment": "Malware payload", "value": "36b792855f80c39e06ac0da0a0c14ca2cad7b9ac", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776476, "uuid": "0eee8464-674b-43b4-9657-87ec71c5fe8a", "comment": "Malware payload", "value": "b43db6d320036118f2d01458b398b8f9b9d0959d88dde5d9be48a07a6a40b94073fbefd44602a7bb7279e4fb27a4ed68", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776476, "uuid": "ac3ba54f-cc22-4b48-b011-1e0cc8f31b6f", "value": "T17DC58C0B7CA505FAC46A973188B76192BB70F8480B3233C72E91B6782F767E05E79715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776476, "uuid": "c319850d-94c5-4de4-bfbe-99eabc425bc5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776476, "uuid": "9fd06c50-76d5-4da0-8c18-adcc9666808a", "value": "49152:fGppXCJ3zu4BEMeHiiA/g7mZV+8aYA6FFpc71N/2bUzPk:f0k0gciiI+8BAAq71N/RzPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776476, "uuid": "933b7a1b-8b4b-453a-bf27-1b1aa4c081a4", "value": 2542296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776476, "uuid": "4090864c-85ab-4812-94de-1b2f7cd3c8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776476, "uuid": "b74ffac8-d7d3-44a1-badf-b61a5acbed33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2011d0f3-344b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775763269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763269, "uuid": "0c6cfeb4-5e4c-449b-94dd-421b1c56cf9e", "comment": "Malware payload (ConnectWise)", "value": "5683779b2233e412a0293f7efd273fe0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763269, "uuid": "f30862f0-da20-457e-9b39-712b9a2c4140", "comment": "Malware payload (ConnectWise)", "value": "5a5fff8d911f41c2407e870dc0428afda0d911215711e4e8c5bbd57918cf4d68", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763269, "uuid": "b76293c3-414f-43f7-bd4f-10cf8fda8b48", "comment": "Malware payload (ConnectWise)", "value": "ecc2ec365f37d9d57a8035c76834773ba1cd6c67", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763269, "uuid": "8fb94176-3d6b-451b-9d8b-f7a7fc850ed0", "comment": "Malware payload (ConnectWise)", "value": "1cf18a687c6bcac6f9ff50d07e5b7cf1b5bd4f21f2ab3740cc905aefedcad7255b72edf9a80c4a5afa822c9fe51ecd9e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763269, "uuid": "d86c30de-17ba-4d4c-878d-fd103ecd4bef", "value": "T16521E29BEE13C72219B682FF48AB6E0CDE90414A1890D5B6795198305F36C2DCBAD1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763269, "uuid": "2625770e-f180-4499-913e-436999309d26", "value": "24:KcKx5DK3rMzKgubhKdoztYc+WFt0FEb4/TM2Vc/U4OEAZAQC:KzYrMssEB4/4/fOEAZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775763269, "uuid": "1d2c102a-4fe5-48be-88a2-eaaa41244a3e", "value": 1257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775763269, "uuid": "011d3b5f-fe90-4073-876b-28b793fb9c84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763269, "uuid": "6370baba-7015-44b0-91ea-71aec6fa1788", "value": "MyAccount - Bank of America-CreditA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa189c7d-3436-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775754615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754615, "uuid": "5660c9da-9382-46ff-a240-6a2780af5966", "comment": "Malware payload", "value": "bc1a51488aa5589f18802e8ae178580f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754615, "uuid": "63581b53-5231-4a3a-ae68-4c6d684d24ec", "comment": "Malware payload", "value": "5aaac6ef2921e78d05429a35017b524ef65596d66c4eceb7c81e2b93e75a8e6c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754615, "uuid": "54db12dd-c509-4110-8ce4-239a1c175154", "comment": "Malware payload", "value": "ccc763152ffcffa5d2da9553d47d0cd5d7de6978", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754615, "uuid": "046e3686-0a5d-47f3-8b6d-4c7d8618bf7f", "comment": "Malware payload", "value": "bc2f3fbd91740adb651d64a5bd6bdcfbbd779f3af377c109655c8c580813a4c6097d1b477970b7bb9d97f760724ee670", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754615, "uuid": "9977cade-a820-4066-94af-cdcd1a535b8b", "value": "T11051DB2A93A8523BF4A70B757EF343572274FD209B669B6A4880427CAC603B45E31B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754615, "uuid": "22bd80f9-b60d-4543-bff2-ae4b70ce9531", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754615, "uuid": "e7829ea3-0655-47bd-bd64-69a355ec5df5", "value": "24:etGSgcPBG5eSG64wr7QyJYYC/N0tkZf96mEWI+ycuZhNdDwakSMD1PNnq:6wsSG7KliYwLJ9hn1uldDwa3MDvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775754615, "uuid": "9f794a81-d3c8-49fd-80af-58c01b91aab8", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775754615, "uuid": "d56a43aa-f689-4253-9a5d-2512530174fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754615, "uuid": "dbc7e293-b0f9-4c0e-b4b7-0a335af34dea", "value": "45ngnrfd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26df540b-3437-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775754690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754690, "uuid": "dd852c92-3bec-4906-83b3-0e15e95c2715", "comment": "Malware payload", "value": "df3fcecf26f691dcfd2b643631a5e70d", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754690, "uuid": "4938e34f-1bef-4529-b2b8-c7ef7af4168f", "comment": "Malware payload", "value": "5ab5ebde3668af697031030f0d762cb29c28590a0074b845b19f0df29291a1d7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754690, "uuid": "85dfa3be-d3bd-4db3-8e14-003e728247c1", "comment": "Malware payload", "value": "f34e3445ce15efb83e9aea9b9f3b3a68715324ec", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754690, "uuid": "fd717967-9e1f-4acb-a620-7bcbbffde713", "comment": "Malware payload", "value": "7dee085580a06b7827ecf14fa1e80aec16354453d6a713c05097ba59f9b30d24402eab00f02ec7caee41aa3446cb8d6d", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754690, "uuid": "62f5a417-f8cd-4283-a25f-7a228e637a99", "value": "T17AD341685DCE04D45733A49586CB2D13EB998213070DCEE6BB8EEBD12F195E8D0EE6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754690, "uuid": "3fc57f83-ae8c-43af-9cb5-8f131e9f9f24", "value": "768:s3qFshOXIW2MylhOe/AgyKPn3VaZStHnHNEPMyjMGO+l0N8fWEET2PAu54CWwAjt:NFshOXrboI06pP39qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775754690, "uuid": "ad14a5d9-852f-4a7f-b0d7-85a9db0d9e9c", "value": 138028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775754690, "uuid": "cbd1bb2c-f555-468d-9a7c-c05b9e66d1b2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754690, "uuid": "2d447f0c-52b3-4c2b-a4e4-6d12ab110fa6", "value": "Fusion_Record_Germany_3839.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba18e859-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719289, "uuid": "67061c1e-c084-478e-8d62-7cdd6e8fb509", "comment": "Malware payload", "value": "fc798140331557ee72114993d929a359", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719289, "uuid": "68dfb484-4e31-4c76-9b46-a8d2836ef607", "comment": "Malware payload", "value": "5ac47a2e590b227b8fdc24dcf18aec91c7079a84d9a47c33cf6512cdb561c2ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719289, "uuid": "9ff1f4e4-bcc5-495b-b10b-0ba137e98047", "comment": "Malware payload", "value": "f53450a1fb1692b7209ffca34ea27899f43adae9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719289, "uuid": "e01c8e28-c249-49e6-b74c-d9beab20b799", "comment": "Malware payload", "value": "716c9d9ff7a6817ec93bb2f7d98da77f387913f04b52d49ac68b51c3c32e4fe648380f5596a5fae043568b480a4c0b5e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719289, "uuid": "192f3a6e-a57e-4239-b69f-60f1693f9f64", "value": "T18054E051D0E9201EF8BA6F206EF9655148797F625B2FC8FE052D4E8D0B52A08CDF7632", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719289, "uuid": "f942547e-709e-4cc0-acb3-71fd427cc86e", "value": "6144:qUQlYvgH7bw+9d39iOwNmus1YVskH6JQgZHtFcJDOZL+GK:xvg/wGtiFS1OJ6JQatF+kLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719289, "uuid": "a7d5925b-f224-43d3-bedf-db73a0158363", "value": 297862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719289, "uuid": "4e9efc1e-e09b-43d9-b4ac-a485544f27b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719289, "uuid": "47c5901d-dbb5-4090-b514-33f510ba37a5", "value": "RFQ SafeTech New Order_#77900.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484fbb62-33dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775715662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715662, "uuid": "0cd2267c-50ea-422d-a603-652ab090a534", "comment": "Malware payload", "value": "bfcac06291039551bdb49e73867ce3f3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715662, "uuid": "1abe67c3-1d36-47d6-8811-5b3fee5631e5", "comment": "Malware payload", "value": "5b034e3d95c935c14bf2a11a5a5561a7f49402b1588f5a3153664c862ffb9516", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715662, "uuid": "e99df3fd-ff5f-4fe5-a472-6a40de206872", "comment": "Malware payload", "value": "2830ef7261c9011d0628958444a468bbed773c19", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715662, "uuid": "7b87f89e-20c4-490e-a4fc-c93c017b8aa4", "comment": "Malware payload", "value": "9b1fb84df0b24a516eb3e099af7eb9fd3e6d76dcd2d24dd55c409676537c1b6d69916cc4bd8f6e9d808d03a70cf7926b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715662, "uuid": "ef2a3712-1c29-48e6-8fdd-411d48363aaa", "value": "T113A5AEC9D44D98D09D003F8A451B69C73FB8CB3D862C08641B2BA99DCD3B979C2DDA5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715662, "uuid": "d3811486-5ef7-4c9a-9c5b-7e0ef9268f36", "value": "24576:bG14QoOLHabLFnyc/kHTihLw4sh42J2E1SUeqLmTTzKKjzE6:zQoOfkTs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715662, "uuid": "65500cf0-aad5-4737-bd60-bfee26f03eab", "value": 2129033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715662, "uuid": "b21c02a5-9ce6-42db-b53d-8af55d024242", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715662, "uuid": "46566111-30cf-49b2-b889-3b60cc3c6762", "value": "Factura de DHL-000428283377.xlam(~706 KB).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e8e10f-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775718773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718773, "uuid": "72567915-40d4-413c-88ea-5304ed6bfbdc", "comment": "Malware payload (RemcosRAT)", "value": "d5053ea8e2fedbcf2f53754ce03a8acc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718773, "uuid": "23f1d06f-f0a1-4bf0-a6ed-d6bcb056b9c9", "comment": "Malware payload (RemcosRAT)", "value": "5bd356b14a0647170924904f7c0411d62ca79733594fe6f7d8277dd68c1ca217", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718773, "uuid": "0f4bc8e9-02fd-48ba-889f-d29072afe598", "comment": "Malware payload (RemcosRAT)", "value": "a02d476526fc39fd51687c8db30874f3e15f5768", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718773, "uuid": "6fb29b61-e0c1-4d61-bcaa-88e4b1be36db", "comment": "Malware payload (RemcosRAT)", "value": "0ed10051b911c0a9cb3fd1ffb635cf3ac4e028bfe24a84c2f2a1574e047ca49befec7b53a45f42e9bda975d96d45aec2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718773, "uuid": "8b7cd22d-2361-4363-8783-44cf456b8334", "value": "T12B352274292918217643907A90913FBEE6DB2471057422EB642B7FCCB03079F6EBDBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718773, "uuid": "8e57c0b0-6e51-4417-84e6-caa7cbe1b5ad", "value": "192:pKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkKkS:bPLwxz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718773, "uuid": "6fc43a79-4672-45a7-9e36-ca0f3bda36c9", "value": 1121825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718773, "uuid": "d0d67ec8-6de6-4f60-913a-946169d40dc2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718773, "uuid": "78663fe9-6220-4444-b0c5-8154ae554d77", "value": "Sarens PO_SB-0407026-001_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf8b9f7-33dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775715643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715643, "uuid": "b5e9245d-e4ed-4c80-939d-bab033352e55", "comment": "Malware payload", "value": "5c6bd55685e6ac173c33c1c7776933e6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715643, "uuid": "3f4d0542-9b5f-4f45-b79f-3bec342993ee", "comment": "Malware payload", "value": "5c0a89db005c16dcb3321e36be7142b68767b7b46243eb60351330a578e5baa5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715643, "uuid": "bb16cc84-678a-4abb-9ba6-287278baf1ab", "comment": "Malware payload", "value": "38c5cdf6ea160ff700e652a2e1e5eac4d2c5533c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715643, "uuid": "2320caab-9416-42cf-831d-8ee01c4f7393", "comment": "Malware payload", "value": "8953fa5a56fa7ff386db3f96e57381b1b37ad757f9eb40af5217bead8436235bd74b70e7fe477680d0db838609de2394", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715643, "uuid": "a84cb212-9b3f-429d-9a51-5a32f9041157", "value": "T183D4112C7842F5F0CF64DF9D8DAA92D4542B3F798164490F271F95A878A4E02ED86CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715643, "uuid": "1438fee7-29d4-483f-b0eb-e384e0cca899", "value": "192:UiTg3bV76L3B55hc6j1fVkcHDG7mbrbpQtTer43O796DIr1iyzO5nfFDaeNe+aUn:/xO9Ks6sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715643, "uuid": "b617208b-b345-4325-a7f9-3cdbff10f7af", "value": 649962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715643, "uuid": "d35fb327-55aa-41db-9a18-5b0442624a55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715643, "uuid": "2fd9b1e3-d5fb-4b6d-a71f-78290ad20ec8", "value": "Request for Quotation-RFQINL09042026 Commerical List.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea62539-3465-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775774702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774702, "uuid": "71766249-90a0-4c71-8967-e36e1e13bead", "comment": "Malware payload (Mirai)", "value": "4809562944e7a59db05a3c8299374513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774702, "uuid": "fd9bcafc-1554-47f1-a842-cec191303584", "comment": "Malware payload (Mirai)", "value": "5c80a69a263ea8a9ca0612fbf452a7d3538006355d3e0ac6927132fc803cc719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774702, "uuid": "8ac164a4-f55c-4a1f-a38c-df91f1422139", "comment": "Malware payload (Mirai)", "value": "fbd92a0da69fd50685c39768f05e2c9112d95ca4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774702, "uuid": "7fb637ce-f84b-412d-ad52-81c2894df9d8", "comment": "Malware payload (Mirai)", "value": "97aad9613229cea58ea59802bd7240d436952d01572deeb81ebd907312708774296441804d31ff73c73f9040baa359d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774702, "uuid": "c1aceca3-f3d3-4477-95fc-1630c83579e5", "value": "T156244C93B905DEBBF40EA77604D307217232FB6549431A32B317BDB5AA3A3D4242AF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774702, "uuid": "420180af-a530-41b4-b3c3-dda14385c0f1", "value": "6144:PxJBwoWzP7y/t+IdhhNjgHELqr5FrAfY4KH+Ehh6a1A2nONsl1:PbB3N6d92Y4KH+Ehh6a1A2nONsl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775774702, "uuid": "46af06aa-706f-4a21-b7ad-b10377d6bb84", "value": 227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775774702, "uuid": "b7459f7b-9de6-4239-b8a4-0f681f93f3fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774702, "uuid": "ca210f76-fd8c-43ba-83d9-a8058830a0be", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4ab257-3469-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775776441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776441, "uuid": "521ee2a6-1f32-4698-8e00-57043820d425", "comment": "Malware payload (Mirai)", "value": "785b218b380e00e58a6f61fdad9e7899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776441, "uuid": "34e44e62-5b4e-427d-8b5b-d42d7945dc36", "comment": "Malware payload (Mirai)", "value": "5c9cc0ac83ac134b406a53d76ebed5365d11759da65a089b195ca1d177f23f29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776441, "uuid": "e7b9d1e0-d4d7-4b0e-8577-0aec718d83bc", "comment": "Malware payload (Mirai)", "value": "48496f33bd0449d8a334a35a51d50d131f8785c2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776441, "uuid": "4754c78a-e7da-40bf-8d62-0c06f2d5dd59", "comment": "Malware payload (Mirai)", "value": "8fa18c3a985cf8cee763b4f629f773c1624973988ffc567682605f334573a32a62aa149ae3bb37e645769ad0718cbdfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776441, "uuid": "c3804d34-925c-45d8-80ed-ca1114b548eb", "value": "T15D241B01B8518F53C5C32BBBF7DF42953736672497DB7302EA24AEB42F4669D1E2A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776441, "uuid": "e2b2b08a-ae6d-49a0-a28f-bbe64d4be96d", "value": "6144:XlTTzQoqxAniNmz1JluBnyFKJKHtEqZ06L18Hts1QS1:XlTPCxALhJ4B6KJKHtEqC6L18Hts1QS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776441, "uuid": "6e7bdff9-fc40-4c41-8e59-f9213b9d1c95", "value": 218600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776441, "uuid": "9e8925d8-3307-4330-b624-80282238ef20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776441, "uuid": "1243ece5-d5b7-4b85-b72b-734a1a6a83ee", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7048d190-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717017, "uuid": "e52a4abf-0aa7-4e61-b26c-002bc81a993f", "comment": "Malware payload (Mirai)", "value": "9d1f3539bf4b1ed6f6f8cf274d5333f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717017, "uuid": "052e5db8-4760-4cbc-8d9b-ce2d12ee3e7d", "comment": "Malware payload (Mirai)", "value": "5d6b79a1b480ee0f406e3d5442e785ef82a097ce5a3cc0c66b1f17115cd15d6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717017, "uuid": "c10ff509-e947-4f63-8d6f-5c3c37d23de7", "comment": "Malware payload (Mirai)", "value": "1613e65481ba5a6115381f23c1259ce0bcaf8234", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717017, "uuid": "d5ac9b28-0726-499f-9bb4-16e6a830cab5", "comment": "Malware payload (Mirai)", "value": "47de6029905759b5eee28cc195dbaacbeb48a9fb308ccde9ca0ac2dd71d246dc7e332a1d01b39d0e2651aea496db5afe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717017, "uuid": "c34c7da5-3f31-4188-91e9-c833f2d7ac68", "value": "T1E7C3AE97F78B24A1C86146F007C76B8E3E6362119E6BE9E76C1E753B193A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717017, "uuid": "1a51aa6f-4424-43aa-ae6a-e4694eb220cd", "value": "1536:3C189r2mIHgqH8IdgTB45+LaLWqEICjCotZ0eVCUxZJmGg9//LWA:y1ur2nj7iq5+LetUCokeVC9Gg9/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717017, "uuid": "a16ffa6f-4801-446f-9cd2-e362a32d602b", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717017, "uuid": "c9d144ba-d1e6-42f6-806a-b7e4c2b4661b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717017, "uuid": "9604d14e-eb2c-409a-bc7d-b6815a7f59f7", "value": "Hammz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aedc5144-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775719270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719270, "uuid": "ec108f60-94ad-4b10-a64d-058c747d0e5c", "comment": "Malware payload (VIPKeylogger)", "value": "359d7d29781845526625fc79e6d1e15e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719270, "uuid": "4b201671-7551-4c7f-a93c-ac04f18150a2", "comment": "Malware payload (VIPKeylogger)", "value": "5dc9c448a27265290684bcc656fb106878b04c44e6c1d17bfd7d9cc36a8397a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719270, "uuid": "bc2fcce1-aae0-436e-801a-9fa314309eae", "comment": "Malware payload (VIPKeylogger)", "value": "1d361d2f4ffc763b1b69412332352b5087c29326", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719270, "uuid": "d44c5cf7-eea5-4ed2-9abc-2f831e984511", "comment": "Malware payload (VIPKeylogger)", "value": "220bafddae5df04d7876282130333e737efb6528fdb48acff89119bd3dc14a7ea552dd6ad51aff53810bb73cab334512", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719270, "uuid": "715fd627-7d00-466d-b3fd-15c6a649adbf", "value": "T12AD2B6CE7BCAB4A5835275E3195FE0A6B2AE9D80344C9050F6C4ECA87C2C71CD566DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719270, "uuid": "86d071bf-1302-4efd-a845-65ea43ccc6d2", "value": "768:momtdRbnU4a6ynxIh+anP6S3i/uEgnbYncMcCGSl:mfbn06ynxIEaP6S3i2EdnPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719270, "uuid": "676d7e53-74d7-4b95-8b9f-1343f7fdbfc4", "value": 30701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719270, "uuid": "0bb8b937-aaf7-4370-943c-98572a739b6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719270, "uuid": "4b4f102e-1581-4613-85d2-d9e94dc71832", "value": "Order No-25012232025.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b9cbff-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719275, "uuid": "219bb002-0f36-41d5-98b2-7dc6c5077ff5", "comment": "Malware payload", "value": "b208d5f45c816ccce246154bc4bcbe48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719275, "uuid": "eb943aa8-da24-4b57-8cc9-6b50846504d7", "comment": "Malware payload", "value": "5e4a7082080a227d860c7c5bacb440e634a9af0828c59413cd28f03a7a4b7aa9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719275, "uuid": "1bb5a37e-d4c6-47d1-8878-14eae70a1a05", "comment": "Malware payload", "value": "1ca1e897db6bb7b70f5bed959249524bc59d1f01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719275, "uuid": "db74903f-48c3-4a02-b86c-847a9a83f958", "comment": "Malware payload", "value": "49858582f2a1321b198fd0541cf98cd0af87f6c67605ddad52f3d2f3c417c7a29ed7e15cba6de87d289698cdb6727303", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719275, "uuid": "bef73568-fc4c-448d-a915-a56538016a6c", "value": "T19554D002D3E86511F4FB5EBA80F2296008397D721E5DE4ED04560E8E4BB8F25DD77B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719275, "uuid": "b1d84da4-4f3e-429b-9470-7e4419d8489c", "value": "6144:N9//HHIgVfhbUIxqQOqM6RAIMOxxV/f9o9CRZhIuF+XD7H47ZUb2rHock7IxyYxb:Rze4b5eBWYBqVWtLn0LYFTviuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719275, "uuid": "e56344a7-600e-47e6-b110-bda58107ca93", "value": 302638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719275, "uuid": "57d57cf6-3571-420f-83e8-896b3f71de4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719275, "uuid": "ab65e0dd-fd03-4fce-a4ca-9a3591003d3a", "value": "QUOTE_National Trade Export New Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab9c647-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775714190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714190, "uuid": "fb5f7969-9a5a-41de-b7e4-e5498a4c2f1b", "comment": "Malware payload", "value": "00b4bcae46e5d359bce20904770c476b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714190, "uuid": "a7906416-58d6-4f3e-b74d-9daf14b1ce33", "comment": "Malware payload", "value": "5f5413f5f4bc08c2d7ecc9fef18245eb2f1f3e378a777830c3612efde89f9124", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714190, "uuid": "39df6b97-9ff3-4e87-92b4-c09146a20cab", "comment": "Malware payload", "value": "101fd17abb8a3f9a149586a119f407e7702a927e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714190, "uuid": "12e4de33-5c55-4600-b28f-d99809eee285", "comment": "Malware payload", "value": "b62f6765e106e91019b383ba4b24b20a7eae164874b044fecd904c1f3364420efbe98fbde516edd31c8bc97f18ccc138", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714190, "uuid": "99bfc78b-1fa3-4d00-8209-c6a97ce35240", "value": "T1D0F00E11002F0120417A03AE0F441CE2F3936227240A24C43DCDA1D16BBF49907F23DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714190, "uuid": "2d8696cb-37ab-484a-8fc5-8d0d47d14cd6", "value": "6:hvk1SFdAxnpDTw0yyw0L2bhbOtlJH0i6gRHU8ZyXMJ2dCH5/EIA6+0EUl3QztnRV:pkAFdGDTFM0Uh6mgpZyKlq6+Ol3ORV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714190, "uuid": "d61013c9-87d0-492f-88e8-1ef0cf05781e", "value": 542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714190, "uuid": "3216478b-5797-4bf9-9c04-148d04a3ca71", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714190, "uuid": "c4d7afb8-ca3f-47d1-91b1-bdd1ff0d1f6a", "value": "pol.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2800dd-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775719316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719316, "uuid": "4a1a058b-5159-4f8f-91ef-843d5be22054", "comment": "Malware payload (StrelaStealer)", "value": "884925f6d52a6926c94f365efcb5fb96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719316, "uuid": "caecec3d-40c4-4a7e-9bd8-b6a85dcf35d3", "comment": "Malware payload (StrelaStealer)", "value": "5f8c68208da634266a32abc0ae86146ed0178e4f5c2253e880b4cfc6caac5f06", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719316, "uuid": "c89b140f-faea-4b09-ae9e-a883b315efad", "comment": "Malware payload (StrelaStealer)", "value": "59d052077931f2bc6bb603bbc4ea88f429610972", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719316, "uuid": "dd32bdf3-0da2-4ee9-a054-77bef65e70d0", "comment": "Malware payload (StrelaStealer)", "value": "273c75213fc62073c60fc608b956085d7e97a7163653aba66b028f64a86d4d9fb1606e192ca3c6ef3924acb37f835b94", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719316, "uuid": "9e688aab-792e-4fd0-b9df-1c8dd2d08277", "value": "T14554DF00C7EE5625F9F29FA092BC4954683ABE65AF1ED4CD05720D8D86B0D09DCB3B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719316, "uuid": "319b18df-d9d2-4abb-968e-c20f8491191a", "value": "6144:wicY/rhltF4Uao+rkMEum56/HTI/gv2h1vcyRF44Q7QEl8h6RJNjn7KGs:wiPhN4UVsww52hiu/2RJ57i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719316, "uuid": "58dd256d-717f-44b5-9046-04f50cc10f61", "value": 302108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719316, "uuid": "69514cc3-fd4f-4bcc-8e75-bb0b2c3f8954", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719316, "uuid": "6a99eb04-8ee4-4a5b-a743-482f9e8fd9c7", "value": "RIYADH Project_Full_Specification_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8023a029-3418-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775741525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741525, "uuid": "3c0189a1-3f31-42a5-b0ea-575c8712e85d", "comment": "Malware payload (Mirai)", "value": "51a09058056c316b51450d03bfdc62fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741525, "uuid": "a1ce5643-5bb2-429b-8ed8-8a0dfd01d3b1", "comment": "Malware payload (Mirai)", "value": "60a4ad4fe63c51594856748ffa30da5358113e9e2aa7085c8ad06531282a127b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741525, "uuid": "e5822074-346e-4026-b44a-c2a4b13816aa", "comment": "Malware payload (Mirai)", "value": "657d9b50b974e7f3a4cb7327fbe5fcfd82fb4539", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741525, "uuid": "737a17e1-9424-4480-9e1e-8f2dab091028", "comment": "Malware payload (Mirai)", "value": "35084a37db6f6391031c526b8c8da0addc5e2dfb98f528ed764988914c9c8ebdfaeba35507dd98b3b4c9c699b8a1b1d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741525, "uuid": "ba101d09-7c9e-4c23-b53b-8112bbcb881a", "value": "T1A3D4CF6AE9156A2BC0C6433481D7D2346377E0815B827302A548FA7D3D927BDCF3DBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741525, "uuid": "8ddf1276-6ad8-4b77-b696-f685040c7bdd", "value": "12288:cqUfQpPnBSSvEglaUuzxu6DJO/+vZbj/oGq6KWSs5KkGZ4MvnSyYtrmC2n:cqUf4pWUuNu6Dw/+vZbj/DKW3GHayYlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775741525, "uuid": "64975bc2-b6ea-44d4-9e36-27b715bdffef", "value": 626952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775741525, "uuid": "fe87cffd-2ab2-4ad5-8a01-48806e5bf2a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741525, "uuid": "29fcd731-770e-43b1-8b50-74cd0a2da36c", "value": "riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c1c406-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775722419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722419, "uuid": "9ec3f846-cb5d-4880-89f4-9a3e57d60fcb", "comment": "Malware payload (Formbook)", "value": "9290f3d2c69fb07093580e699d4a1c5b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722419, "uuid": "b5455a72-0cc3-44ca-b374-c0720c9f8137", "comment": "Malware payload (Formbook)", "value": "610b6eb873a9a8bf9022c5bcdc4c415a0ceaa2b29f02a969ef8f0b9178cb5c21", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722419, "uuid": "e31791ee-6d4d-4a31-9d07-8052034f56de", "comment": "Malware payload (Formbook)", "value": "d18d2258e8cdf07e1d0ad4639e89513364b29311", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722419, "uuid": "7dc721c7-cf0c-45f9-b320-0634ae18e509", "comment": "Malware payload (Formbook)", "value": "e32204fb7e11d851d765cfcc599a6648eeec20a0a106d90ae5e551f3ed6925c859a67ae212de43486251385680a097c8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722419, "uuid": "eae78ce6-b734-4c83-a139-28a9cce271d1", "value": "T15106021189C82FB4CFAC5A1980FE191EA3F04A8F542A7A49F733BD46BFE7904520719D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722419, "uuid": "07c03675-f18b-460f-ae73-e3bc23fd4449", "value": "49152:86OWx73AVPzPaaoB0j/f630jA+Y16OWx73AVPzPaaoB0j/f630jA+9:5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722419, "uuid": "c4d83b92-78d2-4de0-8b55-3c82c4b42c77", "value": 3862866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722419, "uuid": "5e0f7be3-8c65-4028-868a-79b410351bb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722419, "uuid": "9e939683-3b64-4742-b41b-ba1a1a1364c7", "value": "Draft_Shipping_Documents_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028f1f10-346a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775776533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776533, "uuid": "81d11e95-82cf-4ec5-abf1-a0eda164d140", "comment": "Malware payload", "value": "8b53dd195e910f6d3b32fc3a58e62c9e", "object_relation": "md5", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776533, "uuid": "52fc596d-e61d-4e7f-a775-e9577ff707be", "comment": "Malware payload", "value": "6169b5ea630271a76d266373b6d2be21e1c4d1eaf8a1dc2e35508e2212beff22", "object_relation": "sha256", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776533, "uuid": "df0626ac-d64a-44eb-9e3b-c57d356099c7", "comment": "Malware payload", "value": "17f34add79d4442d75f0169d1fbe9ddd73e4e8f4", "object_relation": "sha1", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776533, "uuid": "561063bb-0f69-4358-af44-d97d2bd99411", "comment": "Malware payload", "value": "27b7e7f05deb96a62eb578b0de32edbfe7b5c6a63ef46e0d99bc2df4d5707a5d9a0ff52f5abf08169de50bab3dc67324", "object_relation": "sha3-384", "Tag": [ { "name": "282234", "colour": "#4F83E7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776533, "uuid": "3767bc0e-08c4-4e07-be2f-66126877af32", "value": "T11DE6338053D14AA6FAE7F13D49A7D165D1B2F4505B3286CF0BA44B663F1B2F14E3AB80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776533, "uuid": "5d639c2d-17a1-4679-bce5-74d128679ffb", "value": "8a10bb964724d23496a8cfb98b743e90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776533, "uuid": "81e7f8ba-6b6f-40b9-b6a1-3924aa5d9002", "value": "196608:XzApNHEtbW897GDr/x7eovq5XMP6PzFcPVz097WpHskNqSPrGuZRjMFqbH4Mir47:OE1yNdq1B7iR0gpHskqSPjZpiqbH4a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776533, "uuid": "ac9f3df7-8358-4d9e-abe6-340686f3179a", "value": 14061056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776533, "uuid": "c3a31331-747a-4bff-a3a5-b4d98ea9bcdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776533, "uuid": "0c20cca7-63d0-4cd9-96fa-5628ef07a3f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6ceae9-33aa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775694196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775694196, "uuid": "f90c026f-b017-4941-9e78-9bf0772101a7", "comment": "Malware payload", "value": "35eda594956d765472f62710578ff55e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775694196, "uuid": "4ae27415-9553-42df-b073-6b690c78907e", "comment": "Malware payload", "value": "628d6d40f1433120100104ba405c6074b77e11cde6b2bc4a036975f98710e12c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775694196, "uuid": "0352e171-f8fb-4eff-8f2c-75fe0961337c", "comment": "Malware payload", "value": "6ec0939bae732c95cfda05dfac9de50b25c26aff", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775694196, "uuid": "297e25e2-bceb-462b-9cd2-380a66f5806a", "comment": "Malware payload", "value": "32d70448577d3d2b3b93a62f044bff131bd0aa793ffaab941c2e43e18421fe7e2e351555bbd34e58e5722a042dbf879a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775694196, "uuid": "781ceb10-5d92-40a9-80f9-8ef9c6699a28", "value": "T1CFC59D217586C132D57F03702A2DC76B46797E603B7784DB63E89A2E1EB09C18236F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775694196, "uuid": "4aed2c9a-afae-4542-96e9-c853efcd7b28", "value": "49152:VU6qYaZrf5jSTUialCJrMf+7UVZDEFet4vLNgmUESIEjPMN2lv+oBjY14MV3eVoI:ujSTBtq+84veHjPMNanY14MV39gA4t1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775694196, "uuid": "998b5edc-c242-43b1-9f90-60e92f3690a8", "value": 2515456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775694196, "uuid": "b668f8bb-fcf5-4547-a695-73e445364781", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775694196, "uuid": "cc9c745d-3b37-43bd-afaa-7adbb8bd69ee", "value": "statements.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b86b847-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775722486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722486, "uuid": "95947baa-9eaf-4e7d-9645-466549c0d8e0", "comment": "Malware payload (AgentTesla)", "value": "1e3e488acc77c863afd2438feb5c1342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722486, "uuid": "6a3ee8e4-2716-4d7d-84c4-9dbe7e91fae0", "comment": "Malware payload (AgentTesla)", "value": "642687daf4a3bd204fa418cde7b2db2d95afb1dbfc82ef52ddbe63b204d8352b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722486, "uuid": "5cae36f8-7b44-4e4c-94e2-b1e0a52dde86", "comment": "Malware payload (AgentTesla)", "value": "e7dfbdb06154f9bbc37360a56a6a6db67ebab0cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722486, "uuid": "27921162-04c3-4eed-8024-ec268ab1d893", "comment": "Malware payload (AgentTesla)", "value": "922ead0a532d476080b5abf57b2b0c6b6707f8387def50f0c5ca80a3736a26e29cea2fccd447fe69217fe9e434439f23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722486, "uuid": "29d9ba0f-6479-4d4b-945c-d85d5f70df68", "value": "T177C5016189C82FB5DF9C561840FE151E93B04A8A5029798EFB73BD4AEFE7A04120B1DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722486, "uuid": "7263a4bc-2599-4cdd-9384-5061e89b4d62", "value": "24576:58/NqiUikPpUPS+wx+nvNvnKY2Nw9etS9xA0qMZCTuZAUO8/NqiUikPpUPS+wx+s:5q8iNI1Gr2a3A0pvOq8iNI1Gr2a3A0pM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722486, "uuid": "d2a8c4b0-66cb-4c18-8cbf-fd561cfa1289", "value": 2649466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722486, "uuid": "54376239-c62a-41eb-89d3-3f8f1ba24106", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722486, "uuid": "f108c550-10f9-44a4-911a-02250b97e00e", "value": "NOVA COMANDA 79862.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbc756b-3410-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1775738163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738163, "uuid": "77c07b9a-a7f6-448c-b318-7105edb2d49e", "comment": "Malware payload (ValleyRAT)", "value": "a754ed3ed4bf77c2f069d49d0bfd8398", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738163, "uuid": "0792ee6f-b5a5-4458-a76a-7e3c51e30124", "comment": "Malware payload (ValleyRAT)", "value": "648228dba1713594c1fcbb44a932bc592a8019c8d1032f2554a5b7b89f9c90dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738163, "uuid": "a39f086f-7318-40c4-acec-2da9472aac8a", "comment": "Malware payload (ValleyRAT)", "value": "7cbb481a0662d5cc92c725234dcb2c71fa9cf5e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738163, "uuid": "29ff1062-abf1-4ed5-9c16-6ee42baae841", "comment": "Malware payload (ValleyRAT)", "value": "681b951b00c81dcf3bc07cdfa4f41c6e8129978198bf4d2a02dda5cffc6d1d9d247fdc6541d96943311a770fe49b11a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738163, "uuid": "b5fd044d-cf2f-487b-8ee4-ccaeddfb7051", "value": "T1040733540369C8A5F77B783398AA07DF38B16B5F1C9485039E9E2FDCA4F951B6890E03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738163, "uuid": "037d442f-862a-488b-89d2-eb052ad5d533", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738163, "uuid": "7bcf6665-9bcc-445a-bc94-5c1d1d7d894a", "value": "393216:wAYoeIr/X3ZPIlBSGv22a3ObLEDcyhbiygHJc13hj3NiSAY:w9AP8SGw3ObgQyhbilm3hZiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775738163, "uuid": "8283b5b9-0d59-4f8a-bc42-2c115d4c6cf4", "value": 17065512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775738163, "uuid": "0faf2dcc-88b7-499a-8fec-509f913b6955", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738163, "uuid": "2b379c45-25b0-4299-bcd9-c810931ab5b3", "value": "A754ED3ED4BF77C2F069D49D0BFD8398.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48989d6c-33e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719528, "uuid": "048f589a-f4fa-4c4c-b2d1-81885226874d", "comment": "Malware payload", "value": "1929da3ef904efb8c940679045452321", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719528, "uuid": "9f2d1c3f-d13b-4c15-bce5-b06b4d133651", "comment": "Malware payload", "value": "65dca34b04416f9a113f09718cbe51e11fd58e7287b7863e37f393ed4d25dde7", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719528, "uuid": "700c8c1b-4bed-4ecb-8590-a0ae834e463d", "comment": "Malware payload", "value": "7f3c6f97612dd0a018797f99fad4df754e5feb35", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719528, "uuid": "354885df-c2ba-4b60-9b17-246613cce85b", "comment": "Malware payload", "value": "69f50b08624424597fe540166cacb9fbd3a8dd0c4dafa0fd52b6f290429689b270a1cd4179b26f0695ad87d8cb19b566", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719528, "uuid": "85d30cb6-5a3e-4898-867b-5393eae12c7a", "value": "T1DD444BF1244EF5C4CD0CC576EA1F29BA2B1391D65AA2448B032F1DCD195A0AF7984EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719528, "uuid": "5f9f2e04-e59e-4515-9de1-80126427fb94", "value": "6144:CtaMPYpAgn9K1qwMRGQmtGBSMJy4LfTVwlW:5UIf/fmgFlW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719528, "uuid": "9f73d75c-05b8-42f8-84ca-4dd35a8f63c1", "value": 254698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719528, "uuid": "44034815-5eee-43e2-bff8-31dd06e05445", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719528, "uuid": "90a69dd1-39be-43a2-b370-7161f29ca969", "value": "1929da3ef904efb8c940679045452321.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a999e2d-344a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775762964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762964, "uuid": "df50e9c7-f3c7-409f-8c4a-a3c12a7409da", "comment": "Malware payload", "value": "69bdd2f51581fcd8d5486d970249a9d1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762964, "uuid": "b4962ab5-d14a-4675-ad96-63f83dc115e9", "comment": "Malware payload", "value": "6736e4b8cd5f5d1ddffe281801f9d87758a013e09be65aad35eebf60ed1dfe4a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762964, "uuid": "0b0c5de0-1dd9-4fb8-b0d5-59b4d7e2c78e", "comment": "Malware payload", "value": "83eccc48ce6fb03b3a1df701a6a53023b138684a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762964, "uuid": "8b90d4d8-fe6c-4993-b667-a639f4eb8f1c", "comment": "Malware payload", "value": "8dcfa0997bc6a28b334b77c9f0c98fd8998386540dbff706290462268cc33bc122e1abda7b31be2910bf205f61e1efa3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762964, "uuid": "1c57034f-e424-4fee-b17f-e608e0992b26", "value": "T187964B07E89545E9C0EAD1348A62D213BA717C489B3533D72F90FB782F76BD06AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762964, "uuid": "05891345-efcf-4ec8-b285-65da447b4106", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762964, "uuid": "50bc645b-a68a-48c3-a85f-18477aea99d8", "value": "49152:pVr3bvUiobpy5s2wo2y2BeB4GWLzQDB0WqmxQtil/Jqbq7LCvRRGhOF5vVr+3pNv:pDusuLIDQ4l3qRfsvHUhjc24cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775762964, "uuid": "8fea361b-b6e6-4014-87ee-232cbd1420e4", "value": 9132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775762964, "uuid": "d9d91e0a-b868-4ee9-b784-f2a0f959db06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762964, "uuid": "5de72482-c28a-4573-bd73-766e6b70c8fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55bc3c11-346a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775776673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776673, "uuid": "2c645e54-68bc-402c-993f-ac8bf376326a", "comment": "Malware payload", "value": "a7077eb596f7e015ca4d828f6e6f700a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776673, "uuid": "7c3972d1-6d03-4ebf-8e0c-6566b0228410", "comment": "Malware payload", "value": "67ecef96d358afc47602dfe5d78f24ba54b20cb122bb997ba012871871d87c69", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776673, "uuid": "335b2ced-0b88-41cf-80df-2510c9dcb3bf", "comment": "Malware payload", "value": "327759642de232e50da54eafe2789b9e264184cb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776673, "uuid": "24125820-9fee-49b5-91f4-79d9bea3415f", "comment": "Malware payload", "value": "c3dead2655bfe40e7ec5b21dd0d368f6411db826aced8c212728e4961ad04af5a072b06bbc9861948d898ec44164a270", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776673, "uuid": "e499cee6-0646-450d-8e09-a3cc907352b2", "value": "T1ABB58D217586C132D57F03702A2DC76B46797E603B7784DB63E89A2E1EB09C18236F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776673, "uuid": "79eb9d8e-ae88-4f78-8cbc-abed12313ce3", "value": "49152:QJWqYaZrf5jSTUialnJrMf+7UVZDEFed4vLNgmUESIEjPMN2lv+oBgYQMV3eVouk:YNjSTBsq+w4veHjPMNaMYQMV39gANX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776673, "uuid": "0dbcb47f-b2c7-4cf9-8dfb-d101dd6732f9", "value": 2456064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776673, "uuid": "16efc5f6-434d-4bb8-aae4-b6dc221aacfc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776673, "uuid": "35879689-b072-4014-b459-046477d6bd9e", "value": "pyanalysis.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63780e11-33dc-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775715707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715707, "uuid": "2701f658-8217-443e-92c6-c0d14c0b6e4e", "comment": "Malware payload (Formbook)", "value": "f2a5aa0d37ae705611234a426a8967ca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715707, "uuid": "864d21d8-cdc8-42c6-a354-1bc8a7abfd7d", "comment": "Malware payload (Formbook)", "value": "68f76d6afc51ec8041177facbf1fd67c4bdc702f2fdbe13574e3bfe6177c09a6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715707, "uuid": "95925fa0-65a1-4777-9c70-b24abfcdd47b", "comment": "Malware payload (Formbook)", "value": "869adae3ed765e04dc8b3c01519e3da6d113bc2f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715707, "uuid": "89e8064f-083b-4b0b-a00b-e47f612f91db", "comment": "Malware payload (Formbook)", "value": "028e6b29bc8a659c6461265ffb11fb044c6d23ca16055823e70c89a4ccfbd547e48cff25a9c14605ba8b0f7c6da5b574", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715707, "uuid": "1b4b86d6-9263-48ba-8696-2e748e9e0ee4", "value": "T1BD5526E019EF8B8AF4145E34C113A6251F911FA8B500814EDBEDBDAA76F7385E4B6703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715707, "uuid": "0f862e77-37f1-482e-9d9c-a96cc97e47c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715707, "uuid": "49b944fe-beaf-4a00-9e26-85d5546ee166", "value": "24576:BYC8+v9LH+Y6IzmJo6BiMhsIlnItCt+2Pf9qXx/oghPhcmKo:y4v8/9V/IQ42dqXxfPhcmKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715707, "uuid": "5729ad95-cadc-4ee5-9f1c-0d33c4d24155", "value": 1362952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715707, "uuid": "c1762958-b65b-4b74-be4e-dfcac6e5db03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715707, "uuid": "fd4986d7-4729-406b-8b0e-a7bef495d7d2", "value": "AWB.DHLSHIPPINGDOC.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680f1a8f-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735043, "uuid": "5bc9768b-8087-4ebe-9f18-61b8f848a61b", "comment": "Malware payload (GlassWorm)", "value": "21f99574d8cbff63ec73bcd6be2aeeac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735043, "uuid": "9a3f975a-c5ff-40a5-97e4-05c4c8e2bcc7", "comment": "Malware payload (GlassWorm)", "value": "69017b82c6d80c3e0dd87898cdd533f104dc2b06c9fcaadfe2943b9c82228924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735043, "uuid": "f45547d6-6ad1-4fae-8019-dd6c215d92cd", "comment": "Malware payload (GlassWorm)", "value": "bc1f7076ebecf0fca9a17b2d26c00bbe642f947b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735043, "uuid": "1ce28670-0e8f-47e3-ad5c-f2df7aeb4849", "comment": "Malware payload (GlassWorm)", "value": "0044b01d63dac2ea390bd697ddae12ed8a28ace13d7b8687f693f45ab8c8b682b65ae6f8f4effdb7aafb4f7df812db7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735043, "uuid": "f82ae795-3fe1-486b-8295-e94aeebfd03a", "value": "T1A525BF83D293915CF41AC1715B2EA273F537BC458B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735043, "uuid": "2fb0a673-17bc-4a49-ae0d-5140ea519aa7", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735043, "uuid": "1fa3d186-8253-47d4-8aa6-46996258d0fa", "value": "24576:m+pqo2T3OEe0JRh+w+aY5bsY5b5Y5bUI:m/T+EeiRhvYqY7YKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735043, "uuid": "e188063b-9999-4668-a648-ef014b63b6e3", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735043, "uuid": "94e5fd61-adbf-438f-bffc-764bca245044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735043, "uuid": "88e91f8d-7a1f-4b56-9ede-4c9858a92be4", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb1ac58-3463-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775773811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773811, "uuid": "9ac633df-4676-4ab0-b439-ee0e34dc3526", "comment": "Malware payload (RemcosRAT)", "value": "d31b6086b00dd490886caade5d859a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773811, "uuid": "3606eda5-4f0f-4402-835f-1a0d91b54bdf", "comment": "Malware payload (RemcosRAT)", "value": "6b3303190ab4b02f024f4e5378cf1bada900ed3b9a89796d467b76e425a7358e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773811, "uuid": "c7b7ef08-36af-41cf-a8ba-e28895a2ddd6", "comment": "Malware payload (RemcosRAT)", "value": "f0d0e4e1c1eef2093a3b486f6357924da2ad45e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773811, "uuid": "5bade7a0-b6fe-45cc-91ab-edbee91f66e6", "comment": "Malware payload (RemcosRAT)", "value": "a7d5fc1c6a77fa74e43da95d5ea80df92b8c3ebbcf025361e5a2b6553b3c9b6672497d8f6c467cb822bcd5f82f328ebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773811, "uuid": "34a38796-2bdd-465c-9f61-1777b89fc235", "value": "T15F9412063BA1D792C9D58533AC92D57A0FAAAE2EC5355F07274CEF4E6EF17419C0A00B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773811, "uuid": "5eead72c-2f30-4a8f-a01d-69889a870787", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773811, "uuid": "7fbf83bc-7639-46bb-bcb3-b1ba0cf9cf88", "value": "12288:SbcVKlgggggggggoatMwYpZR5+tP4jtglL3luef5GNTaCmYbs:SbcVKlgggggggggoa/YpwtPwaf50TaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775773811, "uuid": "a47be218-a1c5-48a9-875a-a757cef228dd", "value": 444224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775773811, "uuid": "15ed1241-ff6d-43c9-8bba-d85476534684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773811, "uuid": "181a4868-fbf9-4d4e-a720-9afba79786a6", "value": "rEmployeeSurveyReport.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdbdd67-3402-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775732291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732291, "uuid": "0ae20bab-8700-458d-89be-5f6959c3ecb8", "comment": "Malware payload", "value": "502b2b67e618becc13c83d239d31e9ab", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732291, "uuid": "a2704665-ee55-41eb-a265-9772b917b1f6", "comment": "Malware payload", "value": "6bc20728a1e27bfdf6a508c73810c3931ebf5a3b3244439a1ade7cbbb8101e27", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732291, "uuid": "7169366b-779b-48c0-be0b-a8b792feeb5b", "comment": "Malware payload", "value": "45ec6235732b4a4b605183863fb4c2c980a946de", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775732291, "uuid": "1e6f3f13-6eaf-4046-95a8-30c2d4a06f13", "comment": "Malware payload", "value": "c77086dc192492dd13559e0d28b5c3a957ac6c980d74260803d01e49ebe3192ef0a34c01c5ada1498289921b66efa2a8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775732291, "uuid": "090c993e-63d2-4ee2-b259-d3f2edba7d2d", "value": "T1F1137D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775732291, "uuid": "d8faed61-8969-4d87-a2bc-5d26ea9a72ab", "value": "768:bcs9NyXsZztCO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bZHusZmco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775732291, "uuid": "7ec8775e-2a80-4583-948a-b82ef7f23c33", "value": 45518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775732291, "uuid": "715ec0d8-9303-4ea9-9e84-d751de06e8c7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775732291, "uuid": "7680df45-2efb-499a-8167-de2dacb6b25b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a5862-341d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775743829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743829, "uuid": "2a7d3b8a-f054-49d7-9b52-64d0a3cb974c", "comment": "Malware payload", "value": "a221c92dff41227da5c2851bfb64f723", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743829, "uuid": "b3f2d725-2314-44cf-aabe-09e957fb3327", "comment": "Malware payload", "value": "6d2124b2ee39ac19b8cf52a1f214c3c1108414987b1428d1dbd892b4dca7f7ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743829, "uuid": "7d6d9a94-b368-47a1-a7af-bd98b4b1a018", "comment": "Malware payload", "value": "98063fe51e7d8277ca7bb908146b467a87670031", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743829, "uuid": "b3570d9a-932a-4f80-832e-f497511efddf", "comment": "Malware payload", "value": "33ecda425ea2eb357d313007a07968535d8f47ae5045e97400c8424ff3a7b75b4c44849efbde656efa1e70e98366f125", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743829, "uuid": "05896f63-2499-4ccc-a838-b139c0a536e7", "value": "T12806335763A834D9E52E8232C2E31D79EB76BC352182CBDF817552169F676C0CC389B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743829, "uuid": "1ead2b94-3930-4c11-a50a-28754d009a18", "value": "009883bcd90bc72fe04a42dec52ab186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743829, "uuid": "d1cef89f-03a0-43fc-b9c9-c77c6b7cda17", "value": "98304:YB7lkucFDpe/G9fCTY/SnAsIzdjOlvdfshuJtynPBNnbrUc:YBFqph9f+qSnpmOllfshuJwnXnMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775743829, "uuid": "5b81355c-07d8-4435-9bc1-99c8453e7ac6", "value": 3773952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775743829, "uuid": "3e1d8738-1ff3-4dd2-8c23-ae49b48fc9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743829, "uuid": "11e2b23c-f131-4a1e-a972-67186fd0015e", "value": "chrome_update_old.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b8b587-33db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775715285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715285, "uuid": "b4eaef7b-46a7-416a-856e-241c41f9fbfc", "comment": "Malware payload (Mirai)", "value": "e05ee4ace38a995c613ff82b4454643b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715285, "uuid": "991996b9-5ae5-472e-b0e8-a9815542aa66", "comment": "Malware payload (Mirai)", "value": "6e1d420eb77de6cbf9f3f30873410f1f428cb0ad45bb8cb7acdb6eaca7cf25a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715285, "uuid": "e3ac18c8-dd50-43a0-836c-614e8c3d06a6", "comment": "Malware payload (Mirai)", "value": "bb895de35cd4eb558042406391628cc7bd53094b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715285, "uuid": "0f985af5-962a-408e-992d-f1349594a9d6", "comment": "Malware payload (Mirai)", "value": "516b04c4e5a879cad4a5a76ee0e2846d8789ec62392e5bd5aa7a0c33b51d49c5488862973d51fe52ff0666bf962ae17c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715285, "uuid": "d3f392f8-0b3d-4a71-ad1c-f30ef0da5d1d", "value": "T15AF30745BC819B10D9D636BEFF4E028A33575B68E3FE72029D205B2127CAA1B0F76552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715285, "uuid": "7aa956e4-6175-4d3c-83fe-76f29b292d34", "value": "3072:2hCw6Z+aOvQClgxE/YSGmEjmk6vhaAZcWHfFDg/uH+a+XQ:vxZGFv/Y/m6mBvhaAZcWHfFDYRa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715285, "uuid": "9629130a-b57c-424d-a24c-1e3acc7054d4", "value": 162964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715285, "uuid": "8cc5324d-c8c4-4442-8b39-5b4b6790c98e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715285, "uuid": "785388c0-08b5-4df0-abd6-ae8affec606d", "value": "ec0edfe1_176.65.139.44_25565_20260408-231001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e3fd0a-3468-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775776036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776036, "uuid": "4d70d8a0-c060-416e-bb4d-399ac888102f", "comment": "Malware payload (Mirai)", "value": "60c2a53f40737b269cb6673161d0a006", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776036, "uuid": "c455ff0b-b983-4ac0-af44-40ec56cd8cd7", "comment": "Malware payload (Mirai)", "value": "6e8b83824cb3e71d7cb58f5c12d0635392fcd3c16b54a22051da21cdadc13e5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776036, "uuid": "e6031221-0eb1-4355-972b-6292cad2bd07", "comment": "Malware payload (Mirai)", "value": "e0acd7cc235dafd4782060c29c79c05926906d47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776036, "uuid": "d5939544-8bfb-431c-96f2-79b8fac8a864", "comment": "Malware payload (Mirai)", "value": "e790683241de0f95aad70a48e51d26d0569fd607a7376cc7c8e474e420d2f84455f80fd3bf506974edc9296e66fafb7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776036, "uuid": "b50c166e-50f3-4764-b75b-76a0ddcff507", "value": "T19354EA1B7E228F7EF36D877047F38A309759769616E2D540E26CE5102F2438D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776036, "uuid": "4fca4ce2-2103-4ab9-b91f-e02801b3a574", "value": "6144:jN3j1N9GhsODihaoSrGXY6i9JhNj5rIG/u5XyQV61JKTlw:CmNRe9JX5rIG/u5XyQV61JKTlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776036, "uuid": "a9c07e6a-575d-48de-a668-63f4c3c5e0c6", "value": 298266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776036, "uuid": "01184157-f2d6-42e6-9759-5522a95fed20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776036, "uuid": "28fe9e82-0692-4d9f-8a0c-92112e150109", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992b4c7e-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717086, "uuid": "e59c1566-405c-43a2-b1b4-744dc2206f7f", "comment": "Malware payload (Mirai)", "value": "9c50e1a8159bc42c1d095fc52c359eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717086, "uuid": "9c33b5b5-824c-4668-8fff-aea40149fe9d", "comment": "Malware payload (Mirai)", "value": "70a2f8ee4d56a2f22b306240956cee0a53fcbf75d21d6a66d9b8695c51dc1d77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717086, "uuid": "e2909e46-f323-4e85-a911-ab244327048e", "comment": "Malware payload (Mirai)", "value": "4897349af0727cc0d849c4c292e258dc0f7f0459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717086, "uuid": "14a028ed-f6b8-4363-9a59-33719a482006", "comment": "Malware payload (Mirai)", "value": "fd53d9e5f1d8843eaacf2413d0b0999f3e61be92f74eec2427e0a2a94098d964025d4d4d6c611c319a54b139408cfa5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717086, "uuid": "217eae86-d433-47e0-8953-c873e66dfc8f", "value": "T170B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717086, "uuid": "21603b9c-8b44-45cd-a61f-28b7a30e8723", "value": "1536:SEkWiTLiZECcpHOWWJDmmn5Pd1Oe4datc9BWZ6nak7+TeVedVPneQBZN01y6L:gni50poFEa69BWO7+Te0dVPZ01y6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717086, "uuid": "a62dcdba-536d-459a-94f8-052ecfc9bdb3", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717086, "uuid": "08d29f72-d294-4736-bf77-a8315c40ecc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717086, "uuid": "1727074d-ad77-4a35-9171-a101dfc433a9", "value": "Hammz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f830acd7-3462-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775773510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773510, "uuid": "0f1f6e23-219d-4e49-b37e-918faf331a12", "comment": "Malware payload (Mirai)", "value": "f70c9f223bfda5d0d596ce253d89d062", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773510, "uuid": "ac8516f6-46b7-4225-af06-de8424930a0c", "comment": "Malware payload (Mirai)", "value": "714088991eee10dcd13b7b281d43d986db59da056a5b3fbb89be75a9e48d45ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773510, "uuid": "f874a41d-f68f-486f-ae2f-aedfdb1f128e", "comment": "Malware payload (Mirai)", "value": "0138bab156f3db684c06dc2474e6b585a39e21ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773510, "uuid": "c0587df0-ca89-453a-abf9-2b12a63f3141", "comment": "Malware payload (Mirai)", "value": "a09c6d60493fb81602b7c870114a47b097539504859fced57d6d89f026e029baa39a7fb29508a06dc6fd563826143c0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773510, "uuid": "c6fc83da-60bc-49dd-bd8b-12b248c45a2b", "value": "T1A1540906AF610FF7D8AFCF3702EA0B55148CE81723663B367638D968B60A54E59D3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773510, "uuid": "c2bfac15-4b7c-40c6-a003-148d5b0e1efc", "value": "6144:imiANFdRuPZp/7mzRBfGtuKFBanmPAz+9OjTPor5rIG/u5XyQV61JKTlw:6XglGtuKFgWAHjTPq5rIG/u5XyQV61Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775773510, "uuid": "37066958-a007-4e73-95dc-1da64778068b", "value": 301911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775773510, "uuid": "13df7235-b12a-4730-b268-45fbc9d1934a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773510, "uuid": "74e3c894-c521-41d2-ab06-e3644f8d546b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f22fa38-340d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775736772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736772, "uuid": "2c8c8190-238b-43a1-9dcd-06040978cc81", "comment": "Malware payload", "value": "2af0a6135df3502a7f6de4d2de6db73b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736772, "uuid": "f6be88b0-3305-4b6f-bf17-7b2c44928b0f", "comment": "Malware payload", "value": "7200a9f1e1ea51b66ab9c9274e9d8f805633179634e8ff4dcb8ef82bc02518df", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736772, "uuid": "1298851c-f4e6-4786-8912-aa1e17156bd4", "comment": "Malware payload", "value": "b1c4a94df23638d70dae45f3193a64a6b036056d", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736772, "uuid": "9292ff28-12d4-443f-94a8-7fe6c49ab399", "comment": "Malware payload", "value": "fb5608ee2b76fd1ab58e9bf6039cc74bc253a74a1931864ece967063fdc2c3e3508bca48acb196d08bc649710bb9237e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736772, "uuid": "a55d91bd-8407-44df-8060-2a29073f0935", "value": "T131F423456F4A8F4CC675B8BFA37216E100FB26718EE426BA047D4CFA174A919CB446FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736772, "uuid": "4b0d8d08-e404-4ebd-b408-d2c3e7f254a3", "value": "12288:uLGfum7l/F2gOla3Wvej9xwyOiduNAgYwi7wGK/VpLTru+n08k/Iow4EmQeSary:u9m7j5mv1yzsi7wGK/VpLTa+nI/I/hma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736772, "uuid": "86ec3c34-c7b0-4f17-841c-802de3f722c3", "value": 749270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736772, "uuid": "66469924-40e1-4eef-b112-088e67eb081f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736772, "uuid": "3f834e8e-5fc8-401f-9cfb-6a60d667fc1b", "value": "\u0412\u0456\u0434\u043e\u043c\u043e\u0441\u0442\u0456 \u0437 \u0440\u0435\u0454\u0441\u0442\u0440\u0443 \u0432\u0456\u0439\u0441\u044c\u043a\u043e\u0432\u043e\u0437\u043e\u0431\u043e\u0432'\u044f\u0437\u0430\u043d\u0438\u0445 \u043f\u0440\u043e \u043f\u0440\u0430\u0446\u0456\u0432\u043d\u0438\u043a\u0456\u0432 \u211620260409-7496423-1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03590dd1-3456-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775767945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767945, "uuid": "9e2ecaea-2b1d-4882-825e-75daf1c9c866", "comment": "Malware payload (Mirai)", "value": "8df850faadf7afcd95d28edaeca5e318", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767945, "uuid": "2327e6f2-71cb-4093-ac0a-947f620fdacd", "comment": "Malware payload (Mirai)", "value": "7382e7affc0f9dfbf0f03bbc8c9aea4ed67ac4c67890e36a1cc7ab94a007a988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767945, "uuid": "59825eaf-fee8-4c7c-933b-f53754687c5b", "comment": "Malware payload (Mirai)", "value": "3da8bff9eac390d83519f04ac66c92e86197df07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767945, "uuid": "7d5833a4-354a-4f50-a08e-73aa8b1aec7a", "comment": "Malware payload (Mirai)", "value": "d06738d7ab51c4f94217117235a211b8e2d2354edaee1e65839f5cdf5375f2602ad60475360c857e6dca95f8bdcb5b31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767945, "uuid": "c0d22a30-8436-4e0c-98fc-b45a460de468", "value": "T14A632A81B8829613C6C412BBFA6F019D776653B8E3DA7213DD219F20378792B0E77746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767945, "uuid": "86fef525-8d4a-4a8b-ab8b-2bca10d80383", "value": "1536:UNyzA4/2loHNSF7supL0zA/B3+X6pmOdy7Ep5ccdL:UNyzAnrB3+KtcgL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767945, "uuid": "573a461e-1e67-4838-b0e3-05e4424c7998", "value": 68780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767945, "uuid": "2ad6e5ec-cacc-4a25-97ed-2125c77622d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767945, "uuid": "21e906c2-1b65-4ad4-9ee6-0ff6b618f261", "value": "manji.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c15966-346a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775776644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776644, "uuid": "441fecb9-b624-42e9-9bff-437b670df312", "comment": "Malware payload", "value": "de97474fef2598e003b6bfd53d281dce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776644, "uuid": "d641e498-1bb8-489c-9a6e-e3077de594df", "comment": "Malware payload", "value": "73e8142ef1df9eb6eb5b717c1e6316874632f24d5e276a635ae0e7ebfabe0c2d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776644, "uuid": "c017e4c9-2be2-42d9-a337-28049aa9a0a1", "comment": "Malware payload", "value": "6da266e1ec24fbcf2c02826fd4464beb5ae2c4a1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776644, "uuid": "aac901ba-4a3c-45aa-a905-d95d15fa26c5", "comment": "Malware payload", "value": "f6b4e7be5a525036395a08e00d3f73e7f67f18518b50134c3d4f0ba0736110439c9ccd6b6f294d52483548f3c4f610be", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776644, "uuid": "bd80503b-f751-486b-812c-47318117505a", "value": "T174136C6526953C25AE99883B5C7F2F0CB9A983E1304491DDBF8B3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776644, "uuid": "36054856-2194-4210-b502-2d638fe97a24", "value": "768:bqs9NyXsZztCv9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bvHusZVcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776644, "uuid": "34e366e7-6712-4cf5-92d0-75adf6677905", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776644, "uuid": "64a74780-e7ac-4e9a-a1f0-379cac9e0644", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776644, "uuid": "ffb7586d-6f8e-446a-9e41-34a9cfd7a00b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c52c169-33dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775716044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716044, "uuid": "2ff66a07-481a-44d0-9271-b7987ec8edcd", "comment": "Malware payload", "value": "119a80a15f0a50017e2a3de66705e774", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716044, "uuid": "388c1829-12f4-4a33-b17e-ba72e7c3a500", "comment": "Malware payload", "value": "73ef3fbe275321b78c11b1de44ccfeb1e5ca906c5c9b1c1a9562567cd09b7bbd", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716044, "uuid": "c4c79cbe-c2d1-4015-a848-542818132592", "comment": "Malware payload", "value": "c421e54e16328ebc9913bd46debbfd8b75dbef91", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716044, "uuid": "f7e98ea1-bf12-4763-9387-dfec414ff8e7", "comment": "Malware payload", "value": "05f883d25e13909b145e04c53de9f98b7382620e6f38e4233432911feaf0d2a90f5f1dc6467124795bcb8821b6205615", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716044, "uuid": "d34c9972-c226-4066-98d3-cfe38394e342", "value": "T1D252772C09BDFA5893D9E207EA99F7276D461CAFD2B875172AB38C6CA0024C045DB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716044, "uuid": "41632d13-7c99-4b94-8e3b-e7c09834f1a3", "value": "384:anXoS6BcGFkbh7ZF4gcqzBBIlGQeNyw63fCx4VND00Puxa4NFyNw5W12XRFSWsu2:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716044, "uuid": "5061c151-b859-4b59-b6db-eb0164bfeaf9", "value": 13813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716044, "uuid": "93a595a6-cb61-4126-8716-4a98d8b080a8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716044, "uuid": "e1e60a4e-81fa-451a-a260-4034d0f89cb1", "value": "encrypted.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d76cb86-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717013, "uuid": "e8cdb472-cedf-4aa0-9569-aa37e3f4cc2a", "comment": "Malware payload (Mirai)", "value": "9b77f90181b586b56fd611667d4f9372", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717013, "uuid": "6c1ff25f-d524-4bfc-b079-9199c5e7afe9", "comment": "Malware payload (Mirai)", "value": "7441522aff2455d4c1f6880cca1b51d69531381bfb7687c82c25eaf07e14e33c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717013, "uuid": "da08b1e3-3317-4953-b49b-25ef3181fe61", "comment": "Malware payload (Mirai)", "value": "0bac416f8dccce7ab5a3a62e01f5a0a6561fae45", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717013, "uuid": "8f8c359d-292c-4b78-9fe1-8aea3f0ad662", "comment": "Malware payload (Mirai)", "value": "a280da9ab3272a2fbacdf215c556fb4657943312ce66b36f97bdf4e5c1f1e420d81067fb083a94d4ba1a2453e0219712", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717013, "uuid": "a468cc23-b62c-4e8f-ab36-6005e7a6fbc7", "value": "T1A013F1FFA37FEAF4D93E79B90A0C468CFDB1671FF481A76B44D0942B5D168221822941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717013, "uuid": "84116519-79f2-4a7e-8519-1bf9432b52fa", "value": "768:ghIfHyA8J99JgD00/1kx+T+xveN293zzCdOGPmZQAUxbPC0T27gd4pBx05Z:ghIvyJ7gq+TKv+2lzzuOXQlxbPCg27TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717013, "uuid": "45ce074b-794d-4071-851c-5b5ad223cd43", "value": 41988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717013, "uuid": "4aa29255-4017-43f6-9e8d-2bd772f8ca11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717013, "uuid": "8012d5ba-5a27-49f1-9e00-d3ee63016be2", "value": "Hammz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1de5509-33cd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775709423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709423, "uuid": "36de5df4-92ae-4b8c-a41f-ddd308075252", "comment": "Malware payload (Mirai)", "value": "134c1b150fd808ae9247a10c04a5dafb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709423, "uuid": "4c169fcd-7361-4711-be04-448cb73ff8f7", "comment": "Malware payload (Mirai)", "value": "763e327373af4e6de889bad0f0ede37f892aabbe0287a72401658ec2c68f7019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709423, "uuid": "e8eeb7df-85da-4428-b9ff-7b6755c5e424", "comment": "Malware payload (Mirai)", "value": "63b5fd61af48cea67f415c27b8f313800da46b37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709423, "uuid": "243ec32c-d40f-41b7-97f7-753618e821bf", "comment": "Malware payload (Mirai)", "value": "c2c46229dcc65accc0e11584401d7159051382ec2ff40cce4053cfcdfc28330cf36a9bd3855d762432eb96c92617a2e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709423, "uuid": "2cb20525-d056-4029-b213-c305aac9edf0", "value": "T134B34C85E753E4F1E85705B011ABEB394931BC771220CD7AD7A4FFA2AE626C1E11632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709423, "uuid": "c39009b7-0bea-4204-b746-59a4e82d6dbd", "value": "1536:aSf87I1iuCNT0isIMOkcGe8QVW/6QUj31062jd6oaxkSfBErp:H3iZQveCbdpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775709423, "uuid": "68db56f6-ef62-4750-b84d-d104fb9fa302", "value": 108172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775709423, "uuid": "1b3225fc-eb74-49b0-be61-96430646616b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709423, "uuid": "8eb2533b-de1d-4c07-adb1-9625245ae705", "value": "nx486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882462db-33fb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775729083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729083, "uuid": "49cf2346-a614-46e3-8241-0913e0b753c3", "comment": "Malware payload (AgentTesla)", "value": "fd8da1f89c9a7e94a811d885422784eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729083, "uuid": "9f5b7768-eedd-4ff7-aa36-34d272aabb46", "comment": "Malware payload (AgentTesla)", "value": "765e69564a235c9eac6d724c685066b120cfbdd22ccf40543b3f663427003e4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729083, "uuid": "6d08567e-1cb4-4abe-acda-ae81ddddb4a7", "comment": "Malware payload (AgentTesla)", "value": "d785977f1e09c9a3262d401a499e44c327852e21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729083, "uuid": "a01b3c93-41e0-4bb7-b00a-6bf035a38de9", "comment": "Malware payload (AgentTesla)", "value": "7f732e8b2f0fcfb37b423d71c20e258427fafcf89925c399ddd17a393acc77389a120dacb19d48cf308f1e84d6de77a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729083, "uuid": "5f4c17ab-4690-4c58-a734-e15d5922aab3", "value": "T14A2502456278CB16E4BB9BF91931D13003B67C9EE620C2868FC93EEF357AB505589B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729083, "uuid": "c70c9fea-ecc9-440e-a3cc-0e3f045cbfb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729083, "uuid": "13b3f987-9854-4e07-b899-9496ddd2cecb", "value": "24576:KGHXoMLVGqTNEvgIm6C3fYDtUQpsyHlxyGWZ:p4QTNEYIRwQtT9WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775729083, "uuid": "69244073-2f11-44a7-b781-d1ad4048702b", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775729083, "uuid": "281f0998-6ffb-45fd-9e07-cbd83e89cb14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729083, "uuid": "310f7559-17f7-4e46-a347-76c7e7ecf2a2", "value": "Vessel_Main_Specifications (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcff1de7-3414-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1775739910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739910, "uuid": "94e1cf7a-1625-4341-bcd5-81ce9bf8a814", "comment": "Malware payload (NanoCore)", "value": "aca519ec4819336470c5977a7829c135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739910, "uuid": "a200498c-7784-4454-af75-2b63defb399c", "comment": "Malware payload (NanoCore)", "value": "7791dee10a67c4562ceea979bbcc301649c68dd38a21caacdfa9338b8579392d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739910, "uuid": "247c229d-5c47-4b5e-b048-350f22c8c836", "comment": "Malware payload (NanoCore)", "value": "f56985ef1239e9cbdf54a9f57cd9795297df1fc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775739910, "uuid": "d2a69836-3423-43c6-a53f-7b36bdebaaa0", "comment": "Malware payload (NanoCore)", "value": "3b2a796623f9cfe8e80768d7986d966db54d4e625aed7bd80f5bedbb5c6775b4abc2ef874150779ecc84edf875c49e4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739910, "uuid": "0596d719-c1f3-4e7f-8b62-233843d037c0", "value": "T186F4F183A684495ED96C57B95037CD3A4337AEA56DB3E2CE54E87873BB732C20907483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739910, "uuid": "85b266cd-9a22-4275-a11a-74b5efd5ed61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739910, "uuid": "4f595233-cdfd-4d93-a230-aadb1535ce23", "value": "12288:LLV6Btpmkr/CNYjwixyV1Zcn5HkwnNf8ZAFrSF11TXXNTdi6zYYQ0B2FjoigX4mJ:vApf2NbhjsRkaNhU11LXddi6s1RFuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775739910, "uuid": "093af70f-389c-49ae-a8ec-3110feb776fe", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775739910, "uuid": "9a755bbd-85a7-42cd-9ea8-7557b57c132a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775739910, "uuid": "f2f9c91f-fab8-49ea-8838-999a210307c5", "value": "ACA519EC4819336470C5977A7829C135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4967e0-33dd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775716049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716049, "uuid": "eb431dd3-1861-41b1-b7da-841b6a8cc4aa", "comment": "Malware payload (QuasarRAT)", "value": "599a506f71dab8c3e8b574ba74abaff4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716049, "uuid": "bf68b598-b543-4725-9899-285d86b69369", "comment": "Malware payload (QuasarRAT)", "value": "78b94a7b9317cd36681d32daa672d072c7ee91f8d4a049834bd9ad5a8a0f01f8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716049, "uuid": "ffdb0a3d-d25c-49a8-bd21-237d770a02fe", "comment": "Malware payload (QuasarRAT)", "value": "184fed7091fffb1789b9a34405d37af3089cd4f9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716049, "uuid": "d2d08a3d-f47c-4ad4-970e-7bc1361a5ae8", "comment": "Malware payload (QuasarRAT)", "value": "7c0cce9fffeaa0da3c25eb2e2d5d0f8e4b999d1ffe9f19370b802ef0865627ae6bb08d1525808e2b5ac1cb51f9089ec8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716049, "uuid": "f76caf67-ce97-4456-bf9d-0b16e83ddb17", "value": "T13452AC2C09BDFA5993D9E303E699F3236D4A5CAFD2B975172AF28C6DA0024C045DB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716049, "uuid": "e29e8894-acab-40b5-973f-719dda6e2df4", "value": "384:ykn6gbGFkyLMs4KskInbeYzt0Fft6hOo71r12jVeCcK+kh1CoGTGSg7WFSWsu9d1:yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716049, "uuid": "bd1641ed-0b7a-4369-b074-10babaf53eae", "value": 13581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716049, "uuid": "ade9e090-fd7d-4bf5-83a6-b3ef6b9115e4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716049, "uuid": "d2b22760-b1b3-46b1-9194-39780c72d826", "value": "encrypted.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fec7981-3464-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775773979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773979, "uuid": "ddde34a6-8a62-4618-8c8d-d200de734be2", "comment": "Malware payload", "value": "fd88275f8310775848a73fff84b7a819", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773979, "uuid": "cd5e0d48-62ee-4ea0-a701-6d16ccba2f45", "comment": "Malware payload", "value": "7a28482deb294e71d2562089224db55b9ad0b9c71420530735a04615a042e230", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773979, "uuid": "e20b65ab-ebdf-45bd-88fd-736ef7c1d84e", "comment": "Malware payload", "value": "bc51b1c1d4b3ce52203e817b3209e69ad3994121", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773979, "uuid": "0feb2e07-16ea-493e-8dca-9d4de668f5e0", "comment": "Malware payload", "value": "500a4933d4194589885078f6238542ce38de897c5b948f084214f923e06e223278347a8ef0f307ff496e7bf9f094ea68", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773979, "uuid": "7c018fb0-be77-4767-924b-aa947a2419ff", "value": "T1BA876BD4396DF826E2CDA77C6F75239C7324BC041B91E31A24057FAA9DB22D897331A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773979, "uuid": "1597f02a-0c52-47be-9c58-dfa3ccfb4839", "value": "393216:dD2stzCctTPIx2eO66cocE45fpv2VKs+xgm8zMZUJqux:dD2stOc1PO7kM8zMiJqux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775773979, "uuid": "f047f1b2-0ada-4754-8057-6a121ca95124", "value": 36814946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775773979, "uuid": "4574324c-36bb-47df-9c46-aa77cd51884f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773979, "uuid": "0c4a7e59-c2ec-4b44-af3e-81879dc3e75d", "value": "com.apple.periodic", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f76a61-3417-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775741018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741018, "uuid": "07fdba5a-cb40-4cf5-aa9a-80463695bb3e", "comment": "Malware payload", "value": "484a3c0de2f80a1fdac8bf69607842db", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741018, "uuid": "5c2df4e9-075f-4027-bc1d-7b7c36e6f69e", "comment": "Malware payload", "value": "7b11eaccb78b658e387371a5518e7e51092a85048c600808f118caba3183ce2a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741018, "uuid": "72d2d4d5-a765-4653-bfb9-3a64d2e24d58", "comment": "Malware payload", "value": "3fc2c29f1c3e60736a6425db204276e334956af8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741018, "uuid": "bde16d5a-11e3-4588-bac5-785c191e0a78", "comment": "Malware payload", "value": "e66ffe8242a53baa32b2e022c494a951d5b746bf4871bf5478487c2ae935c26f5701168bb640b753f2043054e54d73eb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741018, "uuid": "d31381ff-bf98-4c79-9a0d-1c6770d82d4a", "value": "T10A7533C3159F69FA62D40F3A50D4BD1A92421F8F6F51B1938853D308A28B4D1EE39B6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741018, "uuid": "51b54594-fe77-411f-9521-ca3dff012c95", "value": "49152:srVNHhwR+SyAXZwUwKG9qwLVCXKRH+YnIBcHJIMSp8gKOP:srVt+HFZwUuqFKrnIipbSp812", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775741018, "uuid": "c8fd7042-13c2-4028-8176-3e8d90fbb060", "value": 1665166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775741018, "uuid": "58739c6a-3d37-4698-aef1-c6eff58fe4eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741018, "uuid": "7acdc1d2-04c4-4893-9235-57c51db3cdf3", "value": "ratatuj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81427d4-33f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775724949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724949, "uuid": "89251089-4ec7-4d6f-a49b-04341d7ed4a6", "comment": "Malware payload", "value": "ffa3d0b5da7e5d5dbe8ea355f737e5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724949, "uuid": "98b09a0e-0333-47fd-a010-98827f226350", "comment": "Malware payload", "value": "7b32282e5b79a39f2cb48ee6e17dc60a382553cb25dfd3b6e7aa913a81d371b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724949, "uuid": "39d8f93a-23f1-4756-8280-60d7a75db4e3", "comment": "Malware payload", "value": "2b9851ea8fafbc0d66f346cba8965a683522c67b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724949, "uuid": "d77250d6-8661-4cbe-a611-6cba88c9d593", "comment": "Malware payload", "value": "e478e367e20601d007151682c0f1f9761c1a2c30a3317bcd2a824a7f7bdcc3a13a94714aeb42e24798474fc289a15582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724949, "uuid": "6fe60eb4-239e-4cf1-8781-50ba8e084f45", "value": "T1B6249E5672D108BBDC63457ACCE70A17F6327853DB38EB6F036042A5AF6B390462AF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724949, "uuid": "e0b40d1f-0291-4642-89e5-197d66bef912", "value": "d9549d2f35acb121d5e8e9f6ed965ffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724949, "uuid": "f573bde6-2c69-4272-a781-c4eefc25ecc8", "value": "3072:ZRrJQCQFbQnDslXrXXl1D6rbEpQlPNb11fNfaSbVVb1T2rMD:/JkkDslTPD6r06b1BNfLWMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775724949, "uuid": "6d42188d-31ef-412e-9836-9a203a60bbe2", "value": 211456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775724949, "uuid": "8302ac77-43e9-4582-9781-7cecb96515e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724949, "uuid": "dc8db3ab-a022-4adb-8a18-faea3b69bc52", "value": "7b32282e5b79a39f2cb48ee6e17dc60a382553cb25dfd3b6e7aa913a81d371b6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fde3efd-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717070, "uuid": "70f66c92-aaba-4608-a43c-37a6b57529fd", "comment": "Malware payload (Mirai)", "value": "8683bc087e3e31bf284133a092381359", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717070, "uuid": "fdeab2bf-6a12-404a-8529-ad531fbb7ab7", "comment": "Malware payload (Mirai)", "value": "7c6d77f452ead8124888d9a4d22ceb54354deed4c642ff78596e9e67677e3fa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717070, "uuid": "a0022f4e-b6cd-4d12-ab79-2b0319a59ce5", "comment": "Malware payload (Mirai)", "value": "ed7f86e3c86cfb3ac84525d35eed6ebf968882f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717070, "uuid": "91758911-fa33-4111-a782-e4fc777bb9ae", "comment": "Malware payload (Mirai)", "value": "81deea432eb21f4da5b398482fcd99310a63ca0d63fc9a833b15654c1e254ac13bfcb7b5dacc5734475ec0c63fa277b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717070, "uuid": "e18f2151-2e82-4c62-a823-5500708cee9f", "value": "T16B736CC9E983C4F6EC130A350136BB379AB3E53E2169DB83C3A9A565DC125C2DA1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717070, "uuid": "eed2d97c-43b6-47be-b9e3-0a466434728c", "value": "1536:Dbsv6XewvySsos1LNxVZW9Z3J8h3qaccSXh:DbsiJzsokLNx+9zs3mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717070, "uuid": "24167449-d712-4f71-acd2-f775b36f1481", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717070, "uuid": "2feb7621-493c-4f56-9cf1-0973d1d800c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717070, "uuid": "e371b8cd-e8a3-449d-85ce-4cea2e74a2e9", "value": "Hammz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fa1616-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1775718777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718777, "uuid": "37af686b-20f7-4505-b48f-e77d63238fa5", "comment": "Malware payload (RemcosRAT)", "value": "a47fb559e813d85ba0745d44f798c3cd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718777, "uuid": "39a89ed1-3fc1-4a2d-81d6-f1a8e47e5585", "comment": "Malware payload (RemcosRAT)", "value": "7ce2e5d6bcea978ad3f2914525bbfb47a2d54eec4dc8a61d0e357d34c68850ed", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718777, "uuid": "5f0f556c-395b-487b-b027-7156cfd9c76f", "comment": "Malware payload (RemcosRAT)", "value": "761556538e63616f77034d2125e85170f54981bb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718777, "uuid": "de119e24-fcc7-4f6a-880d-97567aa26836", "comment": "Malware payload (RemcosRAT)", "value": "0c271b00bdc66999c09cede00d04587d7edbce00a53204a87caa802754d76d0270912c242f8bad38ca94e5f23415cc6d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718777, "uuid": "cfb6f7fd-089a-4574-832c-7a861eb77430", "value": "T1E355626B4918C27765C086EFEFF0F8879AEA06507528557D8C0E41ADC4B606EC9C2F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718777, "uuid": "dde201bd-9cb2-400e-afee-7fbf03d34d0d", "value": "192:cB4jJrztno9nvYYwunu9TSA0ml3IJ6xLO7u:cB45uvecAa7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718777, "uuid": "40e43ee9-30ec-4b41-a45e-948fb17221e8", "value": 1292609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718777, "uuid": "208fb0b4-d908-4a86-adde-8cd4196f1b99", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718777, "uuid": "cbdd20ff-ab61-4a41-b7cc-03656334eefd", "value": "GS_0012603026_xlsx.7z.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebe9b73-33f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775724263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724263, "uuid": "655fdc04-1ed6-4f56-a1f4-1966dec276f0", "comment": "Malware payload", "value": "ffbea32c2a619da8f8e7b56f08c4d04b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724263, "uuid": "727f0760-e5f1-428b-9f04-8f99cb32b3a9", "comment": "Malware payload", "value": "7d016623dea856cf8ec4cdfb943a073edf47029b1769d54462871ac8b0596f17", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724263, "uuid": "c1bd322b-e820-4d33-9e8e-b805abd1f38e", "comment": "Malware payload", "value": "ee8deec1983538329e3fd290cb832dd5978e59fc", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775724263, "uuid": "75324221-a6d7-4e1e-b9ce-4087744fcd35", "comment": "Malware payload", "value": "82283c90254b1c9acb4fcfd84d00b081e27d1b1949576fca8ff91e280215cab5a2de4f747f2ca0de7981546cff5f1c35", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724263, "uuid": "5c280f4e-319c-4e35-9ecb-3f77a5783acd", "value": "T14E572266DB2D6C2FF43B6133CA6A3631D1190E256742A7D3640076DC28F3AD48B98FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724263, "uuid": "4dda51a5-b687-447f-840a-7a21ad542448", "value": "393216:nKW7hXDVIIOXvjXiBpjj77e0X4AswO0LMgEzTYF3OMwQk/WmbSv8TvSv2CJB4Z:nfdzV4XvWBpf77e5wO0LZE/ZWmvTwkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775724263, "uuid": "8d33f3e6-5a93-4c7a-b051-4a1d0f117f70", "value": 27548261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775724263, "uuid": "71b37775-b10f-478d-8128-3db25d80bce6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775724263, "uuid": "b7f96b2f-6916-4959-8120-84e47bbe4447", "value": "com.smschat.mmschat.messages_1.2.8.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09c5a01-33f8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775727890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727890, "uuid": "51415ae9-74ca-4820-8f22-34430b1e70d5", "comment": "Malware payload", "value": "97b17f78a30d33f8fe70b67eb5596cb3", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727890, "uuid": "b787922e-4a2d-4ae8-b0d8-0c754dee59b6", "comment": "Malware payload", "value": "7d5a70a793f90ca437965206defa002b8c94b575c9ab6c59aad7da09b839955d", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727890, "uuid": "71ba4817-874d-45b5-9fcc-faadbaea42c2", "comment": "Malware payload", "value": "e7282acd1ffb0018bedc37ba7988b0ccc2438a99", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727890, "uuid": "cf85a5ef-c1ec-4758-a799-ae6a6e573321", "comment": "Malware payload", "value": "bb272b45d61cc14048a40f8f2d1c219371eb1429b3c9e5d6ec537cd4805f63e59a78964a51e329ac4c29ae9e61dd956e", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727890, "uuid": "c8d15634-7d27-4a5e-9d48-1b5491a5aff9", "value": "T1A15453A0434018A8A25F4FFAB67D75E2D5FD8A757C84094EDE313DA7F97EA0086607B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727890, "uuid": "fea7314f-15ba-4125-9c0a-67f6ca2f7a79", "value": "3072:LYJOX+fRzRRd68Q0J5UgZ2I0HibYCv73iTzKeZ1h5grVMea:ZufVhXgI0HUZv+TzKeZlgrCea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775727890, "uuid": "f08bc0ab-8515-470e-ae2c-e35c65d44c73", "value": 301242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775727890, "uuid": "7a582152-31b1-4827-b2bf-e304b0bfa1aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727890, "uuid": "dd2d9a3d-4182-47c7-bb15-737f56ff1383", "value": "2D Drawings List STP.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d526e79c-33d7-11f1-a769-42010a9c0008", "comment": "Malware payload (TelegramStealer)", "timestamp": 1775713751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713751, "uuid": "058a4f0b-0324-4f7a-88f2-b93a0593de67", "comment": "Malware payload (TelegramStealer)", "value": "e7ab160558077be6994b2533d36fb100", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713751, "uuid": "4ce1f55a-9e89-4326-afed-c9bfc7337bce", "comment": "Malware payload (TelegramStealer)", "value": "7f01fb2e651c5b3cd3a0f7e01db68934889e85d9f20082b68802574fd9f73568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713751, "uuid": "44c43f11-610f-40da-9a76-e8b809cd66e2", "comment": "Malware payload (TelegramStealer)", "value": "07fc2280e46baa77dee67e07d054223563cd266c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713751, "uuid": "e2d52434-d82a-4fb1-8c09-7cd2e32589f2", "comment": "Malware payload (TelegramStealer)", "value": "646a08b6779c53d48182442097c583f2a829b7544e4a2a8018b90a5531fa13269f61451ffcd8fb5ebaed736375774af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TelegramStealer", "colour": "#414F0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713751, "uuid": "a26bc927-86ae-4e4c-b41b-0e599891c0eb", "value": "T15C65010BA7E500FCE2BBC274CD621906EB72FC464B75A69F13954A921F237909E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713751, "uuid": "20925ae1-b627-4dc3-8267-bf2a74632c4e", "value": "c0509d80867d8b435359ad28bdcaf9a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713751, "uuid": "42bf913f-0109-475e-9c60-0151073fdea4", "value": "24576:lrHpLmmFUvPe9JqiKhwCWJ29FvzpcPKDgNd40AaGY3hfAnfousFBQ:imyO3xL20P2SNAa5fmfnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713751, "uuid": "8f7608bd-e1f5-47ec-828f-e49747d9f459", "value": 1468928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713751, "uuid": "db0d620c-6270-4afa-a85d-cca6592eb98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713751, "uuid": "b1a16ba7-efbe-49d1-a255-42ebccffe7d1", "value": "e7ab160558077be6994b2533d36fb100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743e49b6-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717024, "uuid": "680bfe7e-8da7-43ad-8e70-bbb3d4582567", "comment": "Malware payload (Mirai)", "value": "3997dd44375274021f5eeb25717581ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717024, "uuid": "45cb6b3f-dd18-419a-a94a-5ab0d1d2d820", "comment": "Malware payload (Mirai)", "value": "7f088ba3f54509c383efb4adab6d936a33385c7374b0cc30698c8aa9500dd94e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717024, "uuid": "c4084089-1b4c-4c70-8fb3-ecbad893da04", "comment": "Malware payload (Mirai)", "value": "569b08b3bf9d4c84ef4081c08e45a3bdd84b99ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717024, "uuid": "be7b646f-03f3-4abf-bc49-84af1ff3db4c", "comment": "Malware payload (Mirai)", "value": "9c99f3b751cc64cc3577f68f81c574864fc4d1f2ec5b1862afa5f268d68254fdef2cc1a8e320ba2fadcf39b35cd11a3b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717024, "uuid": "5b52c4e2-760f-4187-878b-3d4cfc1d04ef", "value": "T1D363021A2563FC70D7E10575E036A20F7BE006B8A5AEF4966970A38D79D5C0BEB38703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717024, "uuid": "84aa1968-080a-4c5e-b80a-b9976e6830f3", "value": "1536:QWIe2QfoLEoqEWB6hqPjyty3YnkidLkG1Y9sg5zo1A:Qm8EUa6kbyty3YnfdLz1Y9sWoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717024, "uuid": "6b8b9f9b-9fcd-4a1e-8676-8ae58e78a2bd", "value": 67436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717024, "uuid": "aef9b945-d533-41bf-93a7-a7fac0888bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717024, "uuid": "31b54a23-034c-4f03-959f-e71aee54051a", "value": "Hammz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd1eedc-341d-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775743780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743780, "uuid": "a09b5961-d9b1-4be1-89b3-57f51a684787", "comment": "Malware payload (njrat)", "value": "b323c2e5fc6f49a598d9323798c13c40", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743780, "uuid": "7ff959a9-ea0f-47cf-9484-2fc7e0d7c2cc", "comment": "Malware payload (njrat)", "value": "7f0d2adbc838115943ee2d5b779e51070c81038df16cab31c8449ea01189cce7", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743780, "uuid": "c54d2232-c311-4b74-8e8a-32e4071f0e24", "comment": "Malware payload (njrat)", "value": "5497c7466da71f8957e1085935c9dcb1e766367a", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743780, "uuid": "dc728af1-e8ff-4a48-ac78-2ec79f6c8671", "comment": "Malware payload (njrat)", "value": "d418043b3b39cdd8f241f230ac016f5d0a4fcfbfc3662457d0f2205f0404a6934ce7548738892a24faf85e6660e72b23", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743780, "uuid": "f919852f-467d-4554-92b8-9799c23970d9", "value": "T1F055235F2BFA34E5F0328B32C9480F40FB72BD7A5350976F02D4429A5E565E19E2CB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743780, "uuid": "86f08811-4c24-4bcb-a15b-624c1e511d52", "value": "cba2f4ba69a75af73684957a86e1152f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743780, "uuid": "daa89264-ccae-40fa-8d58-f5ce4b90cc90", "value": "24576:xR8g0OxeBrYkRyJP5ComrFwbO1SKazMKxJeNJtURLvMPDefSFcW:z89eeBxSbg0oNJtURQyecW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775743780, "uuid": "7275f8ac-4d30-4851-8b0e-7f5ac984c1a3", "value": 1299568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775743780, "uuid": "03e6c113-5966-4b70-ae44-22b3df05fa4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743780, "uuid": "0a0aa9e8-1b61-46e4-9d09-d856f3ab89fa", "value": "chrome_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fe25eb-33b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775700548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700548, "uuid": "7421b0df-4351-4e79-8b51-52695773e90e", "comment": "Malware payload", "value": "8651734356bfcf731b969c595cb5aab5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700548, "uuid": "b55a4ec6-35ef-4825-aa4b-00c8c9a175e9", "comment": "Malware payload", "value": "7f34b90ecf5690463fdc3a5e44ee45723779c179e886d647fa00985ad57bfbbb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700548, "uuid": "94e84f77-d8a9-4b57-93a4-dfb31925b324", "comment": "Malware payload", "value": "9afcbc40ff07e43263182eb5d4972b44d8b4186b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700548, "uuid": "c5be2d05-736f-4400-8906-5d76c003f0b9", "comment": "Malware payload", "value": "ad8314b1378dae11c6b00ae75a67ca680c92c2b19e2c179862cd34da435cfa9f74199dc8547bfcc2c48073f0864ca2ca", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700548, "uuid": "9eadece0-1b0f-4ca4-8808-b2024ba12674", "value": "T170F1E71AAD8A8032E39D0DF16A66C18A8FBE157327C510FBBFE344A94BD069480D3577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700548, "uuid": "d57c175e-59f2-4fed-aa1a-5e89ec348f5a", "value": "b06690a98652ecccf7c40ef0249b13c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700548, "uuid": "148fe356-e387-4ae8-a911-f436d5968439", "value": "96:73A9NELbgKjd7DTeZnl+IlIdUR25lVXJJGI+RqqyC7tCEIknLe66:73A9k6Znl+DzXJJ9EqqPIkLe66", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775700548, "uuid": "c9919690-55a6-40cd-81ff-0097d7862c20", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775700548, "uuid": "d11fb3ad-5223-4b80-9f9a-1e46b2b41bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700548, "uuid": "2d36bc38-c8fb-4be4-9ca1-5a9ff0fa409b", "value": "getversionx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfe4121-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736311, "uuid": "0d24424e-cf1c-42bf-844a-a3cddc390ff8", "comment": "Malware payload (Mirai)", "value": "a520e4cf064e3d85b7ed9fe2a65d21a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736311, "uuid": "f6314f87-653e-4342-967f-d7774c1de707", "comment": "Malware payload (Mirai)", "value": "809f801bbc4dc03ff100301f3cdeb4010566323d38cbc51725e6f4fa4da75040", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736311, "uuid": "37c64103-4438-4cd0-a629-e6e641e3c340", "comment": "Malware payload (Mirai)", "value": "473821366d71e54073649dcd907feb090771a4b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736311, "uuid": "2063cba6-01a2-4704-a767-da452a474a81", "comment": "Malware payload (Mirai)", "value": "2c47c31ae83b23d936453ae5608f25255028afe839fb0b58a0d8b14d74d4d8b71f68d3a28ca1a347478021044a6fd7b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736311, "uuid": "fb63dc06-37e0-45eb-a611-4008be268787", "value": "T10ED33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736311, "uuid": "981fc788-0ae7-4678-8cf9-40506feed73a", "value": "3072:JuVeGJFWOgt9ctajH1I7sg41o+YLyXzXgvd:JuVwt9cUH1I7sgMeLmLgvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736311, "uuid": "90c7eb9c-2237-4568-a661-27e6f3826008", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736311, "uuid": "1b386625-6f59-4454-b84c-943b1c81dafc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736311, "uuid": "4c82e4c5-feee-40a7-b4a6-c50bc7dd4851", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e31e98-346f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775778900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775778900, "uuid": "9cb082d7-daec-4710-bf66-7f16c5e63ccf", "comment": "Malware payload", "value": "4cd55e5e895e9fe6482f75a3e4f68e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775778900, "uuid": "f249eccc-8e14-4518-a9c9-acb8d6082a5e", "comment": "Malware payload", "value": "81e70aac5e3b1450e9a1ecee78924e69160d6586d76479810e2617ae9b3b17eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775778900, "uuid": "57a5a957-dbac-4047-a6ff-14b4299225a1", "comment": "Malware payload", "value": "15629c4977760847538e1352120b0af20efab57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775778900, "uuid": "b1b7f7e9-7073-4b30-8972-22546af1042a", "comment": "Malware payload", "value": "d506c51ae57f6476cd09c88054e8413f17c8b87c54f92149bd3a1cd53f83834a520d071b7b28e972e458ab77a565d8b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775778900, "uuid": "47865d5d-811c-47b2-989e-e396186d4a85", "value": "T1ACF55C0BEEBD8CE9C099A1348433A5467A6478405B3163E72BD4B3682F73BF0AD75B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775778900, "uuid": "da0cfccc-6b48-4f55-88d3-28e8ebdb06ef", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775778900, "uuid": "b8701e75-aa4f-4bf3-9ecf-f5d8e2f55bdc", "value": "49152:maUM/yhTuQWykwaArTaI5npMVPX5Bj7QclGSf:maY6rbS4PXIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775778900, "uuid": "8515a1d1-b698-40a6-ab72-133b29a92f74", "value": 3598744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775778900, "uuid": "2964ad39-9724-40d5-9066-153537ff28b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775778900, "uuid": "232d1382-0ae3-4519-9391-1ec6af78791e", "value": "SecuriteInfo.com.Variant.Ulise.596178.14908.19120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09dfcc4-33d4-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1775712374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712374, "uuid": "c8b6d802-1e5c-432b-b81e-735ec023b69d", "comment": "Malware payload (CountLoader)", "value": "aa51939d026c854de4ec2bf4b2ec3ab1", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712374, "uuid": "dc297ca4-2021-4099-b7de-da93e96e3545", "comment": "Malware payload (CountLoader)", "value": "822253ec5e51a70b6441e410d46669bc20cce227c8222d56ea64eb07fd02138d", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712374, "uuid": "3d69a81e-a8a8-4795-9f5f-aabbbfeb06ef", "comment": "Malware payload (CountLoader)", "value": "4813bf1f243b0a07763ffbabf404eefae9c6a4dd", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712374, "uuid": "d3ef667e-cef3-4bcc-a70c-cbb40e09ad48", "comment": "Malware payload (CountLoader)", "value": "e03fb1af1a548229a010b7f238c533657fdb196fb5f1f90f1fb68fdfb2282f2a7e97be56338c4c3d72a6a4183f5d7610", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712374, "uuid": "7a4f83c1-a7ec-4030-9f1b-9d5e110a52da", "value": "T176D310CA894E88EDC79F682A416F2C0BC56F5227050DC9907ADEBD553F13DE874B64E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712374, "uuid": "fcae5024-03e0-4417-a531-8e2417e0c8f0", "value": "768:/o2ACaiql9UwhVgW8ZUeLvEz7/gAwxqtWbSOTChRWsLW6LEIHH/BhS/PGGVGzJ3i:VaUHcRpdLEIH6C9/C0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775712374, "uuid": "1962426b-b508-4635-8744-1b3aa8ac8072", "value": 140123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775712374, "uuid": "ff7af67b-1c50-4683-a92b-d143d7f01c49", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712374, "uuid": "3431dcfd-3240-4ea6-9621-88792631dfb7", "value": "Notes_Holiday__31.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7574451c-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717026, "uuid": "eee623ad-c52e-4167-81b1-f74572082a4c", "comment": "Malware payload (Mirai)", "value": "321563a9f090710c631f6a5e73cf5515", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717026, "uuid": "5f4796ed-b5e3-49ec-80d3-2132e083aeca", "comment": "Malware payload (Mirai)", "value": "8256199d6037fdad2e7dc190b40f1d508a27c3bdea5a2e29fc3920af9fabb363", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717026, "uuid": "beb88a94-ff7e-4d3c-a59b-5b44e694a9f6", "comment": "Malware payload (Mirai)", "value": "1f357058ca1c78fa5978a92b480177964b3533ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717026, "uuid": "ed1adb6f-f9a5-498e-b345-964b710a683e", "comment": "Malware payload (Mirai)", "value": "5b469b55f4a9dbfc550f6003c2682c2d4b7041b4611a7a3d59d98e28cb2dceb426205fedb1c6586f55000f3dbb16b0c5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717026, "uuid": "1b10daff-1d01-4f57-8dd3-4c2386c8a4d2", "value": "T15503F168E3506DA4E6D37F3152B89ED9B3E48BF56132AE804256D7123633814E225EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717026, "uuid": "45b4125c-b1f5-4b90-8dc1-44c9a1e87733", "value": "768:Nj7Jzmzi7ygo5RGtRTd2ZrvAU0lgySOTPDRm2pY4ZI4uVcqgw09y:em7y9rGT8T0hSaPDjYoI4u+qgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717026, "uuid": "2c8715ff-766c-421c-8b78-e8d12372701d", "value": 40172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717026, "uuid": "f3233805-af25-49c4-ba7e-0429ad6c155e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717026, "uuid": "08448b2b-2d72-44b9-bc2a-3ce1f6c3a20c", "value": "Hammz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce9989c-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736312, "uuid": "07392322-b2e5-4f1e-9c0b-946e02a26af1", "comment": "Malware payload (Mirai)", "value": "6c92e7473a4e178c9c1d0f0f13984d26", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736312, "uuid": "dc22fcce-4766-4ac3-a18e-a962fc17d53c", "comment": "Malware payload (Mirai)", "value": "83d36992155afe939161adbbd965625e3a39204e38ea85345f7de789b4732588", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736312, "uuid": "14fd97a8-b40c-41b4-b946-a821b22a63ed", "comment": "Malware payload (Mirai)", "value": "ddd3b0a6d454b71b8b6305c16db33d80068ca3ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736312, "uuid": "46d6d6a1-e6bd-4504-b9f4-212a99a79f70", "comment": "Malware payload (Mirai)", "value": "b23e53bf3de8a9803f202e97f496b8323e22ea41925512c3587f57045d7db9f49fc30610959130dec4b7050dbd28c3cc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736312, "uuid": "b849be0d-94c7-4c32-b241-ac7e6f9cc823", "value": "T14293E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736312, "uuid": "a1e74c9d-3377-4a8c-ad73-c50be4fc5328", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8zn:8+tsCurVDN+ouw8Lin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736312, "uuid": "e3d5b12a-ba3f-4afc-a4b2-372598fa26f5", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736312, "uuid": "8ad22d8c-f051-40eb-8a5f-ef7b7ddce9e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736312, "uuid": "86d2a026-3eb1-4d09-a05a-b20c2e1c80a1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe21df3-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775721795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721795, "uuid": "ab889776-603d-4940-949d-e862b621d8e1", "comment": "Malware payload (Formbook)", "value": "9f148713281e95a51da144e79bc3e944", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721795, "uuid": "ac15af3b-1bdc-48aa-81da-356cdacec154", "comment": "Malware payload (Formbook)", "value": "8809ba6b44384ec42e2b54ca885c37496f8d342eb430addeb8f760e2a1fed146", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721795, "uuid": "63727b38-348d-47ba-a8b7-a31e7aa8bdba", "comment": "Malware payload (Formbook)", "value": "4a1bb4620c760f6b5b85932e5a1a1cc38310a698", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721795, "uuid": "55697512-fe29-43a5-a153-55eea6411277", "comment": "Malware payload (Formbook)", "value": "8202eee3a5bc8a58b2ab72a4cfddab8643ac75a3901872b31e74cddcfc7b0da8d9ebdb617a3433e9f04537720c15c667", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721795, "uuid": "801ba4cd-8357-4092-aec4-d75279afeb35", "value": "T1A153FD54859C8B658AC7DBD06D0DAB49A10F7E6F0CF5D06A7A4FECDBC13678440CBA82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721795, "uuid": "e6eb6229-88f2-4ca3-9401-63fd580f75fb", "value": "192:3TNAcLVirZX2Q5wYH9jD7+70x7+FzGx7hTP4PjN0kAjKs1V6AvB/xbQqWFUxI7s0:3pLLez4+293fh2ALwI3w1L4Oe3ebM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721795, "uuid": "42843c2d-83f9-476a-92af-0424b04bccf0", "value": 63762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721795, "uuid": "c1a6d8b1-6324-4916-80c5-c744d1f41679", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721795, "uuid": "b626b719-69a2-4c8e-b9b7-398c627c8663", "value": "024136.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2fd6ab-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717012, "uuid": "553892cb-7fc0-40b4-8338-1f72eac5a330", "comment": "Malware payload (Mirai)", "value": "37119d80a42feb1579c6b552f6cf7ccc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717012, "uuid": "2a97ac70-7b74-4fee-ad0f-7b7bf52e7a85", "comment": "Malware payload (Mirai)", "value": "89600678d068d6c418041a6960ff1e92a0212c5f68975f3a7354decf61a3da57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717012, "uuid": "71965a0b-6e41-40fe-a419-c11343fab1ea", "comment": "Malware payload (Mirai)", "value": "a545994888c8aec26ca6f0f4cc359dd3d7f00438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717012, "uuid": "34d0dd8f-6b75-4de4-b53b-d34282011290", "comment": "Malware payload (Mirai)", "value": "e3d2f9fe2fbf427a0352a697db991bf24e4745cbfb002c2896df01a1917416cb4b525c11b17004d288680a7d0e674cf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717012, "uuid": "7ef9b0c3-1fc1-4b74-bd22-cae6d874c062", "value": "T14D431780F8D2996EC6D4137AA73E318E33A1B3E5D1CA3613CD945B25338A6CF5D66B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717012, "uuid": "e1c0c6b5-aded-49ae-bfea-5ba9e66cee6a", "value": "768:Ecys8ng4d08tmpydYQoyZEFM8fB958jdS8kIf4ubnJ2oN8RR43rMnBN3TWnVKmz:E7nZd04CW75EFMg8FfRbnJko7G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717012, "uuid": "e109e21b-6698-469b-828c-77d4282eb8ae", "value": 55892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717012, "uuid": "8f09d192-521c-41b0-97f7-147adbc1544a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717012, "uuid": "0f605a0b-988c-4b0b-aedd-1cb2ba988e9e", "value": "Hammz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c510a91-33d7-11f1-a769-42010a9c0008", "comment": "Malware payload (BrushWorm)", "timestamp": 1775713494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713494, "uuid": "630307e2-15c1-4b4f-872d-0ea390ce9412", "comment": "Malware payload (BrushWorm)", "value": "47e091f6cdaafc8104b9ff12da1597c0", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Brushworm", "colour": "#5B90FD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713494, "uuid": "07abe36b-3196-4cce-b9d1-f804bbc26dd9", "comment": "Malware payload (BrushWorm)", "value": "89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Brushworm", "colour": "#5B90FD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713494, "uuid": "a16f0a9d-730e-46b9-af50-5014c28117ac", "comment": "Malware payload (BrushWorm)", "value": "42f63a9beb3468a9e642f8644ffe1852c2d6eb0a", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Brushworm", "colour": "#5B90FD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713494, "uuid": "1096713a-51e3-4dbd-96e3-90e1d67ecb13", "comment": "Malware payload (BrushWorm)", "value": "a1f459ecff5f5f25402a6235810e163938c9867f857f61395e285058889034d0c0f41f346b5d9ab5d6ccbb84938e99de", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Brushworm", "colour": "#5B90FD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713494, "uuid": "c47d2001-b291-46b2-a92d-0f07414b7e8d", "value": "T174656B0BB7A502E4D1B7C07EC9925A2EFDB17859433097C707E99A961F237E49A3E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713494, "uuid": "13994d44-88d7-4792-b365-2bd01685146a", "value": "401980caee85c10aaee665695e0c490f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713494, "uuid": "192159dc-352f-4d9e-b151-9395c68ba9b8", "value": "12288:mCFP238iImhOXJf9y1ZiYhSwD9cE0+hhenK2gWioxtiPG+lTjelQMvWY6u:mzXJhOXJ9gFEwDFmK2gTKtinT3MvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713494, "uuid": "ea1e758a-ef93-4416-b54d-c90ab99edad7", "value": 1418752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713494, "uuid": "77f8e762-7d4e-4158-81c3-8b44e6645d79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713494, "uuid": "e6b91cdb-891c-4ae7-b519-ca5fb044fc96", "value": "89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86510a1f-3418-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775741536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741536, "uuid": "7a58d0e1-9aee-4557-abd3-0f720c9c84c5", "comment": "Malware payload (Mirai)", "value": "1b840d6707137dd57fdb653602456489", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741536, "uuid": "d5fe2eca-23b8-42d9-a7ce-6aa2f7c76214", "comment": "Malware payload (Mirai)", "value": "89b04f91aa3e10dc0eb2f9f7f3706b3fd290554bf8296beaa0ba9cd28c3c0065", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741536, "uuid": "e65f4e4b-14bf-4892-8e8b-9314e04b3b0b", "comment": "Malware payload (Mirai)", "value": "c6b412316800ebbaeda938146d88f6f15bce2b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741536, "uuid": "b3faded4-b513-4ce7-9463-561ed3a3df22", "comment": "Malware payload (Mirai)", "value": "21533e0a011a70d992934395def730e4193a2c616b192b01f25252cb720d3bbf53aa13917abaf7e53c938a3cdce29cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741536, "uuid": "db3ac58e-b4ff-4450-af47-6d69f21ef2a5", "value": "T107156B42FB1C4523C8570EF1197F43D5F7217A4341F5A22A270E6B672622E3AEAD734A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741536, "uuid": "c82074e7-1c36-4b33-9b02-89a95ce95b6b", "value": "24576:vC0x1jhC2Ls3H3miZaXQBQGDGx78AJiYEcLZ4b/6aCm:vtx1NC2Ls3H3m9QBJGx77i/cLZ4b/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775741536, "uuid": "1fb55983-9941-41a0-9be8-2a70f605cceb", "value": 930492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775741536, "uuid": "e91c1d1b-5d91-4772-b54a-8cb5e5cf800d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741536, "uuid": "0e35b803-a923-4f46-b809-16eccc9af8b8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b764a807-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719284, "uuid": "217fcb20-7d7a-4771-97e2-c318cdc0ec1a", "comment": "Malware payload", "value": "5f00a5ca00799f2ebdd3434ae9a03350", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719284, "uuid": "e5a60eeb-3667-4b5b-b592-223d04a10762", "comment": "Malware payload", "value": "89d5faf25d12788e6940f49aee1b215e5319b15f8275894f1346e7b4b1d96741", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719284, "uuid": "79be1838-d3cf-483d-81da-6b923c3d7057", "comment": "Malware payload", "value": "0a4b3fbbdba7796a13c3033b233c045d86531e3e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719284, "uuid": "2cf6d315-a14a-4cb3-a8de-1798f4f31d90", "comment": "Malware payload", "value": "c2684db7bf458de57101144c06b2008f6f7c2dfe709b804cc7ad62c98c5972c56bc959e5bfb1085480558cabd755c1a4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719284, "uuid": "7ee89ddd-757c-41de-98f1-f191641bc3fa", "value": "T1F054E136EAD95508F6B71F155BBD18020C29BE277F2E94DC05241C6C4EB0E5ADCB3AB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719284, "uuid": "4f705aaa-5e65-464e-a18d-1a489edc092c", "value": "6144:vPrSVuIS59Ty6t9lhH1YDM+JMvnVxdm6dd7xh3NotMojrAPBE:3rSV189/LiDM7m6dvzotMmaBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719284, "uuid": "9b96081a-4f82-41e8-9313-f50051b047fd", "value": 296382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719284, "uuid": "ea53f731-1c78-4d8f-b3b3-32019e2925ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719284, "uuid": "6ace9506-fc2c-4c40-bc8d-49c620e1be28", "value": "Transfer_S6076122688-000008133-CN5600.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b004a021-33d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775712829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712829, "uuid": "f03aa93e-6309-4e56-a08e-f992b8c091e4", "comment": "Malware payload (Mirai)", "value": "7a698873ea39e6a95b972646917f402d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712829, "uuid": "635bae18-9c5c-474e-8ba7-cd30e371e1c4", "comment": "Malware payload (Mirai)", "value": "8acd9d18a9a754590314c6390ee5261b6886e1bd1901137a979d12b0dba77099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712829, "uuid": "0b72c963-53d1-464d-9566-d721f8fd53fd", "comment": "Malware payload (Mirai)", "value": "ad4924157f8d1e197e1ee9df5b709a3e659b2c20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712829, "uuid": "c31e7bed-188c-4b7b-b109-b35a41c06637", "comment": "Malware payload (Mirai)", "value": "b398eb037348757c984b358bc0c8de98b0d07662ae9da2274ada4c1ab7bb78e4019e4c59f8705e6356a044d32800eb0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712829, "uuid": "63ce0a82-55de-4fc0-82e9-31ec104f4553", "value": "T1D9A3E80ABF610FF7D86FDD370AE90B0125CCA91612A57B7A7530D818B64F64F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712829, "uuid": "71be6570-ef66-4d01-a657-bd57e5e6e8ce", "value": "1536:4feQyAQX/7GSb00fS4CJ+rl6jM64Z8qyRI1JhP3:4feQyAQ7Sgrli4pzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775712829, "uuid": "1dfbe57c-1003-4fcd-9088-611096dc1fdf", "value": 97808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775712829, "uuid": "bfb0b2c1-8770-49ba-88a4-68c0b92d179f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712829, "uuid": "799ec86d-99f7-4f98-bbb1-ab8b8fd48f7a", "value": "dipndotsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7c8460-33e9-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1775721464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721464, "uuid": "e6b3acd7-4dd3-4798-928d-9ab5035ec789", "comment": "Malware payload (ConnectWise)", "value": "6b595472a242500b230e010699e7e157", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721464, "uuid": "a9c27824-64b0-4b28-81c8-a68185d1deb9", "comment": "Malware payload (ConnectWise)", "value": "8afd4117b22e7692de09773405d819888c74b0b55a7f3fa792c1734cc43caf27", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721464, "uuid": "c310808d-1eb9-43bd-adc3-057aee02bdd0", "comment": "Malware payload (ConnectWise)", "value": "8828a9700928c5ebe12ce2d888939cdbb81c64bd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721464, "uuid": "9b319337-3317-4764-8571-2ab375dd5054", "comment": "Malware payload (ConnectWise)", "value": "43c18c9a638e6c6d77e66b68f5dd0e251fa09ada1fc7725d4fddd2e5f2cd8a430a65f988b57799597da6ebf42197cda6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721464, "uuid": "247a190c-7850-4ee0-88b5-7ecc6f6689f8", "value": "T11621DCCF6207B264AEB2521682C72C6CEA825F328E9070B45FE8854CCC10779A3A9087", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721464, "uuid": "b5e6c80b-2814-435b-b27d-0eee21c85b4c", "value": "24:1zdzPK2hNNxNqMNeltZ6BI56w1AZUMaFSOF:1zlXNNTqMclD6BIbAZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721464, "uuid": "6f04819b-6cd7-429f-a992-8aa664e71694", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721464, "uuid": "edb8a31f-c252-4b66-abc3-ad199122ce4b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721464, "uuid": "c05334d9-9e3a-4edc-807f-7451a5c6038b", "value": "Installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92687fc5-33f5-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1775726524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726524, "uuid": "471a113e-986d-4c0d-891f-f37709baaf1c", "comment": "Malware payload (OffLoader)", "value": "5dd6df099e323a3edc4a201b9cea1ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726524, "uuid": "d8e70509-807b-4e6e-8f3d-3f154bfe1e1b", "comment": "Malware payload (OffLoader)", "value": "8bcc3b9c9bdb8b4859317026c8361fcf151963cdc2e8c09bfd5d0b9fdd6cc258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726524, "uuid": "3a7b4dbc-d2cf-48a0-8801-eb9b113422c3", "comment": "Malware payload (OffLoader)", "value": "916a5952a71865c852f87581d079914aac570fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775726524, "uuid": "5f19d921-acea-4d78-937f-3d06d7322cf0", "comment": "Malware payload (OffLoader)", "value": "df4fbf62286200aa496a6608a00adc5988f8cd72a14ff35da339a5702aad1e83c3d3416649823b8004a450cac97ee8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726524, "uuid": "fb6f5c1e-4a62-4fc8-bfd7-0c3f0a14ea81", "value": "T1C9761237B24A673EF4AE1A3749B692245C3B7A61A44E8C56D6F40C4CCF291A02D7F347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726524, "uuid": "892da208-f4f1-45e9-877f-eff1baf8e2b9", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726524, "uuid": "e9e2af35-dd09-4550-9ad9-51ad877f1cec", "value": "98304:oN66+p8dpV8RCea799yj7ULmGeRftZstmAm3N0Eg2Iky8yGtS2TP6E4RxTZBL3nO:M+mdXea7P6PRfsXN53ky8yGNTPK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775726524, "uuid": "ee22a33c-0d6f-4fce-91b7-2aeee7ad7ea1", "value": 7362161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775726524, "uuid": "eba81ba6-1e98-48e6-8de8-9208cc238d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775726524, "uuid": "f4f9d681-c524-47e7-9cdf-609ad5687e6a", "value": "index.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa70133-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717097, "uuid": "93eecacd-db21-483c-8182-cb89ecaadeba", "comment": "Malware payload (Mirai)", "value": "30f08af8b068645f304be9170c531972", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717097, "uuid": "d98cd347-350a-4554-9fcd-0af6f56a1763", "comment": "Malware payload (Mirai)", "value": "8c28b8b9ae6207220e2c6401871f9917f4df46d9e5bed548ee1eb1c12b8038ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717097, "uuid": "92a78cb4-5956-4456-b688-c3670572be6d", "comment": "Malware payload (Mirai)", "value": "873575b9e329ffba6f276db4036a9d3590bf99ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717097, "uuid": "e14927f7-0b35-4bf6-89ed-30d2ff625f5f", "comment": "Malware payload (Mirai)", "value": "aa929a270e3dfcac298cb92c16466a6e556e3af2eb3d95e7b7232d14fa04776d99c1abe2b45ba5b64c161150a8b8c25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717097, "uuid": "bf76c5ec-81d6-4987-9bee-e2d18ea80b7b", "value": "T1C9834B0273580D43D1A71EF02A3F37E593EFD59121F4BA89660E9B4A81B5EF2154AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717097, "uuid": "5e6c6da9-9338-4e92-ac76-98b1df3d58c6", "value": "1536:r9UIXOVeWbi7JNdtp4OlEFL+wmCWoyntMTu5:r9UlViJpdEF3mvku5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717097, "uuid": "06f646d8-56ad-40e7-82cd-e89c81928c3e", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717097, "uuid": "387b03f8-3da9-479c-b7f6-6820dd7a6d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717097, "uuid": "7824360b-ef5a-494f-b1d1-18d4c42912a3", "value": "Hammz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6943bc5e-33b0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775696819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696819, "uuid": "27fa10ce-4177-4cd4-95fc-b3cd1cd573bb", "comment": "Malware payload", "value": "8a8715423e5c82a1bc6343a70fc0265a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696819, "uuid": "95b7bc5d-383e-4807-ae1b-8ecef257546d", "comment": "Malware payload", "value": "8c6298e2e814c64ee75b0de25a23821832ecbad4283b5c8b2673cf4aecd278cb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696819, "uuid": "5e0eb6bb-5c17-4fd1-b895-b119517c0174", "comment": "Malware payload", "value": "37f8d8a3ef3abd0d5125047643fead2f62d9caa6", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696819, "uuid": "ef61f2bc-0ed4-4a55-b550-1c5549ed32aa", "comment": "Malware payload", "value": "6cb081f98410a61b2b0479cc93400c48305ae03431b31eb56007f0048fcdba9b2c3ce2bfa2f5b80c0483096f6ea78a8b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775696819, "uuid": "d1aeb5b3-7ce3-4b44-a893-1325f69b3c56", "value": "T1206733DAC8B817D7D4BBC13C41F4AEE6692B7E569A214D1371A5370329FBFB0A1B4480", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775696819, "uuid": "e08b2c8e-fa89-4f8d-97e3-d40b7e4f1f3b", "value": "786432:nR/Cre3oKYd9Un9P1YWIdxeL1cEkixLUtKnOIx46gID85Fr2X/ti5:nR/6e3Qd9Un9WRd05cExL7OTIDkr2XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775696819, "uuid": "92fdfcf2-2404-4af8-8126-b45a5b714394", "value": 29974528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775696819, "uuid": "73b8aceb-7064-4590-9e69-4a918fc7ebb4", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775696819, "uuid": "642fff4a-bb69-44be-9dce-bf6115065de5", "value": "Fairy Link.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2e7c1b-3466-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775775075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775775075, "uuid": "5f22db4e-79b8-4035-a08c-45371ae2aa38", "comment": "Malware payload (Mirai)", "value": "77b00520cbe94b581572cb898d327c45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775775075, "uuid": "def7d1de-e1f3-49f0-a60e-6e0f51672b1b", "comment": "Malware payload (Mirai)", "value": "8daf92f0870c58ece8b68a3057c3ab6e8477215f853c54cdfe790acf1141161d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775775075, "uuid": "6dc74011-43b7-4732-9430-ec6d29f06a83", "comment": "Malware payload (Mirai)", "value": "a970baaf23c73ece319b1e70de0af1d367668220", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775775075, "uuid": "cdcd329e-b66e-4283-9843-cef18e267a05", "comment": "Malware payload (Mirai)", "value": "3d1f3338882009e2c8c040e47ec23c08357f4a7d7378de515a6562f3f4bd097e2924f45a7212b009742c7729744909f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775775075, "uuid": "7185d6b3-8256-44d8-871b-b5067b2ba900", "value": "T179243A46AA408B13C4D72BBAFBDF425633339B54D7E723059528AFB43F8679A4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775775075, "uuid": "8d71ce3d-daec-403c-aa74-1afbce8df4aa", "value": "6144:gdwydMV2bFTdGegaoAV8naucBY/as7UHKQdM/R1zGy:g+yx1dGegarV8naucSSohQm/vzGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775775075, "uuid": "c68089e4-8f55-42f1-9906-8f4af8d4df3f", "value": 214185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775775075, "uuid": "b40441cf-d1a8-476d-953d-251ce34fa12e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775775075, "uuid": "5434a504-927f-4189-b801-23d179e44ebc", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c566b9-33f3-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775725779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725779, "uuid": "fcb3341c-e724-4afd-bebb-f544888b588b", "comment": "Malware payload (QuasarRAT)", "value": "9c86be5d39b45b58d2b621030fe79ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725779, "uuid": "8c8e4212-699f-4416-93fd-60c3ee746e0e", "comment": "Malware payload (QuasarRAT)", "value": "8df4cc8b9c69f45705eca485d0b21593995aaca8d86e4c6d2a692a06b576aebb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725779, "uuid": "693b7fcc-e920-4cfb-bb55-6071e167cbd0", "comment": "Malware payload (QuasarRAT)", "value": "9c71527ca17ccf49d6e7e3adfa3c57e3c209ed06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725779, "uuid": "65218fd0-914d-4480-9106-b9ddd6dc2345", "comment": "Malware payload (QuasarRAT)", "value": "14daa57a599d6817e477c5aab0ea1659246bf9a6df255c01efa5eefb427a1f1e19e0358efd6e3505a24105fa9e1abf8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725779, "uuid": "5e9ccab8-4b93-41c2-aa85-550aa4fd910e", "value": "T14915F111BBF8C207F1BE5FF5E4B242450B71F8039A26DB4F0988A0B91DA6395DE91367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725779, "uuid": "e6a548a0-1f36-4e0d-b333-9b7aa9095931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725779, "uuid": "ce566c47-2d81-45b0-a98a-1f2c9c441d90", "value": "24576:IdDl5USSWHIPbcNK0KKfaOwI55l2SR8eY3:ODlK4EgKKHwCBmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725779, "uuid": "e23e21a8-90ba-4caa-8acc-07b71aef67d8", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725779, "uuid": "1d45480f-81ed-494e-8479-fa9489e8e586", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725779, "uuid": "ba7e4673-c487-4f27-aceb-637d28e4f4b3", "value": "prick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b7411b8-3469-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775776226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776226, "uuid": "7f0b2bd5-ee87-4e7f-887f-aa0fc2e05ad1", "comment": "Malware payload (Mirai)", "value": "22f7cc50acb022d793e86f50c12164d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776226, "uuid": "569e4b82-db62-440c-a042-4bd1b79119f3", "comment": "Malware payload (Mirai)", "value": "9092e4435b2f2c05027d43b2b9ba1cd1cdf30eaef02d1411e72185c04feea1bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776226, "uuid": "b29cc43a-5f93-49e7-b629-3cc6fb526612", "comment": "Malware payload (Mirai)", "value": "518b52a0804beba804d7c295edb0d1b94facbdd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776226, "uuid": "f8fac5be-7ae4-4534-91f0-ca35d98f962c", "comment": "Malware payload (Mirai)", "value": "73b339ffee6565f52699c575f31b0486a5cf2a715286d899f65fddd2b166e601be8f909ed87edfc2c6c7df2b6f14036c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776226, "uuid": "940dd052-fe62-48a5-a0fc-e839b0f28511", "value": "T1CD44E81A3E228F7FF26D877007F38A319769769617E2D644E26CD6101F2438D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776226, "uuid": "a74f281a-cb70-494b-9d0c-41a54fd61a60", "value": "6144:eqBNzGGEsmhH6BhfelUhGP6yU1hWF5NqohWUkzn7MwA0:eQNzd9m4Bg6yU1hWF5NqohWUkzn7MwA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776226, "uuid": "32734ab2-1694-40a3-a87d-6c7af9ba82ae", "value": 257319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776226, "uuid": "7da9d2c6-c2f1-4f1d-a844-d02514f02b5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776226, "uuid": "7c59d216-550f-4649-ba9b-1f42d057a9ed", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0ae046-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Guildma)", "timestamp": 1775714245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714245, "uuid": "a3a152dd-c004-42d7-8943-af4d5d2b270d", "comment": "Malware payload (Guildma)", "value": "bbefa1da34c6f315fdb9f2268df564bf", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714245, "uuid": "11f12617-179f-4a01-afc7-8dfda3d6fd45", "comment": "Malware payload (Guildma)", "value": "9134dfca81cf719cfe377b03b14dbc95e322cc66a62919090aebf50964345589", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714245, "uuid": "c4865dcf-e9be-48b9-9eb6-d316f2263a23", "comment": "Malware payload (Guildma)", "value": "61d65aed8a8ea0f321fa81113c76cd282d10b77c", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714245, "uuid": "8cd5383b-e094-4e71-8dde-8407c8e01460", "comment": "Malware payload (Guildma)", "value": "869a28a2f273598ab8d7002480738c44296f46e5b3e5da169c27d001af43a823f6eb055ed32676195533eb2159596dfd", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714245, "uuid": "922de825-a762-4015-99c1-00257bcfc78e", "value": "T122918EA41C1AD259DE84CD7CEA032D96B966EEC28C81803C18DD37CE10F55407CD9A6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714245, "uuid": "9c54eb49-65b8-4037-812b-240fd9cec373", "value": "96:8PM3Iqe9djTzYxfcdfWHb1c1G4Ji4i3MeAZhkS:8PM3IqyjyzHJc1G4veAZhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714245, "uuid": "814d9041-f661-4653-8150-502a379be044", "value": 4474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714245, "uuid": "4a1e27f0-d269-46e1-87cf-7d9d8e3842e9", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714245, "uuid": "5a34089b-063c-462e-ba35-942eeb6a092e", "value": "09000769.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec679dfb-33d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713790, "uuid": "57857efd-5387-438b-9749-f8bec85eb771", "comment": "Malware payload", "value": "25f4b7b6f47220db93a665fe0c84998f", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713790, "uuid": "2f49f481-84ec-4c4d-8ce5-b30a0bdce7c6", "comment": "Malware payload", "value": "91f07d3af97ccccd5fc9c485c9ac58334bdb0da2ed732403de066f0486f1f70e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713790, "uuid": "3fcff89b-011b-471e-bd0a-7eaf9e87c39e", "comment": "Malware payload", "value": "7b61896d7814f3f921fb40a644da50f20c8c9714", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713790, "uuid": "d1ef2d16-9fd7-4ef6-bb03-50750c7e3c33", "comment": "Malware payload", "value": "2453747d138bd944ec6ea986faf439a0413e105d38448211ed2d8909ddb75015b9a2bdbde9e1335b2a982d8e9f449dad", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713790, "uuid": "2510391a-2e72-4539-8227-09b41e075b07", "value": "T11032F925B975C16EE61A2F708CE6F2468428BCD5CAC3621F3985F32EA5702D0D93C75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713790, "uuid": "0599f4ce-17e8-4141-81fa-e884b43e026a", "value": "192:C+ptP/Zm6PZjaOaXFSzV414G4gWX41G1:CSZYQJaVSB414G4gmeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713790, "uuid": "11a39aed-111f-4534-9367-aa5cc94837f6", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713790, "uuid": "6d9455bc-c2d5-484b-b328-933dd8f52814", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713790, "uuid": "880abf27-a7c4-4dd8-baaa-cc1675417b28", "value": "QUOTE_National Trade Export New Order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ffe905-33d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775714264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714264, "uuid": "ee42ea99-8c27-4b21-b022-12f669d9dcdf", "comment": "Malware payload", "value": "356cd458d5812d7dbe0d1238465dda42", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714264, "uuid": "512455df-0b2c-4672-9f8f-7c9d1a98de64", "comment": "Malware payload", "value": "92aa755116d8aa22e41f3ea02776fd0085988168e32944e7986354bdddd5f7b1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714264, "uuid": "fcda37ad-faea-4bd9-b0aa-6b9aa921fe33", "comment": "Malware payload", "value": "a3653c7ac96da1fba98b9d5fb61f773c8367e293", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714264, "uuid": "ea4941fb-00cb-4eaa-ae4e-8aa6ffae4a96", "comment": "Malware payload", "value": "fe9e6b5d367c4df96f7989d7fbebbc3ffd9d66fcffd7769a63a603e480e22c9ace0ef53cbd52c793efb08dce88d5bccc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714264, "uuid": "db1ae709-6092-4e7a-aa77-5ce1645fcf7e", "value": "T1DB716CC4A6E81608F5B61E79EDBF7A50593A375D9E11C78C0868E04E01E1B59C87FF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714264, "uuid": "2a0c8a56-802a-413a-b79f-72e5f9ae8611", "value": "96:8iJFpeYr9kBGCMCnA60+rn1/5vIWScMWy34xFfwxVTxVcAQtldJAIZOBz83CVi:8iJFU6CMCAR+r1BvIWSvWy34zfsDAldf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714264, "uuid": "ddb9ee8e-32ed-4036-be43-f03c07977f8d", "value": 3767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714264, "uuid": "53c30fb5-ee92-42eb-a7cd-99b8c7bb9291", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714264, "uuid": "8ef91425-c7b0-44d1-9c41-76157f1e5602", "value": "Dienstangebot_D_Trninic_07-04-26.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c0ea0f-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (StrelaStealer)", "timestamp": 1775718793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718793, "uuid": "462bd10d-02b1-40fe-9704-5a8cddb15051", "comment": "Malware payload (StrelaStealer)", "value": "3f56517f1c31f0866504a5126dc05ff2", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718793, "uuid": "17ec9471-6819-4bf3-a4d2-3a63de0ae53c", "comment": "Malware payload (StrelaStealer)", "value": "93b70cbf0e33621499d8d076fece24e5683003c728652711934d0bfc1902adbd", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718793, "uuid": "e95f39ab-13ef-4e15-83ae-5ddf92098ee6", "comment": "Malware payload (StrelaStealer)", "value": "16f5398cf0893a9b6744024c20a59eba40a1dc80", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718793, "uuid": "59a44a20-a396-426b-8a5f-8530f9d84342", "comment": "Malware payload (StrelaStealer)", "value": "3856dd8b672f7d170f1996bb7f508d15cf773ccbab14b4b7515ffe0a545c21dde9c7840e796993574a0863e6408cc682", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718793, "uuid": "87be774a-e3ef-4b2a-8442-5f220d15fb44", "value": "T165B2303EC9859FF00B2A31A2A52F7A1664150367B5382A4D78CFC19D3B35A50CBF54EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718793, "uuid": "7c0248c3-0135-40ce-879d-305a18b6023a", "value": "384:KKpB/6ySwa0SWLcgiyPS5icQI36Yig66oiciwLSdMLaJ5E2PKZ5kR8VmY6nuV0/f:KI+KoNt3BqDiweneH929e6UfA6I0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718793, "uuid": "3066cb2c-a710-4afc-88b9-3b0f36197bcf", "value": 23609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718793, "uuid": "c7a0ac9e-082b-4e37-9604-1b61eca8c517", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718793, "uuid": "ddfb3cd5-4aa8-43d0-a607-fca7b2b4d8d8", "value": "Confirmation Slip-025521443553574554#.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08d2ab1-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723621, "uuid": "c8d9be27-2547-4772-8ae0-4577806e1321", "comment": "Malware payload", "value": "1900a7f9c71e009eb1b7cd2c3abab095", "object_relation": "md5", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723621, "uuid": "a4f6225c-0369-4106-86a7-24c058cc5a0b", "comment": "Malware payload", "value": "9414e8f5d74be809e996922c13705762b2f3674c2efa8ac212f164c75fe1f38e", "object_relation": "sha256", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723621, "uuid": "dcbc96c1-32fe-4d92-81b3-4805d4bbe066", "comment": "Malware payload", "value": "7e75bcbb56ce0b6dfb5d927d8f0322e5d505a3ab", "object_relation": "sha1", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723621, "uuid": "db5cceff-c00d-4fc9-af99-34efdfa579e9", "comment": "Malware payload", "value": "174fcc5505a57ebb5f7efe5ee155ce404713aedba14d226b071ba325d2e8f4ce755a45993f18e556c63d084fef0957a2", "object_relation": "sha3-384", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723621, "uuid": "102970ca-6e44-44e9-8036-1e003c6d37ad", "value": "T129533CF612135D8F4A270E19E40C1700ECADACE7B3D9D1EDBF895AB54A994588CE0DF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723621, "uuid": "593c89c3-921c-4d91-863a-da329c10e831", "value": "1536:JTjWGnXt8AUPJaPoVVXOYUm87FbzOAfH35MM19WTXPZQKlM:/dNUPJagVhzH8xCO35/19WW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723621, "uuid": "b2d0ac8b-9527-4cd2-90f5-89ebe0661b33", "value": 64856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723621, "uuid": "1543b6e5-8e2d-42e5-bea0-d64bbd69be49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723621, "uuid": "ac003676-e185-499d-b670-f274bac5e138", "value": "9414e8f5d74be809e996922c13705762b2f3674c2efa8ac212f164c75fe1f38e(2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e80d3850-3454-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775767470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767470, "uuid": "82b9392d-9416-45f2-855b-82283918dea7", "comment": "Malware payload", "value": "6ecbedcd9056f2efa8a857d05e5bfa65", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767470, "uuid": "611dea6d-8066-4656-803d-0dd9447eaf51", "comment": "Malware payload", "value": "945783dd6020b25ec34450cd564d1b3aa072ed9d81125a441f8791d4d5d60bd9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767470, "uuid": "2ef9dce4-a58d-4dba-8879-0601c74fc187", "comment": "Malware payload", "value": "d002dc293007e92158927617fcf9e5c772792ee6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767470, "uuid": "194dff63-bc48-4a79-9228-77730db81cf2", "comment": "Malware payload", "value": "76997eb4e6cb10ca32b57f396c42e56a5d5d1d33949b9ee101db426eb23c57d56b8f8102d8aff11ffb077852b8e1aa8a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767470, "uuid": "5b0713c1-e4fa-44b6-a5a1-e7f876282e56", "value": "T1D5063330F0C884E8B0CBEE57861F903B8876B989F55EB613FC624CD5DE059AEC9D9245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767470, "uuid": "1915dc8b-1a98-422f-b5aa-6faf7c45df2b", "value": "98304:CdSoKwIlqa7y5LxL5X8uax9ACkD7pUPMI+L7HQx1dq:XoKwW65FL5MuarQ5yMI+vIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767470, "uuid": "0c5e602a-71f4-4613-8255-bd7ba9b8c5f7", "value": 3725283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767470, "uuid": "99dfc57d-29f4-4945-87f1-0aff9414ee53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767470, "uuid": "a0b5428d-042a-4135-b3e2-d55ced4cde4e", "value": "office_output.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc06005-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735052, "uuid": "c6675d69-f507-4f1a-b87c-8d887d86a1a8", "comment": "Malware payload (GlassWorm)", "value": "6fd35b1c1800e42da11d6523df390e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735052, "uuid": "ced2cba4-bf7d-4d83-9add-434f9cd1bb6b", "comment": "Malware payload (GlassWorm)", "value": "9531d9ddd44f9b7834e54994ee0c9332f76f324f17e1f02056afc0a8c5628408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735052, "uuid": "29a47035-811d-4743-b598-70cc2a19650b", "comment": "Malware payload (GlassWorm)", "value": "5c64509701b05b6f137e86814bcd6e3c15173e1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735052, "uuid": "6038f6da-14d3-4155-a212-2c48690b3637", "comment": "Malware payload (GlassWorm)", "value": "25f7f2f73ea9ab6410a718cca6d2b65f31c75c1631b1b7136b6e03b12eef712446bd71cae6e176e3ef2e9ead64b5fe93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735052, "uuid": "2f71a400-dbd8-49da-ad29-06e4c12dc167", "value": "T1EC25BF83D293915CF41AC1715B2EA273F537BC448B29AFE76790DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735052, "uuid": "45d9c38f-998b-46c8-9086-001defe4f65d", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735052, "uuid": "81607f65-48de-464b-8175-05005f8e8cef", "value": "24576:++pqf2TJOEe0JRh+w+QY5bsY5b5Y5bjt:+2TcEeiRhdYqY7Yht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735052, "uuid": "cabe943c-1dd6-45ac-a5c7-531a7b95dd98", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735052, "uuid": "91c89d5c-7874-48de-a7f9-c4d2e8ff3f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735052, "uuid": "03b16d58-140e-4170-83fe-8cc5a1a4ade3", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c549245-33bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775703267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703267, "uuid": "91675457-99de-430b-b16a-09b6410021e5", "comment": "Malware payload (Smoke Loader)", "value": "25ab740b5cd3a6441fa380f9ded8c530", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703267, "uuid": "87ad5b88-6039-4004-9742-160a765ad888", "comment": "Malware payload (Smoke Loader)", "value": "9597f336130e6e7856244212fdee4a3a1c61026ff2db481f6955b15ebcf395a4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703267, "uuid": "2f649007-c893-4047-9cfc-fd83ab780ab9", "comment": "Malware payload (Smoke Loader)", "value": "bcda338f607d901ba26c1ab9d466168613cef78e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703267, "uuid": "dbc5cd3e-5b87-42ed-b33c-d5fe94fdc25d", "comment": "Malware payload (Smoke Loader)", "value": "725f18d25d76a193c38b0fb58ef67f3366f830c3efdcab993762f671e62c6334d59fc233d4fb4469b06da8e9d31ef2fc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703267, "uuid": "ec06c43b-a0ea-45ef-b5bc-00903a557b24", "value": "T1D095F197A39012F5D838E470A5370C6216727D3BD2B867BB67C8F21989B7183A037D97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703267, "uuid": "11ab6d04-4852-4880-b90a-f8703fc6b2ed", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703267, "uuid": "49da471f-2a83-480a-9f83-9ec117d1b7f3", "value": "49152:JMhfcxMhfck/Rl/9EU31JMj130upX1ax05m2:JMhfcxMhfck5l/9Do33Y05m2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775703267, "uuid": "1e621ee6-e21a-40c2-9a2d-37865919cabb", "value": 1987072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775703267, "uuid": "6d946e9a-5ee4-4fa5-b97d-67e8654e4bd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703267, "uuid": "637f27f5-c003-4a2d-9004-1f52df15157d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0040c1dc-3456-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775767940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767940, "uuid": "8bf10b9d-3104-403f-a021-1f96daf119ee", "comment": "Malware payload (Mirai)", "value": "2032d91b4deb6cb4766e8c04b8138f83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767940, "uuid": "26e83f9a-5684-4c4f-8322-2ddc06df91b8", "comment": "Malware payload (Mirai)", "value": "967bc50e00e70f73a324165ca29182b8ba59055cbd29052f9fa99c1c491ee6b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767940, "uuid": "8c411ccb-86d3-4bb7-b022-5d1b59a68015", "comment": "Malware payload (Mirai)", "value": "f216819f7f800e1dd8e5e88863afff89f4b534eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767940, "uuid": "78e1f97e-5485-4e49-abe5-976b2aa7593f", "comment": "Malware payload (Mirai)", "value": "3ac02ad388a9972a933344653e77c8d0667110b783e468ba2da63a6f230aa5d9cc3d514193449b3f5316637c7aa22a3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767940, "uuid": "17bd96e9-85a3-463d-a963-582b89ff6e82", "value": "T143535B1BA58180FCC19DC2B80B67B63FE97372FD0239F2BA97D4EA265D45D204E6D508", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767940, "uuid": "0bfc39df-75f7-4800-a803-5f10eadcfc6e", "value": "1536:Jovs7uPHD1KdSIDa2OdBq8aUEwN1a6z5xFN:+vs7uL1KlDaTBbMwNFz5DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767940, "uuid": "5effae4a-902c-4093-a4ca-97dbfe55fd2f", "value": 65296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767940, "uuid": "6bec672e-1349-408e-99ee-0f04156579e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767940, "uuid": "3fa471a3-f088-44b2-a0c8-fc5a7ea103e9", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665bde50-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717001, "uuid": "ff566c98-c840-445f-8094-42fdc7c2ed31", "comment": "Malware payload (Mirai)", "value": "d4dd1583d6bfc267a3adf749cc8f6976", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717001, "uuid": "22ccb1f3-c34f-4588-a1ce-6bc9855181db", "comment": "Malware payload (Mirai)", "value": "96aa98b0ce23ad27bd0ed0d23606d623bf3f3d0f8948642b98e9fdcaea7984ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717001, "uuid": "b47a016d-e294-42f0-bb29-45e132448a08", "comment": "Malware payload (Mirai)", "value": "297273de229809793674d6b4eb61e540e519f748", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717001, "uuid": "0ed95402-b977-497f-b50d-1f66be9d9682", "comment": "Malware payload (Mirai)", "value": "49e5c850796e65fe3d0e2fcc63baf1bcec99956b2eac25ca7f3950b7e06a9ff6e1b472e4ecb879a534f3d52bab30851f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717001, "uuid": "c0e40e6e-0952-449a-b640-6180c33c9d82", "value": "T1EE13F1A29632AC10E5F259F8F8FDC582D516D7A5C86FACDB4620C56CB7C748C12C46C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717001, "uuid": "b82e9135-6c22-47d9-98cd-1c39a6005942", "value": "768:y4GEt/uZTK+QsAAVfnXQwkVjs6ucZywynO0fHwRyHAzHad9q3UEL83:yLExM59Ks6D0nO0/wwgzH1Lg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717001, "uuid": "cbeb0ad7-9d7b-4005-98c0-f1a996799031", "value": 44788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717001, "uuid": "943d2319-cf77-4e9b-b964-7845b418203b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717001, "uuid": "04666415-1696-49f4-ab0f-a1e928df83e9", "value": "Hammz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf3dc5d-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775722459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722459, "uuid": "cf10f976-bee5-4f9f-9190-84def6984b0a", "comment": "Malware payload (AgentTesla)", "value": "7263f0228e19424635c426317e18aa68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722459, "uuid": "efee4b04-591e-4ac3-86c3-7f99ea9dd0c4", "comment": "Malware payload (AgentTesla)", "value": "97dfe97161a223b71ddbc56f8dd723aa705c2fd2a79f2b35d861037fba2d571b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722459, "uuid": "a1a4143c-fe4f-4201-a3d7-c0e2d0c0866d", "comment": "Malware payload (AgentTesla)", "value": "339238b84e32dfe3d1719dd28f2ae5fba91d213e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722459, "uuid": "8f427245-bdd9-4823-8bc7-ccedee4d7be3", "comment": "Malware payload (AgentTesla)", "value": "f4dab2693dd45ecec737b14992897408e99f6624b6f77c1b7b1e6b820386f7cf091097c31b9d2204a7f5da848630e8f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722459, "uuid": "1a682790-c885-4d1b-ba48-344a0d774535", "value": "T12F53107E35A50366FBC8F7ABDFA0CC7042E4CDA5C15B0154DDC7468AE26398AA0F499C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722459, "uuid": "a43a899a-ccff-4f5a-b4c4-4f055054cdd4", "value": "384:iXrX1gXYCk3dErqo0K7yebmkVDOes+NA5EewKVAmthMSRVJYLHv0QtfiVPdpuAJO:zenV/zAcuAAmlliZ8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722459, "uuid": "8778bb77-52d3-47db-ad45-267f7d1a4324", "value": 62539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722459, "uuid": "3545a23d-a580-41c9-bc0b-117fefbe438d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722459, "uuid": "abfcb6b5-0d3f-43d0-a8b9-94a7af067ee7", "value": "Request for quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651b8400-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735038, "uuid": "b0a39c03-928b-4941-9ada-bc322779cb62", "comment": "Malware payload (GlassWorm)", "value": "36ed39afda436264846ca04c03f1d469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735038, "uuid": "eb5b9632-87d1-40f2-b1c6-7076f1e17326", "comment": "Malware payload (GlassWorm)", "value": "9a3eeeeac57f58a79659ebf0782fe2abd6b646e8960fcb5e99fb905db5728559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735038, "uuid": "77640f71-463b-4b2c-8e82-f3c56456f355", "comment": "Malware payload (GlassWorm)", "value": "9d703cea17b72e2ebb1a9bd00fa833772a5c8720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735038, "uuid": "4df68d4e-a7a5-4849-baf5-bd58853cd886", "comment": "Malware payload (GlassWorm)", "value": "37aa57157b49550bbd8d44cfeebb9667f728ccd25007f8dcc2d92601a122141053d93d5ae79becd2611b134f8ff4cbc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735038, "uuid": "bda80bf1-4052-449e-9765-dc691468302e", "value": "T1DE756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735038, "uuid": "b4a7ef4e-2d35-46af-90ab-fe1b50e55a19", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735038, "uuid": "3a5980dd-0ceb-474e-a39f-d727725b8370", "value": "24576:Nds9Esxlce6k91UOld2LMxmeDozCMZyFFITEymOCUwPPDpP:NdaEglcAHNaYczYjyL2PPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735038, "uuid": "f671ecb4-afb8-4388-86ee-c718832b5483", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735038, "uuid": "67b92bb2-779a-4829-8cf2-2a746c3d4269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735038, "uuid": "ee41feef-1913-4f0b-9313-38a7a7593159", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa526a8-33d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775714270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714270, "uuid": "93db024a-09c6-4730-af8f-f60c5fbe9dab", "comment": "Malware payload", "value": "903e6a1599563f8abb9907038c4f21a1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714270, "uuid": "da997638-c574-40ee-94bb-fc026ed7c963", "comment": "Malware payload", "value": "9a53a81bc2b8ce77beb387c24718a751ab3e7b3e4ef986eeed42d44894b0e83c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714270, "uuid": "881fee2c-d8de-49c6-a57a-46e319aacc6d", "comment": "Malware payload", "value": "10ae24ead1dece349a81c32eccf2ba342e827b31", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714270, "uuid": "430a5388-ca43-4589-82d0-75869cb0009b", "comment": "Malware payload", "value": "20e4d7de14ad3d5aac6a0585b967e65450d5d2adfde5c1d906f3cbaf60b35e7afaebbcd82ebd9341f7cd1f56fa5e8925", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714270, "uuid": "4e99ebb3-7aa6-4468-84c3-8525f95541d1", "value": "T13E93286035FC2745E073DE76AA256241CBAFB8414A7382C82A5133BCAC21795DD52F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714270, "uuid": "6c46b6a8-52e8-4fea-a2d4-f7aa9fdaac19", "value": "12:8d/Gn8r8oPkLVUL9D418c9gffO0luJFE/yzj1GSEz96YpDVjwj9:8d/GnekLZ9ge0gJFHj1GRzYYpJjwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714270, "uuid": "f4ce79c2-93fc-49e7-92c7-8ce40ad34f40", "value": 93597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714270, "uuid": "156f1dcc-f994-4885-a516-cbd6c96f1b27", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714270, "uuid": "64f14933-8fba-4afd-899e-fcdc9765d804", "value": "Gorschenuk_Odinokie_Zvezdy.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb550dd-3433-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775753009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753009, "uuid": "8ed77026-14bb-49df-ae7f-be07125a0603", "comment": "Malware payload (GuLoader)", "value": "e225e59d4a37474d275ead07ab5a8e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753009, "uuid": "3be46023-8386-4300-b884-67991f20e0bc", "comment": "Malware payload (GuLoader)", "value": "9abc8e3fc8f7ae42dbea952c3cb51b74bd1980ffaddb36b590a66162305bf3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753009, "uuid": "fe2425a5-741a-47f9-ae95-47512e8dcab7", "comment": "Malware payload (GuLoader)", "value": "e2de85a9304334624527e29d2fbdc87ff577735f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775753009, "uuid": "064a86ec-7645-4980-b257-48d710254034", "comment": "Malware payload (GuLoader)", "value": "07fb745416525c4723f2dd9d918094c15e5ba5d48be85881f5a90d48ad4609ff6c2ccd6f0d99e498d565b9c11cac751d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753009, "uuid": "3e03ba3c-23af-4702-a29e-ca35c413ab61", "value": "T138B4120137E798ABEC7D493118B352732E707F7A8586425FB3A4BB6E18722C14D1E16A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753009, "uuid": "732b15f4-71ae-4ac8-8da8-3c2bafb6e282", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753009, "uuid": "b8928805-8a57-4ab3-ae7e-a823bc9f921e", "value": "6144:oX45rw628jOcfk6b2iMZfdu1/PJDlpNjbN56TWNJIDgm2MLqOnPKGtaF3YJj:oX4TjXxbPMZ1u1JDlfiedkqgXUF30j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775753009, "uuid": "9d097c10-2aa4-47ec-b730-813850436b51", "value": 518536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775753009, "uuid": "a42c8544-fc6a-4690-b996-d4e5c118674c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775753009, "uuid": "db83c9ef-aa0e-485f-8ecb-4a5de526edf2", "value": "Items listed for our invoice.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67431fa6-3412-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775738907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738907, "uuid": "48b0e53a-e249-4b06-8b26-04119f7a7d37", "comment": "Malware payload", "value": "1fdd4b5748b8b47b5faad69bc10aca00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738907, "uuid": "c48ef039-2d62-4bfd-b6a7-018cd50ca260", "comment": "Malware payload", "value": "9ae8388b6bc4043a49573a617927cabbd61c254014e0ceb4223cf50431841b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738907, "uuid": "f9f0fbb4-0224-41bd-bc0e-5260d0ca580e", "comment": "Malware payload", "value": "f62b8f6175259bbced8f1ff6ab5df4cc631ffa3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738907, "uuid": "c823f524-66f1-46a5-a267-541a20a7b31a", "comment": "Malware payload", "value": "e8fda8047b1c7d62fc8dadf50d5a02e8fc21e5e3d9423f69fcc53a0bc7000e4ea33c7fe5a4f9b53b77df838a1e6bcef7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738907, "uuid": "c5a0f7df-02ee-4404-9550-30f1302b9dae", "value": "T12ED4E046F7951B9DC96BD678CA16232FFB3034964B082B0B12E59B233F275742B1E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738907, "uuid": "16f7acdd-b2a5-4eab-9c1a-f588a4ded8f2", "value": "af18b23f8bd85b1fd557930d6522f233", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738907, "uuid": "adfce6de-0cd4-474b-8762-4e651e45ab7d", "value": "12288:AArmj2iIXCj71B1VMEMM7zB5qjoo750VyHtcpiqfJg8+YoueXVt:AShXCj7v1u+Uoo7/nqJg8+YoukVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775738907, "uuid": "02f51216-f41f-461c-9617-7a9255ee874c", "value": 653088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775738907, "uuid": "89706dab-6f87-488f-bf6b-e46361a6b7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738907, "uuid": "8f8525c0-45da-451a-9c8a-87fd52dacce8", "value": "image20260409689.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ba9e74-3436-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775754587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754587, "uuid": "28729925-06b1-43e3-90f9-bee87444f243", "comment": "Malware payload", "value": "565ef9c43667036c45f61f4e8c11bad9", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754587, "uuid": "ad83a141-1ec6-40b8-9b81-8403b83a35c6", "comment": "Malware payload", "value": "9c71b2650af49414a75c9c921303617c93e9632cdd6422631ca97b9454ca8382", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754587, "uuid": "5e256795-2094-4119-bca2-491a9ab4ce0b", "comment": "Malware payload", "value": "447c24e14eee8a831f64ea94f444f9a97149afca", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754587, "uuid": "105b9059-6a3b-4777-8a57-2a29b6ec2242", "comment": "Malware payload", "value": "c540f7d1cc102f8fea3a23a73818e518dada6c1224a0d542546b11b4faa0fdd24a9995ecab7bdbb145108e1e9ebd6d3a", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754587, "uuid": "1ab5d905-fa5a-4717-8271-2829685224c2", "value": "T1C145B5168A05DFF0DA393175A6AB7815AA700323B5346A8E3D4EC15C3F3AA50CFE15ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754587, "uuid": "933678b2-ae1b-4d1d-814e-843d7cdde7de", "value": "384:l5TTDSJ26RL+2oDCqIrdYBu2BYpfnhAIt43kAJ18qLj0Yncnk2vDCXNTbr:l5DK2ACZi/3h3cZL2khNTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775754587, "uuid": "ed92f84a-3513-4552-9a5a-70eefef58686", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775754587, "uuid": "d195b2d3-0cc0-4eb4-9c9c-06f33a1391b4", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754587, "uuid": "089c0066-3b5e-4633-a99f-e26ca3b736c8", "value": "Bookings..img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b94e1c-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775722283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722283, "uuid": "318b1628-4aa7-4f94-9c52-7ab03241c47c", "comment": "Malware payload (AgentTesla)", "value": "f195b0107f15b1850f333102985e79e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722283, "uuid": "1f3fa79f-26c7-417b-ba95-dbe825069cc0", "comment": "Malware payload (AgentTesla)", "value": "9ca5bd830644a9556fc89f53974cc9042435b0d58167134712f7235bd5897297", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722283, "uuid": "343baae5-8a32-440d-b1b9-42ab7150765c", "comment": "Malware payload (AgentTesla)", "value": "97ff374d91b01af81633c6f2931a101bc427b74b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722283, "uuid": "dfe36994-482f-4c36-9ccd-f1aaf9a9bfaf", "comment": "Malware payload (AgentTesla)", "value": "5731fb6fe668e99de9e5f131a9a28f507ed9ee597524488d9d55bc0fa70f855da115e6563d30da280a96592a1fc3b911", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722283, "uuid": "0f135ef5-851a-49b2-bd89-8c2214e69252", "value": "T11E164B04F1D49B5CB8A1EF699AA6759085C9635B2D4EAE33F03E417C3FA36E3291104F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722283, "uuid": "b1c2eb27-3520-48ea-b2b6-1868782916dd", "value": "98304:7P0ECx0AWVMBlF+K/oQblj6PW0FL45Zb0cNGj+sb8nwIrzBcSAI+mZJ/TiG2s+rc:78ES1QcldBj6Px4X0UGx8nlPBc4+mZgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722283, "uuid": "7e715692-26a0-44bf-8412-e9593306ff0e", "value": 4209093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722283, "uuid": "cecb4528-80ac-4d47-bb99-66d558a14dd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722283, "uuid": "7cbe454a-a394-489e-97fb-e927994b1f3d", "value": "SO-615-S200425.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa5fc66-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775722492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722492, "uuid": "2a05726a-a50a-4101-8563-19f5c2839a73", "comment": "Malware payload (AgentTesla)", "value": "7d5ef30059c1817a32ce605f66df309c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722492, "uuid": "3a3183a5-ea39-4372-84d1-046348be7b4a", "comment": "Malware payload (AgentTesla)", "value": "9cf9403b0141d986622879b72f8049f55cd6bfb2588c25b5eeb05a0d839bb507", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722492, "uuid": "5039c79a-1ab0-4fdc-b80f-f3b8b7af0c2a", "comment": "Malware payload (AgentTesla)", "value": "4b4b63b83172f88e96c059d9169da559d7709b36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722492, "uuid": "050b39ee-4c5e-4bbf-a9f3-a81a0126065c", "comment": "Malware payload (AgentTesla)", "value": "5e4239c92b89aa2d572a0392b7ea9a1d0acb761a5c4418827e1347717211f9f6ee53254b208c6e4d0f075d79ddb8aaad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722492, "uuid": "b9802aee-f7fa-4937-99b3-aeb8a2df2d8b", "value": "T12753335D9128DCD886D83920DC453C0C9E1D40677DFCF84AD5B47BFDAAA26280CF7AA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722492, "uuid": "2de6a4ec-2620-460a-8332-3dcd830f02a8", "value": "384:5dmVkTmRdepfVwl0Kc6FU/ElItLSfPYWkJ2NwQFc6xlM2dhPhO/pCehBcbOqmmGI:96WhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722492, "uuid": "054b713f-00ef-43f7-b791-feda6af3dd62", "value": 62841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722492, "uuid": "e68fbf7a-6944-4fb0-bcfe-ea72ebdb57a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722492, "uuid": "e0f7cab6-9a32-4d73-9db8-ef10d8f7eef7", "value": "NEW REQUEST FOR NCT Holland BV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7bd933-3421-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775745571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745571, "uuid": "fd36262f-42fc-4d23-aaa5-82f5eeec4b6c", "comment": "Malware payload", "value": "7ec7c2ff08d2a92b774bd930f9e6d7a2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745571, "uuid": "68e4688c-4cca-41ad-95bf-4257aa3cd095", "comment": "Malware payload", "value": "9d57d38d13c4b6c62d49cb820b2ae94f088dcd79621bc513583247a4a43e03b1", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745571, "uuid": "abec4c22-6bc3-45c0-be18-0b2646d5a6ec", "comment": "Malware payload", "value": "31a3702d3a63fdf910e91c7e26a6b3f36eb684d5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775745571, "uuid": "edb8100a-5a5f-46b4-992b-d6d6f5b122e7", "comment": "Malware payload", "value": "8d37fd4c2de0ace0765ddad2c0909c6f27f0bd27ca31be2d250aea033a63747acbe84e2b4d990518835f56b4324ef1de", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745571, "uuid": "f959e516-b57a-48d8-b1e3-404eff68e247", "value": "T15C518F016BFA0756F7B36F3479B955709DBBBD93A121CB5C1160010A1533B148D14F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745571, "uuid": "8688d312-ccb4-4729-9276-22957fd3bda8", "value": "48:8MQnjpT6GjDtdQj0sXAdQjq3AT6KZ27f1Z22T6:8MMpT6Gvwj0sX1jqQT6KZyZ/T6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775745571, "uuid": "a890ee72-28d0-40d1-a143-b790cc6a53cf", "value": 2717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775745571, "uuid": "27e56882-7318-46b7-beda-cbd575b2120c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775745571, "uuid": "5d01eb12-e9a5-4a1a-81cc-07bb0cddac8c", "value": "Ubersicht_moglicher_Rechnungsabweichungen_2025-2026.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6dbbad8-3439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775755791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755791, "uuid": "c31b436f-3403-4d8c-b2bd-317df7214326", "comment": "Malware payload (Mirai)", "value": "ff04372cf768a894a9fe05c5dc391104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755791, "uuid": "0151d349-76c1-486b-8a19-b541eebb739d", "comment": "Malware payload (Mirai)", "value": "9d7613ba19627057630cd32107197f977edb8897953edb93005be3ff3c20ebd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755791, "uuid": "22a35df9-5cc5-4626-876f-e1471bc0220b", "comment": "Malware payload (Mirai)", "value": "cc24aa7accada38f158e2bc18591b9144c7b9ead", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755791, "uuid": "c14302b3-2a05-4462-92d5-5f920f1b997e", "comment": "Malware payload (Mirai)", "value": "ed1e79236dec9368cca78e8761ed14ea32bbb96efcf5e7be1f09819fabaae9a446c513136bc0f07a6b2473ca77065a45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755791, "uuid": "35c056c4-fd6b-47f8-966f-a84680ad9df5", "value": "T17E057C233712CFA5D354C67009F3C6515AE525A20BE251CAB278C328BE6162D6E5FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755791, "uuid": "a0d89328-a29c-4ee5-8058-c2e9a86160ea", "value": "24576:z4SdbiIig2kc87wGXMvPt5JElJZgSZXaLaUx:z4Sw+c87wIMvPm/ZgSZXab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775755791, "uuid": "e6b71b3a-6df6-42bf-920d-dec1334ef427", "value": 826620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775755791, "uuid": "304189f0-2754-4a41-8e25-407699623660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755791, "uuid": "4f8a96e0-a25d-489c-8afe-0de65f8aae32", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d40917-3445-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775760696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760696, "uuid": "659c1f4b-0f6f-4361-85b7-71fd263cdd0c", "comment": "Malware payload", "value": "b59e42bb794372633399b04df1372431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760696, "uuid": "beb660ae-f60f-4869-9824-3fa2826cbc02", "comment": "Malware payload", "value": "9de8a00e661b017376dc8409f15df1eb68f432f9d19373b6fcb6908c71fc111b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760696, "uuid": "c53edb92-709e-4834-be32-b5976859f16a", "comment": "Malware payload", "value": "03e171bcae9ae25ee71b880b5332aedb773095b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775760696, "uuid": "fb61b332-c10e-4728-9923-a4a6e48913b4", "comment": "Malware payload", "value": "08b2004c55299e6f656e77d7ec92b919a6e13a42969b980ee5efeac38bc8d3cdac18863d82e6cd12b6f351a1db8eb6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760696, "uuid": "72a93821-93ea-4f7d-a8fb-9fd9733a01e7", "value": "T176568D43F35291EDC02AC074935AA233FA72BC89433576FB6B944A313E56FD05A2DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760696, "uuid": "a679ed34-d695-451a-9a61-c81e6c58a7c1", "value": "a03ba2dd45dd27edaa3723d1af701eee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760696, "uuid": "f55c546c-a95b-4613-8f6f-68ec1b46f673", "value": "49152:1q2CPEa34ewu1aAoyDDuON85VhWV1XV8mUOU95mxZ1kSTQUAjj9xIZMXDSouTVyQ:1/XywlAo+xqPn/0dTpc7tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775760696, "uuid": "ad4b89b5-9fe8-477a-9634-edb07a20a760", "value": 6453760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775760696, "uuid": "c90192ce-d7b5-4282-aede-393c2b0ac5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775760696, "uuid": "626ceb29-5c3d-4ca5-968d-15c89d949b1c", "value": "amberscroll_v1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b07c8f-3428-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775748276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775748276, "uuid": "eb3cb392-249f-4797-b220-ea8f3e1c3589", "comment": "Malware payload (NetSupport)", "value": "6d8ee15d4bd5df75eec382ca382fcf33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775748276, "uuid": "8bfe96f8-f7d9-45b0-970a-6a796b6e955e", "comment": "Malware payload (NetSupport)", "value": "9e1af8b1e0eb5d851c79b903380f4df31602324da7e04ab44cb2b706fdaa81ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775748276, "uuid": "8a2450ea-2a3c-4e7c-9755-73ba19f2c9ed", "comment": "Malware payload (NetSupport)", "value": "3f116db416261b92f343560cd448cd5c9aeb61cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775748276, "uuid": "b31935f0-d85c-4977-b15b-0468fea727f1", "comment": "Malware payload (NetSupport)", "value": "d2879ab00db590c5da901484ab9b4fab6b1311fb57e6aa0092d683e5c89b38df3a2fadc68efda729f2db2af350767c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775748276, "uuid": "0ae58586-ff8f-433d-8bbc-c7dd58534878", "value": "T1F6F56C0BEDB98CFAC095B2348433A156BE647C401B3163E72AE1B2642E737F0AD75B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775748276, "uuid": "f7d8698e-d1a5-4381-ab79-c4b5e096ea12", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775748276, "uuid": "9044d852-a444-4bed-b025-fdfa6a0a46b7", "value": "49152:IkLkwWAurCpPc8YkFszbcOo42UsHAifXMXjJQcj/:ICH542UsHAEzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775748276, "uuid": "b42cdf8c-1bc0-4af6-ac6f-b3b25032c0ab", "value": 3609048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775748276, "uuid": "6f6fb0ea-e0cc-4c31-91a1-4c9c37d854c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775748276, "uuid": "a4afc053-1c36-4808-80fe-26ee2e2bb1ac", "value": "SecuriteInfo.com.Variant.Ulise.596178.15072.12674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e6c1bc-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1775721877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721877, "uuid": "8213104b-be57-42ad-89f5-7c21e70fc734", "comment": "Malware payload (DarkCloud)", "value": "631a551e3918d81bb67740ac5bfb9d27", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721877, "uuid": "16024c84-1392-4cfb-b2dd-5584da93755c", "comment": "Malware payload (DarkCloud)", "value": "9f4af1454eed18d17d26763908bb54a35679805f12a4fd46859d2a5681eba79e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721877, "uuid": "6ec1151a-0415-442f-b730-928e72592bba", "comment": "Malware payload (DarkCloud)", "value": "69a2bbb129d291ecb3e1da41bac82228045ce9b1", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721877, "uuid": "75fb14e0-8008-422d-97b3-d25fc1342daa", "comment": "Malware payload (DarkCloud)", "value": "3214236a092a533833c22595dea8a7e2b425043f004cc7306277db2c94595e855696ac514c8ec981f7a7a5b006bd932d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721877, "uuid": "49e17887-3ae8-4b6a-bef0-1971cf7cc141", "value": "T13C84F62DCCE84223D7F7D57CA99F4252E88B59B3A61CD965A1F387F90826401BCB361C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721877, "uuid": "3d34864a-eb3e-4287-ab62-1bb3a6753223", "value": "6144:EjlthE9ba/ZSRvu0oqJ2QtmtMTVAmV46j4jP8xh3jRL:EjlthEBa/kRm0oqUQ+MRA6B5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721877, "uuid": "5e4d4ffd-e89b-4c19-9ae5-706787684084", "value": 386738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721877, "uuid": "30929f7a-9841-40de-9e4c-97cb40556c7e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721877, "uuid": "d984b3f8-04e4-4df5-a9a1-fac7c91df523", "value": "Purchase Order No. PO08520246.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9447f79f-33bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775702045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775702045, "uuid": "3d14b303-c6c0-41a2-96a4-95c296fd1cb6", "comment": "Malware payload", "value": "5c15cc6eda60111d1a60894d51d1a648", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775702045, "uuid": "e43c8c05-7db3-422f-b992-87be38fa0b7c", "comment": "Malware payload", "value": "9fe33a9ad9182c40407e1805cc2ac202b210402cb05878a4ed9549045f851d02", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775702045, "uuid": "e3cac658-0e02-4f7c-844a-6316a4c32526", "comment": "Malware payload", "value": "5f30c2e03b7fd11f5f1e8da7984fdf5ba3ba5a3a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775702045, "uuid": "d974f8c8-0359-4b85-ba26-47cf4660c07f", "comment": "Malware payload", "value": "b275e04c32df87ef15e351cd7fc36f2bec0ea09afb3621b7ab9ac6165d1754cccdcab91c1ea277d4a110f7d2569f21cc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775702045, "uuid": "6ead0c21-4e20-404f-bddf-f783ea18d566", "value": "T187B58D217586C136D57F03B02A2DC76B46797E603B7784DB63E89A2E1EB09C14232F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775702045, "uuid": "856fd8ba-23e6-4e25-8e29-8d350409867e", "value": "49152:vSxYtqYaZrf5jSTUial4MV3eVougT/AMJrMf+7UVZDEFe74vLNgmUESIEjPMN2lx:iYqjSTBDMV39ZAuq+q4veHjPMNaTD5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775702045, "uuid": "ca2b73f9-b5af-40a2-9ad4-07eb0f2c175a", "value": 2488320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775702045, "uuid": "0d46ac93-e046-4bfb-880b-0de0bbc7980d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775702045, "uuid": "ac3c76a4-a6aa-4eb5-9bdd-bbab0dd11a36", "value": "ast.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdadb85-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775721817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721817, "uuid": "aeaa2fd7-2f24-4aa9-ab33-8fe646a1b1d7", "comment": "Malware payload", "value": "0f935f5b2fd743dd40175aaea5ca9634", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721817, "uuid": "db02c9e2-c5ba-49fc-980a-b98a9c93f272", "comment": "Malware payload", "value": "a0435107e4fe7882adc31cd524257f2ae3972ed998b125c9f45826469ed48ac8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721817, "uuid": "1f8cb6ec-d5b0-4c44-afc5-77a08d4d4c78", "comment": "Malware payload", "value": "4f027b145d47786ddb09b5a5f94ee233b59c59c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721817, "uuid": "66716f3d-4923-444b-b970-e88d26c49335", "comment": "Malware payload", "value": "54a445a5f9a591abfd6524d4c6add397c0bd6ffcdda1508fc8ef2237463e81fcd1eb16a3ddbc9b47f0e42d66e68da3b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721817, "uuid": "013fdca9-e339-4681-8b3e-886acce5961a", "value": "T12B94A07CDD48D32FE3B3940C9CDF0F03A8A4552A241DFA8DE1C6E70F665658668D21AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721817, "uuid": "80f72d98-6c59-4836-a45b-c0158e4637b6", "value": "6144:V7rArKKnbS9/snPiMIFTfZfw8vAboQ52Q0PUUxLlEC2csx:BrcnS9/U1+N/22Q0PiDck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721817, "uuid": "02b9915f-1a0d-4ff5-9ecb-0715377fb0dc", "value": 417996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721817, "uuid": "3b94f060-4fc9-41cc-b6b7-24b6e7d66358", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721817, "uuid": "d504008d-0234-4b02-ad53-696cad2c4adb", "value": "PURCHASE ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19203c99-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713865, "uuid": "1658b58a-a528-46bd-b32e-6175b832b4e1", "comment": "Malware payload", "value": "65cb7d8f47e8d3ab654a009b8d9c6c87", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713865, "uuid": "e4d66918-2a29-4aaf-9730-8f0410a64e4e", "comment": "Malware payload", "value": "a23294923f67309d1f72288d6d6e047e51bca768d2b1866a858eac5f7f0e1570", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713865, "uuid": "76addfda-abec-4e9d-a451-e0b95c02df57", "comment": "Malware payload", "value": "81af86bab853565d9cbaa827420771ae94559daf", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713865, "uuid": "df40bb9b-f819-4776-8817-0ea859cf2da8", "comment": "Malware payload", "value": "472c22385da328f2735a1011f0b4c086df64ceba679459132e8153a00e1af97c331a5b08cb3f8bd298f81706f32490f4", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713865, "uuid": "69fa9ce5-61df-4ba4-8c70-88772cc9b1b8", "value": "T19394392EDD982239D1FBE60995E90C03EC87AE1F250CFE0E10C583EA7A77586719552F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713865, "uuid": "37e80ecc-713b-40ea-92cd-aedcd128019e", "value": "6144:rnv9cqNgZGc/NUa+QHI3po+b6L1nPFtl79UZlWgkTRH4rNInXGgZi1eI:jv9cogwaUaWio6pPnDwW2eXGgZioI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713865, "uuid": "a97be9f5-d836-4e73-b07f-a0be1458a244", "value": 416096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713865, "uuid": "76126de4-1c8d-455b-8ccd-01c1fbda7490", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713865, "uuid": "b70b127c-ba38-4de8-9a32-80ffee55fa7e", "value": "FedEx_Billing_Payment_Receipt_08_04_2026_000000000pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc915d1-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717010, "uuid": "85400b70-41bc-4aa2-9dd3-65af88625d0e", "comment": "Malware payload (Mirai)", "value": "6c0d99acda1f7802eb9351a078ac5466", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717010, "uuid": "01ab400a-1a75-48a2-ae0c-9fdf51e2cf84", "comment": "Malware payload (Mirai)", "value": "a4eb67adfe8431e0afaf4ec0aee8d292391bc37ec4c1d9a68bcbe05cdc63378b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717010, "uuid": "24a9fb96-da47-4887-b986-2a9c2e4dbc4d", "comment": "Malware payload (Mirai)", "value": "42497f470b36cefeed59975515ec850e09827b50", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717010, "uuid": "299e9ff8-2bef-46ca-9c11-5a9866d297a6", "comment": "Malware payload (Mirai)", "value": "f658df8bba4d09271c3c7a0098df79cfe3b4932e772cb7c828bc3e3a1531b5d836a468d17958f4de514794515ad7fb40", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717010, "uuid": "89c66ae9-b020-4b3c-a3d1-65a5e839f49f", "value": "T1DD739E23C876189CD26842B8B170FE3A53B3E51056572FFB069ACA769447EDCF9493B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717010, "uuid": "ab0e478b-a944-4da4-a165-d6fc74df3e55", "value": "1536:0/Zd1XEc589PGmE++KrpgE7YgJMiCYKkN3ski:0hd10L9erIrbhJMiS68ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717010, "uuid": "8b5330af-ece7-40d1-8f6d-8ab65de02ead", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717010, "uuid": "e633ab20-4742-4788-8a83-f0904960fca0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717010, "uuid": "14859843-cce5-4b99-80d5-570d57bc5ab2", "value": "Hammz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b375fb4-343b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775756496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756496, "uuid": "115a0d12-e58b-4b65-9dc9-e2b54c3a1a71", "comment": "Malware payload", "value": "5d0d0b39be9e74c016a5b65531a930ce", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756496, "uuid": "b88ae3a1-203a-404f-b656-cc98ed929019", "comment": "Malware payload", "value": "a5749f1a6fa1d0822597254181e6d6b426bcc21f8afe58d7fc8b9b8e6eea74cf", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756496, "uuid": "1ff8d585-a0c0-4c6b-a012-0f705176eacf", "comment": "Malware payload", "value": "e7ea95c65fc74a27bbf59d41df4e8c04d01fb175", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775756496, "uuid": "7bd3ddf6-c01d-49fc-b007-60e7900f5f41", "comment": "Malware payload", "value": "59c6f6386ac5889ecb20cb4987e741d07be4d91fea22c1f4da37f3d11bfdb64838faf1e7a132d9c1e4e6643fc4ea80b0", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756496, "uuid": "6b460542-06ec-4b00-bee6-bad3ecbcb630", "value": "T195E31E99886F46EA4B933C60A54B114BDFB01B07070DD1E4732DDA687F2876D44FE8EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756496, "uuid": "f5e36714-96bd-40b9-a0a4-7ca3ed79c305", "value": "768:xqlRaw6m10a1ulD8wI7ZVlmviJx1YxiRuoNOV+982A1N+M8N2WpcTNpkNgSn:x4awH6g5BubXkO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775756496, "uuid": "684750e7-8f22-42e6-a94b-d4b06807ae68", "value": 145125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775756496, "uuid": "e5285770-4184-48d3-9e92-73f3390ad23b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775756496, "uuid": "c4a4fae5-908f-46a6-910a-d2b40c6fa0ea", "value": "Beta_Archive_London_558.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d43a593-33fb-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775729119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729119, "uuid": "e07c2715-042a-485c-b12d-92dedb263cb2", "comment": "Malware payload (njrat)", "value": "997ff57bc0a43875ccc848f739ddee04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729119, "uuid": "65c33995-e91c-4f15-bf0d-2e7edcb5ba17", "comment": "Malware payload (njrat)", "value": "a59934e135fc0befdbcd2d31ace1c2a3ac102d3b82a84313af82c8fdcd43acaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729119, "uuid": "bcc0c8c4-be1c-432f-a9d2-3f397dbf9c0b", "comment": "Malware payload (njrat)", "value": "6d9c54ef2d45648b9c1a3b72083177b14b62a3a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775729119, "uuid": "2fcf9325-48c3-440e-bbb6-0e47b912cabf", "comment": "Malware payload (njrat)", "value": "3f8e1e146d1c8c5c3368e81ef29009678b434f52a33ee930fc58aa25e4d833c5599654c71627a73bac0c923eeba9cc1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729119, "uuid": "110d9d0e-d859-43cd-ae1e-6d0523c94260", "value": "T181F34A9E778A4B15D57D0D70D0FFA93003F19A836633E28A3F8429AD9E112DA5D4C7CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729119, "uuid": "73c9dade-69ee-4e09-883e-05101cfdc512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729119, "uuid": "7ec5e637-c384-4075-aebf-09a9f5dad2bc", "value": "3072:vACAe/VdrZn6+Hzc7Q3E40BjXEjwCYOfMHjzb308Mjm:4CZc7Q3EJIZYNvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775729119, "uuid": "b2ea81b1-41f1-4a70-80f9-07b0bdce0c22", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775729119, "uuid": "92ec83cc-895e-4552-84ed-e36567ee756e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775729119, "uuid": "c5470fc5-1f81-4b5b-966f-b86fabe38c54", "value": "NewClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70f2b82-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775721888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721888, "uuid": "487c17af-febf-4891-97c3-e9d3028dc8ad", "comment": "Malware payload", "value": "c5e410555e64031ff1a81276f3078572", "object_relation": "md5", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721888, "uuid": "4019de5c-b22b-4757-948d-e0621942a72f", "comment": "Malware payload", "value": "a755759a2efb1f49d639af3f8166cb334e7fd537c3baf454e561f7ad6d07838f", "object_relation": "sha256", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721888, "uuid": "3470dca7-f3b6-46fc-be5a-1ac024798ae0", "comment": "Malware payload", "value": "c1a5c26d39d6ae3ec9d492bb2c3a521f545f9926", "object_relation": "sha1", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721888, "uuid": "7acea7a7-e8f3-485e-92dd-7b16d6c5131c", "comment": "Malware payload", "value": "8193056ca4bb5b0f7ef30387e7d81a288b7cb79b53316573f0cf5dcaa6a9b9bd89190c10b40d34ff81cbd2170c753617", "object_relation": "sha3-384", "Tag": [ { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721888, "uuid": "97612989-d8aa-4c25-8709-c1882dea0fc1", "value": "T1DD51051066F95608B5B3BB15AABFA4B0483FB82EAF72C70C0159C15D07F1A408967F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721888, "uuid": "668c3d9a-5d84-47b0-aef9-7e2f9679b3e6", "value": "48:rsw1sAkD1IN7SkyIoHwmRy7uyUx9HtuVihvkASm7LcG5HOH55aT7Rb/I:rsgsZ5KO4oH6Cx9HtuMxN7Lj5HjTpI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721888, "uuid": "e4a70601-ab16-4f6f-9e47-2c7860806fbc", "value": 2952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721888, "uuid": "35e1fb55-0ce7-48fe-99d6-0d53560948ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721888, "uuid": "290da477-32a4-4c6c-98d1-63fba2332ca7", "value": "a755759a2efb1f49d639af3f8166cb334e7fd537c3baf454e561f7ad6d07838f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9353c97-3407-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775734427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734427, "uuid": "437d1f9f-0c3e-4d81-8fce-63576ae21410", "comment": "Malware payload", "value": "5d40c50eb0615b71cfe00bed777ece27", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734427, "uuid": "f47508ec-f965-425a-b0f8-346c015d8cb1", "comment": "Malware payload", "value": "a79212e87431f425bc2c2d9a5b197fff5dbd6ba677462d3e49cee26c97361593", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734427, "uuid": "4d73d138-70e9-42ed-9ff3-35d69fde8eab", "comment": "Malware payload", "value": "2da1dd716d14646f8d06719716502d5a3ae35cf6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734427, "uuid": "8a12b825-e451-469b-b8c9-ad0a7207abcb", "comment": "Malware payload", "value": "447efbf8d58c99b1b68d914cd8c9dde72dd55db9d5cd76b6eb575d39b11e797c5449767817c251caf3e3d71d26b1295b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734427, "uuid": "d913b471-6970-4b82-8483-b73796c14545", "value": "T1C8613B54096916B6C2F0F27D6A0880CF704D8D415360BB6D4C5271FCEAA39D1CDF217C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734427, "uuid": "08bd5378-0d70-4281-b7d8-e1346e786904", "value": "96:zVZVrNYwMb4uM4li/w6nd1byds/2s4FtJg5yjK:B7r6MuMesN1v/2swJg5sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775734427, "uuid": "131eb189-d6f1-4e24-ac60-2cc863e962a4", "value": 3203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775734427, "uuid": "15718309-0dfe-4407-9dc0-9a7024f70aa6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734427, "uuid": "251059cc-8cfb-4d66-aa87-98d49ea45fbf", "value": "496617372946383698.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942815f9-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717078, "uuid": "91231603-5dc6-4903-98f0-9296e8606e05", "comment": "Malware payload (Mirai)", "value": "8b8b45faa17cb0697fa824248f3eaa6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717078, "uuid": "6c4075e6-bb29-45ff-9fe0-235ea9cf0272", "comment": "Malware payload (Mirai)", "value": "a8272109f0963134c278fe3313a2fe3f714f7681bce29bcb453e6c665ada0e24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717078, "uuid": "21e5fd7d-1c0b-4104-821e-a35bb47b9c83", "comment": "Malware payload (Mirai)", "value": "d5f5fc2c0c5b70c5b806b8c757c760de6d54c0c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717078, "uuid": "08455756-a4d9-49d7-8382-ae6f23d09eb1", "comment": "Malware payload (Mirai)", "value": "f1ec22e2800a129d9c5487a3b7bca2c86d6a3553f1013943e5d843644be8f290a6e499fcf931cd208d2be6b59acaab5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717078, "uuid": "b31a801a-0a1e-471c-a611-e7f3cd67e774", "value": "T1DD833A47B98190FEC499D03847BF7537C923B4BE1239B29B63D4AE262D09EE01F19746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717078, "uuid": "639649cd-3936-44a5-b0ad-6d8c44570d45", "value": "1536:MqbF7IdAcsgpY+HqqWEVkCkj6Rv3U8GbdGrAyvQ9ol:TF74AcsgphqaVkCdRvAbdGrXQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717078, "uuid": "1464b408-f0ca-4545-8545-deb24b26304d", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717078, "uuid": "bb977bbf-316a-4b91-88eb-185be8528bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717078, "uuid": "d7e4b49b-a1d0-453c-8f0f-cef4d3c11ecc", "value": "Hammz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f1379b-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717005, "uuid": "8dfbc20e-0988-4d1c-9025-e2f5a88931f4", "comment": "Malware payload (Mirai)", "value": "dbb42b069743ac2fbc3aa96da6912e70", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717005, "uuid": "4bcae9db-16be-40fd-9db1-fcafdeac7974", "comment": "Malware payload (Mirai)", "value": "a843f6a1b68e0c816c45dd7696d3fb2148f967fc29d46fce8daed97e7a01c79f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717005, "uuid": "02695a13-183c-4640-9436-ebd749a02de5", "comment": "Malware payload (Mirai)", "value": "1a68fbe457d5a89c58e6ed1cfbe8f795717004de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717005, "uuid": "5d165516-1f85-4d87-bdd2-57ff9765a319", "comment": "Malware payload (Mirai)", "value": "26b799734e8db085647336bc865679c4b40ff79e3fb3418299200c105364c828d6367042377d2718ca6a1b5a4b88e211", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717005, "uuid": "4ebc780c-867b-414c-ad07-3011fb11ec7d", "value": "T14F9318C6B401DC7DF80FDABB4463290EB631E36156831B26675BBE53AD721E05913F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717005, "uuid": "e30c15fc-0173-42b4-881b-815e5e50a161", "value": "1536:6sdLEbXJld35is6pRA7O7X7LW0XM9FW2edNP/8b47e1ov5TaCkg0zjX9JK1Cm1k2:6DiPpAO7X7ww2ed1nqeTadgqGCm1HqQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717005, "uuid": "989fec98-5ef4-4883-97d7-2301ac271d7d", "value": 96736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717005, "uuid": "78d5b97e-030a-4fcd-ab96-6711fc518317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717005, "uuid": "88b0c7ad-67c3-42e6-8917-4f3a6580933f", "value": "Hammz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5effae08-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736316, "uuid": "3d8dc5df-1386-4757-af50-11f60e2f185a", "comment": "Malware payload (Mirai)", "value": "7e3e2551b17f7dacd220df47e9b9d594", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736316, "uuid": "2d0faff4-f1c3-49ae-849b-80283ec1604b", "comment": "Malware payload (Mirai)", "value": "a8d6bc46c37c1da5c4c5d9b32f3f1ce168a4650a8150f8217b15ac06d3631753", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736316, "uuid": "d2286467-d451-4a8c-ab60-cab59d60d4ca", "comment": "Malware payload (Mirai)", "value": "e1b49c8b7fca270932fc6a51c3410cc3f2aeef93", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736316, "uuid": "aa7787d0-0d86-440c-979d-81d94a756b4a", "comment": "Malware payload (Mirai)", "value": "bec97e32977f8583953020b688e19058b782dd615cf50f74b4b5eeda6b616532c34ed10abd6318cda49f0d8a665693b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736316, "uuid": "02d4b5c6-0c71-41a0-9191-48f1a88d756e", "value": "T1AB04B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736316, "uuid": "f2e3ba2d-b8ed-44ed-88ef-6a1718d88366", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2a:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736316, "uuid": "ba1dd354-7ed9-40ca-8a59-0fc08469dfb0", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736316, "uuid": "0b2b13d1-cf47-4e12-9613-6dcbafed1c14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736316, "uuid": "9ac5da40-88f1-47d3-891e-7b6bc1d325fc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0822a3-3459-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775769649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769649, "uuid": "4b0a498b-143d-4b8a-8a26-a0c76d78e4b3", "comment": "Malware payload (NetSupport)", "value": "0a893d86c09573aba189e1b1212d8823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769649, "uuid": "1ba06546-f835-4f0b-bfbd-a0c426495770", "comment": "Malware payload (NetSupport)", "value": "a9146c63bc2fae347013e63476db7f22320d983ffa501b58c0f74cb5488e4dae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769649, "uuid": "5ba194f0-9a07-4469-94d5-b5f0b0861ce3", "comment": "Malware payload (NetSupport)", "value": "e9304bfe19ecf81bdb28add352d8e0447d702d42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769649, "uuid": "d24df0b2-03d3-45bb-a0eb-630b752faee3", "comment": "Malware payload (NetSupport)", "value": "20e1afc449481566b13c5f25d7ddf4609b7c07a64d2fd02a34eeb82c9ac04d5fa6c95efa5eb814b4cfa71b4100f7a76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769649, "uuid": "613ef529-b2ab-4bf9-bf0e-269ae802892c", "value": "T1E4065B0BEDB98CE9C0E9A1358433A1467E24B8401B3173D72BD0B6692F777F4987AB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769649, "uuid": "038ed8f8-85ba-4556-9ff9-1b687110504a", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769649, "uuid": "c0c04cda-b2fa-467d-80dc-1cd03b132a79", "value": "49152:4kt6isNa+VXB9FFCzC1KKjkrcMBpajUQcHGI:4zNxxABVrPByLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775769649, "uuid": "4e18d146-c49f-4b44-94e6-bfc2a3c3fa5a", "value": 4016176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775769649, "uuid": "b901b56b-371f-493d-a50f-53dad8adadb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769649, "uuid": "029dda1f-f664-4490-8c3b-bae97d93d42c", "value": "SecuriteInfo.com.FileRepMalware.98765326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc5f68b-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736317, "uuid": "b72202d9-fc88-42fc-90d7-3df9f2e97b51", "comment": "Malware payload (Mirai)", "value": "7aa971c47c85b887dda8f2624187c47c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736317, "uuid": "8c9ad322-8334-4f46-b786-e9d88b9c8859", "comment": "Malware payload (Mirai)", "value": "a9f87cc58356034f32cb89480462d5345d20e62559730e95db290cda1e92991f", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736317, "uuid": "67e87af2-6b76-415d-853a-3cef0132ed6a", "comment": "Malware payload (Mirai)", "value": "7da88f7609bee6f7c2bfe71b0cd614dd4fd19241", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736317, "uuid": "7fbdf37e-7857-4aec-91d5-03b2c7428991", "comment": "Malware payload (Mirai)", "value": "0d8450186357d035702141afc212724eae0563c6082c2a24d05a9d4a7d7770b7798da6e96e6072ca0789d27c447f02cc", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736317, "uuid": "3c6f92dc-733f-4148-aef9-2904857e92cf", "value": "T1C7344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736317, "uuid": "6a67f8dd-01e0-497e-96bb-a1a7e8766394", "value": "6144:W8tTPA0OBzabKacEK1dAnJd7wLfdfM/9hWfAU:W8RAVBzabKacE62JCp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736317, "uuid": "6687e588-b30f-492f-9393-6db4a3d97c6a", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736317, "uuid": "e46e2b3c-a52a-4441-a5f0-8653d1b03d4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736317, "uuid": "34454577-1f9c-420e-9aa0-b50ffe039a3a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49e36cc-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719280, "uuid": "9ce7e25b-a1b7-4af9-8829-5a8927c36a4e", "comment": "Malware payload", "value": "428c49abbef4bc7708602529c6538f59", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719280, "uuid": "f0e93318-7f62-4a19-bf35-5aaf52b084e1", "comment": "Malware payload", "value": "aada52fa86cdc6c0883dfb821cbf5959d6bd0e493fdda639dd5b3d5b2c18f796", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719280, "uuid": "4625f7ed-90d1-4387-8e0b-af4743477628", "comment": "Malware payload", "value": "4ffa35d436a7fd73f19e67a16c9f3d12630d9052", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719280, "uuid": "c6d1c292-d4b4-42b0-ac21-cf2848c4cfe6", "comment": "Malware payload", "value": "22809734999b9725193ea9bca0fc128191b94d94101c89eef6c124d4e1d8210b3921918750bbe685df38561cf71a5869", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719280, "uuid": "a22f5833-5db5-4f75-a4a7-8b814f8c2419", "value": "T16454DF10D6FD2919F5F22F20AB7A28108E77BE55AD0D94DD80061D8E8976D49CCB3B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719280, "uuid": "e814aa23-ec3b-4e39-81c0-108b846e3c88", "value": "6144:PbsB+YHoBSqx9XASOAgpxXyJQUvr1emtBwIvmqppvRtq:PZYIBF1TgvXyxZtBwsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719280, "uuid": "36ea4f29-7207-4b54-a7c9-d7bd280fb272", "value": 300276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719280, "uuid": "c9d3563f-370f-47b7-b955-4e545eae66f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719280, "uuid": "b0bf2d62-4270-40cd-b39b-5e8564a6640e", "value": "DownTransaction receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd86146b-343d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775757547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775757547, "uuid": "9cbb8737-8af3-47ef-a2b7-d33818f82762", "comment": "Malware payload", "value": "901c4377dcc841bd3c15d6795f1b38d5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775757547, "uuid": "4dd8083f-e3f9-406b-be66-1b0fb5ea1f21", "comment": "Malware payload", "value": "ab927e61a73abc4ebb6dcf20a91be66315b8794662680c1a9f1aae0b9e167d7f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775757547, "uuid": "48c603bb-e354-4d1e-8310-3ce6a0e98122", "comment": "Malware payload", "value": "1e5ee5b27fca266fcf969eae28a739cb151490ce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775757547, "uuid": "4bd65d75-3422-4304-ad5c-f69f3122e7cf", "comment": "Malware payload", "value": "39a72bf2b7c4e2372ced0c330d94524af6ec2bc855423fd18fa1415ff031b4be2940e0376f690b56eca846c8b44b5afd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775757547, "uuid": "137c65c7-4560-4337-96e9-fb8133756414", "value": "T185046C16F6A650F6E1BBC534C9521906FE72F89247706B9B57500BA20F33BE0AE3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775757547, "uuid": "4e34ddce-17f0-463b-876d-8f975baf2e7f", "value": "4aa8074d5d009ce7610840ae9bfd04fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775757547, "uuid": "cfc78cfb-8fe4-4c13-94fb-138df267be52", "value": "3072:km9T6GDftzeeg5eHPa0OvsvC8go2JLKWiHT3BSrG2M7zj:TDFva0GsvolGHHTRSrjMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775757547, "uuid": "ec29128c-7c67-4593-a44c-11da984f3d15", "value": 185056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775757547, "uuid": "f6f0ceba-1005-4f4c-8df3-37e4b39c48db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775757547, "uuid": "a356d568-3197-4c0a-bc6e-d295fd356472", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bbd9d99-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775718782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718782, "uuid": "57392180-b577-4a48-83b9-21cf9a6e6dba", "comment": "Malware payload", "value": "5fdcd80ef675514aea4643d63d7be815", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718782, "uuid": "e94fe3c7-705a-4c6a-bad5-6fa07f86d3bf", "comment": "Malware payload", "value": "acc178e66a52c6ab1f823a7977b48a786a831cc3e2ac407c192c211783086f47", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718782, "uuid": "f6669fee-e5e5-45da-9a78-a8d96fa4d4d8", "comment": "Malware payload", "value": "260b510d731c288f45a044ab25c488619fd53646", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718782, "uuid": "2720f61c-a287-410d-ac4d-5800b925e0a6", "comment": "Malware payload", "value": "887aa6b2d08332166be647d5099ac042db7e31928388780138686c66807a860203881b886c33dfcdc625655e9b2e7f92", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718782, "uuid": "57fed30c-2f27-42b8-bb5d-b2dc817f0921", "value": "T1FBD511095735B08B5B7BB08D414C964FB5062722754DFCAE0A0BB01747B6B3E88F69FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718782, "uuid": "cc07f774-9338-4261-92c3-13c333fefcf2", "value": "384:gLmoJ7NRL20P1O0iFlFpu7AyZRt2eG3acVuwPl2QpMTugyK3GEOmFIuJ94kqx/gk:Id2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718782, "uuid": "ef95d645-7717-4dad-9bfa-8c9be092cbb9", "value": 2949243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718782, "uuid": "93a1626f-8660-4a06-b8e1-d64aa66cbfe1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718782, "uuid": "7b5a1420-704b-4230-bf4e-c039cf381f49", "value": "Request for Quotation MK FMHS.RFQ.26.04.07.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264de17b-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713887, "uuid": "ca69c210-8524-4c3c-9d51-aa2d8078e6fb", "comment": "Malware payload", "value": "9e2271aa09fb4c66339a5470b696d7a0", "object_relation": "md5", "Tag": [ { "name": "ck-3d80df5d12cdfe6450a782fc87bf66b444", "colour": "#7A544F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713887, "uuid": "39d13e13-d7ba-49d7-bbd0-a0eb97fc7cb4", "comment": "Malware payload", "value": "acf76ece2b4c6ee307318d3000a0b0dda4217476b0886ef2e79bd6b342ec894b", "object_relation": "sha256", "Tag": [ { "name": "ck-3d80df5d12cdfe6450a782fc87bf66b444", "colour": "#7A544F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713887, "uuid": "b0be401f-6cd5-4cab-81fe-50d84c78b2b9", "comment": "Malware payload", "value": "f8d3d94f897113de052e51ccd33bc7e149863fff", "object_relation": "sha1", "Tag": [ { "name": "ck-3d80df5d12cdfe6450a782fc87bf66b444", "colour": "#7A544F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713887, "uuid": "e00f47f1-03fc-4631-95e0-b96f0d9259d8", "comment": "Malware payload", "value": "c513c79f887477a7405ad8161806b487cccc9855ce8a9d40f886b9041783a0abb8cd28f5842f62276dd06125711ed012", "object_relation": "sha3-384", "Tag": [ { "name": "ck-3d80df5d12cdfe6450a782fc87bf66b444", "colour": "#7A544F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713887, "uuid": "c35f363e-3085-4965-9153-96b9c4e2d0e9", "value": "T12485060BADBD88ACC0E9E5788533B217BD657400477433EB2EE216610F56BF0A4BAF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713887, "uuid": "ffbff2a2-5350-4b45-9bf7-2efe2882d639", "value": "24576:npLZiSAiSxnNH/Xz8iljiSnCdtWagpUnRrafLZSXSA5P8D7P+TBggjRfMLlb8:nplXJSRNH/j8+JI9gprNeS45hNkLt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713887, "uuid": "ffbccadd-05cd-4858-b90d-035107024db7", "value": 1867776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713887, "uuid": "b67d60e5-d084-449d-a881-51bdc7c10c15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713887, "uuid": "f4dbcae2-4778-4d25-a117-f91e25189cba", "value": "ck-3d80df5d12cdfe6450a782fc87bf66b444", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04da652b-3456-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775767947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767947, "uuid": "da10efdc-68c3-472d-b881-c78d18d434bf", "comment": "Malware payload (Mirai)", "value": "566fdcd6029bdab355cb2f47eaa43008", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767947, "uuid": "30584ada-92e2-4155-b9f6-b410ebe3e21d", "comment": "Malware payload (Mirai)", "value": "aeebce7f9cc82201e14d75581507596be40db1c1f56a777d27f106aa06507ce4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767947, "uuid": "6e079f29-f0c9-4283-9675-2a718e8e6ebb", "comment": "Malware payload (Mirai)", "value": "92bb527bb179fc96dd02e96a0599ceaebb6aaf96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767947, "uuid": "fbf1352e-e8a7-4720-82c0-0d9c8de56d9a", "comment": "Malware payload (Mirai)", "value": "42648d5109f64c6f12e267089913ef0578a1c67418ca23affc4f94daead088cc2bc38d1536b99be2c215d86c3001cec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767947, "uuid": "5f22100f-292e-404b-bcb6-c03c4bdcf92b", "value": "T1D9931A46A9529F12C4D631FAFAAE415933537FB8D3EA7101CC20AF9423C59DB0EB7612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767947, "uuid": "e5552c38-88ec-42ed-8c9e-f862a7393af6", "value": "1536:J4nazk/gsUxR0dUDNkl3EV0vXR4YQfgasDnu5NVIQqlmKi3kdTQQVdib2uS:jk/qxRPRkqVIXR4pfgasDnu5NHwdTQQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767947, "uuid": "eb3f153e-8f36-4a0a-a66e-3c91b324cbad", "value": 95876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767947, "uuid": "3e4da5ac-c3ba-4597-bb52-f236357611f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767947, "uuid": "770a487e-85ee-4c54-82e4-be4deefe4683", "value": "manji.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600656b5-33dc-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775715702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715702, "uuid": "024fd6dc-78b6-4cc9-bf49-4fb1d70de877", "comment": "Malware payload (AgentTesla)", "value": "c6fcb678ca4d5a3f818824ea8f26b9c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715702, "uuid": "3ec03ea9-9571-4018-a4e2-0efe3b1129ee", "comment": "Malware payload (AgentTesla)", "value": "b01dd3b637e30813fb7ffd763fd7729f9ca0aa9df272483c87fd3c8adc67620a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715702, "uuid": "6b3d5cda-0b2b-4e62-b7dc-3cac592d48c6", "comment": "Malware payload (AgentTesla)", "value": "bbd367ecb3283396eab428d40da72e99926f7760", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715702, "uuid": "e2e221bd-e690-48f6-beeb-f760b53ec4cd", "comment": "Malware payload (AgentTesla)", "value": "ff1d9d85c667b060a5f49afc1f8749e5f7072fa27b0265fc2e5d78714cab638da7bd2c3913a49d88be439995775fe6db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715702, "uuid": "0649ce55-ce35-4706-a7a6-697d148bc5d8", "value": "T175D5F0A2A3F4E94B59E8C8D358C4088F775D296228335F7297CB05F0EB99BD85D2434E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715702, "uuid": "7fe168bc-50f8-43d5-a5c2-6b5324103ebb", "value": "384:CIfCZu47jJTqjLaaUsjCFSiePQRDp32+GMTQiDodkVqW8fSbzy/j/W8Fw9dOiLXY:whK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715702, "uuid": "30c8b261-d2de-495f-a5a4-544286a30d77", "value": 2830267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715702, "uuid": "ebb21600-1223-4dc8-912d-34ea1d9eb8d5", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715702, "uuid": "879087aa-01d4-4f65-b1ab-45dba72cfab3", "value": "DELIVERYNOTE-DHL-ARRIVAL850123324624623569354868707.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda627e5-3453-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775767049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767049, "uuid": "af0cfcd0-81f0-4888-b4ca-c10377f1c807", "comment": "Malware payload", "value": "f362b6233bc315423fd56f8ecafa0e6b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767049, "uuid": "6cf61995-a747-4653-9003-bedb6803804c", "comment": "Malware payload", "value": "b27b4b4cf151566e7f4c959a278f27256823a4774b91241bb37cb3c44f0b3d25", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767049, "uuid": "8fdb3978-5c8e-427b-a038-9c223d9dbcb0", "comment": "Malware payload", "value": "b9d243c684f15bf9885d5e1993e0062e1f816053", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767049, "uuid": "c9bd413f-fefa-4725-975f-74e6f2768f3a", "comment": "Malware payload", "value": "13cfa72743a02a6094557840299768622082abfc137ddf7f8daf81b3121a90a393af592bec2951f95495b008d4c94085", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767049, "uuid": "906a5ef8-f01b-464a-8065-b224d9315fa7", "value": "T1ADB58C217586C132D57F03702A2DC76A46797E603B7784DB73EC9A2E1EB09C19232B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767049, "uuid": "94eb41aa-07b1-42a1-b08e-1b57d4a68854", "value": "49152:NL2qYaZrf5jSTUialZJrMf+7UVZDEFe24vLNgmUESIEjPMN2lv+oBJYDXMV3eVoS:fjSTB2q+T4veHjPMNa1YDXMV39YAEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767049, "uuid": "f1357cb9-ce95-4925-af0d-8003f595e8ed", "value": 2454016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767049, "uuid": "31a63a65-2795-4967-95cf-9d90c0663d7f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767049, "uuid": "2b396fa2-6421-47c6-8685-dbd6d58291af", "value": "main.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d63c2d-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775719260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719260, "uuid": "36dc0d81-06bc-4d46-91f3-3920f1feb17f", "comment": "Malware payload (AgentTesla)", "value": "75222a6d8c92378f988af0fcf3bfbb62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719260, "uuid": "16be98af-1c71-4acb-a03a-c597b37e35b7", "comment": "Malware payload (AgentTesla)", "value": "b2c9f62883835341fe042c81883f6843a29ea94c44d0f361b51b0df95ab63a01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719260, "uuid": "6e72b704-3432-4026-8864-218d763640b8", "comment": "Malware payload (AgentTesla)", "value": "7638fc166a6a85fc477d19500b6e2749c4ab14cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719260, "uuid": "bee6fac6-6fd7-4168-8dfb-18fe7f93f4c3", "comment": "Malware payload (AgentTesla)", "value": "ce7c6378933aecbee96ff2299bde6d1f12b0ea523b513e2a81073163575eb29e2cd816f198215c943f31cbb1aeec9bc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719260, "uuid": "d5748c94-e80d-4e8f-b7d1-8d4ea1e21303", "value": "T188947FB8DE7D113AA1B28A27DDD7CB0385626D07691EF80E04A2370BC4B3543E5E657E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719260, "uuid": "cab26598-0118-4fb0-9a6b-1f24b8068dbb", "value": "6144:vCj+vlIyXbuNfOP02dbEMZJ1469u7c7wLFEDEcvSpOc:6jKlIw3ZzpkIUhKLSYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719260, "uuid": "7b49dbe5-bbc6-497b-a995-d20ec998e28c", "value": 417774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719260, "uuid": "b6656408-b896-4f77-966c-124a03b7a096", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719260, "uuid": "f2125916-dac2-48a7-9178-aee52be9e4fe", "value": "INVOICE COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d451fd6-3418-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775741521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741521, "uuid": "1ac6c9f4-26d0-4609-b259-0a842d6da345", "comment": "Malware payload (Mirai)", "value": "3c0f869bd5e33d10437bfc365f8a932f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741521, "uuid": "28223629-8aa7-4952-b654-650b7e887f96", "comment": "Malware payload (Mirai)", "value": "b3a9404eb25421aa41cc308f5e0326930e569ddf4cbbe1842ffd73a84449a6d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741521, "uuid": "f1b586a2-71f0-404a-9e83-b0d6f04a49c3", "comment": "Malware payload (Mirai)", "value": "442856652d81e7db048c0eec4fddb33bf7d73f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741521, "uuid": "07ee2079-0306-471d-b168-32720b17cdf0", "comment": "Malware payload (Mirai)", "value": "ff11e2a8657f9bc3d662cf21db201009b320927ca63f918d3f2643105b2d8e627664d9a4a280439e685c10a3017b3d3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741521, "uuid": "d4af398a-97c0-43d0-876f-b2d0853e4962", "value": "T176056C223711CF65D314C67009F3C7615AE525A21BE2518AB27CC32CBEA162E6D5FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741521, "uuid": "e37ab3a4-2ed9-4396-a7d6-67ced890fbb2", "value": "24576:A4imjQlwqLc44sIeTw+u8DYjaUi4JZ+jaL6U2:A4iPhIeTwx8DY6CZ+jas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775741521, "uuid": "042d173c-8867-4897-b8bd-79dae67bc12d", "value": 826604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775741521, "uuid": "1b8b39a5-aed3-4521-8d75-4fd8d0c2bfce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741521, "uuid": "fb45a027-5f37-4479-baec-4e2ec6f7a1f9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fda501-33e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775718012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718012, "uuid": "0ae16dfc-a9a0-49db-9a8a-bab199253e27", "comment": "Malware payload (Formbook)", "value": "84132efea7600b20bc4f9e8a4444a9d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718012, "uuid": "2a8c1cbd-ce01-4261-8f13-50f3c9938b7c", "comment": "Malware payload (Formbook)", "value": "b4bca79a4aabe36e301f38979d2c3bdff09e791db3b61750b8bc7b7c462d34de", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718012, "uuid": "7b2bb14b-51e6-42ac-8ba7-6c853a56ec78", "comment": "Malware payload (Formbook)", "value": "16db389171d1892a670cfb5e7dfd0a5c7fdad849", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718012, "uuid": "e30aeaa8-9a6c-4529-9d4a-cd41cb4edcc0", "comment": "Malware payload (Formbook)", "value": "531b700e22a8f9843d900bb453d8cc96cb5984cb40bff64066b23a4538e869ad5fce9cde591f5ee20240cd4adcebe0c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718012, "uuid": "3490b27e-e1b7-4968-9101-2c2f23ad42d8", "value": "T1AC16A740975CE732B5EDA72CD13EBA30594D600364C9EF2E31B8520976A1E1763ACEE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718012, "uuid": "c9973a46-0b44-49e9-93f5-fec77e3aa019", "value": "98304:0XYsW44ECHxNe50KXI42CxIAzY/eJ/9dx+EUWtHu1NlgMTksl:0bSNeiKH2M7zY/s/9/dHYUMTbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718012, "uuid": "65024228-a2dd-463b-a276-96cc889dc2de", "value": 4023985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718012, "uuid": "36f49080-1743-4e75-a431-d4bdfd33c0c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718012, "uuid": "2c07b56f-3a1b-49dd-b16a-9baec05f3617", "value": "PO_Documents_specification.catalog2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca761d3-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775719293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719293, "uuid": "6a3b7ed0-16e1-4910-b216-f744c4ffd8bf", "comment": "Malware payload (PhantomStealer)", "value": "6c77963573dac96a76b882b677d68c6f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719293, "uuid": "8502f358-6bce-4b9b-844b-50765dfe6675", "comment": "Malware payload (PhantomStealer)", "value": "b60de7e83c5e10c6cae5255abf2e3e32000f5f8342d890a8704ab9e034a29479", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719293, "uuid": "cf04e712-b6f8-4308-bc18-7bc049280fa5", "comment": "Malware payload (PhantomStealer)", "value": "891850573758ea33cc5c0e2dd5fa3a4914fec084", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719293, "uuid": "00775dfe-4cda-4094-b0f1-ca60888ce651", "comment": "Malware payload (PhantomStealer)", "value": "f924901a55b7273e6d904e3dfe670b2f0389de95922b1035ef1ba3ebb27355fc990b0513b2630ed1081fdf2b26438833", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719293, "uuid": "b3be7dff-7c22-42f3-8139-ac5837b2802f", "value": "T1CB64D015F3EE5114F0B25FA96AFD08469838BEA25E2ED4DC05344EDC0A72E49D873B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719293, "uuid": "1db49b95-b058-4c24-a466-53f9dfeae3cd", "value": "6144:P2Ci+rGNkTPuB5YKWSaZiYuT6sHhej3D6rg:PxNGQytWvcZRA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719293, "uuid": "9b6e9dd4-b109-4dd8-8691-f84504eedfb7", "value": 320264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719293, "uuid": "2129ba9d-b7f4-4448-a654-3dacfe861aef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719293, "uuid": "2d6b938f-2116-478f-9d86-0e6bbff6ca4b", "value": "BL and Debit Note.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300ea0e7-3425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775746974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746974, "uuid": "b3ed887d-1d57-414f-81c5-276239d3ab36", "comment": "Malware payload", "value": "3107ae2793d6114871c76eb48474d1fb", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746974, "uuid": "f442b4ce-261f-42ed-bd37-352a4f2e2e5f", "comment": "Malware payload", "value": "b688eeb8dc2585f28e641656c8bc5ca9c95c377a86d0fe180f00d55f3fa74259", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746974, "uuid": "b6d1477f-a1a4-4eb1-b7ba-187d6cd9fcb9", "comment": "Malware payload", "value": "c1dfb0f3427623001d6d6be141a2807b5dd65c27", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775746974, "uuid": "20816f0b-a6bc-4fe4-a5ae-04aebc7fb192", "comment": "Malware payload", "value": "c5a43495a51c5d1439ecbe4b82161957ab5788a0bd20eaec0e2f088284bba823ca6ebdbd1909b795617fec1f978809ba", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775746974, "uuid": "d90f661c-19aa-4622-ac4c-55aacb00e135", "value": "T19BD58C223985C533D5AF07701A29DB6F4979AE20BB7744C773ECAD6E5EB08C05231E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775746974, "uuid": "ceec99ac-929b-473f-bdc3-4d10776c2d1e", "value": "49152:4udqYaZrf5jSTUialKJrMf+7UVZDEFen4vLNgmUESIEjPMN2lv+oBNYJMV3eVout:J6jSTBxq+24veHjPMNaxYJMV396AK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775746974, "uuid": "97e52638-9df3-4821-a155-1953a74b6c4d", "value": 2904576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775746974, "uuid": "744256ad-ba85-437a-81e8-aec6cd50afb2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775746974, "uuid": "5c3ed583-d6ba-4cf9-8eaf-ac7050cdf56e", "value": "zh.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40115a75-3459-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775769335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769335, "uuid": "f537a1d9-608d-4836-815b-a4d3fdc64431", "comment": "Malware payload (Mirai)", "value": "9bef51e521eeff6880aff7a300e5b1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769335, "uuid": "75a38cf2-8109-4766-a9d8-dcb49195c758", "comment": "Malware payload (Mirai)", "value": "b6d839441c267eaf51204cbe1dd48d437e04730f73a22ab11c84a74bbbb8d22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769335, "uuid": "8da3bfcb-eaca-4ddc-abad-0bd6be04ba17", "comment": "Malware payload (Mirai)", "value": "a297fc83024720835160f733c1a5a3297847b953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775769335, "uuid": "c014bce3-c79b-422d-8049-ef863caa81a5", "comment": "Malware payload (Mirai)", "value": "d424c6f856fcc3e3af8a7ff3e79be28c37846b4a01cb4e8311ebb4d17ecad07a8f5383e93e441312de30d723ad948c5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769335, "uuid": "79ffe5bb-3fee-4910-a844-84d17e9f0270", "value": "T1B5341902A8528A53C5C21B79BB5F46593733AB34D7DB3302DA18AFB42F476DE0E3A511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769335, "uuid": "c38f4a8d-5330-4b08-ba7b-3822de2759e9", "value": "6144:SAdx0+p8KjcfiaokZ7kfFiCXsUujWnmW2hVDZI0/16O7Nc:SkxiKQfiah7sFiJinmW2hVD60/16O7Nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775769335, "uuid": "a4970541-063a-4fb6-a0a0-daa3d6a8a639", "value": 234578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775769335, "uuid": "57f04e73-3b3a-4bab-ae0e-fd5a34be6701", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775769335, "uuid": "c4c5f059-ad07-46d1-aadf-0b290abdae06", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7540a02-33ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723633, "uuid": "76e85305-8363-4bdb-99c6-00d77dcfed02", "comment": "Malware payload", "value": "f8fbc5f75be8e9428387b4072a79710d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723633, "uuid": "29c55d77-29d0-4098-a7bb-eea1d4ec65e8", "comment": "Malware payload", "value": "b885e252f38bae7713d79302af5d929cfdc6fd3d37e87eae694fe3ad4f778c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723633, "uuid": "35d0eb19-da4a-4d00-979d-f70484f6a59b", "comment": "Malware payload", "value": "000e448087c83023c965d1308e937fc319096310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723633, "uuid": "4da35222-5eac-4e5d-a005-f449e2c05085", "comment": "Malware payload", "value": "7fef1dc7d73751d9855f5a529e666103d0b7e3f75c85408114381cc21196a6c97fc4128c3f51248a9e06b41a1f2b299b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723633, "uuid": "6aaa81de-b9a7-400a-810a-ec3a2821b712", "value": "T15896339993A408AAD877A53F5D25D063D371B8224760D8CF1BE4872B3F572EA3C3A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723633, "uuid": "b7aa82dd-d00d-4da2-98f6-14dbdcca5b31", "value": "351592d5ead6df0859b0cc0056827c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723633, "uuid": "14c1ea72-38aa-4cb0-a3af-72cfc25f940e", "value": "196608:BQpoYtbW897GXPHMe81SF2RPUewytKZ22HsMRqabRgFeDU2:q11wPsZg2Ke3K42HsMRqabYew2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723633, "uuid": "fa3b1577-e626-4761-bd12-6fee5c57e0dd", "value": 8682029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723633, "uuid": "c0a1b9fd-43fa-472f-af3e-ae4b7a52fe4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723633, "uuid": "738f8525-0f8d-489c-a393-63735dea335c", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14620d00-33d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713857, "uuid": "d2a343d6-7349-4d69-be71-7392fa7d09a2", "comment": "Malware payload", "value": "966f1aaefff093731f68663578ca17ac", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713857, "uuid": "e399e878-40a5-44f7-9b72-df750d9588e1", "comment": "Malware payload", "value": "ba9303d913b9e097cb23c5dd92a6a8093f82b46c4ed8fc1e22e8d777e1a9c78e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713857, "uuid": "cf270797-7ecc-49f9-9f4a-499ea4e3fa44", "comment": "Malware payload", "value": "8c29af14372afd251ba665f0c05958363750a4dc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713857, "uuid": "c29eccb4-cf29-403e-9ace-8a5bd435bd60", "comment": "Malware payload", "value": "e625f1f0aa226a7e9d7afde2c08bac3c50a246e5b5fafc2d447c1e33a7a166d7bd239b9734180f4f5344702ebde4d0f4", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713857, "uuid": "a68e5b32-eb2c-4ac4-b35c-94c3c5c1570a", "value": "T112B21E3EC941DFF00B2A31A1A62F7A16A5540363B5382E4DBDCFC4993B359808BF55E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713857, "uuid": "0363bd1e-594b-4632-ab89-8d2c7c3a6cff", "value": "384:KwFGAVBn2NnspqV9c1iEWOwlYUcOFvPgcPdKdrotJ7kPP6rQGkWkU5DYHh4Zgczt:K3DNnhI1fFir0Vbuk8HeR24g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713857, "uuid": "852ebe07-b4a0-48f4-a74b-dc2900c5dc11", "value": 23738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713857, "uuid": "5a13c159-8dfa-4d71-b6e2-b5a801640445", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713857, "uuid": "8ded9e9d-522a-4df3-9bd2-97b74695675b", "value": "SOSTENER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330105da-3454-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775767166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767166, "uuid": "b1e19b05-4e04-4f4a-902c-04c9a7be15a8", "comment": "Malware payload (RustyStealer)", "value": "d71e3bf7d9c579e3b337be144be9c9c2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767166, "uuid": "59b57277-9d5d-461b-9642-efb8581b8355", "comment": "Malware payload (RustyStealer)", "value": "bb55ad330a05e6df1672efb0fe001803c8d0af0f7b0184235bf49ea26cd1b6e3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767166, "uuid": "80b4f2b0-2eb5-42a2-a4de-640ef2e20c2c", "comment": "Malware payload (RustyStealer)", "value": "bb92d4000f320a9e94b51ca9f7859889f701fce0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767166, "uuid": "87c1532a-3cc9-4bb9-9e34-a4ed5363064f", "comment": "Malware payload (RustyStealer)", "value": "6e92d13f71c0c982f7b3522b7dfa5a93928e86f7c17ea3f7497ec627a830c308329de75e2a163cfe6a32a8996e2284cf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767166, "uuid": "7a69cb18-94a1-4013-bf64-57983fd25335", "value": "T115C5026F7EE1B103D7BF9A3886C8887B96D218693593C44B417B8CD6D9531832DB312B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767166, "uuid": "971cf64d-8657-456e-a318-2e7fb2487d5a", "value": "36bb529d569a8fa7e6a15dc2733fd539", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767166, "uuid": "d54e16ec-31ad-4f73-b27b-ea325d54d022", "value": "49152:60f3PO8blKWI5wX9QKM3SuwVuXMBJxtr42jUzTK4zrllZsW7bL5/:xOmMWIGBMCuwVuXMBXtJYXK49rsOLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767166, "uuid": "7acc3d1a-edc1-49ed-908d-f3b8c805b34e", "value": 2696192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767166, "uuid": "c17d0f5d-ddd5-455b-ad70-8408b9458da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767166, "uuid": "74335e77-6af1-4fb1-82d5-6efbf327857c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e590f76-341d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775743509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743509, "uuid": "cdf88eaa-8d13-423d-9f7a-8fa49eb0ed3e", "comment": "Malware payload", "value": "418c603fdce03c3394a5fe2c354a1e49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743509, "uuid": "4c9ae274-c32d-4222-9da8-7d575d5560fc", "comment": "Malware payload", "value": "bb5c45cb88abb1ca0310bc1ac8c1cb1c723bd82768f28635ffe06450803ced04", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743509, "uuid": "f9fd4c79-24d9-4691-b9ea-dffaf458aad6", "comment": "Malware payload", "value": "f13942553564b76a12b8bc3ab24ac1baa04bdcc7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743509, "uuid": "acc23235-0db6-43d2-9bb9-3099489151e4", "comment": "Malware payload", "value": "89ec81fee1c16efb9b745e6179d202bc19f70292468462b45ec74f76a2e74a1a5c1837bb498c5b4fae7a904c0093af63", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743509, "uuid": "19e897d2-f2c9-434c-bc3a-43c8f3ad76df", "value": "T1C1C633A023686CF1E7ABD03E48779559D931BC1A13A5F06783B8C2AA1F2B3703D37654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743509, "uuid": "768f3754-caab-40e3-90ea-16cda80e0c6c", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743509, "uuid": "06bb4844-22e1-4238-990b-dc7f555d1ef6", "value": "196608:PXNlfRuYiiLnbWJWH4Lc35IdQmRrdA6lkaycBIGpEVSE0iuKe1CeKELI4:sY5WJVwJIdQOlp9FzRqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775743509, "uuid": "75422b47-dd9e-4ae5-9f30-73415c14e869", "value": 11815699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775743509, "uuid": "f03624ca-2f1c-4c75-acb9-65ad5bf14c07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743509, "uuid": "216f0f60-e0b1-41ff-889e-aca34c72dcdc", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee85223-3460-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775772420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772420, "uuid": "9b0146cb-0c44-4c36-9569-18cfc773cbfe", "comment": "Malware payload", "value": "e6bb454800ab5c77df03ad1a87c6d4ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772420, "uuid": "70eeef8c-2684-453e-8a5b-871109010a1e", "comment": "Malware payload", "value": "bbd7ec5557567974e343e8987be3bc5c1276162198b9d40f94da43b3acc49ea5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772420, "uuid": "03140ccf-7b88-4f59-b7b3-c5d8ec3223a6", "comment": "Malware payload", "value": "928969831a817b0bc8b29b352f34f5dae8da21ac", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772420, "uuid": "fa32bd63-7e65-489a-b316-bdf31581eaad", "comment": "Malware payload", "value": "8398c3fc74dd71ef4214b5f8cfa7db66f67ccfd43ff2cc9fb1d6012fcddaf0a8e24560d5176922bb24a01bbf99630388", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772420, "uuid": "3e3c745f-ca4e-45ad-8739-6fa55a2af86a", "value": "T190D02B916491503399CCC45B6995D09D308130032C46752CA43376364BCC198F0A5FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772420, "uuid": "2790748a-fa53-41ff-bb84-74ad76d6c938", "value": "6:h/qVzB+QFnTAJ3lqLeBsA+fW4UfpzfW4U5plVyQJfRX5K:5HQFn8J3lf0fgfpzfGpT1ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775772420, "uuid": "f351694d-a5b5-4231-9f79-055e2c1f4b66", "value": 273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775772420, "uuid": "7fbedd10-d9a8-4a88-aaa1-3d251069cde4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772420, "uuid": "5d4be904-417d-47bc-99df-6e503f816e54", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c8d148-341f-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1775744629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744629, "uuid": "a4098937-51e0-42e8-8e3b-8bd4daa5cf0f", "comment": "Malware payload (GuLoader)", "value": "7b09b2e67f2cd0fb3d34ec39ab76d087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744629, "uuid": "e06abd99-89b6-45d6-a7df-80867ea49be1", "comment": "Malware payload (GuLoader)", "value": "bbf8661385fb7921e79eeedc96638845cc489f296652da655a9a0079680dcffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744629, "uuid": "17cb1454-72c7-496b-9b1f-d95ed2be4847", "comment": "Malware payload (GuLoader)", "value": "f27d7fa2d9dd2140bbfcdbe269879e6623102405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775744629, "uuid": "3480f28e-3fee-41cc-87ff-7c7e1fe9f6c5", "comment": "Malware payload (GuLoader)", "value": "ea5a7f55505c5d215223e4515b47c5d8198caa3253a40e58ba2ea69d7f93a322260cc04ddb55468293e5105a9dcfa2dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744629, "uuid": "397997bd-c4be-4191-9682-560c7d3bd6f8", "value": "T1E24523D4B5E8C652D29202B0D633B99386BDEC9F0E74DB4F67433E88793AC8A40574D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744629, "uuid": "6ff9f8aa-da4c-40f1-91a2-6c5eaf136f3e", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744629, "uuid": "7be05654-3221-4128-bf18-ec4ac491b45a", "value": "24576:d4ojf+x3aYsRpPhcbYJdMDTvzaHJbyUhFMwVkgrqPpjevvWU9cOJ:aAQ3UpPCY5HJb7nMwugrqJieeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775744629, "uuid": "02470aac-28de-4249-911a-8a1332750205", "value": 1181895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775744629, "uuid": "4cc6ef70-8d23-4d43-8999-6571bf406dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775744629, "uuid": "f579244a-81fd-40ec-9516-0752047db693", "value": "7b09b2e67f2cd0fb3d34ec39ab76d087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54f2bf9-33d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775712382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712382, "uuid": "7c2f7ee1-f492-4f0f-9d46-a9cdb559e8a2", "comment": "Malware payload (Mirai)", "value": "7d875bd04c3f073b9d762906f9a87a3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712382, "uuid": "4e16398c-3ed6-4119-b216-eafa2fa0d607", "comment": "Malware payload (Mirai)", "value": "bc2c23353d72b044c8377065ac3c9835b7a09197703fb5d60442964c2edbf83f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712382, "uuid": "692fe358-d411-44e9-b73d-9f610832e677", "comment": "Malware payload (Mirai)", "value": "8c4dda8e574c9cca3f8e95fbd61c35652fafb0ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775712382, "uuid": "8fb613ee-b871-49f4-bbae-d034a50d300d", "comment": "Malware payload (Mirai)", "value": "d44fd50936f00867f7e4b500a242341c0b8b6c4f8d5ecb8670609a6a683764ffe021d481e8ff5b6ed30e6c5fadb3592a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712382, "uuid": "3829fe64-9f5d-4a6a-b2bc-a460e31a7137", "value": "T151D31856A9918F12D4C721FAFA9F004933136FB8E3FA7111DD206F64638A99F0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712382, "uuid": "722012ff-3d3a-4d1b-808a-28a1ae9a290e", "value": "3072:wLkS7kMGkST/BY9AHqCkoaAhWUhHBWIT4o5SNE7cJm/:wQSMg9QqpoaAhWUhHBWu41NocJm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775712382, "uuid": "1166d94a-7a06-4e74-9264-2286d4346467", "value": 133556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775712382, "uuid": "bb05cb02-3084-4844-bee0-9e73faf82e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775712382, "uuid": "0d883cc9-0f37-4c3e-b458-3fc4abb9126f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8df3c0c-3416-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775740762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "83b082d9-199a-45c2-9507-f3784e1c0946", "comment": "Malware payload (Mirai)", "value": "6af03ab0e18327d48ee60e5ccf87c698", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "0b3435ee-1269-4a14-9c0b-611f78a02d1a", "comment": "Malware payload (Mirai)", "value": "bc5382c8838351e0363f8852b6f47e1bb8e27f110a168d40f2ed21b36ee92bcc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "09aab63e-7521-4809-9c87-bd8be472ec47", "comment": "Malware payload (Mirai)", "value": "152970fb301f5d1f1b2447806f7f6db098e51bcf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775740762, "uuid": "37288e7c-5e38-4a1a-9ec3-f01407ce02b5", "comment": "Malware payload (Mirai)", "value": "5c1c4c3e1b8974ce277927d84dad3f160af0fe0a1780b80e1cb5805e986ae7a9d89f388854a24c63ee7ccd90fe8d0b52", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775740762, "uuid": "721e30d1-cddc-4482-98c1-6e1d4810d6b5", "value": "T175F43906F8808F62C5D12576F75F8278731347B9D3EA72069A189B343BD792F4B3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775740762, "uuid": "62a0673f-dc3d-4b50-bf93-e00bbdb9df72", "value": "12288:w6S/N8Gdu5zqlDtI1WxhvrJd/zmpPmr0cJP4l6p6h8p5uNj2EMEwBzWKVfZ:HS/mGdma+AxhrT/zmtmYcCTNqQwBSKVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775740762, "uuid": "7b252c30-7075-4df2-8b45-fda23cde0e83", "value": 725232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775740762, "uuid": "581967b0-bb42-4223-a3c1-4cc348538fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775740762, "uuid": "f0fa3ec7-4b63-4194-ae4e-102fe35a3ecb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbad44f9-3468-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775776039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776039, "uuid": "9fd08f08-652d-4208-895a-32d621466de4", "comment": "Malware payload", "value": "0cd49be5262786aa166eb9d56d165a68", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776039, "uuid": "80a405d0-268a-4f1c-8fff-34896c0f7006", "comment": "Malware payload", "value": "bca0c699265451aa6a0eba3e1b6b2cb4f8c3c28bb45fda905536d19b8d047b94", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776039, "uuid": "a6fd8afe-69e4-463f-a4cd-36fd186cf41f", "comment": "Malware payload", "value": "edeac0bb37507e758dd21f10f59a66986f6032df", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775776039, "uuid": "3bb42e8f-fd44-477a-ab5c-c66ec9c5c04f", "comment": "Malware payload", "value": "3bd3ee5e9ae27d73f9430b335fe983529c8476e3d448be06efc8f295eb35c8a9fd18782020b3aa36d94e6375de9d68ba", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776039, "uuid": "5f728259-59b4-4cbb-ab2e-4ebe25fd7c1a", "value": "T12ED3C18C49DE84B4472F2468561F6C02CA9EE223072DC990BBDD9F587F325E079BA7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776039, "uuid": "2a8d0493-1ab2-4781-a9f6-99ad0cdfca25", "value": "3072:EbbbSD14Jq4JG4JF4Jva9npnEmNEo6qezpN6BYZMLgs39:EbbbG4Jq4JG4JF4JvINEo6qezpN6BYZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775776039, "uuid": "bceb0a79-67d1-4755-b156-5e79ddc7ce06", "value": 139811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775776039, "uuid": "d23a92c2-df0e-43ff-bd6a-2fd5af1e3356", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775776039, "uuid": "a586110a-8566-41e2-a16c-b65034d676af", "value": "Document_Draft_v6.9.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b61019-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775721917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721917, "uuid": "fb406a4d-b0c0-4ab9-bd82-8ced760fcec8", "comment": "Malware payload (AsyncRAT)", "value": "d267c6c581b8a5cd14ca60460b779819", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721917, "uuid": "5b3b5bf9-4704-460e-8543-a1b32918e234", "comment": "Malware payload (AsyncRAT)", "value": "bda2b0b9985a34ff7589bec1b5f4eabf3c4e452ba479111663dc96253468b115", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721917, "uuid": "7326ffda-731f-43e4-a471-89d58164a6ee", "comment": "Malware payload (AsyncRAT)", "value": "204f47502e8dfa08fba54642db743636c25e763e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721917, "uuid": "6436b721-7267-4457-a6f0-d25c6c6567a8", "comment": "Malware payload (AsyncRAT)", "value": "d4ad205bffdf05fffd20c7e2ea83ad06765b2ac69ed3a4a08277576e29941d729e470fbb902f8110d3fcfa59702e36e8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721917, "uuid": "ff3fe393-f295-4444-a0b0-6f0cb6cf896c", "value": "T1D6236C4037D8C136E2FD4BB4A9F2A2458679D6276903CB596CC814EA2B13FC597036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721917, "uuid": "46ccb7c0-dfb2-409b-965d-d28b360c9b64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721917, "uuid": "a1f58041-ccf9-4642-a10c-3f19287aa64a", "value": "768:xGq+s3pUtDILNCCa+DixCrC48Ao/Piz8YbQige/VPvEgK/JLZVc6KN:8q+AGtQOxC23Alzb+ynkJLZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721917, "uuid": "d5cd66d7-ab66-4c56-aaa3-c5b3d18c1ef2", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721917, "uuid": "293c52e2-ce1a-413a-a662-c732c48f9c3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721917, "uuid": "c4f9552f-1dce-4aad-9d74-6e8b170fe8c8", "value": "bda2b0b9985a34ff7589bec1b5f4eabf3c4e452ba479111663dc96253468b115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650d9b23-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775716999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716999, "uuid": "eb057230-3095-4f70-a91c-212b308a5faa", "comment": "Malware payload (Mirai)", "value": "9f9a97315c623799a0b5c78ab2b027b2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716999, "uuid": "ba0798a1-8536-4629-9a1f-c6a3abffacba", "comment": "Malware payload (Mirai)", "value": "be15f696ad77d3856e221b4f235a5896286177e2a2c3a244cb3b9385c2019c15", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716999, "uuid": "6208bb56-2b36-47d6-aff4-de240a8a7e7b", "comment": "Malware payload (Mirai)", "value": "c96a246917fd6a6ce73be8b3a512feaf00ea5864", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716999, "uuid": "aa93a56d-71a5-4ea3-9d6f-53a30bb7c538", "comment": "Malware payload (Mirai)", "value": "5d6b1bcb37ddfff1936c44bec673efc6637da96b5cf786c503503cdf92e578d5d1c1cd11c97d200a2799e6a9202d5a24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716999, "uuid": "5f5aa0ba-4010-43ff-ba13-53df0a7fecda", "value": "T185B2D139D9D59DB0C170C4B1EA35CA9026F783B4C2EE3BA1760186B861C254A6FFC4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716999, "uuid": "24b7a28b-a179-4b7e-b86b-63989889ff5d", "value": "384:tVUAgwrUshIYowFf/IHqkWQIouYHG0MW3nQFud8iN8A4kGEotTQKhymdGUop5hu9:zYwpAHq/QhuIG0MAYud8OGpFRs3UozM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716999, "uuid": "d201a888-1720-4182-ba2c-8f5ba5df7ea9", "value": 25128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716999, "uuid": "e9d8ba91-748f-460e-89f8-ec75c4057f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716999, "uuid": "70c1199f-47b3-480b-9302-502594ac8539", "value": "Hammz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed6d47b-344b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775763320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763320, "uuid": "66b0d5bb-add7-487d-bab3-0af55070642d", "comment": "Malware payload", "value": "30bdca301fdf9e0b0a78e84bd3a2c944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763320, "uuid": "634f0e37-4815-4211-8e93-1f67d0d82599", "comment": "Malware payload", "value": "be2e57c39e69b814bf68df033d2421ecfa44f336b3f5e54daf444567fb1e5328", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763320, "uuid": "dc310abf-2138-407c-9df8-395759426736", "comment": "Malware payload", "value": "ee7d4b4bd1b736926f71c6e930ab1b80a7a5aa00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763320, "uuid": "96f68ae7-ac54-402a-8a7b-98dd07bc4737", "comment": "Malware payload", "value": "61908577cf2da88c2c4d117517b6d6da9ee2e4660033837f101558fb8f1c10c3b8d91d02ac21375f04cb4d8646bc6f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763320, "uuid": "081e321c-6341-4d61-a4ad-bafa8ff045ad", "value": "T16557CF5E73C4E69AD416DA399B109722C0B3BBE34F76DCCB4552274A1E7BAC24F36600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763320, "uuid": "bfffa295-77ca-4ee8-abbe-72bda9a0621a", "value": "c572dfbecd114f10c97e5019e1b50fa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763320, "uuid": "6a07dfb7-31c8-45aa-8d0d-418d982053da", "value": "98304:QGXsJw0s9BPm3YSQML67/acYX3+BbWZscWx53Fj:QMsCl7Kn8KOc2nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775763320, "uuid": "71bd8409-6448-4b0b-a664-98392c48beff", "value": 29389312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775763320, "uuid": "a621f89b-8827-45cb-ae96-41b243ca024d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763320, "uuid": "8e7aeda1-67a5-4643-a7af-2dbf51e5a561", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28588567-340c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775736224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736224, "uuid": "2e9df747-0da9-4fa1-abb1-cde9a959d653", "comment": "Malware payload", "value": "7326ee44e7b8b0ca54e16cd82e8cc33d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736224, "uuid": "08098380-148e-4a95-8483-2964826d0e8c", "comment": "Malware payload", "value": "be48389194cbdcb570e64c00b9960a8deef0282ba3def0524d87980f1e43f690", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736224, "uuid": "aaab8d73-c72e-44a6-9ba6-8d3a767f61c5", "comment": "Malware payload", "value": "8c651613f4950f468af565b496167970fef76c8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736224, "uuid": "373dba5f-5a8f-4f7e-8a1f-a7f7f6be69a6", "comment": "Malware payload", "value": "ac58c3153daef058908bef9c9382fd2e647d352c60342e9ff60953fef8dfa1b27906d771fc2ee70671e0d2c1af19599c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736224, "uuid": "22858145-1d38-483a-8821-8d10c1c33207", "value": "T176E02BDC33A038266FE841A364755508C405F0BBCE9551E8E5BE97178D8DB18BE37E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736224, "uuid": "c2411751-0f96-4c5f-9ca5-c2374a04a062", "value": "6:nHdQCLW6dSaa1tUUHcpUXdQRWgb2966uujW0sA+fW6doOa7KFGmaK:nHdVLJsB18c5A6QujW0s5fJdoOa2Ffb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736224, "uuid": "1790bdc7-5e5e-43a9-b8a3-74e786321e1e", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736224, "uuid": "bdaa5f11-2fc0-4279-a49f-f55dbf236295", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736224, "uuid": "8089e763-57d0-467b-9c1a-0a73ebb433a0", "value": "n.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3285878f-33dd-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775716055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716055, "uuid": "0ea23d49-a80f-42e8-ba71-8eb158bff66f", "comment": "Malware payload (QuasarRAT)", "value": "4a179a29e1a8313eeeb35aa1ec4812fb", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716055, "uuid": "4ba90a46-e5fb-4c27-a8d4-e2afbfab7de6", "comment": "Malware payload (QuasarRAT)", "value": "bec11fac7d2d7ab89aa30d81f2011c0de29647dde7098dc9aca72129bebb9896", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716055, "uuid": "553eb799-25e5-4000-9695-5baa862dc965", "comment": "Malware payload (QuasarRAT)", "value": "4aafe940d5a606256e5ed8d899415c69c22e3a7d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716055, "uuid": "f7619e58-9c02-4394-9416-534b0465849a", "comment": "Malware payload (QuasarRAT)", "value": "6377144c3828d2b9f8cfbba92b2e82c0cfcc7778e0432fdd9684c0c428d358d34c488c0ccdce8041d5215d4e2c958da0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716055, "uuid": "b00275d7-52cc-41a2-9c0c-a1da7798d7c1", "value": "T15352782C09BDFA5893D9E307E699F7276D465CAFC2B975172AF28C6CA0024C045EB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716055, "uuid": "27dd3e4f-7316-43b1-9e6f-31bf228c316a", "value": "384:PzPQvnTWGFkSa3UjFvNW4lN3bI5P+ZwbzzaTiWWvQA6c1zx/KFSWsu9d3zyQBzix:PzIe7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716055, "uuid": "0823fa91-2808-419d-9e2d-c7c39f43fc39", "value": 13890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716055, "uuid": "d0d86d69-9c20-4494-b23d-fa63d536566a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716055, "uuid": "7dc62015-ab83-4a09-842b-7486d9539831", "value": "DetectionRateTesting.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f493a5-33e3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775718748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718748, "uuid": "59b7e931-c6cf-47ec-b118-2ab4e6e12b56", "comment": "Malware payload (PhantomStealer)", "value": "655455642271a3e6c1fb9419a5d2b2da", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718748, "uuid": "1a4d62ec-602a-434c-8fb7-18766604d872", "comment": "Malware payload (PhantomStealer)", "value": "c004d5a9ea82ed2ee97a77101674a1daf798b65e21c0fd33d6bc1ec703f7eda9", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718748, "uuid": "b002c712-4f66-4d1f-8228-296b0badfac7", "comment": "Malware payload (PhantomStealer)", "value": "daa426558ac8276be1c09d3c4503e790a92abda2", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718748, "uuid": "7e649b6c-57da-4648-ae30-676d8979e340", "comment": "Malware payload (PhantomStealer)", "value": "2831da9d92570d9025a9b2c0919f12c4b81e91decb208c4be6167a2eed6ea734f11cf6853c687d31e1a883f1621862b6", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718748, "uuid": "cba68d81-dbcd-4a11-86ea-1c0fd4d8b3e8", "value": "T10382A61BCE09DFF00A793151B66B6816A9500326B838794D7D4FC1AD3F3AA10CBE55EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718748, "uuid": "38a44b42-56ba-4fbd-9201-5298e2483f0d", "value": "384:K0L/laINq7uw+u2rWn9ShwRctznmkEWezdK1LIIWwMrc:KolDxIoAe14dgjWwMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718748, "uuid": "6ce22160-a1d3-40a2-ab92-52a1953bc23e", "value": 17672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718748, "uuid": "54a4b1f9-4f57-4202-82d5-428863e9dbf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718748, "uuid": "b413647c-deda-4d90-bde2-9423de14dca6", "value": "Purchase order PO-000806758_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9fc70e-33f6-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1775727029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727029, "uuid": "dc65a4a6-eb49-4807-8bf8-ca56f4a1c758", "comment": "Malware payload (NetSupport)", "value": "e916b8ec6c2663b0f7e1ef71998c3b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727029, "uuid": "39a095f3-38e9-4d95-9d62-316565c0193d", "comment": "Malware payload (NetSupport)", "value": "c131d9943741563152262d0ce82d6ef411431c6f4f28ca168d08eafea73f2a1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727029, "uuid": "b97155aa-baa4-4cad-8ee4-f0581204b6b7", "comment": "Malware payload (NetSupport)", "value": "4b30b6276eb19184e4764effd895a4add85cf26c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775727029, "uuid": "42a9740f-07ff-4e48-9aa5-13f42c70b03a", "comment": "Malware payload (NetSupport)", "value": "7dea2e32dd10df40dd5b41533ae848e0f164512f31bf378ccb1d8ce7eafa580d30b66d4f56d524a1c103ed499ed9fa54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727029, "uuid": "0c32598b-8dc1-4574-acc2-bdc326fe0182", "value": "T1F3F56C0BEDB94CA9D0A5B1348433A6567E6478445B3273E72BE0B3682F737F09879B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727029, "uuid": "142114ff-9a28-41b2-b763-5d9aabd10f65", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727029, "uuid": "abae04f3-951f-45e9-83cb-6c29dd3f7807", "value": "49152:tgska7aAnVwHUALz2I5nirXF3mM9BmAjcQc18a/x:tgIeiXoMTVpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775727029, "uuid": "4be83c5a-87b2-4f43-8e93-241675b1e79c", "value": 3574776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775727029, "uuid": "7e9cb066-09cf-4c5d-8706-05ecc11c886b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775727029, "uuid": "2e5e2e8f-618c-42de-a664-e9d8f52bf309", "value": "SecuriteInfo.com.Win64.MalwareX-gen.17841527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaa1472-33d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775713794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713794, "uuid": "7c30efe7-cb18-4086-97fc-160093988a38", "comment": "Malware payload", "value": "1dbffdeb2bd817f2ce154eb64e78b7da", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713794, "uuid": "a18a1502-35b8-4cde-890a-3c07e04f9b22", "comment": "Malware payload", "value": "c1733e867b91d2f1a95abbcfbb9fbb843ef81e3b6af7fbeafb6d9120ad04cb3a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713794, "uuid": "dbe9a512-344c-4afe-8010-56385bc7a4ae", "comment": "Malware payload", "value": "efa8bded7dad62ea644569e7c1ec6f1cd9ef2fb9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713794, "uuid": "e26c5e52-9d51-4483-b8fa-55d3d38a1d74", "comment": "Malware payload", "value": "25f94ae7733da35976de4ec3b84ab893ddc37490b364e3a4056757f082c5811308e9b44902549757766d6eb8c9604a0e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713794, "uuid": "5a5dca06-ddfe-445a-9dcd-2f47f0385909", "value": "T162421B25BAA9C135D55E2F708C9AF3469534BCE5CE8B411F3A91B33E74303C0A61826F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713794, "uuid": "a6059015-6268-4df0-ad4d-3a28d00b4e5a", "value": "96:UOQ+KuDfwv8CBodfeZwLDaQUdhcSnqXJwKpyJ8QaXFSmCV414G4m//rG4C8jc4C4:Q+pISGZmaQ25VaXFSzV414G4iAP4D+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713794, "uuid": "7a8aa8c5-04ca-495a-bd06-fd80429a9474", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713794, "uuid": "92619c44-cb00-48d8-9c69-1642b511eb6c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713794, "uuid": "7b616085-2485-4b93-8801-6fe757c28f84", "value": "PO#73926890 Wolter Asia Export.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5e8bd4-3410-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775738108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738108, "uuid": "40682d45-31c2-4383-9d78-8dc21b1456d3", "comment": "Malware payload", "value": "34417b87c966222f2cc0c49e4ec6b0a2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738108, "uuid": "c6a509e4-43d0-4521-bade-3a186e82da61", "comment": "Malware payload", "value": "c244d4ea9a0fbd206173ea4f6216f0790463c6c8a7cf9b42f8b931bb85a3690d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738108, "uuid": "e3fa9f4f-26ab-4981-8362-4b39e22e2cd9", "comment": "Malware payload", "value": "1d8e94940abd4e31ebc4874f7d0fd381700f07be", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775738108, "uuid": "1031bea6-1ff6-44b9-9129-dbb59143f19b", "comment": "Malware payload", "value": "83c7e19d2a2e5f44526c2286efeaa62c81393bba8ff975a911ca06c8aafed32aa82621d26c917e75789c10156d5ec708", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738108, "uuid": "4a14db7f-2ccc-4db3-aac4-e0ad86d028f1", "value": "T1D25147007BFA5755F7B3AB3479B95570A9BFBC83A561C64C0164410A1932F04A928F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738108, "uuid": "5371e612-050f-4909-acaa-ebd4efae2a52", "value": "48:8MQnj+XjDtdQj0sXAdQjC7NVcL27f5cL2H:8MMmvwj0sX1jC0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775738108, "uuid": "19e569f9-cc47-45ab-81e0-5aea779e285d", "value": 2757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775738108, "uuid": "0268ce8e-7dc5-461d-ab43-005c231e7aec", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775738108, "uuid": "a934961e-6670-46c5-aa37-130aefda78d5", "value": "Ubersicht_moglicher_Rechnungsabweichungen_2025-2026.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d93cffc-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736313, "uuid": "2386bb70-b56c-4493-8a71-dfdf973222f6", "comment": "Malware payload (Mirai)", "value": "6a6285b9242f1bcb69ff0112fd60ff2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736313, "uuid": "02312156-7d9d-4818-bfa5-c6b70bf817fc", "comment": "Malware payload (Mirai)", "value": "c3499a3a7d2a9d8d43556848d2ac6113f0297ed6e5d11a27ea5374d95d66337f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736313, "uuid": "e7a5dfe2-dd73-41f7-ae5d-969f7ac7a56e", "comment": "Malware payload (Mirai)", "value": "2c768a87a04796f89a50c0e411dc1ffc09d2e49e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736313, "uuid": "94032812-576b-4929-885a-fb159060ddc2", "comment": "Malware payload (Mirai)", "value": "cad9e893dc7f661e4b7304d801ddac8f6d83707760c2683aa1f3043afb8b00b97fa59e6c7f3e6a3c7a6da9b5bec703a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736313, "uuid": "3a745d5d-5c2c-4015-9d02-c9a0e5d5f4ba", "value": "T179E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736313, "uuid": "76ad4fe1-3638-4bd3-852c-48b8f7fd41bb", "value": "3072:CotWnBLigk1Tc3ECC0DvZe1k6aU6zL6EiueCo2kD:VWnligqTcUCCqeS6axIueckD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736313, "uuid": "67e2fc84-b917-4e5f-82ee-8c1bf41565a6", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736313, "uuid": "0a9e8d3b-5299-485e-9dd7-193df7de45f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736313, "uuid": "29f93fdf-f512-42c7-bdd8-38206f0c51a0", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c25ad5-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736320, "uuid": "aa2f2af1-a5dc-48ba-ad57-f2f189fc35f7", "comment": "Malware payload (Mirai)", "value": "286d210bd53f810c32bbc0bf4d87ce18", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736320, "uuid": "b9686601-6d0c-4490-bb1c-ef8e9d47d827", "comment": "Malware payload (Mirai)", "value": "c42e74392b723b4bf65e0d50e862988591eea696038f8fb890f5fa99cb1c49d6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736320, "uuid": "eddd28a5-908c-4086-86b1-7168b214ba88", "comment": "Malware payload (Mirai)", "value": "86ef046752d1d92394b2336bc9b44fa6bc2af23d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736320, "uuid": "ef321f05-b772-4367-96b2-a362b970d548", "comment": "Malware payload (Mirai)", "value": "1c310e98c47b62ac0748f99fb6cd53ea3881d1985eee38f3c746b5fdb1d4dbe8756e2bc9f9d2501b3d151395c66abd91", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736320, "uuid": "2e362f43-d1b4-41e4-98b7-4dfca0898fcf", "value": "T160C3AE73D42A7EC4D1514030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736320, "uuid": "40288ae3-042c-49dd-825f-67719ceafb62", "value": "3072:hfpZykqkt436I+9eIHEmNOkSMPXeC4GnHl:hRZ0F3BcfNOkvZhnHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736320, "uuid": "d17a79b9-f1cc-470c-9f18-950c383e6c98", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736320, "uuid": "f5350331-32e3-4e14-a96a-33aff49d48b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736320, "uuid": "97bbd23d-e845-49ba-9073-b085e85d321b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4e579f-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717093, "uuid": "d3debae8-b6f0-42d0-bf89-9f7a0be5190e", "comment": "Malware payload (Mirai)", "value": "512a598ea2b58734a6d8c40b6c555c21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717093, "uuid": "071b62bf-6093-46ed-a372-5cfdf6c5ea1f", "comment": "Malware payload (Mirai)", "value": "c470e45210b3add604ea2106c5102ad905167b92a68a01215d6681f6381b1f45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717093, "uuid": "0d2bd30d-d59b-4f54-804e-9f150a861c9c", "comment": "Malware payload (Mirai)", "value": "80059c4318c37157ab25ed0c161d383b38bec832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717093, "uuid": "7b6a581a-0fef-436a-a9f7-8615b720d182", "comment": "Malware payload (Mirai)", "value": "4b9c04561404546dd8b9e6bda3b6bcce042489f72ef060cd37d451beb5f4fbbcb7ab3a887bbe2e249b23d70952f25052", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717093, "uuid": "5132b437-9f48-41d4-9ff8-0be2e8ba643f", "value": "T1E8044C46EB814A13C4D62779B69F524633239B64D3EB33069918BFB43F827DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717093, "uuid": "b41fe4e0-3b88-48a9-b227-091fe597c7b5", "value": "3072:lBPR0atTo8saehF/h9XRpgBcAwjCK9RUdaPyoWAM/9ukDm1M:lBGCPsaehF/h9hpwp6CcR0aPyodM/9uQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717093, "uuid": "c3d8b43a-77c4-45e3-bb99-8c45b7926b71", "value": 176523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717093, "uuid": "ace2cd1c-d9b8-4029-a27b-d0a6c2e9a792", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717093, "uuid": "85e5d8fc-54c8-44b9-86c0-43b9140d8d95", "value": "Hammz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29ba478-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775719303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719303, "uuid": "41cdffe3-0c59-48c8-baad-b6d58ceedb56", "comment": "Malware payload", "value": "98ba6f8a20b6ec3fb30812f8485d9cbb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719303, "uuid": "100d9a39-63cb-4907-85e0-214491599472", "comment": "Malware payload", "value": "c4dbb62761b5da9d4f37e2dd25cbf1b9a2e6f18c8eea5f98dbd8e78cb6c28a27", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719303, "uuid": "4568a5d2-02d7-47c5-b4ab-137e68f6047c", "comment": "Malware payload", "value": "9bbef39baf60d03caea4705159e7906299b50e4e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719303, "uuid": "3273c4b7-efae-4b34-847a-356714006a8f", "comment": "Malware payload", "value": "7b84c943db199822e21a65d43ffb56d4ba49155d47a0bb4e218c37c9c16eae59f258df2c9b1925684a75693bd8eaf456", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719303, "uuid": "34d2a820-186b-4df3-a739-29c034d77e99", "value": "T11E64E014FAEC0019F0B65E624679AD61187BFF690E1EC0EE10380E6C0679E59D8B6F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719303, "uuid": "96bea607-c845-4b3a-beae-39e8b0ec0125", "value": "6144:0w+pUwbO0uau1UgCVqwAjuaSEJ1y8EncBVHZX3NRI6gItKORF4gpy:0w+7b6lZCESaSEJVEQVB3NO6gQb4g4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719303, "uuid": "b27a5da4-e3b0-483c-a902-91ea673b2808", "value": 326432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719303, "uuid": "267dda53-40c9-419f-8e00-c36e0c37588d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719303, "uuid": "9ad6ee38-be0d-4d5e-b611-ebb8a744d2f6", "value": "PO 5180241900.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de42320a-33e1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775718061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718061, "uuid": "21c07c2a-d125-4fcd-a740-126afd1e9e8c", "comment": "Malware payload (AgentTesla)", "value": "17aa0c371f64d88f6363bf4a3c15d3b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718061, "uuid": "62bddede-d8ae-4c80-b34e-739937ba995b", "comment": "Malware payload (AgentTesla)", "value": "c580c9599b54360d5a56c5ce574de2cdb2d3118122a2341539d33f84f2658f3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718061, "uuid": "f4464627-dff0-4857-9518-b62e24eda3a7", "comment": "Malware payload (AgentTesla)", "value": "318e7a32402b1bfb60c579f2284ec93911a9a0cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718061, "uuid": "b38478e9-a6de-4cad-9754-145acb678613", "comment": "Malware payload (AgentTesla)", "value": "80ed50e6c10e2c51b5d9ecde47a6f7d1e02b820d6578fd99f468316cdc94d561f7acb0d63e8b1f342fdd7972d2cf1cd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718061, "uuid": "7a368728-8907-42dc-aa5a-249a13c5a096", "value": "T18DF33A60D920057A5F43679DFCA60761C6BDC218863769B0F6DB470D600A5ECF3BE2AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718061, "uuid": "657d997a-bde4-4323-a7b6-6deac7c60fe7", "value": "3072:yBAi80ak15IeYzyO/s76wMgy9S4BIPTAixumQH7hjTa6FSdTk:8/8LW5bSm6ajyBa6FSpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718061, "uuid": "d47afc11-f903-4a3e-97c5-933d5b5b13d4", "value": 159120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718061, "uuid": "c32505ed-3663-442c-834b-6079d8be8408", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718061, "uuid": "9c17ba23-a66a-4af7-a894-7a1c1d342faa", "value": "20260407-00325.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ff5c1b-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717022, "uuid": "0357687f-4186-4f29-83ff-1b7be799ea2a", "comment": "Malware payload (Mirai)", "value": "fa913e202ea95320f7f76d02b87300ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717022, "uuid": "4f4b15c9-149a-4ec3-a215-7caa39526b43", "comment": "Malware payload (Mirai)", "value": "c5eba746e9d00942b6ee7e712d630655e9dafcc9aafae16f6019dfc7bc3d8de4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717022, "uuid": "54c1c92b-e595-435f-b918-080ea722d819", "comment": "Malware payload (Mirai)", "value": "e3515ba9b4d8fef6891eda6744c06ab4d3049ee6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717022, "uuid": "b06f1b33-0984-440e-9c7a-91edec76b7bc", "comment": "Malware payload (Mirai)", "value": "7d68bf8404b42c97897d30d26d15f87455ba701a5dedf5b148c2ad1746819f06c52f3c435331f7b0d07e0ffb4485f387", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717022, "uuid": "87e4f2e5-05c3-4b12-825a-fe8e8e73abb8", "value": "T17013F13036AF7C34E874C570FB64C1A1265212F1E3FE30327614B6A9109694B67FEA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717022, "uuid": "8853f274-e272-4506-a4e0-fdd3188aa536", "value": "768:7t7bV6m0zw86qK9JGRgbUzrskZYIHZke+CkFWjq9yLE/9S2m2Jzs3UozV:7T30N6/JGNz38P/WqYElSIezV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717022, "uuid": "8bca679d-5540-4229-912e-50b9a8d8ce53", "value": 41628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717022, "uuid": "b50cb268-9371-496d-a866-1b57fb9bcfdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717022, "uuid": "c67b5288-a151-49a5-bb4a-7d31d9d9d99c", "value": "Hammz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dab9017-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735025, "uuid": "545a5b5c-7580-423c-a415-c0532ae2bb22", "comment": "Malware payload (GlassWorm)", "value": "1f62f75ea7a868032890b0ffbf38480c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735025, "uuid": "2e9c8ce2-d63b-4f9b-9b67-3c0b71e8cc86", "comment": "Malware payload (GlassWorm)", "value": "c7a8183afc77f89bb00f8b9a57bb3944cb42021a883c67a59b80236398682dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735025, "uuid": "9f8bd935-5f36-4e16-92cb-311d8ba30727", "comment": "Malware payload (GlassWorm)", "value": "23e4f6e59dd4d8d4a5e5e96a52501aa189fc4972", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735025, "uuid": "d9e339f4-8214-408e-814b-ccc3f874df13", "comment": "Malware payload (GlassWorm)", "value": "25e5f5f177834ffceaa31a0c53cc01f30b0e39f47d6129dd714a4e644fe796a2d0d3c1bbdd858dfd7758b1a2955f66e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735025, "uuid": "fb260915-9dbe-4987-b514-8a9a83d866d5", "value": "T190756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735025, "uuid": "c20855a6-1322-4254-93ad-2a84dda3373c", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735025, "uuid": "c83ed36d-14ba-4c94-b09d-2f833df18488", "value": "24576:Lds9Esxlce6k91UOld2LMxmeDozCMZyFFgIEymOCUwPPuAP:LdaEglcAHNaYczYoyL2PPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735025, "uuid": "93bd641c-fad7-425f-bb0e-e2742355a16b", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735025, "uuid": "501e2f0a-cccc-4b82-9939-31bb3153429c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735025, "uuid": "020ddb7c-3ace-4aba-87ed-41255acb85d6", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077189ee-33db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775715124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715124, "uuid": "6a09e986-fc88-46dd-b1a5-4eb75ec923cd", "comment": "Malware payload", "value": "920a6c709b9fd95a683001c074c43244", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715124, "uuid": "008537ad-0bdf-4a24-a6ce-fa7566fa7f03", "comment": "Malware payload", "value": "c7ad6a8bcdc34f8b661071777f458e95267ff00b3e9c1749526454f1c8f929a9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715124, "uuid": "ecbde857-3dd4-4c8f-a6d2-961489ecc9dd", "comment": "Malware payload", "value": "db9bfb6f3664993faabb9f106304850e43f1aded", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715124, "uuid": "a03c75f4-1d04-410f-aac6-9c2e6fbe2473", "comment": "Malware payload", "value": "c5059d58ac9fd994b3d214c9ea3e66aae45c7fce788269aba0cf27cf4e90c7bc9806491381c9db9b7f074b81d5be8fce", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715124, "uuid": "ded4cf08-a62d-4be4-b4f6-4752d9d7ade3", "value": "T14531CD249BB10329E6F78B3998BF621295217A06EF1D8F5F02C4529494B4110F86AF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715124, "uuid": "da4ec237-a283-4b82-948b-bf408bd1250c", "value": "48:8nmeKpUQ8BUah6MmY0yI4wufUIA6q6Cax:8nOCLBDld0yI4wufUl6q6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715124, "uuid": "65c7742d-58af-4ec5-a205-5663a5880a7f", "value": 1847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715124, "uuid": "901defad-7c62-4cef-bc14-2d109dc17ede", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715124, "uuid": "b54e63f0-d0ea-4b1c-9b95-07bdc7cd3088", "value": "IMG-121097502.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf979268-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775719298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719298, "uuid": "c97e8749-7646-4143-87cc-46b21cd1c7d7", "comment": "Malware payload (Formbook)", "value": "9fbbc4037081be27cdffcd3961c6b680", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719298, "uuid": "415dd07c-94b1-4338-abed-67e88bae1881", "comment": "Malware payload (Formbook)", "value": "c7f7dd3b0a3b0f395b1b0aa592a0d21cfce8b2777f9e6ba1323c920d5fa9db1f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719298, "uuid": "b7aa733f-795c-45ed-89f0-f283e733edc7", "comment": "Malware payload (Formbook)", "value": "9db9efc9fd904a1ee36720ecd34fa438fd8ae6de", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719298, "uuid": "b17024e6-3f92-467c-b099-3f004d451c57", "comment": "Malware payload (Formbook)", "value": "71bddf8fff779a0ed885aa01abc81d48da5391092c0547eaec6e5e5fd4f08daa68ea3fc2bdeb4b710acc3d20ee78080a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719298, "uuid": "9f9649ba-81a8-42c8-a168-f6c9dfe75748", "value": "T1F795F21549C43FB9CFA86A1950FE160FA3B04D8A1016B589FB73FE4BBFBB6405127198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719298, "uuid": "3fe8094b-194a-4c59-afeb-184c44ed3bfe", "value": "24576:8loZFiBgGPKEDJcbq7R7a4DaLdyCfoo2zAsJ3uvQ0Z0S/YlFsuJWpmr+KpWNuyab:3zCP3iG7Ja4jAfsurZbSDcjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719298, "uuid": "7e0e3bd2-14b9-436d-b615-d3fedc8e1e2e", "value": 1973811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719298, "uuid": "1559a765-1f7d-4df3-b657-45e81b9e891f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719298, "uuid": "7c5e06eb-dbbc-4218-aeef-5a1cada81b74", "value": "PO-05870-MQ-05868-QTN-1000-04-2026-PR08586.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6947bab-3408-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1775734825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734825, "uuid": "fcd8909f-0a8d-4138-9cf0-e835463160d0", "comment": "Malware payload (DCRat)", "value": "ed7b96f2dde94fee17fe6b5126916db6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734825, "uuid": "be13331f-12eb-4b5f-9776-20ec1c4dbb00", "comment": "Malware payload (DCRat)", "value": "cad68c2887219467ab61d258b2fcfffee834c6d62512714e232cf3f810cf6cde", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734825, "uuid": "230faff1-aaeb-483e-bf38-4fdc4b843c10", "comment": "Malware payload (DCRat)", "value": "54d1eae255794e28b11105800eb8d0a4c2796ac3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734825, "uuid": "870452cb-f494-4a3d-8ca7-455e8d912d97", "comment": "Malware payload (DCRat)", "value": "a39211aca0b0bbcee7c442e433fb0c49d885befe3a5a3de84a8a36f871e3a95b332d46496327af9b1bfc8dd513dc4529", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734825, "uuid": "f1d4e53c-f65e-44f1-a05e-c5b96c3194eb", "value": "T1DD455A017E44CE11F0191633C2FF458897B4AC102AA6E72B7EBA376D65123A37D1DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734825, "uuid": "05f21382-9baf-4b15-9b92-1acaf34ee8e3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734825, "uuid": "82af222b-3a84-4018-94a4-04263c2ffb87", "value": "24576:u2G/nvxW3WieCCfry4poScl0sk0d8fHBWoStMi9yJTHu2Kr:ubA3jCfry4O02BMRTHnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775734825, "uuid": "1dbde192-b285-42f1-9623-cbd37d0a70ae", "value": 1241869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775734825, "uuid": "c6ced174-157b-46d7-85a3-367753ef61af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734825, "uuid": "99c2dbae-dfc4-4708-ae4a-8d3b3075fe08", "value": "inject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025ac00c-344a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775762789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762789, "uuid": "17915bc8-59bc-48f0-a542-06fe64ec287d", "comment": "Malware payload", "value": "5f1ef25512a604f9a3c8f9ec62f6dcee", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762789, "uuid": "a7e0ff1b-10bb-4ca5-881b-37bb85c9f2eb", "comment": "Malware payload", "value": "cb37af113b439fbe50274e0215c42e8098a971697dd4f9fe1fa38fe084cbe0d2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762789, "uuid": "3da319ed-dd30-45e3-8b8d-a33a1910ad61", "comment": "Malware payload", "value": "674e8a448bfd2e0790a4dd1e552fad51fce5ac63", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775762789, "uuid": "df9423fe-4f3b-4b5a-bf74-25a0b1bef33f", "comment": "Malware payload", "value": "5048da3ba52167b1b3c9543068402ac2347b452d8b3e2f1b1079211414caa3112583e639051423fe7a864a85a3d0f464", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762789, "uuid": "0a5c486a-e35c-4401-aa9a-58db4fea5ed0", "value": "T121122A1E7E868072D2D009F056B64B8E9A7C056327C2A0FBF733C5890FA8344E4427AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762789, "uuid": "9bf03fcc-9ed3-46c0-97d9-a6da0319b3f9", "value": "061dcb52602df02b8a4859c27c281f82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762789, "uuid": "bc96428a-c744-43bf-80fc-39cdd9dfd097", "value": "192:JGTgBQP5eBZceZ+OYRqPFJxTEKmFhP+7:JGTg8Pe47RqPFwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775762789, "uuid": "830dad41-c39f-4edc-8bef-23bdf71da5fb", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775762789, "uuid": "c50c3a13-a3e8-4bf0-8654-175b1c913259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775762789, "uuid": "26a2e7bd-d875-4821-95ed-f7929b119b45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f590fd-33e9-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775721475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721475, "uuid": "8c9a8ec6-7d83-4d1f-b436-90527d5f4c1e", "comment": "Malware payload (AgentTesla)", "value": "acbca5f26680b0617ec6a68e9c00ea32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721475, "uuid": "6b77fcf9-d6d4-459c-b6fc-b14f9523204c", "comment": "Malware payload (AgentTesla)", "value": "cb8d00a44cfd8bc63b35d48ef9671d28d20410d6d3b99c92b9f34855c71e095e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721475, "uuid": "bb9c198e-8ee4-4795-81da-082cf0d7fc90", "comment": "Malware payload (AgentTesla)", "value": "3ff23687484648305337b85088547f2482387fc9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721475, "uuid": "db6c65c2-23d7-49fe-9525-c96839fb4347", "comment": "Malware payload (AgentTesla)", "value": "be5dfcba47c3b40a60198b56b9e0e68926d5b1aa45cc03c74009d1e92a4a7aa436c30d2826745f4b88989b4b0fcd91db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721475, "uuid": "a3aa3baa-c58d-46fe-9b63-f24979846956", "value": "T12BC5A97073C1252F5593BA4099F7CD788AABBCED4461BF7A519001A0BE250BE868FC77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721475, "uuid": "fde1d5ec-5327-4c3a-8d53-3e00fbd6e19e", "value": "768:pzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzh:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721475, "uuid": "c12c19da-dcdb-42a9-af70-e8bb883a4518", "value": 2688959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721475, "uuid": "5fcdaf1f-3454-4c95-96ed-292742da0d42", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721475, "uuid": "8f675201-ddbc-452d-aed6-2b35806f25d5", "value": "N\u00f3mina de ABRIL de 2026-987587854.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765448f0-33b9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775700707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700707, "uuid": "fcae291c-b1f8-48fd-ab88-d27151b4b4b0", "comment": "Malware payload", "value": "1ac853f82c5e24dd24a476000531d88e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700707, "uuid": "9901ed24-eb70-4651-b376-a8fc587d952d", "comment": "Malware payload", "value": "cc82f453a128d9060c6579e69940df7e281f9df6d6d23458535c2622df94799f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700707, "uuid": "86d99f3c-a5c9-4320-81a1-6d4100728bc6", "comment": "Malware payload", "value": "49cf30b44a49b27ea0ca2817982252a2c566ac5a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700707, "uuid": "8cec2502-cfd3-49e1-804c-6532369e62ee", "comment": "Malware payload", "value": "c307ea082e8f0a497b32a7b3114966e8979a5ca29cfdee3143d54d6e8f8b8c9bbcec77949b20e260710738f2e3f44647", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700707, "uuid": "74646996-3726-4128-8205-173d84bf537c", "value": "T1B4435B253594C032DCA215300978D2A25A7F78326678858B7FE8677DAFF17C09B2937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700707, "uuid": "c679c802-23b3-41c0-bdce-280f162ca824", "value": "318cc6baf22de5640b5a89a3bd3b774c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700707, "uuid": "378e15cf-e8ae-4c7d-84c5-087d778664d2", "value": "768:0/EAAqxG0QqLccK+xL7scaOZ/IcGs8WbwnWh+6AXT2qEDnXbiPGEDUXnpT0rJmnU:tAc0QqgHW7/ZwcF8c6jELX+PupTNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775700707, "uuid": "ad5450c8-e094-44d0-9269-dbf871d4ab14", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775700707, "uuid": "3d78a21d-325d-485a-aaca-1b1ddb352bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700707, "uuid": "1dc6ba6b-8ea3-45cf-8766-f7f09a68a695", "value": "wildfire-test-pe-file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a20eac3-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775722537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722537, "uuid": "043cee90-8700-47d0-b72c-b7157f03443e", "comment": "Malware payload (Formbook)", "value": "584ad37d2073e89b8507cdece1526ffa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722537, "uuid": "5342a7c9-ce23-459c-889e-4085e8a9cee3", "comment": "Malware payload (Formbook)", "value": "cc91735a3d21f09f0a9fd6f89e448c1c043a49107a062b518a36540964476174", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722537, "uuid": "6d636fb3-5ee7-4c86-83bb-cf6c2be7feb8", "comment": "Malware payload (Formbook)", "value": "c453f6487a2b0ce41793098bd06ec66be5fb6ed2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722537, "uuid": "0023da8f-8445-4b3e-b3da-8a1db1c6c1d8", "comment": "Malware payload (Formbook)", "value": "1421761042268aa017abd163cde89fb8b3ed9ab056fea29f086cc645fe03347854b62b34993a0161f9c0d1c0b0851a6f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722537, "uuid": "3d537b1d-ca84-4832-8bc2-04d56d175f5c", "value": "T13A122185AC69A09456F373764F1B0408F6EB455F560AC694F84CE1B09F75718C2DCEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722537, "uuid": "24a9e410-9eaf-4173-aef8-5899f8c1f86a", "value": "192:YoaPS8o0pPQmsbKD2gWztQFdzVfxgKNR83NV:Yoa68rjD2gWzcXgo83v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722537, "uuid": "4dbe0199-85e7-4cb1-a2c2-f98f1cfb65a8", "value": 9507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722537, "uuid": "2ee40ec9-75f4-46be-8e71-301b2f508471", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722537, "uuid": "8c34d792-0f7d-46f0-8b08-e68ffd9a2341", "value": "S&P 21556.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ca8362-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775722446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722446, "uuid": "bd7ca873-c6de-418c-a0f7-c9f8e8e8425b", "comment": "Malware payload", "value": "e8630147a07d7fa04330a6b2c618f02b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722446, "uuid": "6a893f02-e5b3-45f2-a0ca-ebbebb170d94", "comment": "Malware payload", "value": "cd65e39372824319e0c3697ff51857c2a79ed61df51d637a1983167c1827d84e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722446, "uuid": "9d3980a8-4318-412c-a8cf-6f1de10bb87b", "comment": "Malware payload", "value": "5c649dddd3fa6df50a5d08dd3b65b6ef4c7f9626", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722446, "uuid": "f5590cf5-4a76-488d-a3f1-2d4efcad47b2", "comment": "Malware payload", "value": "1ae05ad3811f7285edd9fda0a7aa5a7efcf0c4d3033de16806412f201fa45365bf611356111627827a7e635d475626f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722446, "uuid": "b3f310e7-da6c-4722-8b9b-cbddae1047a5", "value": "T14B84A13DFE69023E5276DA79C2679A00F8816856361EBC4A48D32D4BC423763F6E353D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722446, "uuid": "1f989b7c-58bd-46f0-98c4-3ce7124ff432", "value": "6144:zymYXXtyZeKKyzOwSzeiBK19HsMIcr9Bvmvb07esPGyaNEs:zpYtyZeKxxS+fHsMIidPGNes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722446, "uuid": "81cd6421-1444-44a9-8743-1d9ea10fa3b9", "value": 395360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722446, "uuid": "1e71509e-6877-4525-9c85-9f88cebba6a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722446, "uuid": "9947e3a5-638c-4741-8e07-c210a49126bb", "value": "ORDER#DOC310326-31032026100024.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895a26b0-3418-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775741541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741541, "uuid": "249402e2-c480-4362-aa62-9a461a0f2f50", "comment": "Malware payload (Mirai)", "value": "5bdad3e7b0f853891572aef20745ea86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741541, "uuid": "964a8aac-4537-425b-969d-80678dd5233d", "comment": "Malware payload (Mirai)", "value": "cde35cf595a184c2a2c9b61a08ea3c109816df81184536a5c472c9bd1773cbee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741541, "uuid": "f7e34c2d-f4ae-4cc5-ad20-14d618690bc8", "comment": "Malware payload (Mirai)", "value": "59028ca39a4545697ea033d74888e5d5647d0ec4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741541, "uuid": "94e67438-9916-4b58-86b8-38ed6df9c6f2", "comment": "Malware payload (Mirai)", "value": "ed67b9b3a48646a760258d8d16b271f6d259b501f29888d121b99163c4fab79cd968aa0bcc93744a5dfd407cc8d5e463", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741541, "uuid": "4318ea90-3365-41c0-a4a6-d77accbff387", "value": "T142054C06BF405FEBC4AFCE30496EC25711EDE98756C2662A71FC8B8CBA5D6190BC7448", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741541, "uuid": "05838e57-143f-428b-b725-5c454388deee", "value": "12288:XPBh+9JqkxZjCU2h8xHlyxQAuprFZGM4YZrqrDltF0ij7rCASDj4rSGr5rKZRGQO:JRrSi97PQOGky7zaJa1PW9KVcOjaL6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775741541, "uuid": "4409175d-166d-4f30-8d20-3ab7465ee297", "value": 826604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775741541, "uuid": "cc324e45-9e77-435f-be41-c9e4b2c94d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741541, "uuid": "01e7d678-3fff-4a32-988d-47623b15d119", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f708eb2-3433-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775752986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775752986, "uuid": "68ddb150-3cd9-4c08-b70d-f073c20db523", "comment": "Malware payload", "value": "867d892b4bc0b1986009ba07fc70b4cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775752986, "uuid": "3590ef52-bfb0-43ee-9353-272c9582a9fd", "comment": "Malware payload", "value": "ce06a5de9e128121f263fa1f274f78f115d52540798d13a6112c2db48422c636", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775752986, "uuid": "b411e92e-143a-415d-8ae5-f5b78fdd1ee0", "comment": "Malware payload", "value": "1816a038b1c6b5dc003627c37591d8cba58f2dfd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775752986, "uuid": "4d286ef0-8d11-4cd1-b0c1-59e562c13579", "comment": "Malware payload", "value": "44c0183f955d05688726724bd2851962886b1f3dca2ad9a7f799fba6e6535efb003c87bc3571c546e7417973e398a727", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775752986, "uuid": "e5c3d9b5-8c2e-40fe-b936-45c05855fc57", "value": "T14C53866E05A500F80B8E1DE747C1F15BAA8EF17435E5B14D670BACEB81784BDAB3885C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775752986, "uuid": "17bfb0b5-20fa-4801-9ae8-ac4a9a201954", "value": "384:RFTvPZuKGB7m/orRQ/TBMn5h88NyNCs5efcY7TMSW1cjshQLMTTJUgcExt94Bbtl:r2szGIax1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775752986, "uuid": "021ae27f-0048-4be2-8d30-b0213c07a91e", "value": 62768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775752986, "uuid": "db87f0f9-9380-4ff8-9e21-0c64197b54c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775752986, "uuid": "7a02ae85-e423-4775-bd84-1a2ef6a24ec6", "value": "Proforma Invoice 0098374848464847434.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14763865-33ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775723735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723735, "uuid": "bfab45c8-0921-41d5-a9a4-ce7938130390", "comment": "Malware payload", "value": "1d48e6bda413f7f73209bfab12101eb4", "object_relation": "md5", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723735, "uuid": "d259928d-e2ed-4d04-afd1-19b1d14cfce2", "comment": "Malware payload", "value": "d013a5239d4a00dcbdd2c1b99855841e084ebc1b8a33b9e44c09467462a08b8e", "object_relation": "sha256", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723735, "uuid": "da21b1c2-d7cb-472c-88a4-5637405cc9d3", "comment": "Malware payload", "value": "69395d029041f5f7f694ac0dc05a458c1cdaf564", "object_relation": "sha1", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775723735, "uuid": "e0261695-95b5-4cc3-81cb-b9379afa8981", "comment": "Malware payload", "value": "5d5c788069bf05693883229efca92419be5f7256b6e6086f6770ea92efab359c83de45fbfd9859aeece31e960334bc98", "object_relation": "sha3-384", "Tag": [ { "name": "amor11-duckdns-org", "colour": "#EEB49E", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723735, "uuid": "50b8163d-9486-4567-b52e-92c31158646d", "value": "T1325592AB5B36FE0E5616754B39A0FC8C8E87B2A3C4139C783108541373FDD9D12666AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723735, "uuid": "71c7b391-e864-4542-9afa-8e5c27b324fa", "value": "192:QqXc8RscAouzP+ouzP+ouzPIpt/id+GdBP7EcBID7uOiWARr38T:5s7cAD6D6DCtMVZU7ZJAr38T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775723735, "uuid": "980faedb-8178-4a2d-9973-638cbb51f397", "value": 1282929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775723735, "uuid": "42f63a8e-4115-479b-bbac-bc5c5ecc0422", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775723735, "uuid": "1b7333cf-7fb3-4683-8870-a00cf2f47ede", "value": "d013a5239d4a00dcbdd2c1b99855841e084ebc1b8a33b9e44c09467462a08b8e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aef6d06-33f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775725598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725598, "uuid": "98551560-9c71-4100-bb36-145be8a5e6bd", "comment": "Malware payload", "value": "a916870b1be4c1cf4e19cb9324a439b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725598, "uuid": "0c2f7cca-d495-4fef-83e6-974b89ae9873", "comment": "Malware payload", "value": "d1a1e6a2c0adc45a4cf40128e683499cd984d5803ad2e3a1ce26768a612eaec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725598, "uuid": "6b022050-0920-4fb7-a11a-3524f427480f", "comment": "Malware payload", "value": "dc00375f36a7968d4946bd7f685f197c617f2c9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725598, "uuid": "557bcb34-2dd3-409b-bb05-ec69ba11aa7c", "comment": "Malware payload", "value": "9c3c66c885d4dce066e9aeb8b64e7edc43f68f4bc805903f1653f6c72a420cb3b6ee04b8aa61fe9db6286175a753fc02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725598, "uuid": "18845240-8fdd-4a1d-8058-2d05d54775e8", "value": "T12DA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725598, "uuid": "4a35eabc-8f88-4c49-b90e-882bccc4f2a7", "value": "38c192218334865e56f906ff44fbc4b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725598, "uuid": "f2823af2-e0b0-4080-8214-55f56c9c005d", "value": "24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725598, "uuid": "427fba2e-dd7c-4da4-bb8c-82e1d0fa6963", "value": 2106368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725598, "uuid": "b34d3606-7471-4387-a610-4b673bab9cea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725598, "uuid": "bb0b3ef3-dfeb-463f-9953-beacfeb72503", "value": "123123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0c99fb-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735048, "uuid": "03823a98-4476-4bd2-bfe2-4a239d0879ef", "comment": "Malware payload (GlassWorm)", "value": "9ce4f992e277555a94df09b638e9a3c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735048, "uuid": "d18fe16f-a937-4b98-9416-994c19c66e82", "comment": "Malware payload (GlassWorm)", "value": "d1aefa4ea3a380c61f74a99b29e02b2ee2ba6d66c1b004fb38faeb647cc87e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735048, "uuid": "aff1ba3f-9f7c-4a3f-9378-e83982afce5b", "comment": "Malware payload (GlassWorm)", "value": "a53e12381f615575ad6c0fd3f54a8d1d735b6b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735048, "uuid": "532db0bf-238a-4e48-9d6e-28cf9e058b5a", "comment": "Malware payload (GlassWorm)", "value": "7d331a6bc93db2ee44efcb3d3ad6c95045d8f2fca13e4f8aed972856461b35f4b712133317def93c97afb75fe57f062f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "w.node", "colour": "#8117F6", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735048, "uuid": "fbe18192-754c-48db-ba78-cd2d9170fcbe", "value": "T1F725BF83D292915CF51AC1715B2EA273F537BC448B29AFE76390DA261633BD02B7A710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735048, "uuid": "33c5c7fa-a8ef-42ed-a8b6-7b4f8eb98b00", "value": "5119aa243ba31aa561ba123ac413a1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735048, "uuid": "6d2bf32e-1d95-4917-94ed-c380e9d60ca5", "value": "24576:M+pqP2ToOEe0JRh+w+WY5bsY5b5Y5bVh:MmTjEeiRhPYqY7Y/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735048, "uuid": "3d54bfb7-8368-4609-b5e6-42162bccc1aa", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735048, "uuid": "6867aeed-0831-4ec6-9813-9789317cb29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735048, "uuid": "9ff443e3-04cb-462b-8529-d4fdd11f7631", "value": "w.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be43f9ac-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775721873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721873, "uuid": "a16c5d05-353a-493f-b2e7-a2b4084ee23c", "comment": "Malware payload (AgentTesla)", "value": "eb50ac84913ca76acd84be55e2c2d464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721873, "uuid": "2de1f938-0e32-411e-8fce-927247e62d0e", "comment": "Malware payload (AgentTesla)", "value": "d2bc3ce27c2b61a4141ce3121815f2116ccb9a065c33fae4c5f11da29e93debd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721873, "uuid": "ba974ec8-a88e-4fbf-98cd-23ec2cb253a9", "comment": "Malware payload (AgentTesla)", "value": "5b8a8f0b8087b6c08b6e9517c2f0ba08d1373e16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721873, "uuid": "e44adf17-92bc-4c69-8dfb-9820e1b31fdc", "comment": "Malware payload (AgentTesla)", "value": "3ad87fdf60bbe3ffa13b97f1ca71bd7885d00c0974645cde07f3e240654d15c9c4d475771f9febfd1627991406163c1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721873, "uuid": "00b04c0f-dd63-46cd-84da-0441b20dd46a", "value": "T10B65011499C43FB8CFEC661990FA250FA3F0498E541A758AFB73BD4ABFA7604111B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721873, "uuid": "95d70c12-00fa-44ab-9f13-fdfdbad531ed", "value": "24576:QgQ0/EvsUjOXQC9yDK1MyDGd7LeT7+8920LZ+0oWsY5Ox3N:QcQ2EvU80olBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721873, "uuid": "e03f63f6-5690-4a4f-aa77-0f5957a9f8e0", "value": 1447123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721873, "uuid": "d6152e30-01da-47bb-a27c-e35e50e1eaf6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721873, "uuid": "25f39ede-1da2-4426-800d-7a1524fde6ec", "value": "Outstanding Invoice & Statement.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7140c5-33c0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775703802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703802, "uuid": "30f3112c-c8a7-4ee2-b30f-6005d13b195f", "comment": "Malware payload (AgentTesla)", "value": "73984dc6501e360231231df9cf877f50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703802, "uuid": "2d1f3cf2-dc3d-4200-9d49-a3d48fba9560", "comment": "Malware payload (AgentTesla)", "value": "d3030deea9a49c1ae50e92acdad8799c9d082c917a419200f7b7462e13d2f67e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703802, "uuid": "c5626053-6353-4ebf-8742-603eb1132732", "comment": "Malware payload (AgentTesla)", "value": "4c3e6c532b8973f2f1bbb41c74e0c8773803f9b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703802, "uuid": "405b0063-fb7c-42f0-8397-b2886797c414", "comment": "Malware payload (AgentTesla)", "value": "adb0a2159c2b9477c9002ef1ce917f3d6100354b2c4d6ba2bcfe55ad972f66a1efeee3d7a2b7d708078febb410c8d825", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703802, "uuid": "638d49ae-a418-4830-bd5e-edad054e7a89", "value": "T1A445F0931618CF02D4364BF12D23D8B01BB62E5EB910E6AE4DC26EDF7D65F140998A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703802, "uuid": "92563fec-bfb7-46d4-9d91-777f8dd18989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703802, "uuid": "e1659f61-d831-459c-8932-c87997d77482", "value": "24576:Di08bXzMyOtlB0nS58rIGI/LJJioF+BFvBPlv9rgLMYi:Di08bDMyYyniSI/L4BNBcLMYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775703802, "uuid": "30bfb40e-b401-424d-9b21-066eacacd543", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775703802, "uuid": "03786582-5c38-4cab-b2a2-c1d5d7ad20fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703802, "uuid": "942dd2e9-f48d-435e-b986-7c5c70eb7390", "value": "MV_CAPE_LILY_VSL_MAIN_INFORMATION_DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c5a054-33d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Guildma)", "timestamp": 1775714260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714260, "uuid": "97e79f58-f149-48cd-910f-ac8384ea830c", "comment": "Malware payload (Guildma)", "value": "50d10fe0939af84d62428c2365354e1a", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714260, "uuid": "3211995a-e0d8-4d0f-a888-159b04d947d4", "comment": "Malware payload (Guildma)", "value": "d328933d97c084026ac13c6efea830feb5bfdc8ece251893a7e23b63d0c89d95", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714260, "uuid": "cf41474d-5221-4903-a68a-cdbfefb19abf", "comment": "Malware payload (Guildma)", "value": "2de8c431883898fd4c1aa72ca4be8da20cea11ee", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775714260, "uuid": "88ec971d-a713-4606-81f8-8cae5f2dfd0e", "comment": "Malware payload (Guildma)", "value": "722fa44893d130fa24d869043571202d8a006f451850393565e04387a09ba15cdac7fc51bde9c513b2a0d4362c33322a", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714260, "uuid": "41482ab0-7778-4664-a566-2aa66113aaf6", "value": "T1D921D81C0915F4F1DDD2E9BAED077A500324490F865ABCC9840522217CF00229DE7C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714260, "uuid": "aa2b8f69-070d-4d17-a7a5-e050c410c020", "value": "24:8HDBJJXKLNrzPUxkfLEzkxmKoDSIzA5UvtX7TodNtg84wzLqk7SCRA+K:8HdJJKLxgxWLEQxP9U1X7cvhS27K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775714260, "uuid": "29e6a4ea-8057-4b57-968d-05aeabf505de", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775714260, "uuid": "f78b9acf-8776-4d60-9dc2-1f5ec27c7264", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775714260, "uuid": "f32c8367-3d20-4df8-a214-735892f6d25e", "value": "254186535_PDF.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefc139d-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775721847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721847, "uuid": "1c121fc0-b54a-4bab-b990-f39cb7873a7e", "comment": "Malware payload (AgentTesla)", "value": "786d3856b0c96a6219235b125c34f715", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721847, "uuid": "3c569a20-652a-4ee0-8834-2a01ddaee431", "comment": "Malware payload (AgentTesla)", "value": "d3493a68bd93d1a403f545343cb627933e8c5102ad2454d4c03b28474f185126", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721847, "uuid": "f04bc022-c0c2-49ba-b723-f2fc129882f5", "comment": "Malware payload (AgentTesla)", "value": "1e16cd52faae6d2b2ab7730817c74f5838451ff7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721847, "uuid": "46b68a14-5ac4-4c06-a356-1ad3971e1d61", "comment": "Malware payload (AgentTesla)", "value": "8ea05196669dc20d3b48c4c54186e30c67e37eef2a766aee03008a26fad11874c5bc289eef56081c4533fbf9d2cf8156", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721847, "uuid": "79396ae5-c317-4eb7-87e0-31aa35f88f67", "value": "T18B94C20CC998026FD3FBC6079EE60123C5A16FCE551DE81A24EB97BB2622641785377F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721847, "uuid": "198f68c5-5422-4980-8c2c-527c9d9f2496", "value": "6144:NcOmpHx3D+1uKBIZD7JCkul2nO963M9/myno9L8QLhO2BuOC1:NexAuKBI70zl2hByZQ0wul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721847, "uuid": "59cb9d76-be4c-4e24-a130-9c0c06d02891", "value": 417162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721847, "uuid": "fe450d61-dbfe-4f67-9ba4-02aaa14efc11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721847, "uuid": "83372d08-e205-4d97-9b46-680863d5acf2", "value": "PO0852026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a49c3f-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775722533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722533, "uuid": "a4875640-bc4d-45e6-b4c1-abd862a607f4", "comment": "Malware payload", "value": "2ef60a1f2b79b30bffebeeb7f9037a66", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722533, "uuid": "945b05ac-004c-450f-8fe1-d51a35e13c64", "comment": "Malware payload", "value": "d51fcbe12a15b3a89a289497ef105eb635cc58c6bf9edbe76c785583d200b290", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722533, "uuid": "018bd5ab-2d01-4cff-95be-0fd4f49db784", "comment": "Malware payload", "value": "b13b079bba8e90bdfc00c4e973e2799427757af7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722533, "uuid": "bd0b0392-6615-4a2c-9eeb-1f534b65dddf", "comment": "Malware payload", "value": "c09a87caea69a701a0542e6490a2bb459c6705cb736144dcdf5cacf5c826b73436cb199255567bb3b21a51de005e3c34", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722533, "uuid": "29bc1d73-ec36-4d63-9c2e-cf5b17872e36", "value": "T15C64D018DBDE0120F2F247557AFA69985D17BF73620DF4EC04A51C9D0A76BC888A3BB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722533, "uuid": "ed222031-0ac5-4781-9a49-9535c5ee1aa8", "value": "6144:6+AETGCMxlMHaJuavAoQG6DSHrXc4poB7RUQhKuoE9hgjcIpX:6+uCE6H87vAJGOs8LRhjoWgjcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722533, "uuid": "608af27f-da24-43db-9706-aff3044c7591", "value": 325656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722533, "uuid": "b884ce5b-3b76-40cd-b468-0c8b93e69051", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722533, "uuid": "d5b85b00-32dc-4da6-b652-ab4d01746bf4", "value": "PO 631809700.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c2363b-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717100, "uuid": "c5ee71a6-8aac-4e9b-99f7-42585bbe20e2", "comment": "Malware payload (Mirai)", "value": "598f8b136d487f4298cc37339b6d0efb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717100, "uuid": "55c17c91-370b-4df2-b8c9-8b915215ab9f", "comment": "Malware payload (Mirai)", "value": "d55d1b1f3b3a41672d485aad701f0c5e395133b9fe6ce316afb71707c61cbabf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717100, "uuid": "def2f8b3-187a-49d6-a249-c1c35f8736cd", "comment": "Malware payload (Mirai)", "value": "224d6c387a4501997f158a1c81c3867bda0efe2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717100, "uuid": "c89d5665-fa18-4619-87f7-b57419541b7b", "comment": "Malware payload (Mirai)", "value": "61be872809792443ef06cf56bc7bc6bdbeb5b0d3866b51f5833daf7c6dc970f6e14cf52a3c8004f80694c7c511cd1f6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717100, "uuid": "8f743fd3-712f-4192-b6f2-005965ff5962", "value": "T1048329C1FA8BC0F1D91B89304067F63FCB31E9695061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717100, "uuid": "71ac8d79-5627-4511-8a39-c546bc363294", "value": "1536:iXDwDhVtcU4xiUWaqH3Fgl3IeEMWximKjfTsv4gz9F7va:kDWKzQLH3FljwmKjfTc4ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717100, "uuid": "53bc163e-4b33-4920-b1f0-d9c8380c43a9", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717100, "uuid": "b1bda2cd-0c00-4a6d-b044-090299f5b131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717100, "uuid": "a2b1de13-7388-460a-bb32-62c42cc8f3fd", "value": "Hammz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a194184-33f4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775725865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725865, "uuid": "7e14deac-edb2-431d-b025-265df6046a85", "comment": "Malware payload", "value": "9600ea4be928ecc13b1029c5796efe71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725865, "uuid": "c72efa5c-d1d4-4339-81bc-8cdeacfdc2d7", "comment": "Malware payload", "value": "d642548065350880601937adebaf682058bb733756bcb12a925fce6bb5227dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725865, "uuid": "9cce0c16-968e-4444-9638-92ca6c188b2d", "comment": "Malware payload", "value": "0dce2c516e4aaba1f639dc6a8315270ea62222de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725865, "uuid": "2664046e-cc26-421a-91e5-e83c7d55f17a", "comment": "Malware payload", "value": "6451d2d940b3a9376a770a30ee9b7f9cd1d65c21eade793148041adb63ccd984981b36ed90fc833e1e9be316acf62712", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725865, "uuid": "b62195ba-4ea6-4a53-932b-8c9fb9cee30d", "value": "T1651733D00BD198FDD8A934FC4371EF8E53D9106225E1BC0B174A6D295A71F6682CCEB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725865, "uuid": "2e7480b5-3c83-4a55-9f01-e680ed0ae712", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725865, "uuid": "258d7a86-9840-45e5-a342-1e9b6bf20fdc", "value": "393216:/RjiKsr4FV6ZyehGhbBh42W7QZixr+EoOt0b6c2zwnoRqn1/eiufA1F3gYz2AZEl:/hihrYcZxhksBOur+VU3O1koj3fVCXLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725865, "uuid": "1c08b84c-7119-4533-b903-30beb8a25559", "value": 19117808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725865, "uuid": "4278022b-216e-49a1-95a5-952bed39c611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725865, "uuid": "93511904-f8ad-4261-9e06-a66489a0898d", "value": "RVtools_4.7.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b19115-346b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775777263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777263, "uuid": "06306292-1fe5-48b5-97b5-e47e23b11719", "comment": "Malware payload (Mirai)", "value": "12d2b50836c3462ba58aa388b725810d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777263, "uuid": "c50ec4ae-df91-4c70-ac63-85c1e04737a4", "comment": "Malware payload (Mirai)", "value": "d66447d601033553dc41cffb648697ee43d55c4fb238350c9dd7671e55d21ea7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777263, "uuid": "f9c66081-7e9b-4e9f-86bd-0db5423f0456", "comment": "Malware payload (Mirai)", "value": "79e2d4d045dc6c2b31331b84742c648d9588aba1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775777263, "uuid": "b9cd430f-4130-4e5d-b039-a3e1928cd125", "comment": "Malware payload (Mirai)", "value": "be3b8f05d57691e5b70464460b522c378e9517767a43db7ef95dccac4724c978b5a0177f86e434544a95d82530704dbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775777263, "uuid": "d58b2a63-3e8c-4447-964f-af370c9c266c", "value": "T19B142A02631C0A43D14B5DF02AFB57F183ABAD1119E7A544F21EFE886772FB1950AF89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775777263, "uuid": "1a5f6583-4a16-43f9-a37e-562e86306f21", "value": "6144:HxvpxoJ6zB9yHY6W2WwLZmTK4+Ehj681A2hNNmt1:HpEHY32WwdmTK4+Ehj681A2hNNmt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775777263, "uuid": "2a67baea-bf58-4f95-81d3-870ac58e3fa1", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775777263, "uuid": "0076a89c-573f-4083-96be-a74dbe5ee754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775777263, "uuid": "98cbe4a1-0d0c-4432-841d-9115de10b22e", "value": "ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9539fcd9-3425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775747144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775747144, "uuid": "75fcdb1b-11dc-42f9-85d6-a1d720d8053c", "comment": "Malware payload", "value": "e8b080c276519547e95930ab15028adb", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775747144, "uuid": "1584b974-cd05-4b64-b62b-a9c0fe4b6ac2", "comment": "Malware payload", "value": "d6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775747144, "uuid": "c86c027b-b12d-4fac-a36f-cc5324617623", "comment": "Malware payload", "value": "4557478c9b47f5d0729b6f6bf21d673068b57126", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775747144, "uuid": "5e423e5f-ec36-4349-8ec1-91415636e7e4", "comment": "Malware payload", "value": "981a9702079966924379b9f9620927a3b103d3a98311e1f485df403bb220bbe99a542533994665b929b21f4c73c54c6e", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775747144, "uuid": "d7d9d91e-9064-49cc-ae01-e0f7212931bc", "value": "T1E3958E46B3A501FCD467C178CD466217F672B4041774ABEF45A08A6A2F73BE23A7E318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775747144, "uuid": "56143581-c3f7-4528-9536-8a454723cc2c", "value": "72aa3d705bc1c7cc7c6057e4a008c2de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775747144, "uuid": "18c48da3-f8cc-4ea3-9a9a-54b4dc81075b", "value": "24576:MAbGrci1CVsb+JPrf+xp8esqhNyjAibJULb1hstRqGG7srGX8vCWI7JgZlHavtdP:VN7Jjfa87S1LktRqVzfHXxQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775747144, "uuid": "0ecd81e4-baef-4445-a917-7701050686d6", "value": 2058752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775747144, "uuid": "2cd86085-c77c-4c0d-bc37-998d62dc541f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775747144, "uuid": "add82e82-05c6-49ce-95c5-805623692211", "value": "7esw3p.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67f7ff0-33e4-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775719336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719336, "uuid": "04f9aca4-ad00-4009-9642-2e2f1bc3f193", "comment": "Malware payload (AgentTesla)", "value": "0ad0188e347965652334e671ff48d30f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719336, "uuid": "a10dbfed-d391-4468-9414-2d24df1eb0c8", "comment": "Malware payload (AgentTesla)", "value": "d6921719449e803cb4703da73c6cb4309e4428125428b653fd716d37fbcd36d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719336, "uuid": "58ed9f59-e763-40a6-b8bd-656f69526a15", "comment": "Malware payload (AgentTesla)", "value": "482bbf5528db37180d90fb1191c10213104789ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775719336, "uuid": "76c7f2a5-285e-40c9-927d-e4ae5f52be4a", "comment": "Malware payload (AgentTesla)", "value": "06d1c85ebae43749796ca28fcdcec89c4d5b9238629bd708e70cd836c9c33159ffa26710e53e1937cb3a5d4b5fab26af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719336, "uuid": "89f483b5-bd49-4b60-b22a-9ae36b3e0298", "value": "T11695944163473A2C8498DB0CD9E2B2FADDF51FFB96B45636AC4ACED3C226440ED72560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719336, "uuid": "dc167fbd-db1f-4575-a9b2-a06285b4aef3", "value": "768:D00000000000000000000000000000000000000000000000000000000000000n:Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775719336, "uuid": "aa36a2ea-8462-437e-8ca6-a43bc92774a3", "value": 1879498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775719336, "uuid": "ce5a922c-f939-4ef2-87ef-c176d432d350", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775719336, "uuid": "4258753e-2656-4b59-b996-20d5ebe1b39b", "value": "April 2026 payroll 8484738383.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff65f55-3436-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775754598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754598, "uuid": "682fe7d4-e901-48c6-8903-784dff20d8f8", "comment": "Malware payload", "value": "45d647425c9d64f3325c50ec89c072e5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754598, "uuid": "7327e4d1-4255-4f27-ba82-63a8958a1759", "comment": "Malware payload", "value": "d71f25184a0dcea8524d1bb7b8c51d76f9c18fd533a8ead2e9d40b75044b375e", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754598, "uuid": "90f829c8-f1ba-46f1-8cc7-1e7aff307e74", "comment": "Malware payload", "value": "a33c0e9b06bd59bb7cffb0617d5695bcc0d105be", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775754598, "uuid": "f2be0ca0-45a6-4277-b071-4d0a4b328bc2", "comment": "Malware payload", "value": "3137a7de354cb1c21bba74c590bd10ffb995da0abec7c32feb0a5b25b4908c76c7a1e97b880226c5d88244ffd8a8454c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754598, "uuid": "7662d1a5-88a3-4e7a-b026-9622dbbead10", "value": "T1EC82B71A8A05DFF01B3E3455A59BA816B9200363B434799D7D4FC09D3F3AA10CBE15EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754598, "uuid": "c933d093-ca23-4421-a61b-d5db68d39ca0", "value": "384:K5TTDSJ26RL+2oDCqIrdYBu2BYpfnhAIt43kAJ18qLj0Yncnk2vDCXNTbrc:K5DK2ACZi/3h3cZL2khNTbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775754598, "uuid": "7dd98a72-0797-4254-b0ee-c5a51f491ef4", "value": 17654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775754598, "uuid": "cfbab050-d62b-4a1a-ae94-81049f703f43", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775754598, "uuid": "10e9e991-e70c-4a01-8802-141363f27f50", "value": "Bookings..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6787ac86-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717003, "uuid": "5cf16505-419a-4a59-9902-52ab4ff6f5a0", "comment": "Malware payload (Mirai)", "value": "13ce996d3ebd2e25a0352be3154a38cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717003, "uuid": "bc63c5d1-d355-49e1-92b6-8e5317157ba7", "comment": "Malware payload (Mirai)", "value": "d7ff085bdff370183825e7c7b6e5e7c14e005068c5f0c059e85187b6942908bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717003, "uuid": "faf63f4f-4e16-4514-8743-7d25e50372ec", "comment": "Malware payload (Mirai)", "value": "a0d1b3b0102fb2861aa3125ed897580ac202240c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717003, "uuid": "d978cc4e-6407-4bd2-858e-e669197841e2", "comment": "Malware payload (Mirai)", "value": "a418b754873c73081df8d17016e1d786a2ad814a99e5a52a6c27dd9888ae252d90c1a8a56230dd4abf35d33b67a891a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717003, "uuid": "89cea7e5-09b8-4801-8796-7b1364024190", "value": "T1B203E04A5A6ACA4CDD3675BA01FFF50F0490AB3F0245C9E741C055BE9DA923118392EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717003, "uuid": "6d31b806-2087-4ef0-8585-f9630aecb242", "value": "768:2AW+GkX7xgBSxKLgTcSw7S6YPDCxu4C7Se8xKPgnml9ND5j0/Zhh2ennbcuyD7UA:29sGBSxKcTc3e6YPDCuS7sgn+9to2knu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717003, "uuid": "a4bd9413-308d-420c-8180-13b544aa5574", "value": 39684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717003, "uuid": "7c050d0b-42fc-4446-a8b5-6415e9547ed9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717003, "uuid": "8898dbb7-7af6-43ca-86d7-be05646b7ad6", "value": "Hammz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ff7924-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775722449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722449, "uuid": "23efed28-7258-4ceb-9bd2-e44705d77683", "comment": "Malware payload", "value": "2dab9d9d4001bccee81c28871404c839", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722449, "uuid": "8c6c81f5-fbde-4f77-86a7-ef09345b179d", "comment": "Malware payload", "value": "d993dfac5e0f31b06b6c44c4737fa78d642d25f82c8a5d49af8c3beadcf5804d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722449, "uuid": "a81ce707-23c5-4402-a487-3f525cf282da", "comment": "Malware payload", "value": "52b371c7de7b40d55d4f438537487bd0846ef506", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722449, "uuid": "d9c303f2-0a0a-45d5-af87-93f091302af2", "comment": "Malware payload", "value": "95cd03823f4d215fabcd8f577f666c7ea15ea3e40a5b4c058221f5eada9b1a9750990596d4dacb5f260875308fd5638f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722449, "uuid": "a863744b-96a7-4ac9-b555-6ebc65707d66", "value": "T1B294A03AD9BD043FD3AA953CE89C180FE9F56D0B270C9E87049333A9AD524C7649365E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722449, "uuid": "636efd2a-d6a9-47ea-95b1-8368df99997d", "value": "6144:FH7ajkfsTGkAbf5exeUhrsRGtvlzyasg5ySu07Bi:ZaxakY5eriRG9lzy1g5sd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722449, "uuid": "f37cf8f7-d28d-458d-968a-5b1546ee5f1c", "value": 418282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722449, "uuid": "8a99d8ee-910b-48d7-b849-b05c73ff5422", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722449, "uuid": "e9c46eae-5e7c-401a-96b0-92a43275e530", "value": "Datos bancarios.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b212a437-33b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775699948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775699948, "uuid": "f3588d9b-b113-4fac-93c1-2c6b71d56b9a", "comment": "Malware payload", "value": "b58986bc4c6704084295a75ef7616535", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775699948, "uuid": "fa6db0d8-273d-4219-8d72-c88adf7bc9d5", "comment": "Malware payload", "value": "d9a17f4d70a7178e259f1bb9d101aa3821d3f02bca2776fefaaa3693516600d9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775699948, "uuid": "ae267fcc-5d9c-400a-aab5-c52b31f8761f", "comment": "Malware payload", "value": "2fdcc45041bc6a28188e91b74672761ff55a4604", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775699948, "uuid": "46ccfcf0-6973-40f8-9f1f-a4af727ed3c5", "comment": "Malware payload", "value": "8106d5242aa84083a1f7e82746d0d2a59dc4cf9dabda50ddc7eaa92f67f457f0fe91a0716664ec70e8c78130939db8d9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775699948, "uuid": "82c6c0c8-c726-4cf7-81c7-b9f0ab78e99b", "value": "T1BFC58D217586C136D67F03B02A2DC76B46797E603B7784D773E86A2F1EB09C18631B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775699948, "uuid": "69793e02-7629-4e32-a8f7-a80bf5c8afd8", "value": "49152:11qYaZrf5jSTUial+JrMf+7UVZDEFeY4vLNgmUESIEjPMN2lv+oBjY3MV3eVough:0jSTBpq+t4veHjPMNanY3MV39gAss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775699948, "uuid": "a076bd8b-ca12-4253-8206-f223e65129e5", "value": 2598912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775699948, "uuid": "fa044ba5-b31d-4bd8-9d35-3df190810325", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775699948, "uuid": "6a2f1c0e-0d2d-470c-a2fb-762840b8ef25", "value": "vc_version.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed69642d-33e1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775718086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718086, "uuid": "391c7c0f-b732-429a-a1ca-78d3704a0549", "comment": "Malware payload (AgentTesla)", "value": "5ce14c0f3168691af8a070087a318d80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718086, "uuid": "495d46b4-e208-4600-b147-df008cbec378", "comment": "Malware payload (AgentTesla)", "value": "d9a37b7365943efa844e2b53206c8ab4d8413c05218600393032706d905546ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718086, "uuid": "81b88c46-a0e5-4474-a46b-9ef1a1319e68", "comment": "Malware payload (AgentTesla)", "value": "7e386892358dfc5cc97fd7328f374bdf17643dd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718086, "uuid": "0c1ddabb-0a4c-4c31-a037-1a80e478367f", "comment": "Malware payload (AgentTesla)", "value": "b8030903138888c54eaa477630cecf3fc3a9753ed8adcc79651c0e4e00202cc4ae38f2a4c35189756b0a1f523143a10c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718086, "uuid": "04c2a3a1-27c8-4308-9def-2ac7ade069a4", "value": "T1D8F33A64EE2001764F87A7DDBCB64661C6BDD216863744B0E6CE470E60069ECF3BD36A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718086, "uuid": "f6fbb107-a61c-46b2-80b8-1731a8e4978e", "value": "3072:dBHi8qrqgfvyWEnOhSYWZbjdul80/kzCNdurTTIcjZh2ikPL57:fC80HfMOmjYkAdOh2ikz57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718086, "uuid": "c0316f7a-5306-41e7-a4f0-3a64a1e00ecc", "value": 158280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718086, "uuid": "8730de3d-7b6f-4dcd-b971-0afb2709d206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718086, "uuid": "29508b29-998e-4db9-bf25-09ca1cdefdd7", "value": "IMG20260407-00371.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1e1a60-33f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775725384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725384, "uuid": "26ac8cc1-4da0-455f-ac64-be54e3cb8ae2", "comment": "Malware payload", "value": "2e6604a3eedf224ed03a558d7d6b7011", "object_relation": "md5", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725384, "uuid": "e06ed12c-94a9-4693-8e88-898f86f497d4", "comment": "Malware payload", "value": "da7125767967d718b646eae67187afa9e1be7d7c6f730ac10446eccada9815c5", "object_relation": "sha256", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725384, "uuid": "64341a21-36c7-4be2-b859-57072386803f", "comment": "Malware payload", "value": "d54e47741c6858cabd16c0cb7d9919c9d5559f59", "object_relation": "sha1", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775725384, "uuid": "854bb5c9-3c89-498d-92eb-8e56dc6034a0", "comment": "Malware payload", "value": "37e6f6df063576a69d575b9452e9e11a3b95bf28cd8e6241833887dd24a2c967e45a66c903a0ef1608879d00f4e6f5c3", "object_relation": "sha3-384", "Tag": [ { "name": "EarthEstries", "colour": "#AFC45D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POPPINGBEE", "colour": "#44FC0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725384, "uuid": "8f2aee28-3db5-4939-a981-699a4d10bb3f", "value": "T187249F1272D508BBD9638176C8E70E1BF6727853D738E76F03A406969FAB380522BF11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725384, "uuid": "3aa6810a-64c1-4cf8-87e5-a43f81aa3aae", "value": "90d642f597b8983215e1f1e4428efbb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725384, "uuid": "a4416e74-7cd2-4752-b718-4edf8ba11041", "value": "3072:TiLM8CMxBNaby4Nk8A7wFOPVLCY+gSgUWStQ2SNvUxs6AaoOBSSbVVjQJeXC:TdMqnk8A7w8IkSgUDevUxlJoOB4SC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775725384, "uuid": "edb7ea1e-9592-43e1-9dc9-b214cdb1cb7e", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775725384, "uuid": "4de72d0d-cfe9-4295-9b74-838cf943e390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775725384, "uuid": "b1766d12-65e5-4976-bdfb-2dc4b073ec58", "value": "da7125767967d718b646eae67187afa9e1be7d7c6f730ac10446eccada9815c5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6062ffe2-340c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775736318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736318, "uuid": "4f2e18da-9f71-46db-bb8b-de321b9bdaa8", "comment": "Malware payload (Mirai)", "value": "e23691909c9e36152060651826878609", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736318, "uuid": "4e366813-e248-4ce6-8cee-ec5e67381ddf", "comment": "Malware payload (Mirai)", "value": "db1096bca46b7d08452662ae51b3d9085593672acc1b4c7158edb1d1e0965ece", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736318, "uuid": "edc23b13-0aa1-4373-aa3c-02e283ee2afb", "comment": "Malware payload (Mirai)", "value": "e50e6a035de8a6209a0859eb1c93962a7b3a3375", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775736318, "uuid": "7b636c60-e124-4899-b051-d3afe5393509", "comment": "Malware payload (Mirai)", "value": "d3e45479aa8c14ff97c4209f0865a0ba624a53dc08ff9973e890e40551cc7732b6f92ba3fbb293a51544ea7618142596", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736318, "uuid": "f04c2b4a-07dd-4778-9f67-6b1b9a189424", "value": "T10A041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736318, "uuid": "3db56165-e4f7-46bb-bae0-6642af9c668e", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMnEzvQ6WJ9G2/7ZiYlTBVmJTy:J3CTRdrD5GFnrPUEsNzZt0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775736318, "uuid": "8f8d7006-d738-4f4b-ac35-517b1472455c", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775736318, "uuid": "af481d87-b45e-4b01-a7ab-2721198b3e5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775736318, "uuid": "5acc4341-a6f9-4cb9-b4a3-c7afd9432048", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbda0ef1-33b9-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1775700850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700850, "uuid": "11d50bd6-0318-496c-bf92-77713bcbee0f", "comment": "Malware payload (MassLogger)", "value": "9d3c64cfb0a614b78e62b11131435ecc", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700850, "uuid": "d0264fe8-f850-4feb-b200-792d023e6ef3", "comment": "Malware payload (MassLogger)", "value": "db20340ec14ba9f06684529efe9e9616938d049848eb6f627bef91018b08a8db", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700850, "uuid": "010d64a0-79d7-4c5a-8035-378435d9dff6", "comment": "Malware payload (MassLogger)", "value": "e215fdf83a4e1e11806092587a2059f8a3caed57", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775700850, "uuid": "f22a38a7-d494-42d6-94f7-b009faf3221e", "comment": "Malware payload (MassLogger)", "value": "a12a108e607cfd42f318ad0e5209f0e55ac478fb5b8e4c69915f0bb35644414084ea9c67ed516dfde8683132ae36f970", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700850, "uuid": "7da9b57c-7628-4e2d-b99c-f825a0535bf9", "value": "T1EE830273F5B09C9D8C8A34612C50DE835DA3B4810BCC6A6666F524324F9FB584AECFD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700850, "uuid": "be944f65-7b0b-4371-8c3f-cbe5813d81bb", "value": "1536:LNQqMfLDfl8W0BXFxaOIXlAHaJB5thqnsKpkdBBA9o/nQmjIQHF9Hyncs:LNQqMfPl8W09AlAHUBThqs4YAGMQHF96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775700850, "uuid": "0e1ca15c-f951-4349-a20a-ea255ed54531", "value": 84863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775700850, "uuid": "9cbb72d6-2d77-4b4c-9c11-7f1fe4386288", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775700850, "uuid": "8ec16c8c-4e49-4e81-a087-a6acb0220882", "value": "Request-For-Quotation-0979-04-0480-PR-07889-2026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4b976c-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1775722435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722435, "uuid": "bb4e1600-5f7d-4d80-9f99-d168bd8e1ce6", "comment": "Malware payload (AgentTesla)", "value": "0a11b050300756e13b9a51c43c8b0199", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722435, "uuid": "8d17bc60-1338-44e9-923c-51e7bf19baf2", "comment": "Malware payload (AgentTesla)", "value": "dbd1ec2ef6ad2c7e3b840363293d893af4c62a527d55f93806916e53dcf408d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722435, "uuid": "fa10fbfd-4c59-407a-8b3e-6f23228d6d8b", "comment": "Malware payload (AgentTesla)", "value": "98ba1b204ea04b5ca539f5462680254b6d93bd52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722435, "uuid": "dd5d4af7-894d-47cb-83e0-d1177525027e", "comment": "Malware payload (AgentTesla)", "value": "c079f47f3140d40f1e59c6dde575bed215d5fd0aba587706caa8f2ff7cbb2973a07f5fb2cc735198598290d256842d8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722435, "uuid": "04006534-9fc1-468a-b47c-fcf6cdcebfb9", "value": "T1A665021549C43FB8CFAC661990FE150EE3F14E8E901A654AEB73BD4ABFE7A00511B19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722435, "uuid": "5aea9c3e-e1d9-4443-9315-cde896f52509", "value": "24576:Inl/tPmaYpxJ7ODi3GIgQ12khMtSF9v0Sf3lN09DNN:66LVDjGM/58RN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722435, "uuid": "db6f2afb-3536-4f83-8910-e36bb8e3038c", "value": 1449923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722435, "uuid": "93cc88de-7a4e-4441-8dc2-01cdaabdff2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722435, "uuid": "df19200a-83b6-4d22-b53e-3fdf84f58aac", "value": "POG2605-3445.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3cd9d47-3401-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775731814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731814, "uuid": "dd494098-6b2b-4bae-8259-94e2f714eb69", "comment": "Malware payload", "value": "992870888874acb073484ad84776dc64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731814, "uuid": "554f4737-9a0e-45bb-8d33-886d7d54fe39", "comment": "Malware payload", "value": "dc87fbe59018aa5a3af84185f86646b4adebab39b82ecd2a7635151a28bce864", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731814, "uuid": "08b4c92f-7e06-4c5a-8de8-89b09d509ee2", "comment": "Malware payload", "value": "3e5e8c8876fbcaa0517b39aa63b268cd753a879e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731814, "uuid": "96149715-b38c-47c4-ae19-786d55d203f1", "comment": "Malware payload", "value": "b85b024a442c959c051d4bae081cf0872d14782fdc77ccdfd3fedd0e0405b7a0df22072a78864d481a4ee81d4b42dad5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731814, "uuid": "20b168b5-d885-491b-90a3-948eab0ccd96", "value": "T1CC844D75DDA823396BB54A2ADFE38E03FB026C557A1EF50B85C233798122642D4F253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731814, "uuid": "73dfe0b6-e41e-450e-b199-c252b1c0b732", "value": "6144:L4Xo+Ykpt+NLr8Ehxj2ieePnql/cUWU4YL7o3aChdkd+OI:L4X1ynhEUc/mQLGg+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775731814, "uuid": "3ae1e31c-4fb1-43fb-9caf-f1965a3ca7ec", "value": 400190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775731814, "uuid": "34bdaad6-c7a4-4385-a0d8-86a595120206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731814, "uuid": "1a11f1ab-54c5-4d52-abf4-c2178e751c01", "value": "shipping documents BL, CI&PL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a6516b-33e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775718018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718018, "uuid": "a45b7fb5-91ac-4d4b-850f-58fd3879b071", "comment": "Malware payload", "value": "69441972e7c138f1e55170bc7de9d435", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718018, "uuid": "1600c4a1-9042-4646-9dc3-599d82efa597", "comment": "Malware payload", "value": "dc91e962be7b41d32d831d6da40740fcae7684d990110f4bfe47cc581209c558", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718018, "uuid": "d35e45ec-1b04-4f18-83fc-f8cd15b73fd5", "comment": "Malware payload", "value": "9f0d46d224878745af258e1a609c308337476439", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775718018, "uuid": "800b8c1a-64c0-4b28-b809-6f23f9b3cea0", "comment": "Malware payload", "value": "bf06d8d7c2708da3c6971381caaf780442e7829b1d153aff2fec66f2100a0c1cc6f22a09906db06b01a74638e2b4a4ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718018, "uuid": "9c44cbd5-035d-470f-8483-6546aa24ac5d", "value": "T17284E634DD5C843A92F6A50FCB80964BFC4E5923371EEC47349726CA006A2C766FB96D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718018, "uuid": "e9ade517-9661-4eef-b6a9-43b1ffe3a1b4", "value": "6144:Ix4PEMvJ5H3HbMMi98jNPHN7RlE1hq94spmySGSs8gsDt+FZFucOgJe6hM:IxQEWp698JtVlaq6wJR6DIZvbe6hM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775718018, "uuid": "c64622ca-9b79-4af3-bcb2-157127cdf0b6", "value": 391766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775718018, "uuid": "b10323b7-6ce4-446c-8ee8-99a1dfb250d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775718018, "uuid": "fcc59031-0003-4595-9b9d-699f0be5c555", "value": "PRE-ALERT 876-415130768.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ee4f7f-33ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775696168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696168, "uuid": "1960dbc4-c4ad-4ade-997e-3956ba6b5881", "comment": "Malware payload", "value": "19fbdb8ae92b64576b0024694d9ae97d", "object_relation": "md5", "Tag": [ { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696168, "uuid": "48242f26-5f99-484a-9f96-269dcd6e076c", "comment": "Malware payload", "value": "dd0919967c57cdabdf8b5bc9c643bb0d250fe935476aa4944544b22132d5163d", "object_relation": "sha256", "Tag": [ { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696168, "uuid": "80eef3aa-955f-4d8e-ab22-73bbda2b8309", "comment": "Malware payload", "value": "091c6e685803ab5379cd89c662bb7311cf80d1f9", "object_relation": "sha1", "Tag": [ { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775696168, "uuid": "2feb1b6e-5291-4f4c-a447-1389e1dfdec4", "comment": "Malware payload", "value": "5c722c647b99b8a6f5c5799feb1f6f8f8d176acfab0bb1efa5eec4bb856ff4380ac07be82a643c3319ca6e99becd9b9e", "object_relation": "sha3-384", "Tag": [ { "name": "200-9-154-125", "colour": "#32A476", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "PixRevolution", "colour": "#D632F0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775696168, "uuid": "e70aff49-4922-4ec6-a83b-1060cdd60e9c", "value": "T144558B85FBE99E2ECC7340360F4A5635154AAE23C742D343D978361C68BB6F40E897E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775696168, "uuid": "fc5ff811-bcc3-4607-8570-56f55d8898cc", "value": "24576:CM+tRJ0XQIvDHMU4zgdjSEnYgy2cagqUnE7N9Dz4EcqtVj:CM+3J0gIvDHMkdjSCgqb7NTJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775696168, "uuid": "0a7b7801-4053-42df-bcce-cf67d9029f75", "value": 1361094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775696168, "uuid": "255e5a91-b035-425c-92e0-668f7551c033", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775696168, "uuid": "5c891d5c-46f7-40c8-8e88-643254502c80", "value": "suret.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ce03aa-33ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775709836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709836, "uuid": "320f1410-d2ac-4742-941f-daed1dda3da7", "comment": "Malware payload (Mirai)", "value": "8f5ed6691b5ad32a9743e2b94a0df7fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709836, "uuid": "0ba82940-8503-4d28-b7c4-6a1b3c5e5ea7", "comment": "Malware payload (Mirai)", "value": "ddbf3d2f7f177fdc92852e146d43dfcab6dac117c27378cdd91d4be3a222bfa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709836, "uuid": "43916d55-468d-49cc-ab95-e1e471e80026", "comment": "Malware payload (Mirai)", "value": "ef5ea85245d1a115b5c0759fba15d6c0404c1002", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775709836, "uuid": "26f18737-d210-4570-9532-388412a61ee6", "comment": "Malware payload (Mirai)", "value": "894237ef75eb6fd8b91defd236059bb1c4135d161020c944b916288879745eb6b4aefbfb4024d9b2f79ca6f9f55192e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709836, "uuid": "b511d967-1e6e-44ca-a768-08e52ade0b4e", "value": "T1BB042902770D4E07D1132DF4273B17E0879FFDA228B5A584745EBEC98271DB22186EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709836, "uuid": "8dfd3e1c-b140-4752-9f8a-1fa3966a8a38", "value": "1536:QX8HnYT9ckK9M4hwlxExa9xXZQAvOEHa8hpTmGqr9o5v3vAiGgsH9fI5Tqu3JH09:QiX9M4hw0xaZQyHp1q+QiQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775709836, "uuid": "bbf38fb2-6ad6-4055-a3da-52d2fc0f067f", "value": 180904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775709836, "uuid": "8eac4ed6-f61e-4e8b-8048-d1b0087d541f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775709836, "uuid": "ca7285d8-da58-49ec-9fb8-22a295263aef", "value": "nppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6147b7-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735020, "uuid": "ae5fce51-9a0b-402b-bf89-89fb3de5920c", "comment": "Malware payload (GlassWorm)", "value": "486be590f36407537ee17ce33c5cd183", "object_relation": "md5", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735020, "uuid": "5c3955eb-537f-4786-b129-8d982cb66bed", "comment": "Malware payload (GlassWorm)", "value": "de4362531e4f5e49b816833feb25ae718f758f229b823a8776248df7049fcdd1", "object_relation": "sha256", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735020, "uuid": "41f96423-5627-47e7-bb7d-30131398ee5a", "comment": "Malware payload (GlassWorm)", "value": "a180d7b40a8283e721b0f297663524ecd7eda010", "object_relation": "sha1", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735020, "uuid": "a90bb086-9e88-430b-9fd9-aa430aacbd7c", "comment": "Malware payload (GlassWorm)", "value": "5da4be438411d736c55ca1c1523fb904b0ec574f458180a6bc9fc4c3b85ed88547559942a488654cb9ba996fb5837ab9", "object_relation": "sha3-384", "Tag": [ { "name": "c_x64.node", "colour": "#895785", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735020, "uuid": "33d4f3da-bf1c-4247-b2e5-2b3e5192200f", "value": "T161658E07F3B400F9D0A7C179C5175A17E7B2740513649BDB66A08AAA6F23FF21A7E324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735020, "uuid": "d1188938-92f0-4a45-9b71-6e9f11a425d5", "value": "b7e1e242db4af3fbbb65180e146817fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735020, "uuid": "04a0aa69-7c11-4c3d-b100-8b33bf75eade", "value": "24576:+FTHiBrhvG/GzgbHUZjDFwp7+WxHRXg0R+D7erqMHJ6h1bg44H:GWF62Dmp7z3g0R+D8qMEkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735020, "uuid": "149b5a77-f5d1-40a4-b42d-4425dc4e9ef6", "value": 1475584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735020, "uuid": "6759b509-f9ca-4e22-98c8-9e3bc786427f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735020, "uuid": "899ef431-3c28-440a-82f3-e90bd05844b3", "value": "c_x64.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe263ecb-3407-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775734435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734435, "uuid": "d2bddb49-d8a4-4f86-b105-57c02d54fc12", "comment": "Malware payload", "value": "4f3d465b971afacdbd25d4d9c4bbbd50", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734435, "uuid": "9137a595-f8f4-44c6-b430-0b2bd0d4d34f", "comment": "Malware payload", "value": "deb2f2f574f20967696ee2832cabece3361b14967806c109729b41fae60ccc43", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734435, "uuid": "382d9981-0c79-4a83-b562-9b4494bdf08b", "comment": "Malware payload", "value": "106cac259751725576434e91b9df07ac156b233f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775734435, "uuid": "870995e0-de3d-47dc-a0d0-2533e71de5db", "comment": "Malware payload", "value": "b2511365d57dfc994725bae3fdafa4d71d52dd4bac3828f5c5a34716b41663ae615f43b882dca00e703c0e9b33be7f0f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734435, "uuid": "8eb50b1b-84a1-4054-ba60-04762894a3cf", "value": "T18C516C3262635C874279DC864640D4A9F5B50AFBA8B658DFF84D483C5FB131363927CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734435, "uuid": "fcf470ad-122a-425d-a02a-e0ae10661ca6", "value": "24:seVc2BVV7r/s2r7UdZ7s0RCHB4fqZ7WvkI7scFva4TbpWKa8kMNBwv9:pVJ/rr7UpEufqwK4TtWKjEv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775734435, "uuid": "107b41ad-c37c-4fe5-9f0f-50ba9dda90f8", "value": 2721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775734435, "uuid": "bbe679dd-1e51-4704-b245-904fea0afe20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775734435, "uuid": "caadd9d2-956b-4bed-abdb-3c626f2d5ab7", "value": "GlOBAlCObrAncabr.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60aa87f5-3409-11f1-a769-42010a9c0008", "comment": "Malware payload (GlassWorm)", "timestamp": 1775735030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735030, "uuid": "5b2bceec-550a-4966-909c-6ccb74fec12b", "comment": "Malware payload (GlassWorm)", "value": "d0e43defb4269397a39f3f32e2eb3b75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735030, "uuid": "6c78d486-fd1d-49c6-941f-db32bec4f003", "comment": "Malware payload (GlassWorm)", "value": "dffa23dfd1efeec8be847c20e67f7ac37d487e1a31abfed6ffe407bc412dcbed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735030, "uuid": "76733bf3-79aa-4b54-9b75-4c1ff20db588", "comment": "Malware payload (GlassWorm)", "value": "20a0fdacfe39430d047b5de55388a9009bd6b27b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775735030, "uuid": "4585d76d-178d-4c11-9883-abe53cc33a42", "comment": "Malware payload (GlassWorm)", "value": "cc6d48917c4afc5982c9120cd8217d4025fd8c8a6fa38a0fe9dda5286576d97f7351daaff8079279cd4ef3efd86558f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f_ex86.node", "colour": "#F775BA", "exportable": true, "hide_tag": false }, { "name": "glassworm", "colour": "#688395", "exportable": true, "hide_tag": false }, { "name": "Wave3", "colour": "#CE1E4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735030, "uuid": "ea5e8c95-dc6b-45f9-b9fe-d0c4dbd9bcf6", "value": "T173756D43E2A620ECC05FC170975B6722F93174055B38BDFB92D0D7352AA3E906B7AB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735030, "uuid": "719e3292-176d-4e3d-b838-745daae84e3b", "value": "b712b3f1f6f5dde070c523d4407e5a3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735030, "uuid": "b2917731-e8cb-4aa2-bb37-12ed6b1bf523", "value": "24576:Fds9Esxlce6k91UOld2LMxmeDozCMZyFFiXEymOCUwPPZaP:FdaEglcAHNaYczYxyL2PPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775735030, "uuid": "fc46a254-52a8-4009-b1f8-02063ddfae77", "value": 1566208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775735030, "uuid": "fc4a8660-341e-4cf0-870b-f56806b8f1fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775735030, "uuid": "da66dac9-be87-43a8-8ec2-d10ab5380a4b", "value": "f_ex86.node", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0116bc68-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775722414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722414, "uuid": "9ae211e7-dd02-4cb9-a1ca-62af299d3dac", "comment": "Malware payload (Formbook)", "value": "28834499f45ac9c713cdc689fd913f0a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722414, "uuid": "e06b8a3b-606a-445c-b574-caa18f446b24", "comment": "Malware payload (Formbook)", "value": "e031abc625bdceab920dc9f78c7d8f26025c279821a28f9cdea434070a15e5ca", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722414, "uuid": "cc6b76e5-6798-4070-8962-77e76d13523d", "comment": "Malware payload (Formbook)", "value": "5efd933869995319313070d1028c4f3851180437", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722414, "uuid": "1f0aac74-8f7b-4bf7-b119-60f0e53d70d0", "comment": "Malware payload (Formbook)", "value": "0371636d0533b3adb44990b0b442c6740942dae3ca1052d83e05aaef4ed7e8e46c86b879d6cf46be1b50cdb93220a43f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722414, "uuid": "689710f5-4ff6-43fc-80ca-2c913bec6dba", "value": "T116530F17DEEB76B02C5A1433E0D8198AEF24547103A3F1FCF95B269A89416163C9F8F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722414, "uuid": "015b6c1e-d699-4116-8b7f-ca1580da09fe", "value": "384:PKgvRgJ8uXcJPxcWG2wHVUnLnbU+azzbk6O3s1PA+eutKwm:PKgvRgJcJPxTwHVULAPbk6O81PA+rtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722414, "uuid": "e6d4e4a0-c2f4-422c-b2db-2a5719ac15ce", "value": 62750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722414, "uuid": "606a2418-f03b-4319-b337-0490f201419a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722414, "uuid": "c983da96-0f47-4b36-94fc-1384c61edaf1", "value": "SWIFT PAYMENTMT103- RMB471329.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b83ae6-33d6-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1775713300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713300, "uuid": "89bb4b5f-92de-46eb-a96b-0ced678b6abe", "comment": "Malware payload (PureHVNC)", "value": "5c36889d4bc9c39fac4d86d771a5b5fd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713300, "uuid": "c2d5dd4a-6fe5-49d3-b8e7-d4af8035698d", "comment": "Malware payload (PureHVNC)", "value": "e0470e49e4364065fdcce549800d63e68b990d4c303d860ccdda892e17ef5532", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713300, "uuid": "fe4a0a49-ff69-430b-921d-116f6b64832b", "comment": "Malware payload (PureHVNC)", "value": "b7aeccc2f37128a36bd0c5f9f4f7b92b4d3f4531", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713300, "uuid": "fe9e32db-df5e-4987-93e7-253ae4b1a3bf", "comment": "Malware payload (PureHVNC)", "value": "1131bc97afe1e0c4724d0389f621b8c5186abb0610a7e1dc75d702198b0a16984c2cc757851289824e0b3366fc5e7aed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713300, "uuid": "b3cf99ff-db76-4770-a012-49d3e6889a5a", "value": "T1C306021189C42FB9CFAC5A1C50FE160EA3F04A8E541A798AEB33FD47BFE7604511B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713300, "uuid": "adc14da7-f1d6-4ddd-8046-2857db28665d", "value": "49152:5Vwd9Od04aBsoKnnIjnfckUr9e7daLguNIOmuv0wPs:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713300, "uuid": "cfd06c6a-bcb8-48dd-982b-02e01139f305", "value": 3938803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713300, "uuid": "8855045f-bccc-4b7a-a445-b800c32d39fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713300, "uuid": "6b8fea2a-6271-4601-89fb-ab3d93ce9980", "value": "Fabitrade offer request 07161.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1303851f-345f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775771837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775771837, "uuid": "f71dfc08-1772-4ebd-a1d4-789a1c7557fe", "comment": "Malware payload (Mirai)", "value": "59edc5d82ce4a8cde5fe4546a13f88d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775771837, "uuid": "2003d223-5c1c-4b08-988f-68d81fa1d113", "comment": "Malware payload (Mirai)", "value": "e2b1cb931cd4bcd34bc9dcb6cec439c859d236b98263df9bb9c9d08ef1bb666f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775771837, "uuid": "1d468297-5dbf-47b6-9954-f03b39a228d5", "comment": "Malware payload (Mirai)", "value": "3edbe024bd54ca727b55011c7df4a7ab7ec37dfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775771837, "uuid": "3877fe7c-7fbe-46b0-967e-adf92ca20af2", "comment": "Malware payload (Mirai)", "value": "1176469f038be6c830be8ef09ff8fd2c059e922bcce0d03c5ce4d3e9b42596d7b3fee7950a9c2162e595eb166645ccd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775771837, "uuid": "83dba45b-f264-473c-a9e0-6e14ffebfc21", "value": "T16E144A13A8A55F97C096AFB662B38A740753EC150B531FBBB66AEDF80603DCCB405364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775771837, "uuid": "5e8682c2-bb4d-4fcf-888e-5b987dc9cb32", "value": "3072:XRXG60g/HBJqUQJ/YuPOdL9WoPKro/bYwbi6D44+rhhxz1AMhONflN:XRZZHBJqlJw9I6Z/8H6D44+rhhxz1AMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775771837, "uuid": "4330cca2-0221-4428-877b-202e40585540", "value": 191977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775771837, "uuid": "01c9c7b4-2041-4273-a63d-cba990985a00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775771837, "uuid": "150c8ec9-ecb0-43f1-9368-4ef0d77ec3c4", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c031fb67-3461-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775772986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772986, "uuid": "a62bb7b3-1501-4310-a0de-6c9c2709e7a3", "comment": "Malware payload (Mirai)", "value": "b7abf84e63223dd0e0b53245f19f87c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772986, "uuid": "d56fd90f-5fa9-4ff8-afc8-fcac1da6fff5", "comment": "Malware payload (Mirai)", "value": "e387d839bef9148bb2f6f9e5746f44fe43146bbc533cd1e6d116a65057727700", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772986, "uuid": "92ce5355-f52c-4a9a-8ee6-1241ec33283b", "comment": "Malware payload (Mirai)", "value": "c7edaaccdc36582f3ccdb0eeefae0de1154d3df3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772986, "uuid": "ad947fb0-ba59-47b6-a2e1-04ce32940f32", "comment": "Malware payload (Mirai)", "value": "e3c7a405ce6fb66a83ef3d75707a6847b54dac4fe5f7d98481be719e6111c57b0bb3607c25acb09b8a41ce23aba76785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772986, "uuid": "efa5c304-42ec-4595-86e2-125ed2e0aa2b", "value": "T1FA243A0775D08DFBC4C68AB50BD791328933F8291B36664BB7A8FD951F0EED86A1C604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772986, "uuid": "f6f9f9a9-0c26-4d71-a08f-370e1bc41e5a", "value": "6144:6tXnrv+YCUqesuxnkrFTxpkvKHg+heN9KAM7pNNle:6JnrCaWkvKHg+heN9KAM7pNNle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775772986, "uuid": "30f6de1e-7244-461f-8932-6a14704fcf8c", "value": 221204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775772986, "uuid": "6bc86c98-c379-4d4e-a0e8-db76e46e7796", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772986, "uuid": "8fc2e4ff-0d54-4c2e-8e26-4bcd2bb4b65b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8151831-33c8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775707367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775707367, "uuid": "ddde0596-f3f8-44f7-9793-94e772ebb4fa", "comment": "Malware payload (Mirai)", "value": "882d8f6aaf19aeea7258c84a73d74d41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775707367, "uuid": "85321577-1df7-4ef3-9ccf-c56b7c4a6c10", "comment": "Malware payload (Mirai)", "value": "e65d632f973d01bc21af09c7c4a6fa549d2de676a01c63c2ea7c97b3eaf115af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775707367, "uuid": "855185d6-f0f6-4eca-aba7-2db8c4345d65", "comment": "Malware payload (Mirai)", "value": "1849070950f72feb4e643e5405f918176f0d99ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775707367, "uuid": "af36172f-8784-4c6f-89be-7339bed073c7", "comment": "Malware payload (Mirai)", "value": "51deef3ef9a1e04a9f3c69f9577e42125c3fd8d6f795f70d8ef82d4250f2474f90d5a6027eb2da8e201d7599eaada589", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775707367, "uuid": "2acde0fa-9fc7-42d2-a146-c937ea91d85b", "value": "T10744D6067B519EF7D86FDD3306F98B0128CCB45721693B3A3674DA5CB90A98B05E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775707367, "uuid": "052ec8fb-d7bc-4695-9391-221fb34506c9", "value": "3072:shdpFxtn5TjvANUnvyNEd7CedQ/oIYIDVMSGd9z9/RRkheN:shdpFxtn5TrJoEwemoIYCMRZ/RR4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775707367, "uuid": "cf173da9-200a-463c-acc6-8b6e000b1305", "value": 256400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775707367, "uuid": "4c17df64-e961-4c8e-883d-93334e5ae0ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775707367, "uuid": "7d20a8b0-8ae5-415e-b1f4-44c2f537e903", "value": "nmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05ebf61-33ea-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1775721903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721903, "uuid": "0c372ec8-93ac-47e4-a95e-8fe35c2d9ac0", "comment": "Malware payload (AsyncRAT)", "value": "de6cc559d524a5aad37178191f717654", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721903, "uuid": "54a4ec5b-f0e9-482a-b800-92c0e9ef9eb2", "comment": "Malware payload (AsyncRAT)", "value": "e94865b2b225c8fe7e51c224d486c50711441647cf2266a7a698c1e56576036f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721903, "uuid": "c53a56d0-98a1-4664-a800-466472b38b0c", "comment": "Malware payload (AsyncRAT)", "value": "b255d993e0c737b280213ff2cd82be1b8659210e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775721903, "uuid": "a81e3cc2-73b7-4242-9ac5-962cc502b384", "comment": "Malware payload (AsyncRAT)", "value": "31f59fadbada21b68d2938314d5c55c7366b4cef12c0e73c7afbf908e2dbea2e0fc45431bc0c7db99677d0010f917bad", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "avefenix35630-duckdns-org", "colour": "#A4745C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721903, "uuid": "2c6e3cff-4940-439b-87ac-9b930480a31e", "value": "T1995112006AF94608B5F3EA05967EA451483BB6BEEE76CA0C8059C54D07F2D408D37F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721903, "uuid": "e007761d-42b4-4287-b05e-d496bd7e73ca", "value": "48:rsw1sAkD1aaGvJvW7SkyvimRy7GE8vkQ4mxZ5dMGOJavYrORN5hLG7CLRa/p:rsgsZ5arJ+O/Y2JfxZ5dTOJaQrYZGCRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775721903, "uuid": "ac8857f1-077d-4cb5-9d1d-92bf4554f2f4", "value": 2814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775721903, "uuid": "5d7a9cab-90e8-40e4-ace6-5afeeda83ec8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775721903, "uuid": "cd4c8687-aad1-4783-bf58-c5263f40a04e", "value": "e94865b2b225c8fe7e51c224d486c50711441647cf2266a7a698c1e56576036f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378784a3-3464-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775774045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774045, "uuid": "801a85fb-0fa2-4536-bccf-a0e6506ee600", "comment": "Malware payload", "value": "9eacbd1fe9ccfcf63e375a8ddcf1e56d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774045, "uuid": "2a4a3513-14a8-44e0-881d-cba51b3e1eb4", "comment": "Malware payload", "value": "e9524affd1366c5cd33527d87f7ef273706cfee1269fa43cd88d22e53bdd58e4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774045, "uuid": "ca5d7630-b17f-4279-a758-901685f5e01a", "comment": "Malware payload", "value": "6bb511240103d44342cb1b818b0d82c5d224eb84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775774045, "uuid": "8c5f9e50-5ee8-4e84-a020-674eab2d5c56", "comment": "Malware payload", "value": "bfab6f24858daaa68c49f75f34a2f99e0b2079fa1ece7727797997b400f2bfc12d054e62df2b1d8236e0864f5953a66b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774045, "uuid": "ec70f97c-f358-4a4a-afa8-db131657d715", "value": "T1366161F5FAB85931754CE49AB8AE40403E938DFF01E8796A500BEC14619C5ACA1BE637", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774045, "uuid": "81a5efe5-2dd8-4a27-8bab-624dee6ebaa1", "value": "48:Xv/wpRI2ddddqdbS7xgXKE311EmoWpu4ahgqfunmuLudZZ6W:XnwpXOS7xyd1emrEhgaZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775774045, "uuid": "57f7cd47-93cd-4904-a732-304f9c1806ec", "value": 3286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775774045, "uuid": "0f6206d7-e787-4f16-a1e9-679e87fb2647", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775774045, "uuid": "56d6df3b-5cbc-43ad-acb4-bc351cc98b73", "value": "5cfec054f24d794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44c53f3-3439-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775755786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755786, "uuid": "7b00a359-3feb-45dc-880b-badf0f5247c9", "comment": "Malware payload (Mirai)", "value": "e36f511d280fb732972f9d0eed9cafc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755786, "uuid": "73e76195-752c-48bc-8f56-c0bc4868b13b", "comment": "Malware payload (Mirai)", "value": "ea03ea2cd7592d737e3b857ac5af962a7ebfc476ca9271e36935dabccc5fa952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755786, "uuid": "7c5b4057-0530-48cf-8b77-483a4593d8ab", "comment": "Malware payload (Mirai)", "value": "e5a962234c78624f354f2045324d3b2cb2eb4c94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755786, "uuid": "b449c217-5f01-467c-81e3-62c3ac6d0847", "comment": "Malware payload (Mirai)", "value": "2a86a14641731b66f62321bf9fa4ff0b822cbb0b8a6cb559d816f55916761defc96adf5b7536f0fa179c2ff86e50d763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755786, "uuid": "4850bdbb-c087-4a2e-bb5f-26fdee17044a", "value": "T128F43906F8809F62C5D12676F75F8268731347B9D3EA72069A189B343BD782F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755786, "uuid": "a97c5259-b6e5-4228-9dbf-74df7d0d2d19", "value": "12288:IxjY1yxBUogT8jzUH78ouLEX548RhFetGGnB8p5uNjjg/Evq0KhfJ:YjY1ywojvUb8ouLi5JRSNqEvzKhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775755786, "uuid": "41801412-ccd8-4181-914a-2310f058bd7d", "value": 725276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775755786, "uuid": "43dd1cd9-ad3f-41bc-8773-fb3b81ff1407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755786, "uuid": "abc445d4-f302-4039-97c7-c1cf87b66938", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e098447c-3460-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775772611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772611, "uuid": "21529a6a-baec-4d16-83d9-8f64498692be", "comment": "Malware payload (Mirai)", "value": "11fc98cef19b3d7b4b9a99289233c694", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772611, "uuid": "7dfb5cb2-a1fa-454f-9a8b-ac9dcbb718b5", "comment": "Malware payload (Mirai)", "value": "eadc572edc24b3b4e357b07f0b2bacb10077cb2226890b8f9d8b4696fde6d5d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772611, "uuid": "f87d98a8-ad81-4453-8dbb-f302128972e9", "comment": "Malware payload (Mirai)", "value": "f7a4eac92e3c958f37163ed869ecf56defcac0e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775772611, "uuid": "569fa334-5181-4747-8fec-bec740c56197", "comment": "Malware payload (Mirai)", "value": "f129a1bdaa1484bffaa120e54d77bd3c047aeba87b13cb2ce3ea3f20a0d48f3c2d5bb4082b0bc01aed028eab9b42dd77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772611, "uuid": "e7b39f9a-ab85-45d0-9ca0-511d255d3a14", "value": "T106C35BC5E793D4B2D8430B7001ABE7395631EC621329CE2BD76CFFB65F22682B546618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772611, "uuid": "7af7adb3-f388-426f-8c46-171d6a91f17b", "value": "1536:W1MXVwBrNbNOQLb9LkYpgb2xZ5S8g7Rkl9bdzUJ31Q6tNB5cz7r1l9FGnBaUUkWG:nXa1Nb1xHtxZw0Wu84zv39KUkWfSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775772611, "uuid": "c58f8ba0-4ee5-4124-be7a-5ed6c10b97e0", "value": 119444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775772611, "uuid": "aaee285e-3f16-46d7-9fa7-4defd642c962", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775772611, "uuid": "d5112470-764f-4da9-9337-614e91596014", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2206f00-33e6-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775720134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720134, "uuid": "2aba4a07-b1de-4d1b-b603-8de2aa72993b", "comment": "Malware payload (njrat)", "value": "3de200d0dda6ff9c2394efe4da1975fc", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720134, "uuid": "98d00d76-2057-4914-91e9-41928bc8fde9", "comment": "Malware payload (njrat)", "value": "ebde03610f974267f12b7e8cee31520d6818a80b166f3c3ab919f81355e14312", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720134, "uuid": "1b143c89-daa4-4999-ace3-e891b0114bde", "comment": "Malware payload (njrat)", "value": "ae0bfcfd4f41ff0791896617811c034fa91fb15e", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775720134, "uuid": "09b15904-2948-406e-9908-48badc56cc5c", "comment": "Malware payload (njrat)", "value": "89d310efe03798b7b30d7f5e479c170706aa5fd14978c0f9807eda12e038a9429ec56904a9be99632d3556d88d288124", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720134, "uuid": "dce94aa3-7c8b-4c94-9aff-b0468ca9e06a", "value": "T11925E0431618CB02D53657F12D23D8B41BBA2F4EB810E6AE0DC26EDF7D65F210998A5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720134, "uuid": "4f7dd525-5fec-48a1-ae92-896b893d5a53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720134, "uuid": "a446d635-e350-446a-a894-9401a7cc4552", "value": "12288:gEWJtJlSNS2qwhbg8RVb099iPnf9a9w8uqhPh7TNe+IEAdZ5nqXo115AkR:QJb082XLjMCVa2x857WdXn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775720134, "uuid": "e81dcea9-cca4-4811-bee0-19ad6491c103", "value": 962056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775720134, "uuid": "0e4f44f4-d2ed-45e7-a797-f5b45e2f1eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775720134, "uuid": "ed146fa5-dda8-466a-a056-2987df4d0c28", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e751daf-33db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775715243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715243, "uuid": "f85bee26-4151-444c-abb0-f16b75ed261e", "comment": "Malware payload (Mirai)", "value": "ec01cfbddebd56d70ede2a7944f880e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715243, "uuid": "c7514776-5942-441a-9d4a-91fa8d9d8a53", "comment": "Malware payload (Mirai)", "value": "ec0edfe1beef73690e59361ea5991162d607b18488504dd537357e590b7e71ad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715243, "uuid": "a4fb30ac-59c5-4ddf-b872-3576ca51dca1", "comment": "Malware payload (Mirai)", "value": "9cd3b5f0cf67113c3124793241bbec9fdbea8fbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775715243, "uuid": "50b2113d-4873-4db6-9fcb-7ec7e6d0abd9", "comment": "Malware payload (Mirai)", "value": "84da6a88ca9e6838bfaa4a870efa51ede7084e7d117e78035b48aed304e6e813db5ad8561c15d0923d48dde93697c21c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715243, "uuid": "70185c9f-d48d-4ab8-a0c2-9443e72c32d1", "value": "T1146302EBC638A457D58071B2C8BD1B8307808164F9DD23B70B9B0A99D3E2471DBDDAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715243, "uuid": "3ca3d182-9ae4-42f6-84f1-3898d8307ff0", "value": "1536:44/xjhNqFJ+fsPxfWl3Myj9dsW+cvr/+Tkb8LGe:46jhNqhtWl3Bj9dsW+6yTkoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775715243, "uuid": "80ace68a-85c2-4076-af32-87040005dd1f", "value": 68204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775715243, "uuid": "48158979-01ff-4fe3-ad79-cff2082c2e14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775715243, "uuid": "a5aff00e-d2ab-4b71-8848-61748bd6652e", "value": "ec0edfe1_176.65.139.44_25565_20260408-231001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25139562-3402-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1775731924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731924, "uuid": "cf448e85-4929-40ec-829e-acb81eb0f660", "comment": "Malware payload (Formbook)", "value": "bfe9fb9c931e5d08fb6951c38b2e69b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731924, "uuid": "e886fdd7-7710-4e4f-ac92-eca431310789", "comment": "Malware payload (Formbook)", "value": "ec5a087e48fc68d24f8e158f6ac29eb994d962e53bdca8a59685b63daf56c050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731924, "uuid": "688479c2-cac3-4c32-9061-afa1c65b3519", "comment": "Malware payload (Formbook)", "value": "0b8b0bca44e83d799d246aadddb58ba206720bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775731924, "uuid": "f12ba562-56d4-4ac2-9d66-5d2e3911b95e", "comment": "Malware payload (Formbook)", "value": "049b78ab398e46a6ae38e72c619050f724057221105e9b3ced20d5fe507f2e8dafdc02c43c8fc148abe9635347860f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731924, "uuid": "3050bf6b-ef1a-48e0-b039-14381a04cf17", "value": "T1DFB5D16173C86A95D82ADE398615D732C1B3B8128B72C0CB5697170E1E7BFD25F3BA40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731924, "uuid": "3f2b33ff-90ef-40e7-a0d0-0287aef58f27", "value": "b789bf030012067b712deb028834e627", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731924, "uuid": "83f8b1d2-b19d-497c-9b10-5535cab83c3f", "value": "49152:2bLgn5b+sskOOq3vxcmiCxqi3HItiMvD/cD+l6zU9iaeS3pj3eNbOjdtm:2Ctq3+mimwiMvD/cD+l6zU9iaeS3pj3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775731924, "uuid": "aedaf392-5069-4f21-ba93-58393fc8858c", "value": 2459648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775731924, "uuid": "399cacb5-632d-458e-b231-b7ce3326ea60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775731924, "uuid": "9b275a30-5b47-441e-870d-2ad882f9edc6", "value": "SspiCli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d566e097-3456-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775768297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768297, "uuid": "8bd23dc5-33da-47ff-b42b-2929019323fc", "comment": "Malware payload (RustyStealer)", "value": "6eeafa197e7ba905b78515ddb6bf63cf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768297, "uuid": "f7329ec4-fee4-45f0-892a-a586b137bd90", "comment": "Malware payload (RustyStealer)", "value": "edacf85392fe394e36a6ad3fe6a2f0aa6f1a9d65f4b838a2e55f9bad17d1f7f2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768297, "uuid": "487919fd-46a8-407f-baff-51a06c50db56", "comment": "Malware payload (RustyStealer)", "value": "5d707904e36d79d3e164394473e0590760879089", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775768297, "uuid": "c9f59899-72cb-4bf2-bd43-0c999561c209", "comment": "Malware payload (RustyStealer)", "value": "45bce83714b6ad997341ca4bdd74df395e2c273df17deedc553cd57f292fb7d982268d7dc6a2f2ff8c222e6098ddd4f5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768297, "uuid": "515430b6-eb51-4308-9ee4-ca514241caba", "value": "T118D5D0B31E0BBE2BC1835038EB9ADB60B2C12DA5BB1A7C5119753FC4A4F38B162D7554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768297, "uuid": "4efa6d16-d9cc-4fbf-9dc5-2ea76495d814", "value": "49152:rymBzj8GZsPLigsn5fQMaPPWwiWgk3Xb/oi+xU7ISl7c90p1IUSWV7:c7IQFXeW53XbD+xo57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775768297, "uuid": "8f328ee9-a7d4-4eb0-b7bf-bbabe244b984", "value": 2785280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775768297, "uuid": "ed4ac120-7431-47f0-929f-5504640a59ed", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775768297, "uuid": "e0e4ee1f-5e94-4379-aa23-127ef10ff954", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc96e3d6-33d6-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1775713387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713387, "uuid": "7c5ec3ec-218a-4c09-8992-e027c86804dc", "comment": "Malware payload (QuasarRAT)", "value": "00faadbd39a1aaabf35b789222110d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713387, "uuid": "fa5467a6-e524-440c-accf-31df83ccb1a3", "comment": "Malware payload (QuasarRAT)", "value": "ee099bf393e389aa3bee9310c2d8b3dfd9b66df71a22a40574583555ad7261dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713387, "uuid": "a0340f07-0e21-41bb-a3d0-f29779b15974", "comment": "Malware payload (QuasarRAT)", "value": "ba5bda33d15a5cb5e1d8e850a5a28b0ed03a9c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775713387, "uuid": "7fb6dea3-282c-4c50-8c2e-3bf51fc3b5b7", "comment": "Malware payload (QuasarRAT)", "value": "90c05e0b6d437103caf0d09a0f84669dddf9c092b425730874a5c226d1601f5d374133da232a3fa641e14edf9eee9941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713387, "uuid": "f09e5540-5c77-4c48-baaa-5e6f70e0f3dd", "value": "T181E5D02039EA401EF1B7AF75DBD4B4DA9A6EF263370AA65D144103464E23B41EEC713E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713387, "uuid": "614e4a6e-2761-485c-bb6b-e7bbb5ea0b28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713387, "uuid": "5a46ed6e-9df8-4724-9811-d0ad62a8e140", "value": "49152:k+iNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRkx6Z:eNgScVIxpLlwZNnAKSb7L3w0Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775713387, "uuid": "df95e16b-3e09-46b3-982a-d6409c09f5e0", "value": 3146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775713387, "uuid": "c9e8b846-9bc3-453f-83ce-22ed11bf8ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775713387, "uuid": "f8eab14e-c28e-4ec3-b62c-e6ba31ec9e3b", "value": "00faadbd39a1aaabf35b789222110d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf7b1b1-3442-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1775759586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775759586, "uuid": "620df09d-e7e4-452c-a63b-7f5bf607cc55", "comment": "Malware payload (RustyStealer)", "value": "91aef7f225acaba150bc59be8ad5fc8b", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775759586, "uuid": "949199e5-2277-435d-a9e9-6f01d7598a31", "comment": "Malware payload (RustyStealer)", "value": "eede257690bdc8c0668c3bef1e394a6c1e50980ba237647fb36c26f46557a450", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775759586, "uuid": "95942229-ffa1-4694-9b71-3975877f606e", "comment": "Malware payload (RustyStealer)", "value": "28bd8e67e2fb306edb06d97d13eb55144304361b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775759586, "uuid": "f1040b6f-6e52-4697-9d4b-47333bfc7c7e", "comment": "Malware payload (RustyStealer)", "value": "e26f7479526e4ffeec2e29e0dfdbe1f34bf61bcc0dbd5373c23d72421c394519786a0846f7b6dd79d4d93a8d6cad7336", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775759586, "uuid": "87b4489d-e21b-4094-84de-110a021aab89", "value": "T1FB74D022FF5499B9D106C078821586777A75B4CE0B22B5FF0AAD15382E29AF12F3DF14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775759586, "uuid": "5a5afac4-fd4a-44b5-bcbc-a01378a29bce", "value": "b453b6d727c811e3597979eb9c9da77a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775759586, "uuid": "2f847c38-0924-46ad-9063-39aaeb6cbc28", "value": "6144:XU5gsqP4miFjMQcPXMeYLQrMkQihWNzhqOYpXHxTDtLSl7AF:X4j84DMtyIMkD8f/+XdtGRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775759586, "uuid": "194d8287-d2ab-4f30-bb00-03d579f41934", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775759586, "uuid": "cab571e0-0180-4daf-959f-51c077a0e63b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775759586, "uuid": "0367eddd-6859-48ca-a63d-65aba11e7556", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c60a442-33ec-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1775722541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722541, "uuid": "2a3d9a6e-5c5d-429a-9c61-dd9918ad965b", "comment": "Malware payload (VIPKeylogger)", "value": "df9665a5eae6f78c8c164a192b4cfc22", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722541, "uuid": "fc1bb24a-8cb0-4213-a646-364eef428d95", "comment": "Malware payload (VIPKeylogger)", "value": "f03d28f29d470494967b84529bc8ac2a0f9524e77b04237db1e1b5097f4eeb40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722541, "uuid": "70b8f59b-7f0b-40cb-b248-4dace9381478", "comment": "Malware payload (VIPKeylogger)", "value": "3a21e77c33c21df721b82eb173fc81351274dae8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722541, "uuid": "ad84e83f-e2ac-4752-a5dd-5dccc6b038d5", "comment": "Malware payload (VIPKeylogger)", "value": "bd813e6fd02f1767ac185e4c8856987a01b07ce29cf3aedf60708c7782981cf9c52d161749ba88d790e3248bb259ca33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722541, "uuid": "075ea589-24d4-47de-b0ba-64e91128a777", "value": "T1F6D2B6CE7BCAB4A5835275E3195FA0A6B2EE9D80344C9050F6C4ECA87C2C71CD566DBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722541, "uuid": "3fad7017-7f66-423f-871d-66725a19b1b0", "value": "768:momtdRbnU4a6ynxIh+anP6J3i/uEgnbYncMcCGSl:mfbn06ynxIEaP6J3i2EdnPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722541, "uuid": "051e5286-1f7e-446e-a0fc-ab439b2822d2", "value": 30695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722541, "uuid": "83cf6673-0fd5-4afd-863b-039315e62da4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722541, "uuid": "d607df29-8fa9-4f61-8efa-0b21bebba4c6", "value": "PI SD237687289.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60633a46-33bf-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1775703247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703247, "uuid": "670edb28-8063-4f32-87d9-34a349648c6f", "comment": "Malware payload (Smoke Loader)", "value": "6b29553bf73aba11567617731e7a6db4", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703247, "uuid": "378efe70-84e5-40b7-bd5c-adecf9298361", "comment": "Malware payload (Smoke Loader)", "value": "f07a03da99b4539d1f9f83b9a39d3e26474ad0137d0a9e35ad57106331cd0bc5", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703247, "uuid": "97680f7e-c59e-47f7-bc33-b4bee8faa75e", "comment": "Malware payload (Smoke Loader)", "value": "0e054af0b804830d0529a06ed2956bf5d0cfa5d2", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775703247, "uuid": "0bae2e7b-5b12-4904-a7f7-5a406a675f83", "comment": "Malware payload (Smoke Loader)", "value": "428662f4ebca96e4d9831f8493fa584d99a6b2ee4544b46279dd1ce30a3e146eed9be22111b9dce73dd2dc1f14e8c068", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703247, "uuid": "4b15e4d6-f01d-484d-895f-d91ba1a64114", "value": "T1EF751297ABBC3157F974137450B305C7AB3834BA8B1585AF32CCE5774A4228A1D3BA4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703247, "uuid": "2e786eda-357c-4ddf-9787-0374a00b5c3c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703247, "uuid": "d01a7ccb-6dd4-4def-b46c-760f5fdb1141", "value": "24576:RtiJmrFBrvgbl4cuE2gOM0g3lnad18kEB+yYia9IIQzhwSUZTE3wYFm+V8:XiErF9gbGERZ3AVEAD9eqZTwFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775703247, "uuid": "c7eb86fc-b42f-4816-8b55-36b260bfdc13", "value": 1613312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775703247, "uuid": "c6015566-bf0f-4a2d-8411-0df595644aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775703247, "uuid": "9ba4fee0-17ce-41a2-a5bb-dab44e14d3b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce340a7-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1775722407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722407, "uuid": "efcf5373-1f84-42f3-8f81-581d2b3831d2", "comment": "Malware payload (PhantomStealer)", "value": "443aafeded1ce03bd9cea0b488860656", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722407, "uuid": "a5e28ba9-cfae-4960-a014-47a9e140f24f", "comment": "Malware payload (PhantomStealer)", "value": "f10dbb2ce0017a0bbd9e8f0e9a67864ea354a1c20ba93fcc94b6b5adecef3afc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722407, "uuid": "22feccd7-2f92-4cfe-a289-606886ef3847", "comment": "Malware payload (PhantomStealer)", "value": "a366ecef1fb0c18bdeeea4d4d4330fe5a3bc088e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722407, "uuid": "bfd2a7d8-a2cb-4c54-8a9c-9ec454b4da73", "comment": "Malware payload (PhantomStealer)", "value": "2bbec6977f8fab52719990e9e69020803680bfce40547f9f48c33503e58aef7a7d329f5602d49c9e3c0179e08c99d6d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722407, "uuid": "3af04693-f188-4850-bb82-72361f1cf735", "value": "T1D664D165E6F01125B2B7BED69EF41084897A79A27E1EA9CC05910C4C0EB6FC4C5B2B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722407, "uuid": "ea7803c4-fe86-45f8-94a8-cefdbc93f8f4", "value": "6144:AoAn2GS/8pXg+Ch4aabSmH5fq8iEs3rznUhbFY0DU9OQ+FyePsc7V:yXg+CGhR3iE2rznUhS0DG6F2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722407, "uuid": "c1cdc5a8-ee01-43d4-a14a-eb81e1af1bbe", "value": 326890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722407, "uuid": "285c7291-7381-470b-83b2-1150605e2596", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722407, "uuid": "8c8a59a4-fd8b-42f8-93ba-b86af824b079", "value": "MBL and HBL drafts.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeaecac-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717015, "uuid": "fbc80cfd-67f2-41d2-87b0-2ab4ef5b0cd7", "comment": "Malware payload (Mirai)", "value": "166fa0a3b7ebd91e96591797ff030882", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717015, "uuid": "42d146ab-4533-47e4-8c9b-ed9b164d341a", "comment": "Malware payload (Mirai)", "value": "f1513aa854578b5d02e1c7cc52005ed462dbe12277e73b8c0becddb65eeff659", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717015, "uuid": "f265c143-18cb-4125-a2d1-9b9f1271f479", "comment": "Malware payload (Mirai)", "value": "a832edc426892fc9bb533d65ab8fd5a7c35de10d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717015, "uuid": "300ba353-5797-4ad6-b898-da9ca82b80c4", "comment": "Malware payload (Mirai)", "value": "8c19e9c723c82bf1ba8684d5e1a2edce22abe0123a8247fdd11873ec661ce2cece983c097b9c1beb515d004315827136", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717015, "uuid": "df193f38-27a9-4d2d-a89d-95b9733cea06", "value": "T15513F1DEB08C665BC7BADC3D680843268DA199F2006BFA4D9F01054C97B47D7BD5C2E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717015, "uuid": "ac06b14d-3553-4977-8929-23b2eddc1009", "value": "768:tInJXx/OohmsD7bh/xerAfORlUR+aZs3fA+nEWd3j53qUJyWEcn7tMHzWW:tIjOqvbhgAGERxZAfvEWdTwUJyWEctMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717015, "uuid": "94b088fa-e8bf-4f79-a181-8daeecce4d2a", "value": 44560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717015, "uuid": "59d48eb8-5ad0-4854-aeb8-4e5c910ee52e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717015, "uuid": "6a995435-a6b2-4c39-9752-a266eefd2b92", "value": "Hammz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f75bcd9-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717016, "uuid": "e6aea52b-9e95-47b6-8c9c-2ce58a752001", "comment": "Malware payload (Mirai)", "value": "aa657178a3c3fd1f4c5052fdcc1e7702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717016, "uuid": "f30829f9-71b2-4a17-9851-34bbb6d04ec9", "comment": "Malware payload (Mirai)", "value": "f1ebdd69d1f2d9e1e70315fd92f58a0d41031c6bc8df3e57503844e11876a8e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717016, "uuid": "f9048eaa-ae50-4da2-b79c-3654c52f463a", "comment": "Malware payload (Mirai)", "value": "6f8b833bce50ea72f2d2809a580315d8ae041b83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717016, "uuid": "72c815f6-a407-4008-a3e5-15ecb9e3b5db", "comment": "Malware payload (Mirai)", "value": "215e22ae4cc740503f0f215548c73550a5f2a0d5bdc6f649c1f5a6474add9fe1b4e82446da1a5314b706d9e0631ed6d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717016, "uuid": "58704fa4-d730-4e7b-bb62-661f58feb55f", "value": "T163A31946F8814A21C5D512BEFA1E318E331357BCE2DE73229E14AF2173865EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717016, "uuid": "9b36b5a3-5195-482e-8874-1d4c11f26c75", "value": "1536:wAnOCdbU/Amks5gIQLqCqOjmKzXkGE++fNLuaoyekXpDiARi2cHHwS0Q7jt5pYWz:rbMPOjmdKcNLuaoucHHwSr3tTLM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717016, "uuid": "821531e5-2364-4cf6-9ef2-e954cf9c5ad5", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717016, "uuid": "b42dbb9d-b0ce-44f7-a612-eda6e51a932b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717016, "uuid": "33d29ae3-e9c7-4b51-bc0f-d7c232b19f99", "value": "Hammz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb3d00c-344a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775763021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763021, "uuid": "c521fead-8ff7-48b3-a2b6-f74d557a5221", "comment": "Malware payload", "value": "fa41f30c4adc321e7642decd9247d50d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763021, "uuid": "1a417faf-06c5-4a08-8e16-27acdd787f9e", "comment": "Malware payload", "value": "f29c9902f0663a344341d03c4566882c159e4301868e5778a8b78dd3220a82c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763021, "uuid": "ddc10cd0-d2b0-4e88-b745-9aba364855c2", "comment": "Malware payload", "value": "69f776fdac5538903c5ac62ac31061d4178c9f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775763021, "uuid": "5d455b1b-af4d-419f-a0e8-9b9175483bb3", "comment": "Malware payload", "value": "9cb04032e9822412ff1123683225179ef87ae0441fedf7613a56f36cab90c3046389cffd16e29609204e4cd936b8af4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763021, "uuid": "b7ef0b1a-6fa4-43d6-8115-df2a0fec0fba", "value": "T17B0713E716D562B8C0D34630928752DA74D0B55A81F9997F3BC72C031A20EFA958EFB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763021, "uuid": "61fc742e-57da-460d-a8b5-bcf7d3fb54eb", "value": "5b99a1349da58ee79499979c3e2113eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763021, "uuid": "c9b04420-4b5f-4da0-ad60-780237d27579", "value": "393216:trw8ldvx1urJlYhf7cABJTGsIXFvvoqrT:tp7qrJqhfbZ5w1vosT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775763021, "uuid": "a50938b1-fe6c-4597-a5c4-fe9326bda0f3", "value": 17722880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775763021, "uuid": "eaee712d-300c-4e64-a760-98b3c27f4a61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775763021, "uuid": "d3eb4fd2-1d09-4beb-88b2-05e8aa0e07af", "value": "RivalMods.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe9bbb8-33de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775716614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716614, "uuid": "5091a446-de07-44e4-97b2-5527ee939cfa", "comment": "Malware payload", "value": "1a8e730c1349027107784c2b269240ba", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716614, "uuid": "c5415ecf-9255-4790-90d1-e885c40691eb", "comment": "Malware payload", "value": "f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716614, "uuid": "fbb8ed69-06ad-4e44-985a-f18f8cd1443b", "comment": "Malware payload", "value": "d3d7b200f4c37b023479ab30a359af4febaf14e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775716614, "uuid": "8fa157ae-e743-4166-acec-e6c426b9bb05", "comment": "Malware payload", "value": "9f941a5231b243c86bae7a567fc57dbf9d7dc6f630a37eb2ce36a8845018f22631066f5a25bc5eb1d74db545499b851f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716614, "uuid": "bc1acc16-87c5-4720-8274-b839909e6e14", "value": "T1CC962907FDA524E8C0AEC13589769612BB717C491B3127D72B50F7282F7ABD0AEB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716614, "uuid": "d27f659c-1fa1-4705-8b9b-e7c2211fc8ea", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716614, "uuid": "e7f8d4df-cf25-4af2-9074-ef7b7627e752", "value": "49152:IA+iQnvpJ1docaf25rASrtDKivrube+jLM3zSpXmwTevkbJGGdzWf2zPqsN1cmTy:IATuxJ+AgxbR0WPJu+fjDDV2eBYBEEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775716614, "uuid": "c3b28a4e-3990-4bff-be7f-8c9ea064264a", "value": 9104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775716614, "uuid": "d2b86b2e-535c-416e-9f70-328548351990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775716614, "uuid": "a71e3793-0be5-4338-997e-2c6a2110866e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed7091a-33c1-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1775704238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775704238, "uuid": "03b6b236-04a2-425a-aff1-d63be24645d8", "comment": "Malware payload (RatonRAT)", "value": "c9ae300b092acc6e7dff9efb8c160d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775704238, "uuid": "399e7aac-f93c-4b29-b081-9614ac7160dd", "comment": "Malware payload (RatonRAT)", "value": "f40ea9c2470ec1d8d31966af3249543993b09821ba491d883fc47b7fafcfdeeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775704238, "uuid": "5c68ecb7-bf4f-4cee-ac38-7d78652ef5d4", "comment": "Malware payload (RatonRAT)", "value": "cebb2587f1cef462c79f00eeda481ffc65167ed4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775704238, "uuid": "50ef35c2-24a8-4d50-80d5-d6901caca18b", "comment": "Malware payload (RatonRAT)", "value": "8310cfee3584d97bf532f641bc29aeffdb136ae941f1947afd18b6b7ee92f27554b995c145971a883fed39ae0c1f75fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775704238, "uuid": "79c52d86-ce52-460d-8ef0-c38a95dc956b", "value": "T1BDD41214B3FD3A15FBBE8F7E19F050480F72B6934E20D24C8E8694AD1575B829924FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775704238, "uuid": "65388756-579c-4cf1-84bd-13594f5602df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775704238, "uuid": "def5147c-0db9-4230-a509-4a8ced9f61c7", "value": "12288:jlBR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piID3l:FL4kkA7lXkXDDuAOFhWSApi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775704238, "uuid": "ee6c4094-1610-4832-b797-1a6854fb1a8b", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775704238, "uuid": "8a287a42-46fb-4c61-9fd0-461197be607e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775704238, "uuid": "73044f7b-7c3e-4e64-9bdc-2735be47d693", "value": "syron.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf30d73c-341c-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1775743376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743376, "uuid": "4a936a28-cead-49da-a4dc-eafbb714712e", "comment": "Malware payload (njrat)", "value": "7a5d43b0f969cd345d0fbac7c404dcbb", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743376, "uuid": "09c95cdb-df3b-4bec-94c6-02d2b88ee21d", "comment": "Malware payload (njrat)", "value": "f49d12a0fde981beb9bd9060f5f7caad8929e213b38f65dcf3565623828542d1", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743376, "uuid": "2affa047-5de5-45ff-a759-7473c07f52f9", "comment": "Malware payload (njrat)", "value": "961fea7e0a6e9165e282a5f42a44507d23db10d6", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775743376, "uuid": "11889a3e-da4d-49d7-912c-97405310b4ff", "comment": "Malware payload (njrat)", "value": "edfc242317cea9a45a66250412c449a43c2dd50af1a2ab0c1e6a0241ab8bff8fd8bcf9ac8ba1efdd28a1d2ce6c315950", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743376, "uuid": "1c4a7706-bc80-47b5-9c92-2b8e372ab7a9", "value": "T1935522176EBF3DEAE56600B6C168588DA721BD7103209F9FD2167D0F3E725C98C3AA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743376, "uuid": "e625c395-28c9-49c4-95bf-b256a92ae7f7", "value": "fa18060b9e29639e6b6e200299ec84e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743376, "uuid": "d4c8aded-3962-4073-9b51-9fbbac144941", "value": "24576:BEDOIfTYc3sNVTfXBytpOjvo2f9fzBNU0sScTZ3H:FIb7SP8OjQ2LBNU07uZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775743376, "uuid": "03000527-513c-4c30-83e5-56f60798fa76", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775743376, "uuid": "3eb18c31-c262-4b50-ba54-9b052380aea2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775743376, "uuid": "7912b01c-3f0d-4103-af49-a2aafc8af33b", "value": "chrome_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa4bff58-3462-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775773513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773513, "uuid": "b7991249-c86c-4805-913f-8f48a7d02476", "comment": "Malware payload (Mirai)", "value": "6468cdc9ef32dbf1fc357852bcd3f3a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773513, "uuid": "96d3a61c-9656-47df-b3f7-48f65aec2f52", "comment": "Malware payload (Mirai)", "value": "f5a7093350b121b0d791ba3841dc401a3e8f9a2ee5843a061579bd55a8fab9c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773513, "uuid": "08f43919-cd63-4965-85ca-870130a8322f", "comment": "Malware payload (Mirai)", "value": "f99b8f51f58bc4329b9c6a96f0e56e0c6044cd7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775773513, "uuid": "3d601fe5-8581-4529-b2f5-eccd383a3e69", "comment": "Malware payload (Mirai)", "value": "7694c75d1fea22ad9225683894034b414edb7956a3e2587498c669ef0c3cee27c71b142d2148a69727583b39182d9a5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773513, "uuid": "0fe69002-b665-4be8-a6b8-25ec932d5d1d", "value": "T15E44F8066F910FF7C8AFDF3702EB0A11248DE41727A62B367638E978B60A54E55D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773513, "uuid": "62baf978-09e5-47fd-a87f-d355dd28555b", "value": "6144:y2hkzs4h1LlpkZywnwe/YAow6yB1hWF5NqohWUkzn7MwA0:y26s43lmZXPeyB1hWF5NqohWUkzn7Mwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775773513, "uuid": "66523c45-2f42-4043-9f4c-eef150fc3843", "value": 261444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775773513, "uuid": "84e37925-eb19-4052-8adb-6df2d7329a80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775773513, "uuid": "e4e92a80-ca0b-4f43-90a7-309cf2aa3ae5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d296fb-3456-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775767942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767942, "uuid": "c44c2a52-d6fb-4b54-8d96-4e7b0c657589", "comment": "Malware payload (Mirai)", "value": "ea841202db85f74ff8970ac004d541b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767942, "uuid": "4019c211-0881-4dd4-82c0-5ef4b80c3925", "comment": "Malware payload (Mirai)", "value": "f68c42aa500783d6986c77a09c242ab345bda1ed7a1f1743df296631d2dae229", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767942, "uuid": "42f34b5c-1f0e-43ad-a461-7728547606fd", "comment": "Malware payload (Mirai)", "value": "6ec99131ffd8f3de73b98ca6864893c4d1a7d14d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775767942, "uuid": "511b04f5-f30c-4554-877a-261b4d1f1ad3", "comment": "Malware payload (Mirai)", "value": "65bf27be228e1f2c357819d1e1e3c5945d5c5957515d27b96e9e100e98467a69b8c467508400327239f72a412ca7c503", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767942, "uuid": "48149020-7c2d-4863-b8ae-d1a95374e6f3", "value": "T1AF435CC5E68FD8F5EA5706782033E33767B2F539026DDA97C758A526EC12940E22339C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767942, "uuid": "7b2f63cd-d8d9-41c6-b97f-611553a52657", "value": "1536:rZf98HjaKC3cQLT6nhDkblKwzb4iJ+6jZyF6e3/3+5:rZfeDc3cQ3Dbltzb4m+2yFZG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775767942, "uuid": "04e3314c-2f66-4a81-9621-b3cda30e0944", "value": 58548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775767942, "uuid": "eb3fad97-ee26-4eb8-a1bf-b9754b8c514c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775767942, "uuid": "f8132cd8-2dea-4968-b251-01803ae02ecd", "value": "manji.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c37415d-33eb-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1775722165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722165, "uuid": "cdd98e8f-89ae-468b-bf87-2d8353556558", "comment": "Malware payload (a310Logger)", "value": "3b49f11b36f131680af85a27b7b939ed", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722165, "uuid": "e23a46a0-8704-4517-8211-7201ddd287d4", "comment": "Malware payload (a310Logger)", "value": "f89f1890ed7c6329c9d27c48f9ee962fa33b2ed4b855562b7d3a240ac892ef9f", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722165, "uuid": "25fb2fe1-5895-4cfa-afae-70f69eeb936f", "comment": "Malware payload (a310Logger)", "value": "f81aa97d3bac257b003709d4e6652357b3e11763", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775722165, "uuid": "c5358230-623e-40e6-81f8-1b0977ffe9fe", "comment": "Malware payload (a310Logger)", "value": "42ab8eb66bbeec1f13a37ae3ebd7d9d0f96f7bd447387a735552023054e16357e7a4ac093332f4680816e972f6db62b2", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722165, "uuid": "f56af7b3-615e-4fbf-a626-266fee4895cc", "value": "T111D502114AC82FB9CFEC561880FE160EA3E1498E541AB58AEB73BD47AFF7A0441171DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722165, "uuid": "f1d672f2-3a1c-46fe-92cb-93e106667e36", "value": "24576:3V5oh86qfsqT9kEFgCl/GNB/Qy5GL1/UcRGshUvhJBLDfc/zb6UT07A8y+LfRyvW:uynlWBj5e54FFSopyFxtFvQJ3LH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775722165, "uuid": "1d73f01c-1af1-43f3-9882-60e4bb6fe66e", "value": 2771162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775722165, "uuid": "91fb68e4-3673-4ded-9093-d63105e1d0a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775722165, "uuid": "bdeeac74-9844-4131-a7c2-8cdd4847a788", "value": "confirmar cotizaci\u00f3n.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01fecde9-344f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775764936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764936, "uuid": "b59759ed-c677-442a-8444-12c9256d15c7", "comment": "Malware payload", "value": "97d09dff53344cd37821ceff7f3c416c", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764936, "uuid": "deb77104-ac66-4ea9-bbc6-e673b1fe162b", "comment": "Malware payload", "value": "fa00ce1f0bc4d635fe512ca6ad4e7174da1907a89b3195021286fc8da4037f63", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764936, "uuid": "5812f0a4-3e96-4c85-b945-ed24699b6ef4", "comment": "Malware payload", "value": "84047b64950aa7c9006fbccaf7300adc593f7ad9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775764936, "uuid": "27cd64af-966e-4a50-99fc-d88e5a3703e8", "comment": "Malware payload", "value": "2c13ac65cdf83781588dac641a743ae0c01ccd57c6a54a6e8ed6228d6c1d7d3e2ab12b7c1ab1838ef4379fa15a38cf93", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775764936, "uuid": "fe7db50a-c771-47d8-a052-f07f53ed1be2", "value": "T16B635CB3179FA145E10B78CA3FC0A2DA0B161968C4B92A730607C977EFDCC678A5B5D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775764936, "uuid": "7c046eae-18b5-4d93-b4ff-966902ea94b7", "value": "1536:XhuUJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJddddddddddd8:X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775764936, "uuid": "b885bd94-2e4e-4f50-8ce2-2f86ab83092f", "value": 69761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775764936, "uuid": "e5e1e61d-7206-4574-9ab1-966b85318c3e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775764936, "uuid": "247f5b3c-1501-4054-9b6a-f1ddfa6d6552", "value": "Scan_5_18_4_1202_09.04.2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964ba7a6-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717081, "uuid": "93ee0f5c-bdef-417c-955d-6341c3845bca", "comment": "Malware payload (Mirai)", "value": "7c5378dbb18cc93e43ec9a945ad66c2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717081, "uuid": "a319ec1d-160b-490a-ae16-b412528383f0", "comment": "Malware payload (Mirai)", "value": "fa414394baf89803ac5fd8665533ae3eb621c18c23a7e5c923d40d79fcbb9015", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717081, "uuid": "ae5e4639-1eb7-4f4d-ae6f-9a4151a269bc", "comment": "Malware payload (Mirai)", "value": "cf4b420ee3aa48919e95d0894534799ac4102927", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717081, "uuid": "25e11e0b-d8e3-419c-b18d-84b8f7ba9929", "comment": "Malware payload (Mirai)", "value": "054ea7f7f0563295eb29ef33382e013185a71e3d3839434b21d5c7b1f970cf2cbbd6cf8c9645de21a48af4b860d13f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717081, "uuid": "55841a38-5183-4c99-bf2e-921764fccb41", "value": "T144B3E709EF611EF7E8AFCC370AF9270124CD596A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717081, "uuid": "8bf31399-0c19-44a8-9767-b2b419b97f7d", "value": "3072:w9urbdDS5HE6o/JO7B3OFp0FsC01h0q6d:w94bdDS5E6t7S0FsJ1Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717081, "uuid": "19051f70-1ba0-43b9-8b83-fe4bdba036fe", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717081, "uuid": "2fb2404c-230a-4812-a2fe-5a12908c1cde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717081, "uuid": "6712cc6f-4d11-4621-ad0f-12f6b22c23db", "value": "Hammz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834959fe-3418-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775741531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741531, "uuid": "76c962d7-9e15-4557-9946-1726ee672178", "comment": "Malware payload (Mirai)", "value": "57d86b3cc26884b5a2148a392cbb2247", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741531, "uuid": "c13cd7a9-59bb-4f9c-a186-ac11fe6ddab0", "comment": "Malware payload (Mirai)", "value": "fcee2342fdd22284bdf622d47e8425dd15a1da4ff29746e1b305aeb693badf53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741531, "uuid": "d3bba097-775c-47fe-b82f-4e4c9aef198b", "comment": "Malware payload (Mirai)", "value": "cd80ee83f30f6478de560cfa4437f399229ab366", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775741531, "uuid": "0f37a8a7-626a-4dcd-8c44-e17f9255b21c", "comment": "Malware payload (Mirai)", "value": "1fed00a81b72481ad7ea48fcae9b26f81f1ee0124cd963ce034fb580e18751bfe2fd17ec17b55c2762925df7e34300ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741531, "uuid": "036502c4-5d5b-4223-817a-295decc4525b", "value": "T13A457D5AB1F370FDC067C030839FDB62A936F46901222D7B61C4D6352DA6EA41B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741531, "uuid": "a2bf765d-53cf-459e-a2d6-aed9a3d09e7f", "value": "24576:uU9tbtDrOJvv3V2sT82h1wjFX+y10PZ1Z:LftDrONF2sT82h2ZN0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775741531, "uuid": "fd9f62b9-9397-4782-92e2-1da401166b32", "value": 1166648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775741531, "uuid": "6a909d54-a994-4ce7-9666-faa4b8790bc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775741531, "uuid": "b73087bf-7eb8-4801-8558-85f4dba0b7fc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bdd963-33df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1775717020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717020, "uuid": "3d9ec8f8-10da-4867-8e77-ecd7025dc0fa", "comment": "Malware payload (Mirai)", "value": "4fd40389856476fde829fa9c383c3d03", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717020, "uuid": "447d9d14-b472-478a-99a1-9a9b65717f51", "comment": "Malware payload (Mirai)", "value": "fd6620ce317382677a46b7e95e0a93e53e2d662716089e6f98637f578c4fedf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717020, "uuid": "794e2cf2-1a8b-4765-b714-5590d191bd09", "comment": "Malware payload (Mirai)", "value": "9db61383bc036dc081733038e99eba193ed787db", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775717020, "uuid": "8cae09f4-3bcd-4911-8da8-bc0a08ee5a30", "comment": "Malware payload (Mirai)", "value": "dd3cccdf6b1d702c9e4644b852a353077a3a11367c639c04c43377d7c27e614f16336bb9295c92d74b11954970b6011c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717020, "uuid": "a215efc8-d4e6-4d36-a69a-11aac54dd5d4", "value": "T13B13F12B231216E6EB45C07042FA0FA53FE95FFAD04492183FD6A5518A9A6F83571CF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717020, "uuid": "70bb535e-3e97-47b8-bc6d-7c81ba9ccfde", "value": "768:mVSrYS3JuIk8or7wskZ6BQucjRmHazJ1FzqoatCyZ567rFp4JgGlzDpbuR1Jh:m8DY8oXwsbQucjY6zJ10JtrS4VJu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775717020, "uuid": "6ad78ba9-d411-43eb-9f09-9a6c326ede86", "value": 43280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775717020, "uuid": "84d36b0f-0a64-4067-acc4-3f29e6590b6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775717020, "uuid": "e69075bb-9ae5-4378-96dc-a1b24f90400a", "value": "Hammz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23432be-342a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775749448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775749448, "uuid": "a21cf610-f5a4-449a-92d5-8d6758ef5470", "comment": "Malware payload", "value": "7986d41c70665fbeba9fcb551fa681a9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775749448, "uuid": "a2df7322-7655-42f8-a19f-f5c127840177", "comment": "Malware payload", "value": "fe265b0d23b986e39cf974a0be6f238f68d3d686c401866ba8a87e9a23cde0be", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775749448, "uuid": "94be3c4f-7df3-4aaf-be49-97b5b43af30c", "comment": "Malware payload", "value": "259b95fbc80372600287a85c74b2b0f80011462f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775749448, "uuid": "3df19863-2de9-4151-a5c8-e08eff7bcd29", "comment": "Malware payload", "value": "1033ee4a233348c601b389aabebd297e80778722a8045de9dfbf9d3f9065fde3b3ade628f99d35193ab1d7f8fa0c19e1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775749448, "uuid": "d388d30a-c5c0-4361-ad89-84091bb89ba3", "value": "T1BEC59D307092C432C6AD01702B2ADF6E5A2D7F214B7154DBA7F89ABE4E744C16732F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775749448, "uuid": "79fc55cf-931b-4b0f-a1f7-982dfb4254b1", "value": "49152:0kYa5qYaZrf5jSTUialtJrMf+7UVZDEFeo4vLNgmUESIEjPMN2lv+oBJYBMV3eVv:fcjSTBWq+x4veHjPMNa1YBMV39YA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775749448, "uuid": "542c54ab-d6fc-4bb2-991b-9a3bbb833020", "value": 2699776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775749448, "uuid": "97f7116a-1b6c-4d2d-b1a4-7ff37f4ae96b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775749448, "uuid": "adfde44d-6270-4672-8acd-8da25cfd0ba7", "value": "zh.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea52c00c-3437-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1775755018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755018, "uuid": "28cf74d1-c0d9-4f68-b4a4-9a10ac3873d3", "comment": "Malware payload", "value": "06542722d02bc7623f5e5994d821b7f3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755018, "uuid": "551c8cc6-2ec1-4f8d-9b22-0ec66f6df950", "comment": "Malware payload", "value": "ff4277ebb6ce33b5796a2636100ef6ecdbfe12862e7ea9a45818e6587c80a0c1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755018, "uuid": "193f5549-ebe1-4cc1-a10c-dbf418850fb5", "comment": "Malware payload", "value": "13470b1c350a335fea8bb73f7668113e78237111", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1775755018, "uuid": "856ad497-0953-467c-946a-0886283ff821", "comment": "Malware payload", "value": "d42cacdfe7ed198b2cfd5eec62c8a3d480f70e5718f56db9e3a7110f79882d7277e6b1fad51bf13aae34ca2303ea9b88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755018, "uuid": "5976e718-a8d5-484f-a042-138c9869c777", "value": "T19E136C6526953C25AE99883B5C7E2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755018, "uuid": "837a6a52-6dc7-4d57-ae79-5d9b87f38e43", "value": "768:bas9NyXsZztC99GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bfHusZ7co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1775755018, "uuid": "dc37fa9d-3288-4767-9066-bcd4ce5c7b7a", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1775755018, "uuid": "d0e237a4-7654-42bd-9903-3e1bc08b866b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1775755018, "uuid": "27151921-7a3b-46f7-bc97-fe2465e59315", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }