{ "Event": { "published": true, "date": "2026-05-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-26", "timestamp": 1779840181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "63c29e5c-e287-4b67-ac9f-8ae9cde51d96", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ec0c3-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783078, "uuid": "4e42cf39-9a3d-465c-b274-04f5728a00b8", "comment": "Malware payload (BlackMatter)", "value": "ef7c080a9107ebb65780c255f2c5d65e", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783078, "uuid": "07cf4364-5c45-458d-b2da-816e0f84acc3", "comment": "Malware payload (BlackMatter)", "value": "0017ecc5f6c73be23b7575057c8e16b4e8a24723d8409420257144a0c7f6d575", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783078, "uuid": "d43a9460-1864-4f41-bb70-0b59c7ca03ae", "comment": "Malware payload (BlackMatter)", "value": "ddcf275807c6a90cced970f197aa586c3cf3484e", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783078, "uuid": "31348bae-45a0-49c5-ac58-e76f165ea287", "comment": "Malware payload (BlackMatter)", "value": "b359cba7e415479459850755b1607038cea29501791df6ce9e51897e3d09aacfaadeaa0ea1b6ca19a8e2d64ec0ef0ff4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783078, "uuid": "fb831b0d-2d16-4eba-9f14-8eb0a8404cab", "value": "T18EE38E11F252D0B3C83718F13736B172B3DE4D6C19A96807EAD80F99BCA58236F45997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783078, "uuid": "77af1e88-a044-4db7-a624-5b04c86dcf18", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783078, "uuid": "84f96938-36c7-4746-a808-88ee356855f5", "value": "3072:F6glyuxE4GsUPnliByocWepIma1E5YcEl+G0zMk:F6gDBGpvEByocWeZEcEl+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783078, "uuid": "7dc7acdd-ea66-4152-9d8c-92cb609ffed2", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783078, "uuid": "f1829615-2650-4679-9746-e9f1c3daeda6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783078, "uuid": "1016a4a3-0330-4d86-982a-3f0e8458a056", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff7e5cd-5932-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779820858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820858, "uuid": "bb9b73c6-867a-490a-9b9a-a3da69559ebc", "comment": "Malware payload (Mirai)", "value": "6956200d579821aa491370d847ff49eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820858, "uuid": "fee1e307-d14c-4815-944a-0015e5b4375b", "comment": "Malware payload (Mirai)", "value": "006eaada1d850afba07de9556c27632e85b671eb56dde75e8cacfa47ca2acde9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820858, "uuid": "336eaafa-4ca5-4711-a028-058913202e12", "comment": "Malware payload (Mirai)", "value": "cbfc9ef05ea34b172c2cb81b8449fe37518691bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820858, "uuid": "f19c875d-c8a6-4809-b2b7-92c6fc7dcaae", "comment": "Malware payload (Mirai)", "value": "f21f070dc92ec7bde6f4bfb9fd5bd5e3b7afa4cf445b01b6d030e137fa3e0d3e0e748a53402447ba13f8b56f85fb5a1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820858, "uuid": "786a7a2b-5176-4ad2-9e52-c1e600c6fbbe", "value": "T1D4B31846F8829B16D5DA12BFFE4E1189331367A8E3EE3112CD205F2137CA65B0B77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820858, "uuid": "f2b353cd-5555-4e60-a88b-8ff442bdceb5", "value": "3072:aHREWhWWBrLN/7ehjIjyb1taSCn8pBPZNRqrHHFC:ARESWUrZzgICPaSCn8pBXRUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779820858, "uuid": "6e2e6235-c9f9-44e1-b10a-79111cf07102", "value": 116312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779820858, "uuid": "6774da15-d023-4f79-b507-aa56661dc37d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820858, "uuid": "5894db61-c209-432d-bb01-814f3c90ed33", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb02fe9-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784458, "uuid": "118be99a-2f2a-42dd-abb2-b033b67c9a60", "comment": "Malware payload", "value": "8fd10ab5b189d5b42b4d41e9335cbe9e", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784458, "uuid": "d6c26ce2-3c02-4183-a459-7438ec316774", "comment": "Malware payload", "value": "00b374d5249b32ab298f86c2137962e6bf1f71e03c4db8e3ae169b601480d730", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784458, "uuid": "74977a8a-c245-4db8-bfea-13cc8456a8bc", "comment": "Malware payload", "value": "26f2d786e5c84cd57f3fc040ade95cc4578c6be9", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784458, "uuid": "6d0191be-c9c7-404a-8101-132d9107ef31", "comment": "Malware payload", "value": "558827c10b0054bca9ac942ed3934a7cfda9df80ad932c0cf51a3378d3f11be9477869ff97a668b1b92382912a149fa9", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784458, "uuid": "d85e722a-f626-4365-8b67-26f0a76136b7", "value": "T1A3D2F8004C691EB0938BC5BDBE999495A126261B1A197434FFFCD2941FC8B3542F8AFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784458, "uuid": "73ab350e-afa9-4ac0-a1a9-175056d444a6", "value": "384:6zGO/0fbxyAXtAn/q8jU3NqOhbTVgOq0R/OntheSK80KVgUysqmTNRQmXoPfnXNm:qcbOC8jQLhbq4dUamTNRfYPfX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784458, "uuid": "f9a8cf50-8e3a-4b48-a1fd-e1eb7fad204c", "value": 28390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784458, "uuid": "ffdbcfc5-2978-481a-847b-9c0e01963d22", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784458, "uuid": "57454436-c5f7-419f-911d-cd0559e51ddc", "value": "00b374d5249b32ab298f86c2137962e6bf1f71e03c4db8e3ae169b601480d730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb740d9f-593a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "ff530a6d-ca94-4a95-a34e-617309e18aa9", "comment": "Malware payload", "value": "4989e283c21ff021b9c6512fb67a1582", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "b518fab6-62ca-4023-91fe-c99f050adba6", "comment": "Malware payload", "value": "0190938222ae0476f4e056d0d6a422bc35b02ec957be13b7cbd3f4cda5872dcb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "8236e1f8-560b-4747-8171-b6e781f28445", "comment": "Malware payload", "value": "0b08030734e3fea3ed1ba11db41fa5c05cc74c66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "7b976e8d-1e6e-4985-9907-071fb66be55c", "comment": "Malware payload", "value": "cbf57922e5416e265338839bac673e307681e23b56be01cab5d66ec19a3e16d2359a6082ab6c09e92dd20a11e7a75cf5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824501, "uuid": "b8f3593f-5f4a-4771-bf5f-63b1ea2ab814", "value": "T1D1E34A0775C1C9FFC4D7D1F44BEA96229D32F82E0534719A6394BEA21B49EE06F1C660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824501, "uuid": "34f30b0b-e4aa-456d-9793-60c382441737", "value": "3072:Num7gDeTxZTa7wHTmUhGB1kNyj0jitWPIhVdboCq00GokM:8mLTPZEzkNU0HQhVdXSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824501, "uuid": "751f9f42-7ceb-450f-bebb-560a01623292", "value": 148424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824501, "uuid": "0be89f53-2b57-4c95-9e15-3430e4a2c5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824501, "uuid": "54d30c0a-608c-4fe3-bfbf-5aff9ec44711", "value": "wife.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9604ee0-58a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779759993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759993, "uuid": "6ee72853-8368-4cf3-b80d-94c4c0fba1e9", "comment": "Malware payload (Mirai)", "value": "f1c68abc5b30e81b1154cb382b14742a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759993, "uuid": "28bbaacf-bb28-47f5-b247-b6c6e4abc2aa", "comment": "Malware payload (Mirai)", "value": "020ed23b49ee2b3c5e62fb3ff09365a5b8eb846ee49e341fd488afeeca54c99f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759993, "uuid": "cd148c24-71e3-4d7c-8718-a2edb62a76a4", "comment": "Malware payload (Mirai)", "value": "3a7ff42fc2059839ef387dd2a397a9045bffc268", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759993, "uuid": "165f418d-acb2-4800-a0bc-12e2e90bb4ed", "comment": "Malware payload (Mirai)", "value": "d9c789e42e50792d566e60d264b1b9b8b944e50d95f9eb359ca8f684cf3b930241ac110ebb9211b5fac2684aaec07862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759993, "uuid": "5f8ee83b-01d3-4bc2-a5a2-f9b5205ffbf9", "value": "T12BA36AC5E747D8F5E86205B16037F737A731E8361028DB46CB98FD37AC42A41A66A31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759993, "uuid": "84a46b92-79e7-4fe2-84b8-7529ec3128f5", "value": "3072:Ds/pbXd9eqRuS4NJkr1oEsFLQvTr0GC6:2pDGqRuS4NJkrWEhnq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779759993, "uuid": "7f8ba618-46f1-4203-b935-9dbe941dc4f6", "value": 103988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779759993, "uuid": "01baa965-9409-4b0d-8679-3d379730025a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759993, "uuid": "5cda2bdc-c9b1-48ec-becd-52b1c45bc283", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d45be2-590d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779805002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805002, "uuid": "a3cff932-f9eb-43c3-8ecf-ef5ac866fdfa", "comment": "Malware payload (Mirai)", "value": "b8ba24cb87e6a328e4ab60aa51c41083", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805002, "uuid": "34052834-cd51-45c9-86fc-6cc78b2eac75", "comment": "Malware payload (Mirai)", "value": "02d67733b73358967896926d7283f3d9e6266025d3b2bbb5c5fc9782956e65bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805002, "uuid": "0f7026d6-b06c-46a8-a448-1e68859d93dd", "comment": "Malware payload (Mirai)", "value": "9cc12f14359e2ac6e7bba5aa8c5042e6216b4cfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805002, "uuid": "4e61a1af-ff09-43d9-a116-167126648e23", "comment": "Malware payload (Mirai)", "value": "4c0378f1da93b52f33faf11365ba47b0906cbd7be94f3902e2a5611cc7845d8b4f426349ca4cb143a411500e740364c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805002, "uuid": "accd9794-c61b-4486-8fdc-5861c61c20f4", "value": "T127142B03E6519B12D0C251BAFF6E454937236FBDD3EA3102DC24AF64778A8EB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805002, "uuid": "c02fc005-1236-4d83-aa64-a6760b7471cc", "value": "3072:LvDQ3VMGPFUIYYAuYkXQod9AqAM5a7vQDxw4/GsGUGSmFhX3ZsCYz:L03CJZzYXQ3qAYazQDqMGlUGS+3ZzYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805002, "uuid": "b94eafb8-7f91-492f-918f-147486b7627d", "value": 196720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805002, "uuid": "583169d1-82d2-4152-9d80-734bac121d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805002, "uuid": "eb16b9e7-e554-49b3-9e0a-2b517e634066", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63144092-58d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778746, "uuid": "9dc08c71-d95f-4994-b682-7eb14a36014c", "comment": "Malware payload", "value": "ff3bd9531ffac127ac8c16d2a0295de0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778746, "uuid": "25552d97-948d-4938-9476-8836c5976490", "comment": "Malware payload", "value": "03f67442c7ab9fc7daf468522cbb60a479955d68f8457dabbccce7105c4fbf9d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778746, "uuid": "e9e7b47f-a9c2-4573-89f8-ddeac46b1f06", "comment": "Malware payload", "value": "76ec32ce87f05a3655a87a023d7ff84a27d43780", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778746, "uuid": "4a7e5ac1-69ee-4e5c-9b01-a7370dcca8b6", "comment": "Malware payload", "value": "a047250af7d95bb496002abaef8626b7e58e6e41ecad94fd43edb6e3d8b1c10114726611ee1bcf855c56b94263c32d9f", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778746, "uuid": "416a3f75-7723-4d37-a495-ad59721c10c8", "value": "T1AA55FD07F2FA8C965E27999C1597DBD1906086B4283ECBCFF486D7902D3473906EBB09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778746, "uuid": "e2d7d5ca-661f-4f5c-b4c7-7f4f2a248f2a", "value": "384:IZ7TrvsZq8l2ffvu7Tq8q8l2f3z5mgsVXhgmHqLzIPeQ/fsIy7gV69jTAz5mgsXC:f9yD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778746, "uuid": "6038cadf-1e17-4fa1-be92-fff292e5f3f0", "value": 1353557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778746, "uuid": "594e4a22-e832-48e6-ba2c-07a01c69042b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778746, "uuid": "5dbcfeb0-2150-4318-b93d-9d3f6a799db9", "value": "invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010fa191-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779776863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776863, "uuid": "2a686ca9-a313-4398-aae7-9d21f239f309", "comment": "Malware payload (LummaStealer)", "value": "24bd02187725c89009ba06eebfdb7cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776863, "uuid": "5c39b33d-3fa6-4054-83ff-05621e45b36c", "comment": "Malware payload (LummaStealer)", "value": "040e0d767faccb2b706ec81553b14743f1d24f508c69bb5921716bdeb14ca1cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776863, "uuid": "3542bff9-c869-4440-bd8c-34020d4b597e", "comment": "Malware payload (LummaStealer)", "value": "b160e7c41c91f1c65aa0a39c0a34d29843beebcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776863, "uuid": "ddbec35a-8230-4e45-a101-d77609d52ce9", "comment": "Malware payload (LummaStealer)", "value": "aeb391a789fb9bbb7a56a0723e868d0ed940521f6e97ed811b09932a63cc9f0216af3a36e2ad1db7a50b4221b169d36a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776863, "uuid": "1d4c4f5c-f45b-4947-9581-846d57fd14aa", "value": "T144B56D10FDC7C5B5E4025631D4EBA2FF2335AC098F3297DBEA983E79B9761E50826205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776863, "uuid": "6a83b28a-d8d9-40db-88d0-662799d23ba4", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776863, "uuid": "56c6568d-b56f-4b0c-8008-f7de6e2ffe99", "value": "49152:o6+gz4n0J6yyIZEmIQgOquMEEnyzdNNkxRNbsGGqmHU:pBz4n0J6yywVIQgOquMrnyzdNOCGnm0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776863, "uuid": "ae7992b0-0429-491c-82cd-87e6586d93ce", "value": 2485384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776863, "uuid": "40a18cd9-585e-4527-948d-e7696443c5f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776863, "uuid": "5d3cf952-d44f-422f-9a24-e71cfbb44520", "value": "SecuriteInfo.com.Win32.Evo-gen.58782278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e72f72-5903-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779800863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800863, "uuid": "eae04db0-b5d3-4a50-81d1-750e75a879a3", "comment": "Malware payload (Mirai)", "value": "264f33eaababd6d4b6fd10b49133c76a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800863, "uuid": "8a4fbd42-1a6d-4438-8854-67241a061052", "comment": "Malware payload (Mirai)", "value": "043fbcda469ba6cb56b7cef10fde7fa49346430433c97ffcde024b0739eb08eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800863, "uuid": "fda1f946-a4a7-43e1-b504-4eab09cf7c09", "comment": "Malware payload (Mirai)", "value": "a1a2ece5b57daecb5c434cb3816ee5238d43b1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800863, "uuid": "7331af77-dc2b-4ffd-b63d-6d38dabb4d95", "comment": "Malware payload (Mirai)", "value": "8631f3ede4faae4b0e06ec7d306f28d62c427171e5a14f3f8919ee7b74e22fbdb9d8c471dbbb63fd88369e85b642cf7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800863, "uuid": "e55d36d7-0463-4a51-9803-62654ef1b105", "value": "T16463F150083D389FEE3BC834535A434421E10B717EA69B2E66765EA24E8B5DE31F71F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800863, "uuid": "c323a073-8718-4a4b-84e1-d2f07fd80373", "value": "1536:HgoFxFPZOO2uAK5Pmatrt/wlPX4nZS4biV8ne74:Aovp32+rXmX4nZZiVieE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800863, "uuid": "88ee35de-b38d-45e8-9a90-b7f7ef900385", "value": 69448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800863, "uuid": "494dec59-9669-4e77-913d-e6f8e45f8787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800863, "uuid": "1a4a9c3a-d705-4438-ac8c-6adaec85dd4f", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bf9792-5939-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779823792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823792, "uuid": "635e1832-b660-47b0-aa6d-8fb05d16d2c0", "comment": "Malware payload (ConnectWise)", "value": "9b369185f62b5541e42d5c332ca65384", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823792, "uuid": "98ff53c6-8680-43bb-a330-d130bd59a7ac", "comment": "Malware payload (ConnectWise)", "value": "050e582512aac223eecc32d19baf386c61353c826404dc4234dfeacd24c0ff12", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823792, "uuid": "fa8c73e0-6bb7-4a35-bec8-2c114b6be9fc", "comment": "Malware payload (ConnectWise)", "value": "a360132e871e2e783a594f367dc06c8f2aa2f186", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823792, "uuid": "aedc693e-64c4-4993-91f2-41aee3138960", "comment": "Malware payload (ConnectWise)", "value": "1598bc38b6ea157a1585351ba274613b1bfe15e31aa287db0ed151aa9de712effd247b7ac1352302db9f4cfb7a974ec6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823792, "uuid": "98e17335-76c5-4e85-b346-dfd90476b743", "value": "T179646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823792, "uuid": "330b595d-ca6b-4b5b-bf87-bf03f7cb4d07", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823792, "uuid": "29cfba5b-27e4-4cd6-8678-42a6234c970c", "value": "6144:VmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9cPmmJ:g1iw7gryNkSV1hy1Z1u2JLa9cPmmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823792, "uuid": "0f654ea8-763a-4120-ad40-5aa05023b7b9", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823792, "uuid": "4019ea6b-b556-4d01-ae21-a11998892ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823792, "uuid": "1beaa850-9c3f-4cf0-a306-04b4fd66a292", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfb9732-5944-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779828586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828586, "uuid": "3b16c4d8-617e-4ebe-a53b-6fd0073b3889", "comment": "Malware payload", "value": "3da4d86f2fc94e560a6554a7dfabde39", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828586, "uuid": "f7ae8d84-de39-4433-8e0b-b2dd1019ca4b", "comment": "Malware payload", "value": "0517ca4649e33faefa3a6bfcd2707a8376a981be4b42b9d19146ebb93e7f8a35", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828586, "uuid": "58dc1761-e7e3-4b96-a427-fa41667152d8", "comment": "Malware payload", "value": "1d4588a4d943f36a2ca16a5ff2cd5a307a2333ee", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828586, "uuid": "efa6bc5e-d8d7-4c86-8c2b-02a052cbaec8", "comment": "Malware payload", "value": "33b407402037ad4d848df32e48ba7599d1ab2f964384327123c313396b8bc7fd011ac4c03237e0d56b8aed6b2bac87e7", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828586, "uuid": "bb2099ae-5bf2-4293-be40-9217880422bf", "value": "T18BA5B793216B6503C4C5FBB47B8AA726E314FE51A8CE48B5B965E294DFD93CBD013380", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828586, "uuid": "1e1a4bb7-193c-4fa5-b510-2d64e5e64a66", "value": "1536:z8ghSyjTm6hy39sN3QtRMDYHGfswY3L0s3PMtvWuWOCyjp2JWAEshqpg5u0bpzsx:z8CjTm6hyNsxQpfcvWuW3yjMuAqpgAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779828586, "uuid": "be10dac5-7a0d-4037-804b-d334df44f165", "value": 2236912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779828586, "uuid": "5cda4efe-9dc6-4208-a9ed-ce96aaf9ae59", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828586, "uuid": "4ecf79f9-a235-4c7b-a50c-6f6e945bbe34", "value": "winapp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7989c74a-5898-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779754732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754732, "uuid": "2c475915-d49a-43d5-9158-a45ee5acfc9a", "comment": "Malware payload (ACRStealer)", "value": "0584f0c423b34246e4f2fa9a0c70fce9", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754732, "uuid": "fb55a929-a200-4570-9eb6-50739a92cc10", "comment": "Malware payload (ACRStealer)", "value": "055950ef8db469b7f9264e1c651a125ce969677d7d86d3e31deb31b82b3958f0", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754732, "uuid": "c8b86746-f9c7-45da-9dc5-9864387f76d8", "comment": "Malware payload (ACRStealer)", "value": "62124406f715fc6f3ae0b7771cb4921017bdea88", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754732, "uuid": "352c856b-a920-4e5d-b240-53128b713c86", "comment": "Malware payload (ACRStealer)", "value": "553a9b75263af7f707055011ac11496592c29e006b04ab945f381cc70282f9a1a42840f9467e859ac333cf1790cb24f8", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754732, "uuid": "fe729ea4-fbb8-49b2-b8e9-07a1eea76c28", "value": "T1F0C58C12FCC785B2E402563289AB62BF23359C055F329A97EA047A7EFD776D51C3A301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754732, "uuid": "0b21a506-3ba7-4a10-8afe-7f76f7ccf31d", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754732, "uuid": "bf7b8b72-80c9-4540-8d47-54682b548278", "value": "49152:YcmG1vqff7aikepPHpzhMtBRJEr6tzemfB9e:YcmG1SfOikepPHRhEBRJEr6BemXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754732, "uuid": "7101a225-5d46-47f3-b174-71a63245cd78", "value": 2648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754732, "uuid": "bfb82513-48c0-4876-98cd-d36ab2dd7c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754732, "uuid": "f08d7666-147b-4e48-8736-6d05981cca86", "value": "bjbh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c05ed24-590e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779805363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805363, "uuid": "796b20e9-18e6-45ae-973e-913dc132e00c", "comment": "Malware payload (Mirai)", "value": "017521310b33e9bcdf1919de5206ae42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805363, "uuid": "d22f2905-ca81-49cb-8f15-12c9ec968334", "comment": "Malware payload (Mirai)", "value": "061af6bd4b26b58d51193e7a2c2b53182253009bebd91c8ba44c70f250d56fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805363, "uuid": "90342a6b-422c-4239-9289-e3f0a0e76a6c", "comment": "Malware payload (Mirai)", "value": "fda965e1226f0741731e1546c7f7767e0943964f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805363, "uuid": "1b7daf68-f996-4c02-8245-54dfd222acbe", "comment": "Malware payload (Mirai)", "value": "927920b4cae071cdc4e94169aad4c6a489a6847eee8e4e9760731b149c0800d227ca8371d7000bda7209b2f71b2a30f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805363, "uuid": "79a8a3a3-28ff-44b6-bc87-117bd77ef5e9", "value": "T12BF32B51FF83CAF3E40304F080EAAB3F5A30ED1A4436C559EB657EAAD5539D5E20A364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805363, "uuid": "17e1c4dc-0639-4dd9-9f7e-d9dc6e6e3780", "value": "3072:qohH0V3JL6BTMTeZRf7tzJVhDrAhstnex:qI0n6OyTkutnex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805363, "uuid": "e64c7824-cbde-4703-80f7-f82c41cfea7c", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805363, "uuid": "1be13985-e02a-4d09-89a2-724e12d286d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805363, "uuid": "3d33784f-9a10-4bb4-a060-52d6dda6487c", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c47864-58f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779796331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796331, "uuid": "d96c2c07-23a6-4dc1-8562-68156b04d18d", "comment": "Malware payload (Formbook)", "value": "3c8a2f5ee1d4285961169e769c506ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796331, "uuid": "4a41a2dc-e315-42bb-829a-aa75827ef812", "comment": "Malware payload (Formbook)", "value": "067deca3f69d5194e2eaa573ff9f31c9a3897e707722318230c4ea34ac79e2b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796331, "uuid": "48f950ed-65a0-48d0-ad60-a3b99140ff7d", "comment": "Malware payload (Formbook)", "value": "d20f53eec918bdc6ae1b5498f1458bd98c12222f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796331, "uuid": "19875d61-3933-4ccd-861c-12300c4ac8ac", "comment": "Malware payload (Formbook)", "value": "f532d53a4b3ead996f4c6dd54e4baf10ab55887fda5af0339a14ce9140faf65520801625403c111724fa2395fd822167", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796331, "uuid": "1e1497a7-8052-45fa-bc37-fb2b2f629454", "value": "T1FC541209C6C27526EBD492B49BD6E77FA54CFA73260F496FA963090E6397AC07804702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796331, "uuid": "3c109b52-3c16-449e-b19a-1a5d6d1aa5e0", "value": "6144:b68dBAt0UYp4Yp8RnZzYHQInmTWYmTdBx4i3pxbKYtQnKxezUt9zk5:bbBADYp4YpuWHxmTlmTTx4i3pxbKoQnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779796331, "uuid": "ea371ad5-eb45-4f9e-b601-68cc75bcd025", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779796331, "uuid": "99111f33-cb4e-4219-b749-b3c6e39fd0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796331, "uuid": "a6c42dc8-4838-42aa-9b6a-c0d1a745fc9f", "value": "067deca3f69d5194e2eaa573ff9f31c9a3897e707722318230c4ea34ac79e2b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e03f14c-58bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779770147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770147, "uuid": "8c285e45-ef69-4c8f-9a6b-7674d1ed3df1", "comment": "Malware payload (Mirai)", "value": "54430f2e631aaac1e7063fb7137c9736", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770147, "uuid": "318011fb-496c-411e-914e-9a752e9b092f", "comment": "Malware payload (Mirai)", "value": "0681924b8232338f297a87f6faa886f3dfe8405365d206c9099a1b19ad990489", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770147, "uuid": "b56cc001-edcb-46c0-a7f1-ed9c51a5f627", "comment": "Malware payload (Mirai)", "value": "e5986c22da5df4417c2f201cc930adeab20743ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770147, "uuid": "76a7aa0b-45c5-4a6d-bbce-bf92b39bb703", "comment": "Malware payload (Mirai)", "value": "0add77483ec41d4e86e62b650c08b69bb6334bd636bda24e86cbdf7b638cb70bdaa71fb94eb60b5ea53186e4a456886d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770147, "uuid": "49d5b790-93f7-49b2-a14f-3845f268b730", "value": "T1279423F4649463F9E4F3123CB20F4B8ACD3F8567ABA40535EAA38D4F06357846846DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770147, "uuid": "693438d2-f0de-4a5b-8452-5df7efc3f02d", "value": "12288:bGGYAR2kVxDaj5xisBPi9U2HUUcUVAdCQzq3hi9+ga:CG7sknajTTQ1UUcVzqM9+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770147, "uuid": "eef72840-4073-4859-9f1a-31ee7be35321", "value": 436748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770147, "uuid": "2239b12e-c103-4d61-b630-3c503d03ce75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770147, "uuid": "4037b107-326d-41a8-8da4-c23d123dea38", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfa36d1-5940-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779826866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826866, "uuid": "4124a1de-504d-4af9-a4f8-32ceb0b23c9d", "comment": "Malware payload", "value": "1f7a68b55d8d41278496a30ac8d7640a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826866, "uuid": "bf5d700d-ee6b-458d-b60c-9eb8454312b3", "comment": "Malware payload", "value": "07153220ad7f4acccdb8ddd3a64849cb263bbabb032c119ab71cc00fc49a9fde", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826866, "uuid": "eb2abb7d-fdc0-49d5-a303-a2b6b8150fd3", "comment": "Malware payload", "value": "f61a4f1f36d540ec657a5048290f2794755ad96c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826866, "uuid": "77665610-a9a8-4abe-ac81-7846528dcf70", "comment": "Malware payload", "value": "3b8546109d1e7017ab0ef2e0826b1aaee1fdee860e84da45112a0c17b3c994932691858ea6b0b87bf7892b986a66cd96", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826866, "uuid": "132aea1e-3c59-4739-9ec0-bfb8ee9703aa", "value": "T172B633268E79BEBF4AAC632C707F1F1D4FA40E948499E9D657D36DC34B0EB50011B868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826866, "uuid": "e204bbf8-1909-425a-991c-f6705f00cc58", "value": "49152:SPrTO4LrI4LK/IzFCBpKXeJxoZIDfI6QFsxfSd49xRFso4JCwfdmkS93iG2kaVEc:6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826866, "uuid": "4df396a0-a0c9-49e4-a938-e044d4bb5080", "value": 10651485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826866, "uuid": "24a6764d-ceec-4c15-b33f-24937d1a3b2e", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826866, "uuid": "d5d578ae-faef-4a58-9772-db4aa4ecca34", "value": "Madium-Boostrapper.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00af649-595c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839058, "uuid": "b8b747be-dfc5-4c7d-b439-ea973c72ba06", "comment": "Malware payload", "value": "49022b9f75b759b855f935296b11aa7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839058, "uuid": "2e3c82c7-b6ef-451f-be26-157666c4512b", "comment": "Malware payload", "value": "071ea680902d561e0581c9c370f98634aa9edcc9882e4624abc739ebc223df43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839058, "uuid": "cf0ebd29-25c4-4e8e-9f0f-f7a8cbe739f6", "comment": "Malware payload", "value": "6bad4e75a16941f0a4859211fe996d5975662044", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839058, "uuid": "72b63d91-1188-4628-86ab-6d8a7d04b922", "comment": "Malware payload", "value": "949c1f632e69ce11291cbaf22030f3b50df802b384fde8b653a80db55762c3dda3ebe2872f7398f691939b54d5e4442e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839058, "uuid": "f2e63ff6-7466-4e81-9ac8-307f8b0c0132", "value": "T1E4769D41FCEA94B1E651113209A6A2EF2331B90A1F31DFC3D9447B7BAD775E10E223A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839058, "uuid": "964a36b3-1d55-4122-9205-2eae18f7a646", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839058, "uuid": "72c108e4-5c9c-4a6a-8309-2af64ede6752", "value": "24576:qFKJheWOI51SGCccMwFzbJvGGNSTnbYo8cRfE+0zzrv/Z0y1ddhIZsvvM0ZLTPr4:qFgoz3b+0zHWy1Cy8S7nQcYfYD1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839058, "uuid": "5bf11d50-2a6d-4727-8152-ae623fd042ad", "value": 7477888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839058, "uuid": "c3219fd8-5b12-4460-b6c8-8553a791f624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839058, "uuid": "9e2193e1-b6f9-45fe-acef-526537577443", "value": "SecuriteInfo.com.Win32.Evo-gen.42147515", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0121a0-595c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839057, "uuid": "0cb21723-d8d7-4a0b-9b61-cd1dde1d7f50", "comment": "Malware payload", "value": "3b46ba616e3188b47ba28245843f5c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839057, "uuid": "65e9e303-4c38-46d8-aa51-fe2a2a76c3d6", "comment": "Malware payload", "value": "082ef68f30ffd01e3413c6b82a191f389c07fb18a2b450a6be40dabcc27d8a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839057, "uuid": "e9fa1be3-4efa-4efd-8c67-75f52d3180b8", "comment": "Malware payload", "value": "a99bd76ff151b87da14233f2a26cfc66d41ad4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839057, "uuid": "3eafeb05-97fd-48b3-938a-540b11c9db87", "comment": "Malware payload", "value": "c3acdb336bc2fbae22e2f2bee5ddbb793d2762373077e864c2b5d08ab3bb13987bf86a0bce735c5865fe1c48c229ad4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839057, "uuid": "07c7322d-0da7-40b0-8aac-9f23cb2e4a22", "value": "T12A76AD42FCEB58B1E962523348F6A2EF2331B9090B359BC7D544BB7AAC771E10D26351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839057, "uuid": "07edca49-625f-42be-8993-acfbc93bd6ac", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839057, "uuid": "747d0580-3e1c-492c-8cdf-1eb98af7e8d1", "value": "49152:cr7j5qPRpHQsUymvrWfZEsFpZ4XvpJY5YD14:crX4PXHQQgWvFr4Xhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839057, "uuid": "7427eef9-0691-4ed5-aef4-ea24c78066d1", "value": 7528064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839057, "uuid": "25140a6a-5827-48b6-ac95-66768c61c597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839057, "uuid": "6717907f-ec52-48bd-9857-8eb9012643d6", "value": "SecuriteInfo.com.Win32.Evo-gen.51316269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a5d1b1-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784310, "uuid": "196ac41a-ea7c-4e69-81ab-467baf16056d", "comment": "Malware payload", "value": "76e7344452f753fdddbc7b24e65bc51a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784310, "uuid": "5f4053cb-19a4-4266-afd8-f9186563d76e", "comment": "Malware payload", "value": "08a899149a76a03dfe3b381e62b45eeaa38c39667a165b3a5a97134349015681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784310, "uuid": "9a6d39b9-6ead-478d-9767-cc792b7a0f38", "comment": "Malware payload", "value": "cb770e3894b16628d35e8c1358b04c07afd5655a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784310, "uuid": "f1742dd1-cdca-4169-a9ae-8f3d10321a2c", "comment": "Malware payload", "value": "909696830012c4e135fabb8832789b6d3242a59ddca45733073490c1a85d8383ced65b6b8b0b0fe3fb2543aa87032e88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784310, "uuid": "317a5318-7c0e-40d2-b9df-e97580927cea", "value": "T1AB47DF77814338D9E5B98DB4D41025426DAC388B5738A3C7BAC871E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784310, "uuid": "48bc5358-1399-4023-93ed-c6f07e45bbb1", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQO:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784310, "uuid": "d33ab2bd-e74e-4c54-adb3-6ef938f63be8", "value": 26673152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784310, "uuid": "db678f58-7c00-495e-9ddf-2c660996ae29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784310, "uuid": "46096c3a-e4fa-4827-8310-4bc63df5cf48", "value": "20260526-004051_sftp__root__656510752739371355_sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7667a7-58c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779774329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774329, "uuid": "08471d8e-d544-4324-b5ad-10e551f3a0fd", "comment": "Malware payload", "value": "1a24cae6771c97e9fecadcaff6c948f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774329, "uuid": "5582a6b7-e10d-41f2-97d5-4ebcb698ee8a", "comment": "Malware payload", "value": "09d05a196af7079654e2b4b9a1160622d5dd84b4c54999a48d08cf9ca7120432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774329, "uuid": "b09a3911-f4ec-42e2-b59b-88cd296a30a5", "comment": "Malware payload", "value": "d9e1b00d4899afd0fdcd8b8e1268e85e21dfe80c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774329, "uuid": "8ba1fdd4-2f09-4dae-8f13-6421fef8d934", "comment": "Malware payload", "value": "94b283c458d280209e0b1af3194f3d1588702b38054361252f95f66119294a03751f35a713ba3d380c70805e5d4cad31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774329, "uuid": "945cef9e-a0b9-4600-900c-3a4373298e8c", "value": "T1B4D64B47E8A545E9C8EDD134C9679612BB7178085B3163E72E60F3282F77BE0AE79700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774329, "uuid": "9f7b40c5-5b8c-4e6a-9c2f-c289c3a1645b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774329, "uuid": "f3818f33-3e2e-4d64-9909-ccaa4e2f2e99", "value": "98304:c6tn4wnal4Ab6rmSMPj0gTG33DJdaTZiiLCTZBRA72KcR82jvvJEYG:canTal4AurmpiiLCT/C6Y2Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779774329, "uuid": "86c7d996-166e-430f-96e2-37ace5002cfb", "value": 13814323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779774329, "uuid": "2097f81d-1410-405f-b146-23b484daeee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774329, "uuid": "e3ad28de-a916-420c-b4c6-9ff7037fc671", "value": "1a24cae6771c97e9fecadcaff6c948f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc3e70f3-5930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779820127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820127, "uuid": "2e57f919-0ec3-4382-aec2-1055b209dc55", "comment": "Malware payload", "value": "2082631e9717af503d0a72fb0164a876", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820127, "uuid": "4ca9b8b4-02d1-47be-bfda-d4829063eaf1", "comment": "Malware payload", "value": "0a31e3c31b0cf1be2ca586bacb072146dd9dfd744d5435f4eb864983dbbbf291", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820127, "uuid": "76cd3ef1-72f3-4e34-93c5-3f41553d849e", "comment": "Malware payload", "value": "bcfdc56dd37cc2e602fad70c0e9a9ec331fd4919", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820127, "uuid": "d5940349-cbf1-4b44-88fb-d070056d5b12", "comment": "Malware payload", "value": "e9fdb2e133438146a3c077e22b8c0fd9af2629fbc6ab6b2593e27ec75bfa7eeba9f00cedd3294fab83f49debf579edd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820127, "uuid": "d5d471e5-3729-428d-96a1-c5f926c6fc11", "value": "T195931791B8829A1BC6C5137BFA4E42CD37267398E3DE3117CD265F2133CA56B0EAB151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820127, "uuid": "ebe09c6c-fe32-4780-9006-912b7b824f31", "value": "1536:P+oNFyC4ecO74aBb+LxjN7ygeqXgQojCyUr9ovJ:WoYm4aBSWqXgFCHcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779820127, "uuid": "37d527db-ca26-41da-b35b-d55231a7b6b8", "value": 92080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779820127, "uuid": "6643be0c-90a3-43bb-84d7-64d47be33099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820127, "uuid": "c2554efe-41a2-4445-89a1-49a153f6ab28", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9954ee8e-58ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779791292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791292, "uuid": "444f22c4-dc4f-4a1b-beff-d72efd7bf96d", "comment": "Malware payload", "value": "12a36d188d07420d5d20273b835d47e8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791292, "uuid": "fd4680d2-4bff-47d1-ba68-6831ad27cc2a", "comment": "Malware payload", "value": "0c15feb12251c87f0ece29a4378e44381eceef01df7feb3e0e5de50222ec2406", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791292, "uuid": "61289c96-b54b-4146-88c0-f02b121bdb6c", "comment": "Malware payload", "value": "a0c82fda2fd6fe34e9c39f8aecaf279d5543474d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791292, "uuid": "04e8a00f-dbfb-4575-8175-f4d563ae9698", "comment": "Malware payload", "value": "436386d43426484fddf99a561449c612c96792487578a31fdeb3d4b21c3f835ad28a6023f40dfc8f1b617bf6e10ccd7f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791292, "uuid": "ca9cdad6-3c17-4ea1-bdd2-cdea3ad79eee", "value": "T109B17D283E8B14C8C02B93BB6EC0FE447575D1E697D168DA93EA5444D73974F0A91701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791292, "uuid": "f51ea281-7122-4c7d-9680-f76540703896", "value": "96:rb4NdOVJETkFeyV+5RXA5lkrvEkbmf/JjrlVaVnQ+1JKsDqHpUJ:fjVJECVuWkr8amf/JPlUVnQuKS+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779791292, "uuid": "a7a41853-74e5-425c-941c-8a534fb78069", "value": 5485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779791292, "uuid": "e477537c-9b6e-4e06-ae08-75595e9a756b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791292, "uuid": "8c9c7649-528d-4e1f-b4f4-1ccbbd1ed4ab", "value": "photo-529383169.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa394cb0-5912-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779807212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807212, "uuid": "1a7bc3ee-af83-47d7-a48d-49ff646b2ad8", "comment": "Malware payload (Formbook)", "value": "134d9698a9639c651596cb7b2b0461df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807212, "uuid": "14181623-81ac-43ae-9902-945d55c5cedc", "comment": "Malware payload (Formbook)", "value": "0c6730a7efa571195ca00c719b07035db16574b2cd5f9a8313fbb5661ce45841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807212, "uuid": "23587131-81e7-4b47-b35e-33e1067fcfb6", "comment": "Malware payload (Formbook)", "value": "79f1c1a8894dc75266ae247927fbd8959662b8fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807212, "uuid": "13b6f2f1-8e60-4dd3-b5b3-8e19ce903c2f", "comment": "Malware payload (Formbook)", "value": "747aeaf05db4131b3879753435d958f3d981cccf6b5aa2f5ec784bd7b669d3b5d0d7a36a89ff936ce39212bdd56557a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807212, "uuid": "8212a422-5fd6-41df-a495-3262a1cd52ac", "value": "T1C7350204231EDE12D4B68FB948B1D7B407745D88B960E3139EE97EEB78393925C183E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807212, "uuid": "b2f6a218-9cb5-4976-9817-be8493439251", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807212, "uuid": "9dc28119-9767-4b55-9f10-9357dd3b755a", "value": "24576:ka4sL+/8Ss3lxvI56Oty6d3VrMkMnI/Yq4B8xxHxR:ka40FSs3lxvI56hm6kNn4kxHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779807212, "uuid": "7d711746-1f9e-481c-847a-23605b9f45b1", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779807212, "uuid": "a8eb5df8-8e73-415e-be3a-1504711efb52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807212, "uuid": "357ed5e2-ea4c-4c2e-b2da-78e519314aff", "value": "NEW Company Registration form & New (PO FB2150204_pdf).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2dc994-5939-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779823806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823806, "uuid": "ad754e8b-4df2-4fe1-bd0d-e45a86fa1b9c", "comment": "Malware payload", "value": "e450a5a5d7ab61ae44891e45038c02fd", "object_relation": "md5", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823806, "uuid": "51d290a7-7667-488e-84d1-962b40735014", "comment": "Malware payload", "value": "0c69afe39e636cab46012ed722b4b48710ec2af81042c7b84f87915c4a9ba0b9", "object_relation": "sha256", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823806, "uuid": "750641e9-9a97-4d2e-a6f4-810f2e33040e", "comment": "Malware payload", "value": "ce1c96670e2f01eda2f2ba0bc3e64d09f3c9c319", "object_relation": "sha1", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823806, "uuid": "d9e27e1b-a979-4f75-8438-9cb6f51e05c8", "comment": "Malware payload", "value": "ccb8223bc27480bae6cc46aa34f04db720a7ee16ac403b7d28c6a7b57bfa014f531f3b7e48f0322dcfc473247ff80867", "object_relation": "sha3-384", "Tag": [ { "name": "pw-dx2026", "colour": "#19DD5E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823806, "uuid": "37c0f959-dce3-4101-8815-c63d0019e76a", "value": "T148F73393F91E54AE9006513BE521FF4A4D710EEFE4A482A745F8C88F540057F3AB6FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823806, "uuid": "9eaa2b42-f5e9-43fc-8dac-c5acf5b2bf9a", "value": "1572864:pIa08IpMNXGhqBmpEQynESJbfUJByUeVQRbvDR+ruDexTxEsiYHgFb:pjRNWhqBXZmyJCHR+ruDsTxij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823806, "uuid": "05b72cdd-bed3-4dbb-91da-4838c127cfb8", "value": 76065537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823806, "uuid": "bc29b301-ac86-4700-a821-008e8e5e5fb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823806, "uuid": "7fef2e0a-86dc-495b-954d-31370f257577", "value": "DivineX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112e683-58bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779770072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770072, "uuid": "a3c1ece5-12e8-4456-aebf-84b62517c728", "comment": "Malware payload", "value": "b2c25f5bbf59c108c54fbb1dbadced1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770072, "uuid": "ecec06d0-7358-403d-b4ec-b1cc9aa132cf", "comment": "Malware payload", "value": "0d5dfe4294ffd0b64b148b548942c8ba907a383c6d9c1bd8852019b0a12877a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770072, "uuid": "d0f89146-ee62-4902-b6b9-6600f6bcdefd", "comment": "Malware payload", "value": "3ebecf42cf0ef70986fa43da58ee24ea247f8843", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770072, "uuid": "b8701f5a-5679-4718-8ee3-c72ebd2bb821", "comment": "Malware payload", "value": "f6977604da1ab9b480bf0092cafff734c51c09495d4fd1c44ec5a903140f6c687bb093082e3d9673d48f86166e0788bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770072, "uuid": "838379e7-106c-4618-b1e4-0c117a472255", "value": "T185058D9EFD6E3C47E2DAE33D9F4A83B1A22BB150C31351533581432C94C6ADD8BB1669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770072, "uuid": "414f14db-50d6-4112-aa28-98678f744677", "value": "12288:xR5Qpvvo4ZdZx3LZ7gZX4qZKNbIpkiaOrRQjVqqWquw5BfNINUC8H9AQzt/c:HGpXdjLy4O4U7r1qBSyC8H2Qzt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770072, "uuid": "4281c49b-cccd-4b4b-9cac-033bd721b1c8", "value": 865216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770072, "uuid": "54d6b604-4943-4459-a66d-466f058a35dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770072, "uuid": "e11d3daf-4c10-4c2e-b7d5-1c4e54dd48d1", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9078215-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "72b19e25-d7e9-47aa-afd0-9e5f3d9a1eb1", "comment": "Malware payload (Mirai)", "value": "42336b7e492d98421b3db97b9c0ad4c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "892808cc-a85e-4f82-82ec-ccd5cfc641f7", "comment": "Malware payload (Mirai)", "value": "0d7c779f565db554e0b993a550a6efb555b2dc10c44e6fb760b36d60ca150685", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "6e3bb263-b142-4745-b5d3-515070785f55", "comment": "Malware payload (Mirai)", "value": "302ad7ec669f57b130c4ef53eb76eede4cfe62b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "dbbe45d5-0ca7-46ac-be8d-df76b1712c26", "comment": "Malware payload (Mirai)", "value": "de670acf0d82e0065d8e0dedd13dabca17a9b26900e44643158fe4a2e67e9df41c49c32c7ecef8c91d7ff9a2a31b1bea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "112335a9-1008-4d32-aedd-b7be6c28b952", "value": "T1D7F307C7F901DFB7F80BE3724493081A7530FBA609521A73722779AAED391D81467E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "86bfac28-fde4-49b7-a889-a5c05784e7b5", "value": "3072:YhmPMDu0+04xqy2H+sqvr5c+vl7v0xhfV4jbiLLjcMXBjPZD:nkooy2esqz5N78xh7LPXBND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824497, "uuid": "b4c47523-9038-45e3-bd31-8f5aff682a2a", "value": 166920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824497, "uuid": "f2c4519d-71a6-403c-b556-40687aa86cf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "87ce2649-b95f-4ee4-9a99-701f744045cf", "value": "wife.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de68b72-58f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779796293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796293, "uuid": "5f54b052-8a63-4e94-af9c-f2af85d73390", "comment": "Malware payload (Formbook)", "value": "2801f26571921e7fb439a3b16d6c314f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796293, "uuid": "e71bea7f-c15c-4770-8e4f-3cdd4965d387", "comment": "Malware payload (Formbook)", "value": "0d8da544ca387d036d255a462b860dc42228a0bb0b9fa4914f899436a3bd7d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796293, "uuid": "2e59f196-3afe-47d6-933c-c6749315613e", "comment": "Malware payload (Formbook)", "value": "c9e323860eb44a931027f53453f34b06d393cf2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796293, "uuid": "7461501e-d816-4afb-9def-207008cebe81", "comment": "Malware payload (Formbook)", "value": "d70eab61c1b5f889fa88a75ad157ec51f4d2c0cafb50a7726aaccf50ecd4aae29b9a86a22e135f9b1a4ee0e75baac270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796293, "uuid": "f3db781e-72f3-4e49-9808-edea0b507b5e", "value": "T197541209C6C27526EBD492B4DBD6E77FE54CFA73260F496FA963090E6397AC07804702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796293, "uuid": "5e614f91-7cae-4762-b3c0-7a5caa799088", "value": "6144:b68dBAt0UYp4Yp8RnZzYHQInmTWYmTdBx4i3pxbKYtQnKxezUt9zkZ:bbBADYp4YpuWHxmTlmTTx4i3pxbKoQnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779796293, "uuid": "30a28a91-77fa-44e8-abb3-965b7a9d184b", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779796293, "uuid": "59b04ece-f32d-4ac9-9b9b-93233578e81a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796293, "uuid": "8bb28e40-0189-4785-a91b-7545db666321", "value": "0d8da544ca387d036d255a462b860dc42228a0bb0b9fa4914f899436a3bd7d54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95b8f6b-58ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778005, "uuid": "16a44bcc-a28b-4178-a087-0f4f5e0d4b97", "comment": "Malware payload", "value": "a67bdee71bfe9c9fa76fb948414a8f53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778005, "uuid": "54749428-72dc-49dd-952d-ee914d9a548b", "comment": "Malware payload", "value": "0de6482c69377a127b91aa9c28d24981b656be44a9181a83c5b014a933987216", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778005, "uuid": "0e2338ac-21bd-4e47-b7e8-e86325b76e64", "comment": "Malware payload", "value": "78bd61aa99d8e684f540456f14c18cd7904c20ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778005, "uuid": "45c892be-bb20-49f7-b9e8-474b93fc28b8", "comment": "Malware payload", "value": "511989fcd446920451d9cec8acf2347de32c3731b2dbb5f273778c6985c1d8716652f84b2ca4583ea55273ae1038a985", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778005, "uuid": "805a90b4-7037-4e33-acf5-97db60e090b9", "value": "T1CC256C62ABFA210BFDF39F60AAB95091587BBC561D35C54DD11B0A4E0A73E48C871B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778005, "uuid": "221457ab-fe3f-49f3-8db5-65bbe8ba28fb", "value": "3072:jB+bxfj7zVUBznz1/DKkVs/TtLQ6Ro5QNQoKNb9elrgqo/7DXIPp6qwA0z9LcpPA:BBzgsM4QNQoKzbqGGVPlCdJZtQ9h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778005, "uuid": "48154eae-00af-49cf-93b5-5c0d49df498b", "value": 1027966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778005, "uuid": "9229e7d0-01b8-403d-98cb-052109513bf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778005, "uuid": "6c733942-38ec-4ae6-937f-3db097477cb0", "value": "RFQ rfq_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c924e0-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779777006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777006, "uuid": "877db6d4-1a02-49fd-bb37-522e2dcd4e39", "comment": "Malware payload (NanoCore)", "value": "5fcb5aa1fdc9c289de1109170ee84049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777006, "uuid": "1fea509e-2913-409a-a77b-584b5106a0b6", "comment": "Malware payload (NanoCore)", "value": "0eedf3a80df9b816949c1ac066553d40b5bb0113edec7dedd1b19ab7228ec5a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777006, "uuid": "7c9693ac-5aec-4d2a-9e7f-a6db761e024f", "comment": "Malware payload (NanoCore)", "value": "66d3c081007d09225c5980b62239a74945c33417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777006, "uuid": "8f700a57-0a70-4afe-976d-3fa03ac9156f", "comment": "Malware payload (NanoCore)", "value": "234236b196fab8ca600e24565ddb7209a27da329f6486c2f5dd50f2332f252d56e2bf21fb7964b368e5d2f284e3b6090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777006, "uuid": "ccb2b0bf-aa73-4bfd-b014-d6789a18aeca", "value": "T1F914C02677A84A2FE2DE86B9701212039779C2E2A8C3F3EF58D454B75F267E406071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777006, "uuid": "d200b3b4-59cd-4a5a-88da-cb9d2e8e6c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777006, "uuid": "7ef1c03f-7a17-48ec-9951-017bb7e6a93f", "value": "6144:sLV6Bta6dtJmakIM5litzMM3/mpjxE7pzpTVV:sLV6BtpmkqitoxizpZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779777006, "uuid": "96f722c3-3181-435d-b13a-32349965b792", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779777006, "uuid": "9374e587-22f4-4ac7-ad25-d70fbe642648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777006, "uuid": "7026a383-3a94-4e53-aa81-e95c3ea2a2c4", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ce9346-58ba-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779769243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769243, "uuid": "795f03cf-85fa-4ce1-99f2-df1339df0217", "comment": "Malware payload (ACRStealer)", "value": "0f76a34e48216bbeea0125d949457247", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769243, "uuid": "2c81b37f-e8d4-4a6f-b3cb-e94f65199ba0", "comment": "Malware payload (ACRStealer)", "value": "0fe0fb2ef253b3df908d8998d5654b33a72e7ad32832851f6934790cf5dfbb04", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769243, "uuid": "0757ff41-8278-4913-9a75-6d8217880a34", "comment": "Malware payload (ACRStealer)", "value": "8d750542b863aadcc5adf0d92e7c9ad1464f116e", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769243, "uuid": "bc982331-8c41-4517-85fc-e429fe310d22", "comment": "Malware payload (ACRStealer)", "value": "0c4d8f9aa7d376b4226ba399fb49428e4ed078e7cc05cd6b936dd3d98204ed43779148d31e7c151604e298e7701f1fb4", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769243, "uuid": "a29cef00-f96c-4a9b-aa2e-c769d255bc2e", "value": "T12DC57D11FDD745F2E50212329AAB62FF2335AD050F329A9BEA583A7AF9771D10C36305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769243, "uuid": "4a06326e-2409-49dc-8465-50833ba17b72", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769243, "uuid": "1565b265-9752-46bc-9aa3-b71e91b5bdcd", "value": "49152:CuBDQxz0b3RJ2Y0JFDmDF6bZDYisB9dT:CuWxz0rOY0JFxbZETdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779769243, "uuid": "f9a7b1d3-15ac-48ef-8474-66cc852f4f98", "value": 2517504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779769243, "uuid": "f54adfb4-d424-4231-8a89-fc5a7ccb8dfa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769243, "uuid": "730a09e6-3f27-48d2-b147-e694039b1f89", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29c11d9-58c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779773403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773403, "uuid": "9e21eb1d-b76c-426b-942c-9de522c904fe", "comment": "Malware payload (Mirai)", "value": "ce7bced96d5675640af548357cef79d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773403, "uuid": "e4831dc8-6617-4cfe-b6c6-80bfd7d1c9aa", "comment": "Malware payload (Mirai)", "value": "100c27a78ab124a6e489e27b4447eaa300752933bb73e340e1b571d77cf7314f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773403, "uuid": "8a0c041a-922b-4391-a8cb-7e515bcf7453", "comment": "Malware payload (Mirai)", "value": "bfafa03bf09b30974dc4470d4281df0506760983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773403, "uuid": "f32d443d-2461-4c7e-927f-2943282e8569", "comment": "Malware payload (Mirai)", "value": "75ceb080c3574e797be0934cab0e224638fc0c2bd9bb62dca0b1cc8f83d7569641884fa7b4b98fd82bdff97a62e5fe52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773403, "uuid": "a613b211-a31a-4449-a50f-ac6c2d0b4fa6", "value": "T122F32941A646DAF3D4C30FB512A757664632EC295B2B8F05F32DBCF89E075CCB11A268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773403, "uuid": "02b71ee0-86f1-4d63-a404-28a634b1a90b", "value": "3072:HJXZ3fR0lxIRFigFmKajMXUughFYLY6OWIyrzilC+tMxaFD5L:HFZ3fR0HcXUughFYE6OWIyrzilC+tMxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779773403, "uuid": "16898a59-9fcd-40c5-96b0-a58ad46ce60f", "value": 157836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779773403, "uuid": "d33199a0-c308-4ace-8e46-19d59531ad08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773403, "uuid": "a9e5dbf9-e600-4c60-8dcd-4feb3a957d75", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ba4707-58ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779789989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779789989, "uuid": "7be94399-7058-4e0b-b528-250277b4cb5c", "comment": "Malware payload", "value": "dc679e175021502764832adbeddefa54", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779789989, "uuid": "ab6800fa-d57e-43a7-9eba-9ef99a3a5c39", "comment": "Malware payload", "value": "1060429a99ab99144049ec0e4b2c5298a61be739b26bce80e43d9401204a7af0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779789989, "uuid": "f4250bc0-30f2-4824-8c1e-4e473477edd7", "comment": "Malware payload", "value": "f216767611fa0118850d6752f32a1589407ca32f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779789989, "uuid": "62c37e0d-f2bc-4c22-9eb8-3847a36f39de", "comment": "Malware payload", "value": "291572d4cccd82fec50e335a8b9cfa70d2a8d81901e77aab352a25f8305ac4163a2ce0f16ef3a18fabd3c2d30f442580", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779789989, "uuid": "3d5edfd1-8179-49dc-bc01-5beed253866d", "value": "T1723127045AF8071CE3F28E7C6BAE12954836B916FD71CE0861641DCD00A4A13EB7AF27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779789989, "uuid": "3216e16d-4173-47e5-982d-b21cba9be4ef", "value": "24:8lLJ/Bqk+fvbiExpS3SqlqHLCC/+Ba1wNF7Kul7OrWipL/+bIr2zFVrab0R:8NxoiwpKSqan2Y1A7VxkF2bIqzFRaQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779789989, "uuid": "5ff4b506-4530-46d3-8ba9-efd1c5bede15", "value": 1750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779789989, "uuid": "32a269f3-afcf-45a9-a79a-712b37cd99ac", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779789989, "uuid": "558798e1-beeb-42e5-b25f-48cfcd28abf2", "value": "List of Required Items and Services.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1145a26-595c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779839060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839060, "uuid": "aadb5cca-995f-430d-b688-8015c9756672", "comment": "Malware payload (ACRStealer)", "value": "ad82ee491dbb17adb13dc9c7ffefacd2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839060, "uuid": "c279374b-036f-4b08-91d4-4a7240b03faa", "comment": "Malware payload (ACRStealer)", "value": "119b387e12f79637227c095822f018cc3cfb6e1111e0e473e6edadcbc08cf350", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839060, "uuid": "c6a81bb7-bfba-4cc2-917a-9e09f3dd9067", "comment": "Malware payload (ACRStealer)", "value": "da27d56bdff4348dfe3a2f02137a7a987780d6f2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839060, "uuid": "9230ef3a-efff-4589-83ad-2fc793e3c39f", "comment": "Malware payload (ACRStealer)", "value": "e2bebb82d6b2e361c536db6eec262fb800a448eaae12d5f5377fae11ae31f4531aa9a20f0a9d922b25a6e1a91867ff91", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839060, "uuid": "2240436a-49e3-4d80-b96e-d4c7126e90a9", "value": "T138769E81FCDB54B1EAA512320CB2A2EB2331A9090F329FC7D9547B7AAC775E10D32755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839060, "uuid": "a22001cc-b9dd-4d81-a87c-c19a7154d4c0", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839060, "uuid": "3e1a7aaa-dbc1-4beb-a7e4-2da091d61d41", "value": "49152:CPAEM/oShxuxPQ8vfNVljDjpWuOCYDYD1H:CPfcV3uRRnnpHAuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839060, "uuid": "4f1ae257-5097-4ca0-bc63-e310b9772ece", "value": 7526016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839060, "uuid": "260f9e4e-3a8e-428a-aa9c-6008a9da3fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839060, "uuid": "1c0919bc-2666-4b56-a44a-e92fca1ad583", "value": "SecuriteInfo.com.Trojan.Siggen32.45063.3370.18667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e5abd9-590b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779804121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804121, "uuid": "a3a1b7de-7c43-41f7-9d97-4a019d99c421", "comment": "Malware payload (Mirai)", "value": "c896621ba8cdfe13bf6a7b1acad6524d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804121, "uuid": "3bd4ee62-0411-48a5-ac98-f17f965c84d4", "comment": "Malware payload (Mirai)", "value": "11ab20ea0e9cc10786077e954196677ab43ab0e54e73bd8c1850c4d1b0e6a912", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804121, "uuid": "038ddf1b-1d2f-4856-aa82-e4ee77884710", "comment": "Malware payload (Mirai)", "value": "41e70fdccbd261b03dcf2300a1616735b748e563", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804121, "uuid": "2c8d7879-ee72-42f8-a8f7-8174e07355bf", "comment": "Malware payload (Mirai)", "value": "06601283eeac03419b31cae54b8f88b2b1736bcc99373ab2f59b5ffbdf7677f00e1dcc8a821cb6ef5003168a27b49a98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804121, "uuid": "6bfa169f-8418-42a1-946f-ca6af01b4955", "value": "T1A123F11F6C325240D5E9D5FE384E7589AD24854DA8403AFF3CA8B3B3F845B186C3839A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804121, "uuid": "ad93fff6-8707-4e04-80b3-bb4ca4a8c293", "value": "1536:n75x1F3FOw9sfIdIS1u+DQ8TBnouy8B8x:n75b9sf0ISPDfoutB8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779804121, "uuid": "d11c82de-6b4c-4da1-ae24-7417ab9a8b14", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779804121, "uuid": "7bf97357-f735-4bda-a79f-67ee5f2b1284", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804121, "uuid": "e38fd358-98a7-413c-a343-5d9aef2a293a", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5808f75a-5928-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779816523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816523, "uuid": "e75a8aaf-8da3-429a-8341-1b4ec338820b", "comment": "Malware payload", "value": "307fa5bf26d8d1104774c69627533c3d", "object_relation": "md5", "Tag": [ { "name": "aidvertiser", "colour": "#81FFD4", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816523, "uuid": "f381f26c-35b4-44d7-928b-455ca5b2481d", "comment": "Malware payload", "value": "1280cb0d807ad5bcfcc45bd65fba3c30eb9cd928adbacbfee99b38908cf2cb7c", "object_relation": "sha256", "Tag": [ { "name": "aidvertiser", "colour": "#81FFD4", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816523, "uuid": "0186959a-c074-4c54-96ab-53ed80cc6de5", "comment": "Malware payload", "value": "874694d4da4ac498916912cc8dba08b7657a656b", "object_relation": "sha1", "Tag": [ { "name": "aidvertiser", "colour": "#81FFD4", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816523, "uuid": "8dd774c7-69d5-4e0e-8399-1333d2084737", "comment": "Malware payload", "value": "9c2596995ef3fac1988206bf62643a9e8834ac191eaff083392a1d2e30d08121e0d1ac58090d897ddc3d91aec4cdf706", "object_relation": "sha3-384", "Tag": [ { "name": "aidvertiser", "colour": "#81FFD4", "exportable": true, "hide_tag": false }, { "name": "AppleScript", "colour": "#AF5489", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816523, "uuid": "911c01ec-b02b-4038-a916-cec9a682f827", "value": "T1DB3122B37319749793594CA230E020FAEEBFAF1F8858E186E98C432F58C475DEA23445", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816523, "uuid": "0c6ebc1d-a24d-4372-82cf-1f0f7d0727dd", "value": "24:qUeMfxaR5UoTAZOMIsGTzto0KJ1iuz3YMOTgQ7lTzAjc9JAsG0zZxDuSMYr:qXBUoTAEMdGtLK/mZTTlAkJAsFxpMYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779816523, "uuid": "92d4d1e4-5c44-463f-a8a0-034377b64df8", "value": 1624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779816523, "uuid": "18cf4885-13f3-4fd4-8660-e9e456020d79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816523, "uuid": "390072b7-f746-46aa-995e-f12236ed0727", "value": "aidvertiser.applescript", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47950112-58be-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779770969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770969, "uuid": "916995e5-8bbb-4926-9a4e-f3deddfbcff5", "comment": "Malware payload (ValleyRAT)", "value": "4afb25f1c6d862466a1c44709b4fc6cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770969, "uuid": "c8a1eeb2-5d28-43e8-8304-1b9d089c4a24", "comment": "Malware payload (ValleyRAT)", "value": "1290bdba07eb77310f187c0392c5c9469ad2ad74baec9815b033ce99c445daaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770969, "uuid": "eba45508-a043-4c9d-9c02-3585d95b84f9", "comment": "Malware payload (ValleyRAT)", "value": "702fe397e23d41fd4cd5a3f3f76acedb39ee90e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770969, "uuid": "69e042c7-f071-437c-8a2f-162f6a3c16ee", "comment": "Malware payload (ValleyRAT)", "value": "61c029915c0c952555fe4d2b2f0fc9284e7c1839619683db9f6e4321c77cfa6e2e2c408a8969c2cc45abf9061c901e02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770969, "uuid": "729174de-9293-496d-bdf0-c5f2be73f864", "value": "T17BD4AE44EB9810E8DD49F6FA08202DABA77134AA472541DF029DEEA15F37DE44F3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770969, "uuid": "8410aec1-3435-4a05-a8c7-c847b0bded62", "value": "749bda20403cb5de597ca37e628ccc49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770969, "uuid": "e0a21255-035e-4b65-b5d1-fa12df69ba9c", "value": "12288:g8WQWNxnTa+un9QfIjMFA4exbmGEPHtrgAwH7x2qqpw3k:SQWjTa+cMF2bmGYHts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770969, "uuid": "7da85f48-7eee-465b-a16b-b005a33972de", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770969, "uuid": "887d64f3-95cc-4089-b3b7-a75b3617ee5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770969, "uuid": "90bd810f-43da-420a-83e8-d7b129acacc7", "value": "\u70b9\u51fb\u6b64\u5904\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb646530-593b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824958, "uuid": "be6ed2fa-c8fd-41cf-a5f2-ec4e3969e50c", "comment": "Malware payload", "value": "150f6f6e09565db8fef5d40ed4a9b67d", "object_relation": "md5", "Tag": [ { "name": "pw-spectra", "colour": "#181234", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824958, "uuid": "2fa1c3a1-91c7-44df-b600-658cc07d1319", "comment": "Malware payload", "value": "129a792bcca6abe9c3ad00e886197281a68cb9c8797974a956b154ba84b3cac7", "object_relation": "sha256", "Tag": [ { "name": "pw-spectra", "colour": "#181234", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824958, "uuid": "445f7e28-f99b-4d26-9c00-f084e4dc7cab", "comment": "Malware payload", "value": "f8fb3eec47f8e83e9b368520f781a6cd2d485c1b", "object_relation": "sha1", "Tag": [ { "name": "pw-spectra", "colour": "#181234", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824958, "uuid": "778cd0c6-b1e4-4f52-95f6-c586c3a0e1f4", "comment": "Malware payload", "value": "aca81c3f081928cb0bda8cd094e12c4308234fafbe6794f87733f22354d51520a46b9da649eea768ce26b5f2434c07d3", "object_relation": "sha3-384", "Tag": [ { "name": "pw-spectra", "colour": "#181234", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824958, "uuid": "ecb1532f-4c81-4e77-9e75-d9dca78be48a", "value": "T192283352A0910785C3FF98DE06DC8EA23E7C5D6603102F4E4FB78D679AF4EA54295B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824958, "uuid": "d065f1ac-4706-4534-86e6-740c4de64f45", "value": "1572864:SUoc7WIu1ErAeBnMdgPxbpjxWswveeli3nstPqi/BLSfqoZoUlPmXy0orJx1PnSm:SUpuNedbldw2eanskipY9+UNKOJxZS4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824958, "uuid": "54dfb5f0-9a8c-4490-b765-a296e90d2247", "value": 99896078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824958, "uuid": "edd9d65f-2a69-4d5f-a324-139f8a3be8bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824958, "uuid": "e5fbebbe-4b16-4789-ac1c-300d6f7e17e0", "value": "Spectra_Menu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81208593-5936-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779822605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822605, "uuid": "6dd58848-abb0-42f2-b396-a88b71d0784c", "comment": "Malware payload (NanoCore)", "value": "7caae6051783ef34f266fd844e15db01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822605, "uuid": "c9ed78bb-d28c-4760-9755-c929df95e0e8", "comment": "Malware payload (NanoCore)", "value": "12deaec6ed13bc99dc670d7f01739d008c7c76c690fc164148c9dd38516287ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822605, "uuid": "519fd161-4651-4059-ab48-cab257064371", "comment": "Malware payload (NanoCore)", "value": "5738032e33055dd6e6ebbf6b3787c7fbcc08b893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822605, "uuid": "75d039d9-6171-42fa-b8cc-1c62a46f2f34", "comment": "Malware payload (NanoCore)", "value": "6bca7fa25bb328c2bb6977bbaf8c6ff6712ba2380f0a995824c0cf74e7c3632bbe4db3580ce80a5f06b14c045eb207a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822605, "uuid": "2681d0ff-8f9c-40f7-bf55-0922967075b2", "value": "T1C014C01577A94A3FE2DE82B961221143837CC2E399C3F7EE18D464B64F267E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822605, "uuid": "77fca242-c0dd-47ed-82e6-e03302c48795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822605, "uuid": "9c14425d-006a-42c6-977f-fe7ed6c56f1a", "value": "6144:MLV6Bta6dtJmakIM57MBrwBJnaMC8xFev7y4QT1tPm:MLV6BtpmkWMFIPHPe2DtPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779822605, "uuid": "093ccaa9-fb1c-4846-b9a5-fbaafa8d01f7", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779822605, "uuid": "c07d878f-02fe-4524-8903-c087dfb2078d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822605, "uuid": "dce96e72-fb67-43e9-bc7b-7debba01c07f", "value": "new88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d0b2c4-58de-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779784901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784901, "uuid": "7daf0172-c731-4c55-b6a8-a86697872239", "comment": "Malware payload (Formbook)", "value": "77c3852c6a8299e23d8681ec8b6c1c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784901, "uuid": "d2fcc3ce-a3fc-47d8-9b86-6fa6dde4df8d", "comment": "Malware payload (Formbook)", "value": "1307815065111057e99756a8f0e7f590869c275101fa0f6769e529b90e42677a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784901, "uuid": "a587389a-80e1-4dd8-a513-91b175f77285", "comment": "Malware payload (Formbook)", "value": "91a7e9e19808a3baaaa3a94f99aceba3576031ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784901, "uuid": "d9a8053b-ea13-4523-8025-4ee79e8c96b8", "comment": "Malware payload (Formbook)", "value": "5a89dd136de31f33fdbcfd256cc7c9042b33ae3d4f6c8f35ceff92700915f91d8d89cd438d289acf0e6cab14cf0a3510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784901, "uuid": "09f47c29-45f0-4262-a8ed-743cbcb07846", "value": "T1E1350204131EDE02E0F68BB90860D3B417B46E89F970D3139EEABEDB783679159553E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784901, "uuid": "63403b73-fa83-4776-aa0b-0500574affcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784901, "uuid": "42d3ad57-ad6c-4851-a900-488bd3fc4fb8", "value": "12288:1jNdPNsXuH9OWBETmzvOyJrB9UNNrVtOqNIMfDrRkmJoYKgsTkTgQHVRo3eq4O15:dVs+ETWz9urcMfRk3Y6MbotoBDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784901, "uuid": "8a80fc73-533c-460a-9158-5791847d9936", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784901, "uuid": "347bf955-f3f0-4ec3-94b8-c93e96b08ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784901, "uuid": "addb3de5-0d8c-49d2-ad6e-9b5b357983c7", "value": "Yeni Talep Duco_Nq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86fd24f-5953-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779835126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779835126, "uuid": "238a9eb0-4247-4fd8-aeec-4771f0c05d47", "comment": "Malware payload", "value": "f2255d6c779594e6bf2423ab48188040", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779835126, "uuid": "c4c9eca6-8c7f-432a-8bdb-c3eee6e50feb", "comment": "Malware payload", "value": "13276d04bfb4ed0b81c38cb49e70571319fd61f593179bc3bacc6c8e29fc1bad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779835126, "uuid": "d3a209ca-f65e-4860-9eac-752453b52742", "comment": "Malware payload", "value": "2b05a7dd8d3fe95359197dc32543d9fac0bc0b05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779835126, "uuid": "132bd167-1ad8-4b36-bbc1-e71cce2a5729", "comment": "Malware payload", "value": "8aedd21d0ff7278239bef80566e026be214690d50606e06c8588da0e32cdc8bb566bec697c464909cb55c41327ccd698", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779835126, "uuid": "200cc705-9cdd-4011-8a1f-2ec59a55d5e1", "value": "T14BA3294AFC829B16D5C522BFFE4E118933136BA8E3EE7112CD205F2427CA65B0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779835126, "uuid": "1adc32a5-eba6-40d8-8f69-3c2917579fac", "value": "3072:0/SzBLZ2y0pLGzkJyGdfaJaztGhOdO6OM0hP5SE:mSz94pazGsJaztGhOd9OxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779835126, "uuid": "3a72bd39-86c8-41db-b691-fef994cb87a5", "value": 106328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779835126, "uuid": "a9ca6e65-9e83-4c40-996a-20e69172e51e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779835126, "uuid": "02dff3b8-bf1e-43bc-9be4-df10c3b55424", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668d98b8-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783047, "uuid": "2ae9e3dd-090c-4de3-9947-4dad01a7217b", "comment": "Malware payload (BlackMatter)", "value": "1448782d19a14ed581626b9ff5ddbc40", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783047, "uuid": "8a51047a-5fdf-4ac6-9bbb-a1ae45b0fa1f", "comment": "Malware payload (BlackMatter)", "value": "136b57507a3cfe1fc39cf6973869dca7e871e91d63f283c77380fc33298d6d51", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783047, "uuid": "19fc190a-d066-469f-8291-d8fd4efc02da", "comment": "Malware payload (BlackMatter)", "value": "da3a158ae3a3c49ecf83931f1efe87dc5772a564", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783047, "uuid": "84c25a1a-5583-4bf3-9e3c-c88aaa5f1eef", "comment": "Malware payload (BlackMatter)", "value": "7eee49d2a98a98166a3a5f4f5fbe2b92604614fe8e2c4f40a564aac39ffd8b41ad74c25c9c79da72e7d17ea67aeffd19", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783047, "uuid": "c7564ade-3881-4f3d-aa9e-8354a2ff01e7", "value": "T1C3E37D21F612D0B3C87718F13736B1B2F39E8D2C29A56907DAD80F99BC658236F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783047, "uuid": "184b25b5-bf1e-440b-90d6-6ca00777e14a", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783047, "uuid": "d4aa7a63-ce70-4eef-806e-b98bfdb483f2", "value": "3072:K6glyuxE4GsUPnliByocWepl/pQ3WmNYvBqZXUa7XQT:K6gDBGpvEByocWez/qoBv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783047, "uuid": "36252aeb-09b7-40b6-9c02-9ab1c688b44b", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783047, "uuid": "339fbc20-941b-4516-863b-f1c86d9693d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783047, "uuid": "87f5cfe8-f941-4206-9857-5fa7dd565680", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd11c44f-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "833a9675-69d7-41a8-8954-942e238480e5", "comment": "Malware payload (Mirai)", "value": "15fea5eb881ebf813c3c94a786bdb2e3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "e6ce829d-aef5-4fbf-b2fc-dc28aace9f5c", "comment": "Malware payload (Mirai)", "value": "15de9e80ecf601d41eb6966be87f98e6d0abaed584006f47571d31b7a026cc8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "0cd92c0a-dca2-40c4-b5a0-d25ab95700ac", "comment": "Malware payload (Mirai)", "value": "b614961ca008b35dde90a03d6f178cf74adaa4bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "5870ed32-ce28-46d2-b9aa-80a1923da630", "comment": "Malware payload (Mirai)", "value": "f22b130efb8544f8529e8a585540ffc1cf45a6d51a3c0bde7152771f8f882be7adfd35a43e1546996e3d5bb9d0b3f27b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824450, "uuid": "2e6d69bb-985f-4e88-94a5-5a5439a3ad64", "value": "T130639E16D82509A9C286C5B471EC8E3A1B13E5C063837EF71A7AC375A067D9CF849FB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824450, "uuid": "7a487620-19eb-4f58-bc31-1116c7ae1f63", "value": "1536:D/rMkOtfaR0glv2ZKsT5Z7BPxznCI0sCp8udr:DYkwfCFlugsz9xznsxrdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824450, "uuid": "44f67471-a7b7-43df-839a-7ba1cd5f9d7d", "value": 67252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824450, "uuid": "773ad247-011e-4013-9c3c-8d4c02c561bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824450, "uuid": "863dc103-dd6e-4eb2-acd4-0ee65ea8e35f", "value": "Space.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b2f90f-5899-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779754974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754974, "uuid": "a6a93ec2-aeb9-45e4-9316-4452fe6902bb", "comment": "Malware payload (ACRStealer)", "value": "abfa75a8f1ea517c41ea3850728f243e", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "td-distributedruntimehub-surf", "colour": "#E67389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754974, "uuid": "9c8a4498-7da7-450d-822f-5b48ad764e09", "comment": "Malware payload (ACRStealer)", "value": "16a4344dcdb51bd043a360dd954bbee9ed5d497dce177e3114740598cc90d78b", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "td-distributedruntimehub-surf", "colour": "#E67389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754974, "uuid": "ca25e270-7531-4add-9bf7-f457c1ca6f8b", "comment": "Malware payload (ACRStealer)", "value": "da5a657f780de7708b44a884b421b5d981fea869", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "td-distributedruntimehub-surf", "colour": "#E67389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754974, "uuid": "ed540449-6e40-48f1-98c5-3b68c72fac99", "comment": "Malware payload (ACRStealer)", "value": "3840b0eae4860786878cd27810b7743abb529eb7eb3994ebddae04ec84b3e23ece83b67e3da749d43529b4cbda34c354", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "td-distributedruntimehub-surf", "colour": "#E67389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754974, "uuid": "d67fcba6-86cc-42ea-9ec5-aff5f87588bb", "value": "T18EC57C01FC9394F6E402133299A6A2FF63359C091F769E97EA447A7EBA732D51D32301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754974, "uuid": "85c4a892-de40-4c1a-85cc-48ea482041b3", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754974, "uuid": "bd521e97-c143-4126-9c10-728361b36315", "value": "24576:Yjp+5jkRnMUIPEhDesu+IeIou6wcyUa+QSR9+aCVtNYI3GJGs9nY3oHFs8YF963z:Y3McCVN+QSR183L3Ks8Cpb3B9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754974, "uuid": "b1d814e8-9888-48c5-ab26-38ffb5fe6055", "value": 2569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754974, "uuid": "1205915c-ce53-4b38-a7f4-2575ee0f2678", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754974, "uuid": "b146e89a-d21b-464e-979d-79ebe64db64e", "value": "gXjgD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6241726-5906-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779802105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802105, "uuid": "c445df96-692b-4cd9-8571-2b0066c5a3f0", "comment": "Malware payload", "value": "fe4f9ad2ffb66248933e2dcdccc0fe6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802105, "uuid": "f2c0c7fd-be02-43cb-b7e2-0225ca2e8d8d", "comment": "Malware payload", "value": "1722546d1080adf512d5e232e240c749bd20f6cb448c2f1be2487ff811cbf01c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802105, "uuid": "568ee2b7-12d5-4895-aa50-60366d1c0ac0", "comment": "Malware payload", "value": "867f290b888a3c7e42897af70f251c6bf86d16ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802105, "uuid": "32544cfd-f962-4124-b4c0-c0bd44828498", "comment": "Malware payload", "value": "8ae27b46de2db9d50d0c18f9dc2e1638b27b7c6fb6e4a8cdd44572d99308c4ab8a46a2c979e00b920bfeae372d9c9747", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802105, "uuid": "fa47674c-fd9b-45fb-8475-074aaa81fc0e", "value": "T1B8B59C51FCEA94B2D611113289B792FB2336BC094F31DF87D9487E3ABD735E109222A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802105, "uuid": "f8089264-1830-4065-852e-126b6b28a907", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802105, "uuid": "87f02749-3e0a-4fbc-b991-ffbc7d74cb2b", "value": "24576:gY+qy1SBQkzGCcx1ZBmg56DydbOI8J2MyGJDrleiv5pKgnzu7e86UVxILDqYoBdV:gY+ZB9zG5rlnzIOVNLyGmqtYUYD1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779802105, "uuid": "82b599af-f10a-4f69-9d92-8ace91c5b158", "value": 2284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779802105, "uuid": "8b2bd52e-f354-4aec-b3bc-b8230f60f526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802105, "uuid": "5b9726b4-79cd-44bb-9cc0-23a1fe53a44d", "value": "SecuriteInfo.com.Win32.Evo-gen.33748797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446ffb23-5929-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779816920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816920, "uuid": "6564f7e7-cc48-429d-90c3-4151b58e3639", "comment": "Malware payload (Vidar)", "value": "358a982e12784d72461aa17df94d6bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816920, "uuid": "e1eeab8b-1ce6-4747-8a52-a656d9388ca2", "comment": "Malware payload (Vidar)", "value": "17a884c17360f1c91907b844601671dca7e3842fc7dc7a29ce5ac0d1e9ddb57e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816920, "uuid": "28ef7216-bc2c-4930-8d21-35d32522798d", "comment": "Malware payload (Vidar)", "value": "c019147f2ed5d44dcedaa24ff2159450c449d940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816920, "uuid": "298f282c-adbf-4d7e-bbd5-26d6a18d85c3", "comment": "Malware payload (Vidar)", "value": "e2e715540bc4c4c84a331b982d56117897d6d75dfac2bee0bbe2b7322d0373f20c4b953f7aef41aafea7f553fd1a8eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816920, "uuid": "92698fb1-9e6f-4f09-b3bb-88efb970f612", "value": "T1A2A59D877C8454B6D5BA923288B5A1A17731F8490F3537D32F45BABA2E3B7D00E35398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816920, "uuid": "8af98be6-a80a-47a5-8bf2-e6cfa98e6886", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816920, "uuid": "1973b9de-54cb-4815-986c-f78d2bddb224", "value": "24576:uFSvD243j70s6t95OMcmEZnj0IoP8+kQ3AlnocrRtWljaXzsjQ6OgLP88WdALfhm:qS7P3v0sWS6Y8P1PUWl+X3gLPDvD1Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779816920, "uuid": "fcc5479d-2d4b-4e36-9ba7-66a60edb8929", "value": 2222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779816920, "uuid": "97194f23-569a-4bb9-84cf-125444c30fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816920, "uuid": "788584bf-faca-4559-a00e-11ef18c44169", "value": "EclipseV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32888071-58bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779770075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770075, "uuid": "3ba96ec8-0c68-4d72-919b-f7d4ed5912f4", "comment": "Malware payload", "value": "0abb57da3d91514cf53312b2c22a5b40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770075, "uuid": "597cf98d-b205-4e19-97e1-9d79e529d926", "comment": "Malware payload", "value": "19843b5be82930e279582202a5ac52abf01e9562c792bfdc64778ab72395682d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770075, "uuid": "97e92a57-25b6-4db4-9be9-41aba6ed3bc8", "comment": "Malware payload", "value": "e796f039f7467940bb6a26b2482aa35a89e4a214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770075, "uuid": "4a7e0d51-b83d-404c-b1dc-0d2c791966be", "comment": "Malware payload", "value": "c2c0ee7ccec3753567f9ecd4598fff29726d49fb70d73540e5939f7a72db5b66a91b9cbfc108d04a2f78aa500740fd68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770075, "uuid": "b7c6a13e-b269-4eb8-88b9-d724b9fc0fe3", "value": "T145C4AE57F5261C43C4E39A3E16A7C2785267D24A1792A305A30FF4BD3AC673A4F1A7C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770075, "uuid": "ba24a4d9-2e26-4070-ba46-a4cc5f6d0553", "value": "12288:MPr4bIpYlyA65lkKuOcHpFYbgpB5RSjlz6V1ARuRHkZr:tBlv657cJS6A16V1A4RHkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770075, "uuid": "0da29e11-487d-4320-812f-b99555c42ea4", "value": 561540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770075, "uuid": "17861a32-cf95-4aef-9330-e13ff885df9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770075, "uuid": "47e22373-6592-4ab8-9547-e3c147bdea35", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353ad476-5896-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1779753758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753758, "uuid": "bf50fb8b-18a5-4439-a998-1434820a9579", "comment": "Malware payload (SnappyClient)", "value": "089cf4619a8fc225088e73cca628ccea", "object_relation": "md5", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753758, "uuid": "f7535ea5-1608-4516-a786-41f5b5aea295", "comment": "Malware payload (SnappyClient)", "value": "1ab308300660f970a714e41cbb6f83c03c094ec159d9c96cbfad1b580c25ad52", "object_relation": "sha256", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753758, "uuid": "87cfd706-6734-4102-a0ed-327e313ac467", "comment": "Malware payload (SnappyClient)", "value": "49675b7591524840206800d73bff1463a92c652b", "object_relation": "sha1", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753758, "uuid": "b86fea11-d5c7-4ffd-8827-c90d38cf7496", "comment": "Malware payload (SnappyClient)", "value": "dfcf40304ae450815df060aee6bbfce602780adefe5cd68e623a9cb82afde7a51fdd61c95800eda6043c0e0c742c34b7", "object_relation": "sha3-384", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753758, "uuid": "3c8f8ece-8eb9-42a3-affe-f8b71a9de608", "value": "T1BFF6338E88E1181D834B593CD8211E44E74A32BAA7E39AB1E794A6FF04C713F546F47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753758, "uuid": "9ef74d3e-ea38-449d-ae26-5a51d2fd3b4c", "value": "393216:i7CrJyRtzBCC7qSjzsfVCqtAQToDTQ8OgiLpjo0rY:9rJadCKjzg0qthoHQ8Ogipo0rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779753758, "uuid": "0a38f8fe-ad8a-48e8-becf-8f6378e0a8b6", "value": 16302702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779753758, "uuid": "06a40d91-ba2e-4b35-bc31-a270bed1fc75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753758, "uuid": "0e9a4848-4867-4ea6-9218-5e82bbc93657", "value": "289284235475738274", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53ce8dd-590d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779805190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805190, "uuid": "0acc9f15-06c9-4582-b592-c5a5a6d21ba7", "comment": "Malware payload (Mirai)", "value": "c67d3d86d17607f3a8843f86f07dc0d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805190, "uuid": "98f6bbd2-0029-42b5-8230-6ce6d54519a4", "comment": "Malware payload (Mirai)", "value": "1b29c503c2ab3a258e06cf530c4c0fb8ae33c1022cacedb7e91eab4dfb4728f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805190, "uuid": "0ac335d8-2a0b-47e1-ace1-001fa9ee3d64", "comment": "Malware payload (Mirai)", "value": "1ed423155dca8f74dfbfd32209320a93886312bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805190, "uuid": "5651274e-92c3-4f06-b544-f80721089748", "comment": "Malware payload (Mirai)", "value": "3536c5e1094e6bebae4b92e8956e39203246c5086b51350bce9d41643af4155713dcc8b96aad8cc4f4402f0cb39c9443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805190, "uuid": "e80ffed1-e1ca-4331-821a-bb4e1599d5bc", "value": "T1AF042A46FA518F13C5C751F7FBAE42883B266B7ED3EA3102DD256F6423864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805190, "uuid": "c3c2c57a-5ef4-4721-8d02-1a27cd7db24a", "value": "3072:Y6fWakVCPz0M6RqKJ5islFqY4EnyGpoBsEWLeAwGcy:Y6uakVCPz0Hvvim4Y4EyGpqsve5Gcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805190, "uuid": "e56035f8-168b-41cc-bac8-b89a4f1776ec", "value": 180092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805190, "uuid": "5c964e1e-2b65-4342-b3a2-453d5cd2db26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805190, "uuid": "6e853ad0-0bd7-4082-bb66-fba3ea2afae9", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479eb573-5899-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779755078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755078, "uuid": "3cf61612-a41a-4e13-bcbb-e96035a54f1e", "comment": "Malware payload (ACRStealer)", "value": "dfc0a175dffcaf90cc60e46f9c55c751", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755078, "uuid": "6d1d5d98-9df1-4cfe-ae9c-cc7e80dc9b82", "comment": "Malware payload (ACRStealer)", "value": "1bfebf79c24d0813eb39fec74637d52b008188812631a4f666a59fae7c0cef2c", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755078, "uuid": "a845b9fa-bdd4-4bb0-b034-1498a6734d53", "comment": "Malware payload (ACRStealer)", "value": "1054a0619ab8897e6802d129f50faa2df2c02e8c", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755078, "uuid": "f3904a5f-0440-479b-b4ac-21327802f95a", "comment": "Malware payload (ACRStealer)", "value": "14f4f6f1560959008e716dfbdf3131950bbba6113f09f6a9d2dc3268bad2135df0411bc9ac0e71f5685806ec5bfacd91", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755078, "uuid": "34582ef4-31f7-4783-9582-12aab56ef3ef", "value": "T1AFC58C02FD8384B2E402133295AB62FF2735AC054F369B97EA147A7AFD736E51C26315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755078, "uuid": "b3fdfbcd-80c1-45fb-a724-249439dda8ce", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755078, "uuid": "157ad91f-68aa-4565-9999-f356b52f873c", "value": "24576:AJRQA5P3n5D6CjoeOP4ONX69pAHtLLA2Qiw+V50B4qDQr5sE7dL9vk832H9jzeh/:AJ/viHrLAriw85n625MaMjz8hLtB97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755078, "uuid": "8915c4be-fab7-45a0-a57b-1d2814200761", "value": 2688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755078, "uuid": "3633b044-12e2-46bb-975f-fbe1082c5e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755078, "uuid": "7cfe71c0-cc96-4eff-beaa-eca84c16dbb6", "value": "hnmh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4854119-589b-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1779756227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756227, "uuid": "0363c167-5544-4193-9c11-5662d2a87f07", "comment": "Malware payload (GhostPulse)", "value": "f3c801d13523ad32a605e584150ebcd5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756227, "uuid": "d21c097c-d0a5-4ed3-8b07-2177f3e05593", "comment": "Malware payload (GhostPulse)", "value": "1da41c74c16854d4f52888972454ca5912613a4c2a340756f69f38437d4ca920", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756227, "uuid": "ec6b1aa8-d444-4892-8ac6-5dce28f8be9b", "comment": "Malware payload (GhostPulse)", "value": "5d86ee4697d7b59b716ae8c6e0918fbd931a988f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756227, "uuid": "45f9db6a-45bb-434c-84b9-7b06b1573306", "comment": "Malware payload (GhostPulse)", "value": "d2f2237cf4a5f69f189d716eee97c5be1d56e5c7d36eac028196bb6bdad95d38fe9791579b2959ff00048ce673aa95e3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-SnappyClient", "colour": "#EABB27", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756227, "uuid": "06c707b9-2785-47b5-add0-9f325fe6ef1a", "value": "T1AE7633967BC0E0F6CAB9B335CF5EC71E4236E795B2018E5782129E201EE75B119831DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756227, "uuid": "5d0d298e-edd9-4a12-8a54-ef9ce388395e", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756227, "uuid": "2c8c258e-47aa-4a96-9a1e-71195450b361", "value": "196608:+pRJZTNrPhw7VSD4yKuA98sg2WMLcMaXh4Xom:+pHZJrSsEyW9tR3M4Xom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779756227, "uuid": "e0ccc110-7430-4539-97a5-e84bd2f0a1a2", "value": 7328606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779756227, "uuid": "2746b376-9037-4d26-be32-dcedd1459b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756227, "uuid": "2705c326-652b-454b-953c-68813753d6fb", "value": "KFUMZTOS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bdaf85-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824457, "uuid": "4eaefb42-8147-44ef-b421-93bfec96b121", "comment": "Malware payload (Mirai)", "value": "c09f494bee7e03ac78ed0ef14960e97c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824457, "uuid": "c002e184-06ba-4fb0-ab3c-b0b955326b00", "comment": "Malware payload (Mirai)", "value": "1f2d510f2636936ed4479e47c5906f8e2fdb16020866e4cc7fe161f582f41016", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824457, "uuid": "2bc82b47-68e7-4013-9a3f-2bdf4a6a64bf", "comment": "Malware payload (Mirai)", "value": "8f479d6b06f9fc1c316857207988aa4afb4a1576", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824457, "uuid": "44e7541c-8ca2-46b8-a82c-6effe2fa0292", "comment": "Malware payload (Mirai)", "value": "5f38b6fdd74a54ee5d14754213f17b2a4a4416d32216be96b062e422284e5428a0fd04ba7bbee617dd7433d7dd8709d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824457, "uuid": "04798a89-5b13-435c-b46a-88d06e63ac7b", "value": "T1ABF2E1B53189647781F4ACB3D47183E12E7B00B6D4E933A15FB9824CD187612A9B7ED2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824457, "uuid": "3fc1d202-7d79-42fa-a591-62c8efd731da", "value": "768:7rFs5me135wp1C+s9vbM5YNMygu+OR1juP3ACqtqNLIzLtZ6GbryKF/ms3UozZ:7/eRSnQjMgVuP7qtqxgtAgrdtLzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824457, "uuid": "70d85bba-7470-4879-8876-e90520708b6e", "value": 36840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824457, "uuid": "823859e8-05fd-47de-90c6-57c1622bdd33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824457, "uuid": "2b074927-caaa-4c44-9a30-6ddf2b0696c8", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296d0ccb-592c-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779818163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818163, "uuid": "cd35c1c8-abfd-43e8-9f6a-a0202602b791", "comment": "Malware payload (Formbook)", "value": "36629c16781e807e233dbd515c07ec55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818163, "uuid": "c1da7347-c2c5-4587-bb76-d82722f0ad72", "comment": "Malware payload (Formbook)", "value": "1fc0d3b626b104458df9a73e2261bc1150fca4c2a6ceae2fb0343406f4c7d83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818163, "uuid": "501217e9-88f4-4d21-9ac1-edd5048a7865", "comment": "Malware payload (Formbook)", "value": "f4d15eefcba11acb653e846da2f7a26d1c5af81e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818163, "uuid": "c0678780-c319-40ed-ba76-a916b4a80cf8", "comment": "Malware payload (Formbook)", "value": "0448e18d73929a29374e21e636f64a28256a0c47e7f6adc64ed9e4ffe0c71040fee28c61f8e7c8f31a0768705ca40853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818163, "uuid": "8fc8b3f7-4bda-4b4c-bf55-f8cd00e17b87", "value": "T14F450250221ACD09E8969B798C70F7B467301E44F971D323EEEA3EEFB43755658242E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818163, "uuid": "7b727c9c-c0d3-4bd5-b8b2-44384731d123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818163, "uuid": "e1a0db28-01dd-4e62-9992-e1f08d08efcd", "value": "24576:F7lRX8wfJpfKu5NrgWfDAVdagN2jmdZq6uRq+vH+SSSFF:/LDfKufrgJrN2iSJPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818163, "uuid": "394b2583-de49-46c1-b214-03919c3cc8ed", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818163, "uuid": "efd0ff66-fec1-4aaf-90aa-54a9ffa5e13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818163, "uuid": "5b502065-e9a7-4a10-ae83-9465fa0a3dfa", "value": "SC_TR11670000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09ba9c1-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784486, "uuid": "721c5a83-0af3-475b-bbfa-80e4e0e202cb", "comment": "Malware payload", "value": "df82e500c8ecb7bbc1d5bc61187ae565", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784486, "uuid": "70923786-5de5-4d62-904f-b8f5d8764920", "comment": "Malware payload", "value": "2146a9c89601763189a3369e23ed9df93d0e7de9d57d68cd2aa53c8566297356", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784486, "uuid": "a9c97a25-02ca-4210-9de2-1c4b953c378c", "comment": "Malware payload", "value": "bc6cecbbb551cc500ca2dc3eae8be1f59c50a407", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784486, "uuid": "ed2864d7-873c-40f0-baa4-9a4aceb5c03e", "comment": "Malware payload", "value": "daaea333dbd9bf0b8b3f2dc4f7608b0c939bd31dd47679cad7b22cf171480e9a3552b98b016e7fed719135c413c06b59", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784486, "uuid": "575e1bf5-31c6-4394-97d7-da42fef92d8f", "value": "T1B903F8118C591EB0D38BC17D7F899455722A2A1B0A197834FEECD6901FC8B3582F99BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784486, "uuid": "dc5a3461-c522-4cc5-b78f-43859e807fe2", "value": "384:HGkGO/0fbxyAXtAn/q8jU3R1Ohb8IXQME5eTGZN9tqeyjtdV80zyulLP4HXAmHrQ:HcbOC8jm+8IgMMv0dVdyHbLw7vrrRP7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784486, "uuid": "47f630d3-30ae-4ddc-b38e-ff53e518f558", "value": 39961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784486, "uuid": "f78fba65-0974-4a28-9230-a0df523f2418", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784486, "uuid": "0d02d3df-8a17-4e22-bb0f-2970e544b901", "value": "2146a9c89601763189a3369e23ed9df93d0e7de9d57d68cd2aa53c8566297356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456d8d01-5939-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779823793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823793, "uuid": "06da6cba-4133-4f23-8d83-1a2b0efa3213", "comment": "Malware payload (ConnectWise)", "value": "5100ffe4c6efb9d3baa5d5e6e9d08da7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823793, "uuid": "78a15ef2-abed-4879-b9e6-501d669afd69", "comment": "Malware payload (ConnectWise)", "value": "2186855f4b59b08be5b16aaf91243cf34d8b9d3b7fe91c4746097e6034d0e70f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823793, "uuid": "7ceb4fca-922d-42f5-b526-068c46465de0", "comment": "Malware payload (ConnectWise)", "value": "069d5f7b37faf2199deabfe160678b1dfb9b64d7", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823793, "uuid": "94a530cd-9953-42d0-9c4f-785756b0e32e", "comment": "Malware payload (ConnectWise)", "value": "b495a1af68e88f5136cd8beed1950b0420c644fe8ceedabb47b56c33183424d6975f220fc1b09dcc196992e63b43746e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823793, "uuid": "0d73d308-6da1-4166-9bf2-3880702a5ac0", "value": "T1CB646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823793, "uuid": "bd246daa-3e50-48ab-8b36-c739b5df3918", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823793, "uuid": "1c41402d-ee26-4492-bc8e-953186ce6155", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFvi9pPH:B1iw7gryNkSV1hy1Z1u2JLa9pPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823793, "uuid": "8905deb8-d5a0-4f08-9614-9948f2d7c9df", "value": 312608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823793, "uuid": "7e33d73c-5498-4874-bf08-4a49518aa028", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823793, "uuid": "d741475f-df46-4fd2-b5f4-17af16657cd9", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58dcf9f9-58c5-11f1-a769-42010a9c0008", "comment": "Malware payload (ClipBanker)", "timestamp": 1779774004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774004, "uuid": "b9c573d2-002b-4b55-8ad9-d4032ef7f853", "comment": "Malware payload (ClipBanker)", "value": "003fded469ed969173c89a706d47913a", "object_relation": "md5", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774004, "uuid": "498cc79b-b77a-45e6-8f7b-d177121d247e", "comment": "Malware payload (ClipBanker)", "value": "21a1302b0de5030820969964eeacd4ed8b7bd5edbe7001e169f728768d5b9628", "object_relation": "sha256", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774004, "uuid": "f24c1b76-abb7-44b3-8a91-572747896026", "comment": "Malware payload (ClipBanker)", "value": "dbeecc518165aaf061d1dc87b7c13d346dac9e32", "object_relation": "sha1", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774004, "uuid": "2cda3623-ce55-4e9e-9327-bbd40e7eb05f", "comment": "Malware payload (ClipBanker)", "value": "e787b741b0a53aa42f756f6675639526f9212c5d0f81b12086e9a0bc0797d3ef47827520596915164593c3594ce9f48b", "object_relation": "sha3-384", "Tag": [ { "name": "ClipBanker", "colour": "#C8C7C4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774004, "uuid": "fc4fbfba-f904-4063-912c-3357c7b2b50f", "value": "T159664B07FCA105E9C1A9E23589A79252BB717C885B3123D72B60F7382F76BD06EB5350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774004, "uuid": "6261f2db-e986-48a2-9162-b3a037a879fb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774004, "uuid": "9033bb84-1138-4db0-a440-8de678e597a0", "value": "49152:QRkDYv9s+Rrz6qCx7CZC/yovKsGLc7+H4d5Yh13mOFJdtV+zB7Dx2j0Jqk5OEtOY:Qizo6NCbL1H4d+h1HdOl3g/R6+uEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779774004, "uuid": "4fa43927-cd59-48ba-ac8a-d0000791f658", "value": 7026779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779774004, "uuid": "c5ddc9cc-1253-493d-a398-01fdeb28d34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774004, "uuid": "f43c2ed7-c285-46ae-9c9c-ea8520091dc4", "value": "003fded469ed969173c89a706d47913a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d77b282-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783058, "uuid": "1687a905-5c2e-463e-840a-83c8b27560d9", "comment": "Malware payload (BlackMatter)", "value": "e96b16aa390ee3888bbcfa87e3a73f9f", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783058, "uuid": "eb6d92ee-c011-45e3-9911-15dd05ce1f02", "comment": "Malware payload (BlackMatter)", "value": "21b12514e8d728ac9c1381540af63aa2501ed5351e21bf9a90162233f9f85b2c", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783058, "uuid": "5e2bfc68-f0bf-4bde-98e8-0f0bac8c73f3", "comment": "Malware payload (BlackMatter)", "value": "23765c717e1f163d91faf20b827c9a55f8727829", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783058, "uuid": "91852285-d649-438a-9d47-728ce9b5c795", "comment": "Malware payload (BlackMatter)", "value": "5b939dd0a3a9f756f447b0ef8ad3cc16365b85249b20005508debdab94ebe6e458f0d3d1ee50acdbad40c5a9be41f9ba", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783058, "uuid": "1b2ae6c3-6e5d-47b4-aad6-1cdaecd69f64", "value": "T1C4E37E21F152D073C87718F1373675B2B39E8E2C29A96947EAD80F5DBC648232F05A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783058, "uuid": "aeef0fbe-561f-435b-a2bb-b3b0039a1b51", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783058, "uuid": "10b7ad3c-3b63-4610-a6cc-e3457c94ce45", "value": "3072:b6glyuxE4GsUPnliByocWepJe7GwVNkg:b6gDBGpvEByocWe3oGwVNkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783058, "uuid": "a395b8b1-8045-4058-a218-798a001b2ee5", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783058, "uuid": "822b37c6-c529-4cec-9121-23f311bb7f93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783058, "uuid": "85aa9b7d-8886-4810-b514-82f6f2e029ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1628c30-594f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779833477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833477, "uuid": "2a546558-afba-4ebd-a938-b2a2f1910322", "comment": "Malware payload", "value": "f2e3f1a295999cf598aa47d2981699a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833477, "uuid": "a45af1a9-7ba6-4f62-83f7-a672d29b6915", "comment": "Malware payload", "value": "258c14ec310e17504a0df203a3796611baa5b7e021de79123de4ba0ba6ed73d2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833477, "uuid": "cdacb74e-104b-4564-a4b8-0da022e6d540", "comment": "Malware payload", "value": "32ea777019e67d98511ab36e6e6b8f8f368b2379", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833477, "uuid": "70c789ef-1420-4d5f-90d5-dccc30062b94", "comment": "Malware payload", "value": "2fd5104fb3f0c833b022d6832cb961cd4c6793e9d0d8066382bbbcdafc3c9872a041282a5a77f34a0b63c1c6dc3e9e7f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779833477, "uuid": "29f68608-03be-4d11-b998-365a7fa720f7", "value": "T1DEF02EE1AC2A447737AA446EF0C55C6C17A6141B848628D0391E58F2DF5FE48F126D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779833477, "uuid": "358f389a-9e58-4d08-a60e-5bdc867e93b7", "value": "12:VAhriHic8J+TNLIWxGg91BeQZFB0OC6HaZYmt7CGw91+4yK:VAZiHiHwTNLIO9h7B+psyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779833477, "uuid": "8d4502e8-837e-4c3a-ae47-bca5750ee9a1", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779833477, "uuid": "91bba65a-4c21-4e9f-9fd0-3eb59e4dc6ba", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779833477, "uuid": "8f643ba3-1b81-4075-b765-8cedfde48a53", "value": "toto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebec2c45-593a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "cba2c3e5-8b90-46dc-b207-2ea20b63d94f", "comment": "Malware payload", "value": "ed0ff2341eddbb945b7995fa099827fe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "b15c786d-8bfe-485d-965e-f1516a066462", "comment": "Malware payload", "value": "259eaf7433afc8daf8b971e1560c5bda300066351ca14e69d4d36751601a87cb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "b99ab225-0c61-4630-bcda-52133455568d", "comment": "Malware payload", "value": "7ff08072ae1040ab499c45d66efdf698e1d57a74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "451ad857-4d7f-47d3-89e6-13ae0d5ce88f", "comment": "Malware payload", "value": "dee43c9d6f199980ab3130d1fa0e2d527272c7abdb46397ecc481882a25e114c9875e9d4cd7ed1fff085f69c78c9176b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824502, "uuid": "e12496c9-080b-4840-aad1-d70bff8e4ac8", "value": "T11F51B3B803E0267385A8D906737585A67003D9E625DF192CBE8AF9E4E9C4933F5297CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824502, "uuid": "1919259c-5821-4584-aa78-30aa5852cd48", "value": "48:fp3BC/pgerp0pu6QY9ur64HpAD5pNfApF2pGznp+M0p4WIfpAvNnpG+tpGp0FplT:wQ/ZIENc+3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824502, "uuid": "3634f442-568d-4e82-b78e-e8e52857966e", "value": 3031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824502, "uuid": "f6fb8d3d-9008-44ed-875d-bbf6085298ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824502, "uuid": "a110033a-51bd-4529-b5a9-b68df31cf3aa", "value": "peniss.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec42ecf5-593a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "64f9b825-a32a-4afe-8714-2e85aafe1d09", "comment": "Malware payload", "value": "5e66e14d61c2c2a609fb24bd53f8a18a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "c4cfdda4-771d-4e9a-93d0-1cca33c133b9", "comment": "Malware payload", "value": "281202d7e0913ef38cd90ad6a9de98a1c7422a76cb949f36cacda44881652856", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "a26ddb05-ad25-40af-9639-e49de1401896", "comment": "Malware payload", "value": "a711a8559ceb8bee8cbd0201439ab9b5c1965bb3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "aaf40f03-470e-4f38-90dc-59ffa9d7b616", "comment": "Malware payload", "value": "f8fb2b0e681708efc58804b0e0ee7830e5ba21ec2988ddec24737e5f11650492efa0542d5b1ba2a1bc0540466da26ccb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824503, "uuid": "92855f1a-d5bd-42a9-becf-15b34798e203", "value": "T16EE30946FD419F13C5C321F7FBAE42983B266B6DD6FA310299257FA027874D60E3A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824503, "uuid": "3bff3d68-b664-446c-9735-84d83a0857cf", "value": "3072:Sj+pLOpMsJpesFEcO/46j4fO2kL94ANd4j:q+pLaPeWBO/4uqO22mANd4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824503, "uuid": "1093795f-a302-4b05-b1e0-ec1d8d5b2a43", "value": 147104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824503, "uuid": "6903ea53-2726-441f-aee4-a1cba64971c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824503, "uuid": "29f174f8-896c-458f-b659-854a685e5948", "value": "wife.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666b89c0-592e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779819124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819124, "uuid": "e788778f-97a3-4f21-97d5-60fbc2ffbe40", "comment": "Malware payload (Mirai)", "value": "f1c9f6ad9976c0bc3949c51c67c43263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819124, "uuid": "3eeb9321-57f7-4ab1-8dcf-92aecd7c182b", "comment": "Malware payload (Mirai)", "value": "2819562eef6afc8e8a06542a1830547cfb4373bddcc44d90b801c93dc2069058", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819124, "uuid": "367a8848-aaa4-4c72-893d-aebb5dc33bd7", "comment": "Malware payload (Mirai)", "value": "baaa22ac4a0be435b0e7381bfe9f6bee56a17fd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819124, "uuid": "ebc3c5db-71ea-471c-a98c-40246cd8fa91", "comment": "Malware payload (Mirai)", "value": "477593c20def962dc06563ebb8ee6e03215bf1fad2e6fe46de5e2e4e7c5b900bc9ebbc5ce82f1136c4beb15447ae1abd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819124, "uuid": "1dbd71f3-3d7a-4984-9de9-2ce1442ec64e", "value": "T1A9C3D70ABB501FF7E81BCD3B06A91B09348C651A12F57F76B638CA1CBD5A50E16E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819124, "uuid": "73b975ca-8c57-4b8e-b257-b29b6a0adad4", "value": "3072:rAZSWB1sCZkrahn6a/sh/txcakT2v8nROazu14/4kQtHr0xqTQbh:kFPwrmn6a/G/tin6yOazu6etHr2qTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819124, "uuid": "90ba5d75-2f9a-4534-85b3-13c6c207b903", "value": 122504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819124, "uuid": "a6bf8394-a896-43da-8ebc-ad592deab44f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819124, "uuid": "eb1d36b5-f71d-452c-b790-abcf3d650d9b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b01c63-58dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779783827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783827, "uuid": "35770aec-fadf-45f1-9334-3ea0509491b7", "comment": "Malware payload", "value": "f2eaf487e4b06dc570ae28959a95001e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783827, "uuid": "0d747944-6592-4926-a9fb-c934c03c50a0", "comment": "Malware payload", "value": "283134d603c06e550f10d5a3fa8707e2a58541f72cdd987157d2f8b812a3bf2d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783827, "uuid": "0a0605a1-ed81-4da8-9883-1dc65e13bf64", "comment": "Malware payload", "value": "6ad0f24b3e602d0cada49b43339787cd1b44f9e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783827, "uuid": "38204b04-6c92-477c-87d0-54c955a68b34", "comment": "Malware payload", "value": "8d9ef947b8001c6fe6d06806095710688c3a8f9725304e4d2d421a056878a3997c5e5be28076341e911b058aa0b3ad4d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783827, "uuid": "358d5e05-9b3b-4748-a473-ebdb22f3139e", "value": "T152137C6966857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C09B9CD219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783827, "uuid": "9f4cf880-bf00-4e8f-81c7-503243851ff2", "value": "768:z+s9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:z+Bcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783827, "uuid": "5c48295a-2470-4db9-a67d-442bb5958101", "value": 45522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783827, "uuid": "770d2049-5eba-4597-b4d5-d06a140fe6d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783827, "uuid": "cea2513c-7982-47ac-86c0-79e329475166", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e348664-5930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779819916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819916, "uuid": "60f3e3b3-94ca-4a2a-8511-629c7edd17e4", "comment": "Malware payload", "value": "a75369d86e7ac7b2366ebfeb431a43ff", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819916, "uuid": "b41deaa5-c048-4759-ba0b-c927a56a0d21", "comment": "Malware payload", "value": "29fd20c5322714a7735311ee9e9d62b0e8cf4910f97211c447bcf6c20500a384", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819916, "uuid": "668d8bcd-c613-4063-a9fe-7ff386f05179", "comment": "Malware payload", "value": "5ea2d2feb574da229851fb16153da1de3eec54aa", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819916, "uuid": "c1307f0d-1eab-4ff7-9624-5d5fc55c2260", "comment": "Malware payload", "value": "f972b39151c7e87613b79f1cfc2e29df10062d8865d7db48cd1c29a786ba464a140222ccc13e8f6213179c91b6975543", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819916, "uuid": "e997894a-2646-4fe7-a62d-a561d9f2621f", "value": "T1A4E5336A933EAE5B263CA61C69D07CF84FE8E4F1E45278CF169927116F9308ED19F044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819916, "uuid": "54aa5bcf-b5e3-4c1c-98e9-718dceddd9c4", "value": "49152:41m8KkK9zs39LzoECeMSs2FrGuoqQodPUOHj28f3GsMh+L+/c+dXiU3Tf19mot8y:41/Kksw39c4doqT5f3rh+UgiCTfXxyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819916, "uuid": "9f155c7d-fe05-497d-ad8e-a608886c3bce", "value": 3239176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819916, "uuid": "bbf1fcf0-8476-4f69-8c9f-c5d68655b596", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819916, "uuid": "eb237cd3-1067-41dd-b606-ce34a35229a9", "value": "MSTeamsSetup-x64.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0da388-590a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803749, "uuid": "b598c346-dc47-45b4-8d91-46039cc70ab0", "comment": "Malware payload (Mirai)", "value": "8805000c5b9d07116c8480f698d109a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803749, "uuid": "c61ddb9b-f691-4565-936a-17f470c38a4a", "comment": "Malware payload (Mirai)", "value": "2b5f3a68785769b4609992d33f2e4fc43086b9e7625fa1a0c74d4756d45dc47b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803749, "uuid": "20610d03-56af-47ee-8ff0-82c123ab5a56", "comment": "Malware payload (Mirai)", "value": "d3357bf47df74767222e1f64d45bb8cc45b92b45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803749, "uuid": "ba15994f-7d49-4489-9749-ae5c24e7a453", "comment": "Malware payload (Mirai)", "value": "773296883aef4d9fd99393483719be904873a0e54e1ac4a6cbadbc998bf0b346e41453655c2198663024a8e428b81138", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803749, "uuid": "44d3501d-a778-4442-b998-73e3b8cfee29", "value": "T1DFB31846F8829B15D5D612BFFE4E118933236BA8E3EE3112DD205F2037CA65B0B77952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803749, "uuid": "845ccd6e-9391-4464-b19c-604b8831b819", "value": "3072:EZ3O4d6WJgB/h5PoivYkXalaASunHexCjN9ocmZFv:c3O4d6WKJRrvY5laXunHexCx989", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803749, "uuid": "093eb6ee-46de-4f45-84fd-a7b3cbcb6442", "value": 114480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803749, "uuid": "dce04b70-5842-45e7-8bc4-a1dfe4ad8d78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803749, "uuid": "01fe5fd6-a788-4115-bb25-4218f3fdea74", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e1a6f3-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1779776687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776687, "uuid": "e2382992-35bc-4c18-b20b-ad470d0ca45c", "comment": "Malware payload (PureCrypter)", "value": "a3a7353d3d067b66f9d918bb9c7cd952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776687, "uuid": "12bea62f-f6b7-4d5c-aa19-955043f60ae3", "comment": "Malware payload (PureCrypter)", "value": "2c6f16b5868f5e059d3e54d18fd6042e77448c6783e3a85646d6c632803c958f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776687, "uuid": "f009661f-1b8d-488f-9db5-dde3987c975d", "comment": "Malware payload (PureCrypter)", "value": "140456b65becf90fd16389743cef11db1569007f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776687, "uuid": "1aa6a5c5-2e28-4130-8f26-616c73c76e54", "comment": "Malware payload (PureCrypter)", "value": "c1723042fa8c751f8bfa83ab51add2d4c1144b2f233f0a0c01bcb8a205ba729feff987a475a6f0e23659b12edc3b0ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776687, "uuid": "5ce94b31-cef4-4ada-b0b2-06a6f0dd9e02", "value": "T145C401C276A44F22C15066B2C8E7482917F9FAC73AB3C7463E4913461E413E5CE9BBC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776687, "uuid": "71df6d8b-0fae-4187-b4f4-272998737897", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776687, "uuid": "87c3f24d-6695-407f-b60f-1e400d4ac0ab", "value": "12288:BXGHsJtECqBLHD90i4KNCUBXW6N/FA8IsXWH1OsKVtP+Xw2IifJF3pOG:9GHsJi/J0i4KNH1/FyEg1OsKVtWXbIiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776687, "uuid": "4550ef0d-2f47-434f-b204-99beb11ed1b2", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776687, "uuid": "66ffec15-c4bf-4e99-b252-a4c189903f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776687, "uuid": "cdb63229-5f1e-40ba-a711-f00f7a09d41f", "value": "a3a7353d3d067b66f9d918bb9c7cd952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1228893c-590f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779805668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805668, "uuid": "6c0cd16f-b4f1-4be0-b77d-37b0b7231c5f", "comment": "Malware payload (RemusStealer)", "value": "f569c75406d2910ac758040da0e067fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805668, "uuid": "952ba5bd-3988-4cb5-a7ce-5475e4330adb", "comment": "Malware payload (RemusStealer)", "value": "2d0a4aba600f61d29e6de6bafedb6e3e42118d619e98004a4ed51eaef99ef1e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805668, "uuid": "4e490f74-6d27-4a91-89e1-dde160e337f4", "comment": "Malware payload (RemusStealer)", "value": "abb244bb19f071a1d8a40083f44d20a44df37c8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805668, "uuid": "bc18be46-6376-4743-b560-7eebc060f288", "comment": "Malware payload (RemusStealer)", "value": "54fd94632b964fd91f1f79bbb9bb59e83334fa93af0fdffdf3d0f9cceb7829620a7a4af2a68d0bf8389846c760f0d329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805668, "uuid": "ea345dd7-0dd8-4dc6-8eb2-2b016f252e53", "value": "T195655A43BC8064BAD5EA923189B5A2D17731F8590F3127C32F11BABA2E777D44E35368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805668, "uuid": "f8aa6645-1bf0-4c92-a8c9-efcd262141c6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805668, "uuid": "46b1a504-4ea1-437a-81eb-ad36f60da7ec", "value": "24576:7EjiWtG33iFJ94IAct1+8mAr9s9EjQ6OgLP88W68OzzIcD1LR:42WA33iL94IDj+83s9DgLPMcD1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805668, "uuid": "7e67058d-f08d-4714-826f-0c461fb3b918", "value": 1542272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805668, "uuid": "9dcc1229-ffc1-48a9-aeeb-02999768f91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805668, "uuid": "7b30183c-8d1d-43c1-b82d-e947f7319e4f", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2c6d82-5903-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800615, "uuid": "d633168a-105d-4c4f-84e0-7472d0f50bd0", "comment": "Malware payload", "value": "9f5682216b1c909d3023db623a3cb71b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800615, "uuid": "9c5a4935-bca0-4f23-85b0-1910d222f597", "comment": "Malware payload", "value": "2d7b52fa15022f97a866b631885d8789f4014cb254e5aa5e2711c8b6bfffe90b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800615, "uuid": "80c1f797-2977-4f73-bc4d-5244bf259f01", "comment": "Malware payload", "value": "17542bb85c1d0cccba46e6b36dec83c4bb22a1e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800615, "uuid": "ae7c7233-2a4d-4b8c-8437-a0752f37506e", "comment": "Malware payload", "value": "a7d343fdd3a60511918cea6e64fc2b821d43ed86764dc186d4ad2fcac44b6afabe45b67433268c7bbf7970e6978816a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800615, "uuid": "194a9beb-3b72-4563-a760-b6b159bfc9ff", "value": "T158355239CAD60115F1B7DA14BEF50002A83F7F562A3D89DC1189128F4B7394DA9ADB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800615, "uuid": "2ff7e6db-08b8-4a61-a366-57d3d11f5113", "value": "6144:WXHKU17hnMTE3c8QYS+kVobfKnA+sVZQ1fN4qGiVQ0EwNGB5S3kiEQtUjO98RLH:2HKURhvbfyA+sVOtN4L/wcB5S0pSIEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800615, "uuid": "fa6f11be-c150-4950-8cd6-828281560e49", "value": 1097142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800615, "uuid": "d4bdbbb9-45dd-4200-8d5f-659cd4b15f46", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800615, "uuid": "ff8f8290-dca5-42f8-b7c7-5cb2ff9c8ce0", "value": "SHIPPING DOC INVOICE NO. USF23-26072 IGR23110.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fbbc8f-58bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779770030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770030, "uuid": "1afc88d2-43fd-4732-8256-618d03e212f4", "comment": "Malware payload", "value": "20a919f37886482ec2139c5ef7e0318c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770030, "uuid": "4b4f74ac-fff8-4488-a640-9cf4d344c070", "comment": "Malware payload", "value": "2df465579031a23a8322ab834a7e29c31dba2c80041c2d4421fd4a5f51832c81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770030, "uuid": "54396da1-58b6-4d92-8d9f-c605878f687d", "comment": "Malware payload", "value": "976b22b6f507bf5fc6cea2a7ed792613d5e85bc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770030, "uuid": "9a3798ed-ad76-4959-aef8-ace2edf3a180", "comment": "Malware payload", "value": "bd1c14be5c3e00be2fc06ca261d0d8dcee22c99042724e1ae2a6a9bc2cfaa743674cb4439e29164af86c25fc52dae656", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770030, "uuid": "0c0070e7-7072-483f-93e8-84ffbb7eb202", "value": "T1BE7423CF31B7B5EB97844D3C39A511C2BD204C384CED4E4D8E99B956F268B186CACA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770030, "uuid": "449e91b7-a66c-4bb6-9c89-41e7a7ad45da", "value": "6144:Otio/+y6LbhN/ro/qUPoZG/Og7ysERi0CVp7VyBETf37A4pD70JxD9CRbSgs9ZdF:JlAwENARPCVp53M49oYSgY+TG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770030, "uuid": "1d1a8d62-b57e-4fa8-9c11-0a258b16893d", "value": 370012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770030, "uuid": "a216e5d8-69c8-4fd8-9198-1eb190d22076", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770030, "uuid": "f535b9d6-b4f5-451c-8183-eb23c5e9689d", "value": "bot.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78df7ac9-58d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779779212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779212, "uuid": "af65a2c1-282d-4e5e-830b-f431e71d7c6f", "comment": "Malware payload", "value": "404121be0d526af3d609f9691f6f632d", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779212, "uuid": "b9bdc637-63b3-47a4-880a-7ce662a3067f", "comment": "Malware payload", "value": "2fbcd3769625921eb5a3d506df218931e0797f1e093a913c506741daf2c4dec3", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779212, "uuid": "91f9d7bd-838d-4fc5-bf7c-0042409a0d34", "comment": "Malware payload", "value": "2e35bc7077b475103c001fe044edde918cf7b8f9", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779212, "uuid": "5c19c71b-23b2-4b39-9a53-70ca60a9aedf", "comment": "Malware payload", "value": "5819942e9cc6b8e0a9449d19fecd4fcace2f1887e5d289a3ea30abfa4d4d2c22c457214a37d81cee4b527eb186721c0a", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779212, "uuid": "aacf3553-e0f8-4952-8a87-1ed70a2f53f3", "value": "T1897395CD2EC6F01A46C230E71E27B091A62B4C81E59C9455EFDCB59DB8E9318F13F668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779212, "uuid": "e386fd53-43e8-4c58-90f7-61a22ba190ea", "value": "1536:d+oA8xT0jArXqT3kuDjOeQJUkvVphwGZRwwvP51Ti76aUPueUenZHA2ti/PblXQG:dkDo72qrDLhlMBvEd+Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779779212, "uuid": "ecce9d6a-a2ea-4270-9ac3-ac5f6d5ab33e", "value": 73912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779779212, "uuid": "bbb9ab5b-8263-408c-8a06-58eaf4aad366", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779212, "uuid": "54b3d1d2-a971-4fd0-8711-56877f530962", "value": "YT-MY3SWIFT2026-W3101473-CL3028957-K84830SS-39172029384-AY464910102937584.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f5f4f8-5904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779800982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800982, "uuid": "21927147-6a21-4c01-a398-e22d6bcf7151", "comment": "Malware payload (Mirai)", "value": "4cd3e0789d5fcedd25e857255ebe66cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800982, "uuid": "e21750d5-7876-46ad-8775-d5c4dcdd9c9b", "comment": "Malware payload (Mirai)", "value": "3116a1bf532b0f7b81cd4cb5e11407a7144efe7e7a7c2415bbae9ff308cc17a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800982, "uuid": "b4548cff-659c-47a4-a23a-75a7d6ac6fab", "comment": "Malware payload (Mirai)", "value": "737b846d6160dad6ab2ed01aeecda3d19d86ccf6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800982, "uuid": "078e1f86-917d-400d-8ed1-fd4ca9e84189", "comment": "Malware payload (Mirai)", "value": "53bd203bf8c8b24998a176d33acefa59ba9ccb8aa2eb10734674d81feae9aedc90a95c34d4f5a9f2fa00dc9c51731cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800982, "uuid": "40dfb877-4090-435a-a563-a63925d9853d", "value": "T13D931791BC829A1BC6C5137BFA4E428D37267398E3DE3117CD265F2233CA96B0DA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800982, "uuid": "157aa27c-337d-488c-a8c1-4ba93238da76", "value": "1536:bfXQiU8NPUHmw9+XHeqALywjnb83kxSdvI:DXnMZ+X+nnbPyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800982, "uuid": "34542e52-3759-4513-8658-50d7ca3028c3", "value": 91528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800982, "uuid": "cbe3839b-7359-461d-93cd-5f3c4c7dd8fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800982, "uuid": "9e2cca02-3af0-46b1-920d-22811d2b6e89", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cfb86b-58ef-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779792167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792167, "uuid": "46ce8be3-10f1-4014-a3f0-9ca8dbfe396c", "comment": "Malware payload", "value": "1e5c289739f75271e0f5136b93d0dae7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792167, "uuid": "6e05ec95-69c8-414c-906b-f5d211ec81dc", "comment": "Malware payload", "value": "31b0f515012355e104a1e4f10baff85c3066a037f17272ce9c2445fd8377a96a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792167, "uuid": "e8d2eec5-f826-4841-a50d-424219fcf328", "comment": "Malware payload", "value": "d1813eb15ed321fc7fa4e1c8c0552a02fc789d69", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792167, "uuid": "fd39eb07-731f-4e29-a5ec-95320193540e", "comment": "Malware payload", "value": "e2a671680f9cf4fee57eab67c43e726c23037230a04123ac387ba0aa5fe1aca0b71fe8045a06108736097931568214b2", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779792167, "uuid": "e9602250-7c45-4e76-9354-3726ac9b7e07", "value": "T16931027819B1DBE0C3BD7570442F2F572090BA93DFB097EC960125606C11227FB2EA9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779792167, "uuid": "231864d7-2756-4b3d-aa1a-677299ec5e9d", "value": "24:8f3/Z3fSiirz8jIiDoZhfNOK+AIQjbyRXBIi6KqHHIx:8PFfQojuyA5yDpFqHHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779792167, "uuid": "310d4f05-a795-4500-8a90-6ff45ccad641", "value": 1457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779792167, "uuid": "d3208911-62b5-4b55-9084-5017871773ce", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779792167, "uuid": "85ddbb27-affa-4814-89b9-a830ad73aee1", "value": "1e5c289739f75271e0f5136b93d0dae7.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f843db5e-5939-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824093, "uuid": "8251baf9-5d0a-4f7e-ad8d-0f33209a8e67", "comment": "Malware payload", "value": "16af2592dc40d95f2acc2209f0b0e051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824093, "uuid": "fb4512ec-7863-4906-9205-bf074632bf0f", "comment": "Malware payload", "value": "32536d5c6177c05d66257a957bd7e8d2724ca77735e6d4559a39a46ab525bf5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824093, "uuid": "e0bc1d24-1f1d-4d9d-b52d-2abba7397b2e", "comment": "Malware payload", "value": "b6dacb7dfe7d042106ca89c86e2aa4a85667be5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824093, "uuid": "94ae5679-787d-4317-bf94-2c72633f3580", "comment": "Malware payload", "value": "72c0a75e0208033057ad1026a32eb9915baf3d4c7b3968d7f628dbb3dbe75b7af57da5f7bc2be0b0aca2c86e2efe0836", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824093, "uuid": "9226f2cd-e635-41b6-82f8-ac201fd28ef1", "value": "T10707AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824093, "uuid": "35a0a61d-c7dc-4dbf-8a86-e1339f7b2661", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824093, "uuid": "2a5f3cb2-856a-4619-9c34-7d06acf66ec7", "value": 17334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824093, "uuid": "b1cc1c18-4e1c-4740-a83c-7e27c3cdc201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824093, "uuid": "ba074f0f-a6f3-4c13-a246-1ed504e3f1ea", "value": "32536d5c6177c05d66257a957bd7e8d2724ca77735e6d4559a39a46ab525bf5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b26cc0-5902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800442, "uuid": "348166bc-1c2e-4fa7-9311-2d697df4adf8", "comment": "Malware payload", "value": "c4f9384946925518c11961463f3ad6f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800442, "uuid": "526f340e-270e-4c79-a75d-4f776cff92a6", "comment": "Malware payload", "value": "32abc56beb200a0a20d7e7b631f6e34f708d8846520c5816379460c2816336f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800442, "uuid": "33bb6899-ec93-4c40-9ad1-b171ab39e469", "comment": "Malware payload", "value": "bcf510f0e3958f34b9fcc9ac99897899f21b9873", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800442, "uuid": "8f436ff4-d882-4591-8020-f4a685566b4e", "comment": "Malware payload", "value": "a4069eb1467b6a42f452e3616ceb4d9a8f2efb130d4d9b8c977622becccc7f05b9f587040b16131790ff0099ab8c389b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800442, "uuid": "3460cc4d-00f3-4fd8-a3c5-55d05a08eeb7", "value": "T1FF35DF29D7EA0305F1F39BD4BDB55002993FFE56293DC94C1185028E4A73A09A9B9B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800442, "uuid": "14db82ea-6cec-4c2e-a1b1-e33c99098359", "value": "6144:88eOGBqGPYmMiOujjV8Uu7rjqAxo1o5j+kqTwM52A5UjqSlGyvN2:r/GhMbuHOZl8o5ckM5B6jBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800442, "uuid": "41a6a789-9d2f-4826-9a40-b7a0b1c03569", "value": 1137882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800442, "uuid": "6ecd338e-3a23-443b-a6ad-ea9e10060311", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800442, "uuid": "01b8634a-edd2-42ad-9cc4-d50fc1d2c7b7", "value": "SKM74109765400.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f4081c-5933-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779821477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821477, "uuid": "4b8958bb-8e8e-480a-aafb-ccdc3980701e", "comment": "Malware payload (Mirai)", "value": "741944594d33a8f5f5d39cb30eb3510d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821477, "uuid": "283dcf0b-3b82-48c7-9801-ee95b8812f85", "comment": "Malware payload (Mirai)", "value": "34079023bbefe8aaebe41a272df151f67b23af6a1cb210a90641a9001a5b3e10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821477, "uuid": "707798ba-1c27-403f-b64e-26cf6ffbfe69", "comment": "Malware payload (Mirai)", "value": "694b9bf39d91ec4f66ba9e7e40f4a7b9bb108ef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821477, "uuid": "37a264dc-b33e-43d6-8494-a61cdfbe0c64", "comment": "Malware payload (Mirai)", "value": "d0b989183bfb0b25ecf1d9b940f21df6a75fe4f200dd39eddebd2d47638bbad02341ec2e26f1449c9574ddbe40c6538b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821477, "uuid": "9c6290de-e2a7-4313-8146-ce1a1d98eefb", "value": "T1DE931791BC829A1BC6C5137BFA4E428D3326B398E3DE3117CD265F2137CA56B0EA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821477, "uuid": "4bb182e4-e9a8-4b4c-b817-81d9fda564e5", "value": "1536:CDoFk6egIecOi4SRTmLxL+TyIOCXFQF7RvIt/nwZ:Koi34SRSrCXFS1w/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779821477, "uuid": "aaef7fda-9e40-430b-aaa4-a9c1b48552fd", "value": 88956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779821477, "uuid": "c2e767af-b087-4b57-832b-436c31a64033", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821477, "uuid": "4d90163f-cdfe-458c-9bf3-a5ccdeb700b1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e562f7a2-58d1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779779394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779394, "uuid": "474d1627-fba2-47b1-8fa5-0cbb6513c92d", "comment": "Malware payload (AgentTesla)", "value": "7f31ca4db3c0e5c9215e0e38c75858c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779394, "uuid": "413a0200-d9a5-4c3b-8667-65ea9ca8efe3", "comment": "Malware payload (AgentTesla)", "value": "3420ee11371c89745534a0c17f93fbe3b11991c2cc109b2f33ae9a2a8bfc8141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779394, "uuid": "c31cd3c6-d520-465c-8e70-9d448c100d6b", "comment": "Malware payload (AgentTesla)", "value": "591fe6c66caf1b469e5f0ea66c7c63ea9c5392bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779394, "uuid": "e0900f0f-734e-45b7-ae80-1db652962ee5", "comment": "Malware payload (AgentTesla)", "value": "a0fae2f6b92a0252f284c505cf1eb53d18c6d263e77ee990485f7f2b2c0a805ba70b2a39a09f5ba6267bba4bae621f23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779394, "uuid": "08335f45-93ae-491b-aff4-b744f77c2256", "value": "T1D21394DF719671B1821234A76E2BE067F2AE4C83751D9014EAE9F4D8BC38B2CD475938", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779394, "uuid": "21b6716a-10cb-4580-83b1-4b49de1c3cd1", "value": "768:MFO0VPhkqRTMDlqs52INxZhdyMirbfWrNEeq0iSAvwaW42G7esg6eS39EnuKvTLq:Pm5BINTr8rbfaSD7vwaWbsxeS6nWCgl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779779394, "uuid": "a35d8559-79f0-4fa4-8cdd-2db65c82efba", "value": 44839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779779394, "uuid": "906e27bb-fed8-4e5d-a0ed-cb0acacb43f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779394, "uuid": "6ef0bba4-a44a-460c-a320-2f590196eef2", "value": "facturas vencidas FE9989, FE86765, FD8787567, NV0049890.jse", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee79c1bb-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824506, "uuid": "6e142897-0fcb-4ad3-90d1-c9dc3d3866b1", "comment": "Malware payload (Mirai)", "value": "b4ec891982a33ca9233711923e5ea652", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824506, "uuid": "e7f392f2-eda4-4c7d-88bd-ebe53fb78e01", "comment": "Malware payload (Mirai)", "value": "347c9a0dc9136764d641c98bee0ec6cc7fa8b74996e5a827f33320faa5ef389e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824506, "uuid": "13d1282a-550d-4db8-adab-7a7c6de01331", "comment": "Malware payload (Mirai)", "value": "88ab8b4b3fbd97674c2ceebe35db1ca973ccf68d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824506, "uuid": "c71935c7-9bd8-4210-96d7-cc03baade37d", "comment": "Malware payload (Mirai)", "value": "6265ec7ceab2364833f8e2893048d8d75a03bf9b2795540cd112627b77f636d70cdf1b380bf067629334266594be3401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824506, "uuid": "557358da-2963-4550-81fb-51ebc229bbfb", "value": "T102735B41B3880D43C1970DB0363F2BD6D7AFE9D122E4FA852A5F9B4691B1A33154EEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824506, "uuid": "14675bcd-c221-43d2-b387-4c783b0dbabf", "value": "1536:uJE+FvWG8T9mCFwUzQz4ln7IHl+94tCy/f7P6t:uJE+5x8TTRkg7IF+7gPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824506, "uuid": "db9d780c-4671-4775-81cd-465db32b61d3", "value": 75184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824506, "uuid": "1e4f084b-78b2-4e43-a6cd-f4ed8fc9deb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824506, "uuid": "0fd50129-f29b-4649-b83f-bd519979b431", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c03fa62-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783083, "uuid": "79c6ab08-31a3-46e5-a64b-42acd0f78037", "comment": "Malware payload (BlackMatter)", "value": "d6f5542b08e4a7df8e203fae272416c7", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783083, "uuid": "3a54d2dc-1965-4607-86ae-671a109943c6", "comment": "Malware payload (BlackMatter)", "value": "34ca794e716157290147b180a0d65d47ddf6dedde646957324d40bf299289294", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783083, "uuid": "e8ba2734-e900-44f3-9b3e-f83f10c99743", "comment": "Malware payload (BlackMatter)", "value": "46171c3ab0a471dc6e8f4670a124852381912f75", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783083, "uuid": "88b5d1d8-6a75-4c96-b76c-515759e68c8c", "comment": "Malware payload (BlackMatter)", "value": "b5a2f4f279c4d242b116fe5e1342630b73132f23bd102c80a86da5b2b0f6252266843aed79c6200ff4073661230634f0", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783083, "uuid": "62949587-667a-40e5-9be7-e74a537a7ff7", "value": "T1CFE36D21F222D0B3C87718F53736B572F39E8E2C15A96847EAD80F59BC648236F44997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783083, "uuid": "cf38f4be-31df-40d6-8966-53064a54ea14", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783083, "uuid": "85259989-a340-4207-9fc1-d00f7dd76c38", "value": "3072:Y6glyuxE4GsUPnliByocWepjy754yJIJpjVkFhwVJ/:Y6gDBGpvEByocWeFy7Sy4pj+eL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783083, "uuid": "3cc21e7e-11e8-4dd6-a749-2d7fa31ace7a", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783083, "uuid": "1eed5c9d-0422-4f8b-b403-1d5c6c112bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783083, "uuid": "b23c532e-236e-436e-be45-dcae29abeb05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccda86e-5932-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779820772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820772, "uuid": "d6c2fa3b-b19a-4f11-afcb-6cedd3dff688", "comment": "Malware payload (ACRStealer)", "value": "cb4bcdaa9755840e3dc6079b87676d36", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820772, "uuid": "6669594c-bb44-4253-903a-4e54c131deb7", "comment": "Malware payload (ACRStealer)", "value": "350a2b69e5de4c35dc2b9592e145ff425373356cb2fed475716e1bf7455dd802", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820772, "uuid": "626e1431-3eeb-43ee-9787-1f75eb4a30af", "comment": "Malware payload (ACRStealer)", "value": "823bf52e94837e08884736c10c4b929bdbbe56a9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820772, "uuid": "5c1eae53-d82b-44ff-8f78-be6e4d83a0c5", "comment": "Malware payload (ACRStealer)", "value": "3e38ef52417e4c059b4340c4b8331ae527691c75f1918cf358b66844171977a7b58a9a638244cffde84a578915bd4e83", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820772, "uuid": "32418058-9b71-45b8-84ea-1ebc4a807027", "value": "T174769D51F8DA58B1EA51223219B7E2EF3331B90A1F359FC7C6447B7AAC335A10D23265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820772, "uuid": "842afe76-0017-4496-9089-f449468bc0a9", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820772, "uuid": "3c30cda0-f7ae-4267-85c2-1706de4e506a", "value": "49152:LXY2TgUTOniRuK/LS5lE1SI9zEueZkYYYD1m:LXtMUS+T/Lmy2Zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779820772, "uuid": "b5afa51c-5427-4faf-bdab-1effdab52d87", "value": 7430272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779820772, "uuid": "67748dbd-0025-4c98-9516-c219bada5726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820772, "uuid": "4caa13b2-b3ca-4e98-8de8-4472a86f547b", "value": "SecuriteInfo.com.Win32.Evo-gen.14395324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d57e6e-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763908, "uuid": "9187e3f0-a1e5-46d1-b54a-48ec45a13ea6", "comment": "Malware payload (Gafgyt)", "value": "3d0486a46ac96fc393f7cf3e0081222f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763908, "uuid": "74803ea0-ac40-4be6-bbe1-19a4456223d5", "comment": "Malware payload (Gafgyt)", "value": "37213df6ffed3fae7896c9008dd1c28ec9ea37e123293e0d4fef025c09086f67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763908, "uuid": "a0403052-46ac-489c-8a54-768b4dbdc16d", "comment": "Malware payload (Gafgyt)", "value": "104b046f6918ef4ffbf4287640806e61cb09f6d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763908, "uuid": "41a24e7b-fc54-4a9f-831a-9e7e5f9778aa", "comment": "Malware payload (Gafgyt)", "value": "4a653454f6b6c994834d3513a90a6c221f4e3fcce61752d2ec939c5f97eb4f12bddbfa01b135097bbab0a17604d86fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763908, "uuid": "4e4c59da-5284-400e-ad48-783ede36e120", "value": "T15AB33A56BD018F53C2C315B3FB9F47887B1667F8D2EF3203D925AFA1278A4D60926990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763908, "uuid": "732b1bcd-4b99-435f-aca7-9a5cf03f7185", "value": "1536:tFLUYu/wW9MgwbG84b47XGF2rwGDcCa6rwO0923qVbvR0hrh9Fvo5hJppvq:tFY9T9q6+GQcGK6/U7qHro5hJppvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763908, "uuid": "a14cecf8-2ea8-436c-a99b-e800d9e4e925", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763908, "uuid": "6a02b2dc-8c5a-46c7-9ac0-5228a5bff9ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763908, "uuid": "6a1ef764-87cb-4eb7-baec-92e66886ce7e", "value": "FBI.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2703d904-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779778216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778216, "uuid": "c715c831-b538-4266-a99d-a241c77acc46", "comment": "Malware payload (PureHVNC)", "value": "4e54ab1bcda9a1e6a28c10a29ad4c3b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778216, "uuid": "fd90f991-8f3a-4f86-8b94-0ffef7b20eaa", "comment": "Malware payload (PureHVNC)", "value": "38582041b3f7cc4e17afab411b38cde8d1d434a030a95cca2cc644c43fe8c1b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778216, "uuid": "b40cb988-6c6e-43a1-93a3-221d07270df0", "comment": "Malware payload (PureHVNC)", "value": "db377e25900e737041cb97ca54ef2d5510acbd20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778216, "uuid": "34018399-af9f-4938-997f-f2fad7f56b30", "comment": "Malware payload (PureHVNC)", "value": "9bf4e49434371864123d64f70e983dfea812d08158716e6a746549e5edc731bf3a4bc0960cb67a7f39887beabeab238e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778216, "uuid": "aeef3056-46ff-4497-be07-f5c6c42af230", "value": "T1ECB401CB7BD58B11C2990AB1D8E74A2503EAF5C33AF3D7463B28169E0D823F4D955B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778216, "uuid": "2f45582b-3465-4023-9f65-8b1364fedc1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778216, "uuid": "78b22ff9-c53a-4733-8fd9-8ef1e83e3fdf", "value": "12288:EjQE+zaDs1ocEIb2MyuKqP/I7lO9G8hit:EjQE+KxxIbUCk4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778216, "uuid": "155e78d4-c186-4975-92b6-5b518dc84513", "value": 531968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778216, "uuid": "42e85c94-896d-4f2f-b0cb-952d138328a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778216, "uuid": "ad33d329-8623-4eec-9aef-ba4f11ca29e2", "value": "4e54ab1bcda9a1e6a28c10a29ad4c3b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e090f31d-590a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803867, "uuid": "5b5ca285-9bbc-410c-9bb5-ee81a7426c69", "comment": "Malware payload (Mirai)", "value": "0e2732c3714a42c0c52a90bb315fa12f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803867, "uuid": "ea7efb37-e5ac-4198-8f26-9049b51a7657", "comment": "Malware payload (Mirai)", "value": "385b565cbe102a2f8b72fefa9b4624df05376dd4274d5bd0a3b78293f1799110", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803867, "uuid": "5839b72f-3e57-4aa7-982e-8193044cd1dd", "comment": "Malware payload (Mirai)", "value": "e4a5798c506ea5f518258ac264384a4d853cd7f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803867, "uuid": "d4233e9a-4459-4d66-808e-8f7e1348e315", "comment": "Malware payload (Mirai)", "value": "f8f3cc9945804dfe0151390ac613f71edc1064169c921be4e54506105e0b35de61e21c72f495417cb77ba1bd2283cc7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803867, "uuid": "aa1b4679-c988-4309-8eac-cc7eeda3d635", "value": "T10653F1226D0BFC22C13436BA783E2AC1DB712F71B3F932061A249649FBD25979E945C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803867, "uuid": "dfcecc86-9f7a-4cac-877e-75bd9210c55b", "value": "1536:9OwlXDoW2dhlyC9UmBGxFn7iRC1/yH238pzZEERWwu:9VlXcWEhys8Fn8C1/9mNRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803867, "uuid": "8a1469ad-e4ea-4af1-a7ac-0ebe93ef4359", "value": 65644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803867, "uuid": "137bcc31-73a1-4fb4-82bc-c4af9fd7757d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803867, "uuid": "8ee78827-ed73-445d-8519-6dcba525e094", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3708d12-58ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779778075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778075, "uuid": "9596bb35-8324-4bc8-b82a-3b761539abd0", "comment": "Malware payload (AgentTesla)", "value": "37158b558621adac20964d976625cff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778075, "uuid": "886446e3-4783-4757-9871-d02cc4775708", "comment": "Malware payload (AgentTesla)", "value": "387da5edf39457b69f654637feb52e35be921ce99e7b5f39ebdbcaf77637f61c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778075, "uuid": "1174206f-6c9e-4dcb-87f1-f6a886949fc1", "comment": "Malware payload (AgentTesla)", "value": "e5b00771943a7171e587a9d29db1cf04694089fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778075, "uuid": "dc3c346a-5514-4ba3-a63e-0dd952aa09cf", "comment": "Malware payload (AgentTesla)", "value": "4ba0ab74baabb579fbd89b2e1bb9613009e20a3fb083347147a30f9d0a6f34732542cfc7a74bac2c8af32f8fe2a03403", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778075, "uuid": "c19e70c9-f99f-472c-95c1-1f7d9a467e7f", "value": "T1E6E53C149770E064A8D2CF5DA932B7E4B18F284769F88760711FD2317E9AF5386828F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778075, "uuid": "1d971070-ffc4-4cc5-8e40-e61972bd052b", "value": "98304:s4NmrCtKlhvDWDKoGGyZm8Ny8422EhyLSRSn1euITXZ3CZKcnawdTv9LYJ:pmRyDKAJ8U84NEdnBV3UKcNdtYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778075, "uuid": "9618f82b-d558-48e6-a789-f11c11bf03cf", "value": 3212591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778075, "uuid": "334f16c5-2ae7-43f3-903b-43a72a7618b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778075, "uuid": "c07d6607-91d4-49a5-8aab-112237d01817", "value": "BL DOCUMENTS.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462e2a9c-5939-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779823795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823795, "uuid": "805eaa48-db97-4ee1-a17c-68f9b52cdd41", "comment": "Malware payload", "value": "236cb468441621706cca7b0bf635acd0", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823795, "uuid": "b3e96f13-87c6-4ffb-968b-82776478efed", "comment": "Malware payload", "value": "396338a7cd50d063eb76aa7fabfe7763aceb533355c10244af1f5353f96905e6", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823795, "uuid": "9472f92c-1e97-48d5-8c7b-80f7f8514074", "comment": "Malware payload", "value": "fbd27dea2a4ada670e9e75762ed47bab909a31d3", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823795, "uuid": "8a8ed488-9cc6-4bdc-8973-63281286723b", "comment": "Malware payload", "value": "92ef1f1e2b24d984676589f7ef86111152080c0f38f3eb0d79c9bb21145fdd11db8aa7e9f55c558922eeca871d6961f9", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823795, "uuid": "96fe4112-3f2e-457e-946f-febb80cff23a", "value": "T18B46F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823795, "uuid": "8741ebe3-e385-4793-b396-f7e3796418ef", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823795, "uuid": "c3499947-33e5-4e4d-8b4d-47a450a6ec62", "value": "49152:BfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:Srs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823795, "uuid": "93ef1bf0-916f-4b44-aff3-2efc9cd00cfa", "value": 5648416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823795, "uuid": "9bdf5996-e354-427b-aae1-71df824fb2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823795, "uuid": "ed12bc89-f8d7-43e9-a314-b42a111ef51a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e112e338-58f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779792701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792701, "uuid": "8cd46478-31db-454d-9687-1daa4047b160", "comment": "Malware payload (Formbook)", "value": "8498c149193ed4fbe787331e119efcb1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792701, "uuid": "de931e6c-38a9-4733-910b-b01c905503e1", "comment": "Malware payload (Formbook)", "value": "3a00cc2faef315e0959f4a854c6e2488fac7ff8b4baab557484427f8ece89aa3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792701, "uuid": "8378d6fb-521c-4b13-abd3-bc9e6c905183", "comment": "Malware payload (Formbook)", "value": "4e7f7f7efcc443bef673173c9839a7c24fc0389d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779792701, "uuid": "fc153204-c8e9-4a38-b0b4-3cfc4bb04dac", "comment": "Malware payload (Formbook)", "value": "f0bdcfa1a203c0eed3898641454e529ee735d83b48e9eb0f1995b644ce6f15d3c9723a686e28872528e2d36aee8cc829", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779792701, "uuid": "3bf85819-9257-4f72-a386-1adf8f00115f", "value": "T13B31370456FE1718F7F79E7D98BE12114836BD16CCB1CE0C0264914D1065A12EE3AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779792701, "uuid": "fe804d94-dcda-412f-8606-d7aad97063b2", "value": "24:8lLJ/Bqk+f2binXpSxa3C5gn6G+w2wNFR1GuRBZpugnib8r2zFVrab0R:8Nxo1Zia3ryw2AzZ55ib8qzFRaQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779792701, "uuid": "745eb9fb-23e5-4025-ab5a-d4abac9645c7", "value": 1696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779792701, "uuid": "8c5a91cb-82a4-4d85-a6d9-5d0d5d3b7a6d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779792701, "uuid": "48eaa126-5510-40d3-a087-88d7f52f2eef", "value": "List of Required Items and Services.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b21df40-5898-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1779754681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754681, "uuid": "ed53dd87-0de2-4da4-b394-871d4809019d", "comment": "Malware payload (CountLoader)", "value": "957df45742b4a59c9fe592b9f4f4ab23", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754681, "uuid": "adc5688e-808c-49fa-8673-b24b904ac966", "comment": "Malware payload (CountLoader)", "value": "3a4bd613e5e42e9ec2b6bb549e25009ffd0de63038b17aaeb920f6667fb6364f", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754681, "uuid": "f595c59d-0149-45d1-a560-c3248dfa7092", "comment": "Malware payload (CountLoader)", "value": "a62c4a20f33cbcbaa467c7f559fb290a51a87c67", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754681, "uuid": "b875076b-ba4e-4f04-8510-5b52dcaa304e", "comment": "Malware payload (CountLoader)", "value": "8f152be86fad60d91151975581580a38bd852b033928a3cbe7b2ae4facbc5a3cac2d960641e14067595747099f0f6f1f", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754681, "uuid": "3e17be9b-1e71-4e9d-adfc-3c077d887ea4", "value": "T15A514226EE431CF6E2D38B53D3E3E719BAA988ED81075EC07479C0429C50D790B58E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754681, "uuid": "13d6e374-7104-42c1-a788-4f92ba87d97e", "value": "48:F0ee5xQY7/0LYrHvCrx5xkxbYr9nm6zvPGqpEGduVin9aeE5sFYnnrhW9zIAzn:e7/3Wt7gkT75pE1IfYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754681, "uuid": "3ae98570-025f-4b58-9ee7-38945e00b9fc", "value": 3135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754681, "uuid": "af213aee-3c5c-45ff-9c16-191f0ccc70e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754681, "uuid": "91171823-9605-434d-a59b-bf5bbaa17df3", "value": "image.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9221de1f-5899-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779755203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755203, "uuid": "c136a1a7-3d72-4af7-92a3-5267cc2e39ec", "comment": "Malware payload", "value": "9b9b5cb15cda18396cc54b49bb6fc513", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755203, "uuid": "1dcb7473-3aee-4e54-b55a-5415eb6143bf", "comment": "Malware payload", "value": "3a60aef280501867080bbc1aafec15839796600e4bc3cbd9d3a2677962013294", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755203, "uuid": "fc6a61e5-5d0d-4fda-aefa-e471e1b8f2db", "comment": "Malware payload", "value": "1c4c20ebca056b2221eb5cfa6b9fc38492b24d42", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755203, "uuid": "52880172-105e-4d2e-9254-4b8209d2fa2b", "comment": "Malware payload", "value": "d656247e420f9b3300ea4ccfda33a988dd42203a5c1d4763f094a7a87008971de2bbff7b2b5438ed63c569f3db730abe", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755203, "uuid": "d6271f61-7c2f-4ceb-8d74-15818024ec49", "value": "T1F8B57C1BBC9548F6C069633288B662927B74BC490F7213D32E90BA7C3EB36D45DB5B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755203, "uuid": "350b89eb-ce4e-4868-a564-28ffb09101a6", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755203, "uuid": "28ab165b-10cb-4cbd-a471-25ce8b12c615", "value": "49152:GT8dDhX5IY7zwmMvOtkYxvyURuk9HlWmstrs5Ha:GT8/XmYXXhTwk9HlVsy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755203, "uuid": "f1429fe9-c884-4a22-8bfa-fdcd50a377bc", "value": 2357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755203, "uuid": "6c17d4f8-abd2-4b16-b76b-b022ad7d5e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755203, "uuid": "1b1f6483-5c4f-4853-9d27-04b4a40a93bc", "value": "JLFfdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e33e8a-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783052, "uuid": "7488efbd-29dd-4084-a3c5-679e9c18e3f5", "comment": "Malware payload (BlackMatter)", "value": "e7ab9b2aee4080c9946484c7605c7f69", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783052, "uuid": "5f09191b-df18-4544-952d-685dcc89bd7c", "comment": "Malware payload (BlackMatter)", "value": "3b42403b11b999e966158b0bea2080b863409f37cbae53845ecb1a2af67d8cde", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783052, "uuid": "af007e74-2341-4177-94d3-ad50d9aba06f", "comment": "Malware payload (BlackMatter)", "value": "df6d17f48f9eb91eb6c6212af8dc242103c200a6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783052, "uuid": "710fe03a-2026-4554-b318-6019cd23b561", "comment": "Malware payload (BlackMatter)", "value": "ab00fcab1536a16b20febf5c9420330e54eb6475ae7967c2817badcfb26d28bccd860e89e1c823f2e01f447832850aa3", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783052, "uuid": "f7bd55aa-01d1-4a49-87a8-3607b7e9e4fb", "value": "T189E36D21F213D073C83718F12736B5B2F39E4D6C19A96907EA980F9DBC658232F15A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783052, "uuid": "3b9c62a1-e907-4684-b03d-a1ef36cdf341", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783052, "uuid": "7db1a62f-485b-4dcf-8dba-3d8d3c1e75b7", "value": "1536:wzICS4AwwRlcz5AxE4vGP1iU8KnliIs3iocZMgkGJp1opDqdv/xDak2BvqXmR1Lt:P6glyuxE4GsUPnliByocWepSUtajv6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783052, "uuid": "29100211-9bd9-4d71-a2f8-0270abb41c04", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783052, "uuid": "53dfa53e-2cab-4fb0-adb3-bbdaa384bc11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783052, "uuid": "f903ea32-8ffe-4b12-848e-572046dd58c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558dcdbf-5946-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779829404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829404, "uuid": "6b018362-837d-412b-b759-8295dc1befaf", "comment": "Malware payload", "value": "7b30d0422e7b68ac1f25e55231a9331b", "object_relation": "md5", "Tag": [ { "name": "172-82-66-247", "colour": "#5B088E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829404, "uuid": "c7be807e-70e1-4cdd-a3c4-e5c30f2a3f26", "comment": "Malware payload", "value": "3b5f63f8d93b793cc6aea51e2ee3b1aac354918562f61cc3f74eabd933df4757", "object_relation": "sha256", "Tag": [ { "name": "172-82-66-247", "colour": "#5B088E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829404, "uuid": "eda862af-40a6-4b50-a2e7-a8f5d76f281b", "comment": "Malware payload", "value": "0c352d64d44d7cc7dc5590222847400450b0aeb6", "object_relation": "sha1", "Tag": [ { "name": "172-82-66-247", "colour": "#5B088E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829404, "uuid": "f3b7a65a-1dd8-43ea-9303-896f1306ba57", "comment": "Malware payload", "value": "9ed5f2d0eaa7bfd084eade62aebdcb7a21a44626832c6058c049a3a27c294534e24ce8f49258e17e0cd345145ba630bd", "object_relation": "sha3-384", "Tag": [ { "name": "172-82-66-247", "colour": "#5B088E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829404, "uuid": "474366cd-1357-4635-b157-4f7251f7140a", "value": "T173845D37EB4504BCE1A6C1BCCF678942D772788D0372AECF17E059911E676E46E3A602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829404, "uuid": "06fa5cb7-45aa-4acd-bc89-801a1990f1fe", "value": "a974c92dd0c1408293e67603001cedba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829404, "uuid": "4812f9e5-600e-41f9-96ec-c58787d6d846", "value": "6144:J604SK5G/cPri9eCnrsJvygfST4VXueXVFEUFLV8cpfNXwbdhZvV899N:w08i9kLvgURaCXmdhZde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779829404, "uuid": "84e05aba-dd2f-412e-a3ca-c5fca6509d02", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779829404, "uuid": "4056d92b-3204-4470-9352-3040261644d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829404, "uuid": "ec1f1c8b-f919-4216-85fd-39b909b0dc29", "value": "7b30d0422e7b68ac1f25e55231a9331b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b80437-5933-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779821106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821106, "uuid": "5736b8d3-b80f-404c-8f97-cd1699e774c9", "comment": "Malware payload", "value": "de3f453d70945c533e2feff4e441308d", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821106, "uuid": "2ab9fd26-4713-41f5-90ec-1c09e77312dd", "comment": "Malware payload", "value": "3b61e21b1541a4f18fef24cb2b054c2e1b66fb4bb209f07483f56f70a348860f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821106, "uuid": "e1f945a5-d443-4b8f-a62a-fece035f0b85", "comment": "Malware payload", "value": "76beab2cb50303a7d3a459ec328dec7c482e6152", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821106, "uuid": "1a6f6e5e-c26d-4006-898e-210d8b9896e2", "comment": "Malware payload", "value": "0bd667c4bfcde4ba49f9ddd2e5c316555065fa4ba8aa0d08d78f19e5064e04d681ff4a7c664a7d4a4ffb4965b6a32621", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821106, "uuid": "743f01a7-1e56-4feb-a087-a69947dc0e56", "value": "T1F0A5AD47BCC050BAD5AA923188B5A1917731F8590F3127C33F15B6BA2EB77D40E793A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821106, "uuid": "d318ae39-16ab-44e2-8690-05ed871c0bf1", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821106, "uuid": "6c880f56-7797-49a1-8477-1b0d242cced6", "value": "49152:oYs3QItbIHbQ3l/+JtxBHw/dLaLgLPGZD1l:Q3obQVqtxBHw/1j4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779821106, "uuid": "4c5ed41f-7c0d-46d5-b246-8ea0c5c0969f", "value": 2221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779821106, "uuid": "3ff9722b-6743-415b-a343-be1c6b808669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821106, "uuid": "978884c1-2942-4ddd-b688-6f99ac3d778c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e956ee-5939-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824056, "uuid": "4cc2b92a-07d9-4044-beee-c2d8b6dde953", "comment": "Malware payload", "value": "288ee9953602fecc46ee95d8ea7f19b9", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "pw-xeno", "colour": "#EBAE26", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824056, "uuid": "730e1728-c3cd-4d34-ad66-14d832b5389e", "comment": "Malware payload", "value": "3b6dca60889a2d3cd3a1ab766fef24bfcac74da9be30a55f74f5b626e9c0be3c", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "pw-xeno", "colour": "#EBAE26", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824056, "uuid": "b6726ce1-9006-45eb-b085-f9231629f829", "comment": "Malware payload", "value": "c7e3cc026a4ca48692b4ed4e8a3993be3e6f1806", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "pw-xeno", "colour": "#EBAE26", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824056, "uuid": "7db47371-5259-4259-84f5-e4c0491f08b0", "comment": "Malware payload", "value": "d22cbcd1c736e036446c0977839ba197564159a828bf8581fecef5936d561d8e0af611e9d5fc98a69e2941019c350856", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "pw-xeno", "colour": "#EBAE26", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824056, "uuid": "2e1cda0b-78ca-4699-9f09-06e2e264735e", "value": "T19767337D02317FF8A2D987105E3DB8A9641FC9C81A0A68D248A0D558FE51E45FF72E2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824056, "uuid": "95ec3415-3434-4cc1-b3d2-5fff27d9fa38", "value": "786432:7GkHWeEEN8fII27vL81Z6kq8Zk3xwZLETif:732JFftgQ1g88cEWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824056, "uuid": "00783867-b682-49f0-8168-51ca2fe40564", "value": 30317757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824056, "uuid": "9b325bf6-c7f9-4a6f-918e-d3af1f688b3d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824056, "uuid": "fb04247c-3713-439a-8503-b7a7c929da23", "value": "xeno.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ead94b-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824521, "uuid": "59cbbfe5-97aa-48ce-88ff-64e7097cb190", "comment": "Malware payload (Mirai)", "value": "5d4ff9a571d33c7bc970cf2e7ac70c01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824521, "uuid": "5bfcec70-e550-4dc1-b576-c85ddc3c77f9", "comment": "Malware payload (Mirai)", "value": "3b8fa5f9e75f63b50fbfceed3345f07dc3bd8bbdad9cb8492db33853938f811b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824521, "uuid": "712624d8-e2e2-4462-aa46-f5e208a4eabc", "comment": "Malware payload (Mirai)", "value": "ea1fdffc362ff29465b746423e68edcf409f18cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824521, "uuid": "7ce483c0-e6ee-4f93-ac5d-36b0d69dd81b", "comment": "Malware payload (Mirai)", "value": "91a296ebd1002d3fdc26f247a635bb16253209b5863338eec7ba0cf032969a7118474ec01b4215374d6c5cfc74ec5a80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824521, "uuid": "38e3defa-2a30-4cc0-8430-5b740038059e", "value": "T12C13199AFCC24A3FC1C01379A6AE5A4D3721E3E5D2CB7607CE585B3136C660E1D6AD80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824521, "uuid": "d702631d-49d5-4785-a770-71573876e813", "value": "768:XG2/l2Geuo2SdeQxZE2hgoG3U6ZQ+PVgOJ4MmJdtBNCwToOM:X3JuMQxm2htqzVgOjGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824521, "uuid": "a6d381d7-8dad-4ea5-88e7-6efa2b733fa5", "value": 42788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824521, "uuid": "92a41920-06b4-45df-85ba-558c89ab7d88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824521, "uuid": "084a3215-0aaa-415d-9013-be789ec10ec4", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7e7cb1-58ec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779790846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790846, "uuid": "1a23bc32-a792-4afd-b864-89309588ee5b", "comment": "Malware payload", "value": "9c8d675f57de022c143c8ef45efec289", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790846, "uuid": "362641b7-4251-413b-8026-5f6d205a0a01", "comment": "Malware payload", "value": "3de5b658a8d65e4e84d7795b2c59a0ccc6e42fda635a442c2054f6a79ebfa0be", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790846, "uuid": "55fef21a-06d9-49b6-8980-055a735ab304", "comment": "Malware payload", "value": "26b50cd98bddc6d7ead2289c9bff31cda439918d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790846, "uuid": "c0ed8f10-c69d-41a5-9859-7518568b6aea", "comment": "Malware payload", "value": "14589023d34353ec2cef57fade28786f82db63c754070aa5d85642a7d419959fa6bb99cfbb445ee1c5761da798ae9e02", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790846, "uuid": "b1adccc4-6e92-4372-bd31-327c4fa890ad", "value": "T18741FC192BC11725D3B28E3754B6F301C631B911FA23DB9D49C0A3C8281521AFC36E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790846, "uuid": "ac781ec5-455f-4a36-a335-61dafc6635c8", "value": "24:8Gl93SJrJ8rLP1ySELV8gAn6d+/x9evw+/2oi1T4I0FXQaR3+haboEnE6HZ6N+/4:8Gl0D8au3P9PRMISXv3KaVE656NGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779790846, "uuid": "abb3105c-8273-4a47-a985-4636b00a2032", "value": 2262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779790846, "uuid": "fe9cdf94-a1b5-44fb-b45b-0c93b585a243", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790846, "uuid": "69bd96e2-80e7-4ebc-8701-75ad605ad5f0", "value": "Screenshot 2.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f26f834-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779800160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800160, "uuid": "dba8328d-3291-4bb3-a4a4-d4a655646f2a", "comment": "Malware payload (AgentTesla)", "value": "8b1df878b0de19ab4a248dd99d291133", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800160, "uuid": "e2faf822-4703-4ca6-b1dd-97de7ee54139", "comment": "Malware payload (AgentTesla)", "value": "3ee1860c0f5353263b70752681bd78872a5b9abf642b93669993f28f83933215", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800160, "uuid": "a7b34c1c-14a0-40fa-bdf0-e8814c648f04", "comment": "Malware payload (AgentTesla)", "value": "3ca2c6b52de60ae5cdc399d6ebfcab1a59668ab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800160, "uuid": "341823be-2b18-4c92-884d-786600789e15", "comment": "Malware payload (AgentTesla)", "value": "057c9fd84a7f87b85e2693f3842cef39355c92603f5f2b066b18611e98f3b3ed37add6407f5f9a062cbde890884b6fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800160, "uuid": "87160b70-1e3b-4351-96b7-3ad0d37a0ba7", "value": "T15545AE2DF38C11E8D227C134CBA66232E77578560761BADB0799D61A2F73AD02F7A311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800160, "uuid": "fc1173f4-bb06-4e56-9768-297f9b6f963d", "value": "6a944bd0bcb5d377b2dc62f983448768", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800160, "uuid": "edfa217d-7213-462f-beb2-8fe409fab297", "value": "24576:sS3pMtTglbOZP732xxuNxsOuUnFIR7PjzshSSNLyQmgzbY5AIg9PC:ppMtU9BuNxsbUnF8PP6uQX05An96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800160, "uuid": "2a8c170c-5152-47da-8439-d0ec7fc00b21", "value": 1213543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800160, "uuid": "0ab97aab-50d7-48a1-aada-0b0d6437a293", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800160, "uuid": "265b17c3-c38d-40a2-84e9-a8d238ad3e6a", "value": "Nova ordem.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5f5f5a-5904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779800985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800985, "uuid": "ee695c18-1ad0-4ca2-a9cc-518f999c5778", "comment": "Malware payload (Mirai)", "value": "d8bd71c2b2510f60c4ebc6e9bcb4966c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800985, "uuid": "d7c19334-7a77-4b26-b7ba-f27245d4a710", "comment": "Malware payload (Mirai)", "value": "409a387d0eb9b361a90f0b6da9ec4d1c64299bf738a42f24f4dbd52e5f5bdf5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800985, "uuid": "4a6a46c5-7e97-487a-9a0f-314d2475774a", "comment": "Malware payload (Mirai)", "value": "c6833d3a97d3f24eb6bb38d48f51be2846d39450", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800985, "uuid": "0b7b7af4-97b2-43a0-bf56-9c8f7ab5bc43", "comment": "Malware payload (Mirai)", "value": "5e0b9e15f2f56f45b4080e17e88fc07495d458eafcf7ff8f463d7a2cc8eb5a6f61edc5f3cf493bd3bc4daa8c9757841c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800985, "uuid": "e034ba00-803e-4cf2-9058-b33c6586321e", "value": "T15D041946FA518F13C5C755F7FBAE02883B266B6AD3EB3003DD256F6427864DA0E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800985, "uuid": "43706113-2597-49e3-a5cd-f154b364a90d", "value": "3072:UbIx4G1Jy1cXyVZwPAQN4uBkav2hahpssQKRAPy:wG4Gz4ZopN4OkavIahXQKRAPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800985, "uuid": "329ff5bf-5d37-4688-8ad1-5ac211a3ee85", "value": 175996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800985, "uuid": "60baf1a4-c9a2-4339-baa0-b7d2b6a5cea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800985, "uuid": "2fd09ab3-f9fb-457f-82c3-474d20f423e2", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc7c753-58bf-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779771305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771305, "uuid": "0cce02d8-391c-4660-a62b-b1f83aeeaf74", "comment": "Malware payload (NanoCore)", "value": "f8bf897aff9779149fe83e6292ce34f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771305, "uuid": "dff3ac3c-0f01-4ead-aec2-6d3e7a254ff4", "comment": "Malware payload (NanoCore)", "value": "4121d69c165b16754eb62f1b87930e7c66a69e4c4a5e6526c10e1c4fea547b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771305, "uuid": "444bc22f-1396-4a3a-bf7c-1ee187b49877", "comment": "Malware payload (NanoCore)", "value": "c063457925e2b650e81c85ab9763818cce366483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771305, "uuid": "813f46af-ef6a-4cb9-a878-11fbed0d9e98", "comment": "Malware payload (NanoCore)", "value": "80e60816b9a265de445473d2c527c872f5b831c9dc3471677f7cfd4fbc9099ea36a374af47603e3126e3b72b0356b63c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771305, "uuid": "f8b3fc09-d31b-4754-bac1-e555507cce39", "value": "T1A214C01677A84A2FE2DE86B9A1221213937CC2E3D8C3F3DE58D415B78B267E546071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771305, "uuid": "1ff048fe-4042-4fb2-949a-1e570969f536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771305, "uuid": "eb584cea-12f8-4bf2-ab1c-696d6fefe528", "value": "6144:MLV6Bta6dtJmakIM5cc0kTgdXi6Wv7zoEa:MLV6BtpmkXc1cXNYAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779771305, "uuid": "4080a65f-7889-4571-baa2-66aa49c43200", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779771305, "uuid": "b2f4f531-902c-41d5-82e6-91069075f51b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771305, "uuid": "0ba42d47-36fa-43bb-bc89-92349d4fbff6", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7452c0-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "1de0e244-f7eb-4a33-816c-0d5233f8d9ef", "comment": "Malware payload (Mirai)", "value": "72c84e14cf4c14d408daadb6e04fc8f2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "d06743f5-22a7-4f4b-974c-fc7d7f887e32", "comment": "Malware payload (Mirai)", "value": "4124789b4ef5c38b7edd6196ccdd94658525f5dfbbf1e5dbb921aa5167021352", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "0867f97e-2cc7-47f1-a12f-6d44d05d91f0", "comment": "Malware payload (Mirai)", "value": "31d9a8c8dd3f74ae4144f2b1c5d7bbc85aa807c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824501, "uuid": "30d15cb2-25ff-4727-a66b-5801489e5230", "comment": "Malware payload (Mirai)", "value": "13ab741192267aee191ba53688a22695be11d2b7baa4cdb7580ff7be3b215c2eed0147400ebb7f1ba897ba8afa4caae2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824501, "uuid": "a808aea4-306a-431b-a750-ba46dfc25b71", "value": "T1DFD3F705A942AB11D4D731FAFB9F425833536BB9E3FA3101ED209F6123C6A9B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824501, "uuid": "8d02f632-bfc1-4e63-bb2a-3111ccdf42da", "value": "3072:Vx9VrRroKY0Q0ZA37D7ZL6cMasvlFb6elzslSCSS7Zc/:Vprbqn716cMasvlFbDgS3GZc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824501, "uuid": "9d4d8c87-0232-4f63-aa54-4647934b1337", "value": 135220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824501, "uuid": "11dbf66a-17ca-410b-a058-faa42f653af9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824501, "uuid": "ee475f41-e017-4bda-968f-9e96e3d565fd", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1826f83a-58ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779791505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791505, "uuid": "7a9c2356-3325-469d-81fb-a12099cfab26", "comment": "Malware payload", "value": "26cfc1787e6277b95f634b73cb4a43a3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791505, "uuid": "a94e5195-476d-4f01-9643-158917699694", "comment": "Malware payload", "value": "41adec097d93034cc669bc98a4e7e723f62c3f4bdcf6e017025dd9ad5b7d1585", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791505, "uuid": "6255165c-11d1-441c-be48-1426e1761251", "comment": "Malware payload", "value": "0ea4abb22477cb4b659850cc8d6c62323641b84b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791505, "uuid": "0e23f9af-ac3b-4429-b83e-fce275803207", "comment": "Malware payload", "value": "e8d37514181a351da9508dee0ddf07983fcfc1e9975c3c1da8174c2ae2b76efe03f08cc9cbc0f32e026b5fb55ddecdc0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791505, "uuid": "3de83c2c-f99f-4a32-8163-d77d7be20792", "value": "T1DA71E902429B9B8481FDB5B3120F97C7F734A66469233B734375A6794EB32808D6011F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791505, "uuid": "ba3193f1-a330-4de7-b690-3263ceeab0b1", "value": "48:9jhrL8vBpYxdRschrL8vBpYxdXbndhrL8vBpYxdGdVsXbn1/:LrwZpCsmrwZpsb3rwZpHvsXb1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779791505, "uuid": "effb3ab2-08ec-40ec-8404-a4bee22c7bc7", "value": 3530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779791505, "uuid": "79a08e7c-eed1-4079-92f1-76d60f1813f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791505, "uuid": "8727111b-1068-457f-b420-ae56e0de2459", "value": "\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b \u043a \u0434\u043e\u0433\u043e\u0432\u043e\u0440\u0443.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2884bd-58a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779759222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759222, "uuid": "ffaf1faa-2c09-4644-bc19-4e67f296de26", "comment": "Malware payload (Mirai)", "value": "9c379baa17a609e5d0234c96782d4d5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759222, "uuid": "3ce0348f-7c2b-46fc-9cc8-357ca04a7bb0", "comment": "Malware payload (Mirai)", "value": "429f1f19db79095610d9e4185ef248578f699e193382f3f83c5bb819df698816", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759222, "uuid": "fed0abea-5a97-49b2-b83d-3808d9f8b08e", "comment": "Malware payload (Mirai)", "value": "cda975cdf53c5e63a3c802ece4b8b902aaf6a4e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759222, "uuid": "d8f62786-9273-45ce-b474-bdfef034272f", "comment": "Malware payload (Mirai)", "value": "7d3a445a7d4da9ecc6a568bf0b9e7411a13d15994880dece510c147ae570c865e1ba3ecc09009ddbc6a99dc2a5c9c17d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759222, "uuid": "dbe417fb-6b70-48a7-b197-4774f47fcd2e", "value": "T13D144B46EB818B13C4C21779FA9F42457333D768D3EB33069928ABB43F8379A4E66505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759222, "uuid": "e88ad999-2292-4d0b-bcb9-a024910b170c", "value": "6144:MMoJwxTaXxEzP4lI7A8uiLKGWGL/KZ/0a:8JwxTaBEzP4lWAkOq/0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779759222, "uuid": "a1c8d53a-db1d-45c8-a9ae-6972a817ddd4", "value": 207735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779759222, "uuid": "3fe68a65-f3ad-4db5-91ff-9267d7e191a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759222, "uuid": "d3318cc9-8a40-42cc-9110-61b10a587abe", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8982601c-591f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779812741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812741, "uuid": "a4579e98-96c4-41dc-85d3-10f4546ca490", "comment": "Malware payload", "value": "59ec1ece9f534dbaab87c2b65c047136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812741, "uuid": "a66ec25a-1aed-4d17-b234-ef3869d18afa", "comment": "Malware payload", "value": "44f594e2a9168c6de0d3f74e0d493920fac5210a49ebc73b6bd292eede9e81cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812741, "uuid": "9b1c5e1d-913b-4120-a7ed-e21f0fae9597", "comment": "Malware payload", "value": "152b401c48e95b85792bfad4bee713802ce683d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812741, "uuid": "f86fd08b-228a-4d38-8bde-7e14ff9c240e", "comment": "Malware payload", "value": "f7bf7e35ff5616817af2472b09499f41c75c1555c0bfd51df1c3b6914e0864a2ed542463be937072d1367e82cb7eb708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812741, "uuid": "6b2f9e55-2298-4eb1-a1e3-184d590cf7e5", "value": "T115B5AD51FCEB54B1EA1152324CB292FF3322AD091B369F83D5447B7BBD375A10E22299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812741, "uuid": "405e019e-66e7-4e60-b0f8-0aae0b7e82c6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812741, "uuid": "67196a44-9740-4f3e-a10b-69ea3b3e1938", "value": "49152:VBoEgsDZx4VaVtQkwGjMVeOMSfa7iJuYEYD1gpDZ:VBL3D74VaVEA6ENZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779812741, "uuid": "437b810d-2a4c-4268-a71e-ef70663314fc", "value": 2307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779812741, "uuid": "d55340e9-35ad-44ff-815a-d051930d3e50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812741, "uuid": "6b80ec5e-645d-4c47-9126-7d3505a77249", "value": "SecuriteInfo.com.Win32.Evo-gen.63969584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb88228-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "22ffc08f-6c6b-4fff-ba72-9bffb07b82cd", "comment": "Malware payload (Mirai)", "value": "fd6ef621892cb69dd70ed345e4e8d32b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "9cae65b5-5576-4de7-9a49-ca2b6a98daec", "comment": "Malware payload (Mirai)", "value": "45d8f88064dcf2d9e1492d4c984fc120e160582047b0826e18d5d342ad9caedc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "3e936789-e688-4e67-8cc1-54021e58ad4f", "comment": "Malware payload (Mirai)", "value": "41e1cf7e40ccd3ea5c7a18d82ffefb057d34f9c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824502, "uuid": "0c80025c-239b-45df-9ae9-411ac2a2af81", "comment": "Malware payload (Mirai)", "value": "d082602d0d89419a10cf49ff88fb60675befd0464ff7b732c949926ae00debd5ed18e4bb40f769ce8960a52d0295dcc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824502, "uuid": "1cafe320-4b2d-48fe-a7c4-61d78a3b3ff6", "value": "T1F9F30A06F5519F12D1D211BAFF5E424937232F78D3EA32029D24AFB077878EA0E7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824502, "uuid": "53ac8b2c-6d62-434f-9d64-d5d4c0b26407", "value": "3072:Z9JvrLfxqQK3YqDlcmXpZSc/kIPa72odhsN02UANdkJFwi:Z9J0tHXpsKkiaBMN0WNdkJyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824502, "uuid": "d12bc338-5ccb-4d7f-b6a6-7e0c41e56abb", "value": 167928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824502, "uuid": "4df7433b-cb4b-4a4f-a350-70a5d595f09c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824502, "uuid": "3905569e-1d07-461c-ad12-42207e334750", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870cb43d-5932-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779820897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820897, "uuid": "418126f0-602d-410e-a9db-2830a3876918", "comment": "Malware payload", "value": "8c56e8e3ee079961aad81a5a51fc9030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820897, "uuid": "ac238065-4cf2-4d45-8d81-9ccb32736c44", "comment": "Malware payload", "value": "467ad7cc014c2098f96b7fb681cfda600bb614f2eeb68fd296b70dfd961d02df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820897, "uuid": "f31fe6b9-3b3e-486f-9b72-3c77f00806e3", "comment": "Malware payload", "value": "b5a87ca6b9a6eaf97f0c0ed28a4f99a0a2ddc855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820897, "uuid": "f247e61b-f60c-42f0-b0b4-859f86fc8fd3", "comment": "Malware payload", "value": "c0040e06278adfeb108ae170eaac7f62e1746a135cf48892dbab6d4af4937e8db559357f5a20d30fd0fb31dcb9f82136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820897, "uuid": "9aeb71f2-34c3-4391-9733-868800fefc34", "value": "T1FC94725B3E13B836C33D59BF4891B14A59B85C23A9C8F1423CCFF7686D39D478A0A592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820897, "uuid": "47e95e4a-95bd-41b9-aafa-edc0fab9078d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820897, "uuid": "ce2d4288-8ddf-4330-9fe7-f3dad0198ee1", "value": "1536:U4TshfCyK0ZgCVl9brnY2Ce9nyn+4Z9z:SFCyll9br5DJ4ZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779820897, "uuid": "95dd2282-fb4c-4ffe-9b33-1a9e34316de6", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779820897, "uuid": "78d9ab23-6fa2-4bff-a2e5-357a18307f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820897, "uuid": "da1d5fce-3d17-4fc0-9539-d958a5c89d72", "value": "Top25Apriloice1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92e2e21-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779824524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824524, "uuid": "ad35b8f0-2db5-49be-a4aa-e526978dba6b", "comment": "Malware payload (RustyStealer)", "value": "23ad566e1357680c2540a1925ed1f61d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824524, "uuid": "b9af67e0-28e3-4541-bdf5-b5a38f144470", "comment": "Malware payload (RustyStealer)", "value": "46c8f2fcea461eaabfc8c8c27eca9e4fc589474b43021b0fe95284d8637e9705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824524, "uuid": "5a5c3e88-521d-4410-858e-98ba756c5cc4", "comment": "Malware payload (RustyStealer)", "value": "ad21afa19ec13bbe75d91e714063cad5e07b7b63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824524, "uuid": "97967904-117c-46c5-ab15-36dc9d6a1590", "comment": "Malware payload (RustyStealer)", "value": "b2bb335e2d8ee6f633a5d54afdf2854690263cd0de6ee9f3e9e3bcae406ad5cc0221897974a0845d7c2bf56a244b69f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824524, "uuid": "2b622224-2bc6-4b75-8ebe-d41d340fa8c3", "value": "T175B6F816A76960D9D1BFC078D2935B22BD21709907393BF786C1866A2F21FF8AD3C354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824524, "uuid": "011b01a3-ffb0-49cd-b561-eb0f3ed400ac", "value": "7ed060ac2a923fe8cfde8f62396aff82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824524, "uuid": "9a9ae6c8-34d5-4f18-8838-cd3adf3454c9", "value": "98304:bqMnhWC+9+FnL9WEFUaJDmU+ZPtIBfUbwvcZu:eWj+9+Fz/wunc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824524, "uuid": "29a8a298-fb7e-4879-a767-22f0959074cd", "value": 10489856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824524, "uuid": "38c6082c-84bf-4a47-957d-bb5904b92d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824524, "uuid": "ef19f1d2-b01a-4536-833d-b4f375b7a40e", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee7e542-590e-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779805314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805314, "uuid": "ef02dcd4-629d-4c97-ab25-ddba1e6f7813", "comment": "Malware payload (Gafgyt)", "value": "9b01a92526cdff2484fae85ee3cbc368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805314, "uuid": "26e7795b-f67f-4566-9837-991bc40c2f59", "comment": "Malware payload (Gafgyt)", "value": "4709e4a110cde3d3a41ab7fe26c4156ca0b0bde338cf66e928f5d3571e27bf7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805314, "uuid": "e7419cad-42a0-4bce-8954-138f44eae089", "comment": "Malware payload (Gafgyt)", "value": "0a8a53c37448bc3ecdb9117b5b713b71efe6609b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805314, "uuid": "ce13760b-036b-4a12-8fc9-174a7643201d", "comment": "Malware payload (Gafgyt)", "value": "5ebdaf736d4f0b9ce234d0ae67b505cb0ac389d5af95067b41d0d1d8e110767e60807bd978bbc833228ed561eabd6182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805314, "uuid": "7b23c6f5-967e-479d-aca6-4f135b777ccf", "value": "T12B53F1C5C50B0BCFE32D47B651DCC68B5830F33EB3CA53A9B959B2BA80A9EB8544C541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805314, "uuid": "3671c22c-4440-47e9-9091-66248be578bf", "value": "1536:pBdTlnLrVSR7ASpK/cgZtInaEaWoe2nWsRK2Bnouy8B8P:pBrnLrVg7P4c+tFTWoeoWMKQoutB8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805314, "uuid": "d04dad7a-81cd-4d78-98a8-4005d7c1b060", "value": 61808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805314, "uuid": "5b4506e4-8965-486a-a41e-104ebd90e721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805314, "uuid": "5511ca86-61fe-48ac-bca6-b4c6e6b90822", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90c0792-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763911, "uuid": "f5224062-4e7c-456d-b5a1-8b089c3cf51a", "comment": "Malware payload (Gafgyt)", "value": "183ee0887bb1a8caa54ae47344c24e41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763911, "uuid": "04f3ac1a-e476-4e82-9f85-101f7ed64bb5", "comment": "Malware payload (Gafgyt)", "value": "481523616cea98d994f74265c09efa2aec5a69ecc679ecf7f9555a46b54aaa2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763911, "uuid": "7263d88c-a2fa-4a41-849f-15a6a6a341a6", "comment": "Malware payload (Gafgyt)", "value": "a285175eedbac0b145caf3e1f211063cbcc10014", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763911, "uuid": "792af5fe-39ed-49b8-8099-62a8ece6552c", "comment": "Malware payload (Gafgyt)", "value": "374bc1f8b1a99eb56ede954b1143ce14b58fab71d9c116be20ceaddb76e5056eb31833f19759bdb3393c8c8a80934694", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763911, "uuid": "b211d908-d911-4da2-9a9b-285e6ef727a6", "value": "T1D9A35B03B6D18DFAC08BD1F047DF6A259D32F4FE166371A76394AD902E1CDD12A19E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763911, "uuid": "2ed87672-9a1a-4931-b5ba-24ab80d8106d", "value": "3072:9DO20sEyGiQw2g2BkhP9HJkVX/9jJ3vQteQZCV:9DOTXfW2BkTpmBJ3vQtefV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763911, "uuid": "1098ad57-bd29-433e-ad2a-cea1dbc72147", "value": 100216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763911, "uuid": "538c5431-ed36-417e-a54e-b8ecafcd4f55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763911, "uuid": "94862a83-0eab-4810-a71f-f58ca3fb8cdd", "value": "FBI.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d23ca1-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779778162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778162, "uuid": "86b56ca4-a1d7-4457-995c-b310f2f26393", "comment": "Malware payload (AgentTesla)", "value": "77bb812744710271ad06cf93c6ca3d2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778162, "uuid": "8b44ef0b-0f5d-402a-99bd-5a228f1de60f", "comment": "Malware payload (AgentTesla)", "value": "485f73aff7ba767b4ca18f63e1b271e0dbb603f4dbb082aa37ba9e3a72ed8aa0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778162, "uuid": "498c1e62-34be-4368-8b55-4968e031a312", "comment": "Malware payload (AgentTesla)", "value": "41fea97cb7ddafa3342d0eb1f9fc67814fc8b572", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778162, "uuid": "21014bec-37ef-4219-9e5b-30e44486c1f8", "comment": "Malware payload (AgentTesla)", "value": "f118566a746a0793ab0bff0b82012fd5ba2990a171cd76cb0b53dd233d129a86338f5ea3bd85c814ecce2e1e8d10f90e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778162, "uuid": "fbf2f057-a2f5-4073-9f41-aea53f7199ec", "value": "T189250254630ADE06C4D29BF45860D7F503B84E64A911E3539FEAFDEFF87A3063948292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778162, "uuid": "8852f395-6c62-4362-a997-537839977e1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778162, "uuid": "09a288ac-abd6-4845-b13a-d69a319c0e76", "value": "24576:0gD4TS1p3oKsBzK/qkIIlWyu5LhO1DaKbDtwPvKY7qd4:344pYKCO/pIIgyutYDVbDK6eqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778162, "uuid": "3dcc8b56-76ca-4c42-81f0-81feb82b1d08", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778162, "uuid": "a3870f93-9eae-48a2-ad0a-6b6592e0c255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778162, "uuid": "89bbd377-bd4d-490d-a2a4-adf691c7f659", "value": "pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d6e1ed-58ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779791723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791723, "uuid": "06227cb5-aa5d-4c27-8259-49027f94ea6f", "comment": "Malware payload", "value": "9cc761eefd1cd30408a4328aec6ea511", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791723, "uuid": "a3db67d2-754e-4aab-b61a-b3f7292e7440", "comment": "Malware payload", "value": "490585f82a0ddaafd9eead803859e06dafc0219a5bd1c08482c98f3d37eec231", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791723, "uuid": "6311a4dc-a43c-4050-beee-d5b60c755491", "comment": "Malware payload", "value": "c65f5d8b9072aefafeee73227610f4082843762a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791723, "uuid": "9d92713a-ba6d-4a63-bef9-7e4c8cb2c6ab", "comment": "Malware payload", "value": "45dd19c9daa849e6749a330cf9178dcc1f3292b5c9e6440ed09f626da98f580a07118b6644b2ca55bf16fedc20beec74", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791723, "uuid": "7b2ad2c9-9769-4cec-a515-3388bc7d7e7a", "value": "T174E312099CCC04D7CA7FA449C8826DEA2D7D92CB159FFF22B77A303954ADF500B191A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791723, "uuid": "35618a58-d0bd-48b9-8050-579173cb74cf", "value": "3072:p4zaA7QVLvcYS+SbJ121Tz/+JR+M3IAOvwi8fG+KOsWyk5aJEkD7fFzmxE:yp7QVL0Ik7YTzORRskG+KOJykQJ9L4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779791723, "uuid": "b512ad19-7e49-453e-82d3-5b67ae562d42", "value": 148715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779791723, "uuid": "527851ba-1ff1-4582-a525-90403e78bfc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791723, "uuid": "e29d65ce-72c5-4690-8a13-addda5e39558", "value": "\u0417\u0430\u044f\u0432\u043a\u0430 \u043d\u0430 \u0437\u0430\u043a\u0443\u043f\u043a\u0443 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u041e\u041e\u041e \u0411\u043e\u0440\u043e\u0432\u043a\u043e\u0432\u043e \u043d\u0430 \u0438\u044e\u043d\u044c 2026\u0433.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a375d1-58bd-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779770836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770836, "uuid": "3414b653-9b74-4f30-8b94-84110ba792cb", "comment": "Malware payload (ValleyRAT)", "value": "59608af8559781dd3858dcfea6c096ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770836, "uuid": "9b129b50-5a12-4127-a303-2cf4d4a55fe3", "comment": "Malware payload (ValleyRAT)", "value": "4a185dfac160b1c80a3dc57c0b13b0193f2365fa2f992142e8f757786b9ca0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770836, "uuid": "8f76073a-bdec-4d2c-8899-bb88d24c740a", "comment": "Malware payload (ValleyRAT)", "value": "94e4ec365e2b27b9711c49cba3d249527cfc3f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770836, "uuid": "d85cd6bb-1f69-42e1-9613-b094e8d585b7", "comment": "Malware payload (ValleyRAT)", "value": "626b41a083bdf262226e26a3931340194077af91d48fc3d169ed09407fd44861fcef75f744e72b740edec8817e38772a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bm[lddel]", "colour": "#B9CE8D", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770836, "uuid": "1b75435b-a7d5-446e-983a-270ab602c29e", "value": "T163F7DF22B696CDC3F8568638C8564AE42372FCB0CB5187CF25947B293FBE2C89DB5511", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770836, "uuid": "3ad14f46-bc5c-41c4-8e92-1a276f1b918a", "value": "461926f212e0446fd2ef1c1bca2468e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770836, "uuid": "1e01b7c7-fb64-414a-8e65-8636294659ee", "value": "786432:LS0huYvglTaQvXZ0uaMROe63unQXeNL+VerXl+9YKX2VGCrCl:LSV/yuaMRP63unQOiYujgCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770836, "uuid": "ca0eee01-d13a-4465-8088-bac1d0bf1fa6", "value": 71708312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770836, "uuid": "fada6914-089f-486c-8fad-87f7adca0c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770836, "uuid": "16e6dc05-0e03-41b7-b578-784336104d8f", "value": "inst.aan886600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85aa14f4-58d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778804, "uuid": "3721602f-4975-477c-b4a9-8f280a6e9f55", "comment": "Malware payload", "value": "a91f82146306edb692d2e0128715ec17", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778804, "uuid": "096fd9a6-2206-4a2c-a21e-940bfae80cb1", "comment": "Malware payload", "value": "4acb5601081496ba7576ecd976b1551460028736ce1d820d76c70d0fc4e23d40", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778804, "uuid": "fbc4cee7-f96f-4f36-8b20-4b74ca7da920", "comment": "Malware payload", "value": "70e9ed74d35d6e4933548b8ea509467f1c2d0964", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778804, "uuid": "b5d7fcc6-6753-4444-8d19-9767ad292b9f", "comment": "Malware payload", "value": "9edb3b2406dc4d57b86de385ec1e33972a9522c9bb4fc114184c44a6053f291589317d13bdc63a8f0dfe6020289600f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778804, "uuid": "5e1cb648-2851-43e5-b093-96ed5509a249", "value": "T1E8252C5167FA520CF2F35F886AB75435493BBF566D39D21F1248218E0AB3A009CADB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778804, "uuid": "eeaf5817-94a4-4fae-8c3d-6e0109a58908", "value": "3072:N7KayTuVbFac8lQIjg88lQHZjyJSlmePizrCV/Ma9AiUE8ly/pBlMUY82fDgSp3K:GkG39AinphqfDno/KhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778804, "uuid": "a5d138ee-d119-42c3-9019-d8ff79f8ffa3", "value": 980372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778804, "uuid": "e5817135-b0cd-4630-b787-f5e4e7c4dcad", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778804, "uuid": "140708b1-1fa4-4efc-a528-e25aa67b4c9d", "value": "NEW PO 2085990.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0c00a7-58ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779776264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776264, "uuid": "c0f2dce6-3665-44d1-b7f1-cf25c7cc6da3", "comment": "Malware payload", "value": "a423d25bba138fbb0dc1fee378911065", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776264, "uuid": "08efe51f-7642-4056-a084-455e9d0bf749", "comment": "Malware payload", "value": "4bee1beb8fb7d03ff3d860e3e35992ae8941abd3429d0e6b6933cf2714c50bb4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776264, "uuid": "9c236895-6184-43e6-bbe8-3a9d4a442722", "comment": "Malware payload", "value": "93367c3810641c7315bccd7f8229f73c59a99ff2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776264, "uuid": "4e97e40e-a058-4316-a6a9-30a22e6816bc", "comment": "Malware payload", "value": "fdf5bde8c5303722057b5b7c0440045c1ca373bb99475b5f866c8674bf1dc8e2485a8fb30b0615f00eee3c1051a6b545", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776264, "uuid": "aaf7f903-c81b-441c-a873-1a183abc5c0b", "value": "T18D136D6526953C25AE99883B5C7F2F0CB9A983E2304491DDBFCA3CF18C15A9CE71871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776264, "uuid": "5e43efa1-29eb-4a7a-82ca-a9a3d09381ab", "value": "768:Cr9NyXsZztCk9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:MHusZscy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776264, "uuid": "44daa1c8-301c-4a90-810d-53a0b2026d64", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776264, "uuid": "f9ac6d39-0966-4259-b413-5c1d8bf4ffd6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776264, "uuid": "1166a7f3-5759-4ff7-abd1-afb4c4fdd530", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c4ce61-591b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779811204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811204, "uuid": "485f0139-455e-49a8-8903-e3c511cfb9e8", "comment": "Malware payload", "value": "ad9d3509daa563bd7cb0a292b2ae92b3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811204, "uuid": "1e2e879f-1170-47cf-8ef5-b6b39bc27545", "comment": "Malware payload", "value": "4c7ce5786d066f49bed431e17a96e79ab0984ae98c910f20ede1d072c1fe55ea", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811204, "uuid": "84011183-425f-4a7f-9361-d7d9402780ff", "comment": "Malware payload", "value": "782135cbee47ba409529edc0a055c0045e13656e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811204, "uuid": "639fb8ca-604b-42aa-9f48-96cf4523bab7", "comment": "Malware payload", "value": "3a6c13f452d560a721f9f8ca6bf3179a00ab223a5ab2064c10c18df072703651d3d7d7070ce9716d19220328937e437d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811204, "uuid": "b55fa03a-ece6-44b0-b15e-1f3eb7293bf5", "value": "T1F75633DB4E6B632E6750CD2489132067946C5DCD7C3BF0A5BCA2BC99C31917BA81368F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811204, "uuid": "aee83a0a-393f-4e89-98da-8de14451ac98", "value": "98304:GETyf0F8RwSt9fUxgtV/ARnF8uxPsWICuddptJYgRacQ0c2cUQAZU9C/yCgkw3H7:Gc8r/oxgjARnF8CPoLH+0QUC9CaCgkwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779811204, "uuid": "cb8e7d95-9ebd-4d48-9ffb-7d1a77185eba", "value": 6119903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779811204, "uuid": "1b39859f-5bf5-4809-a2a8-51f36ff68b0f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811204, "uuid": "145e01c1-5c19-4ead-ace6-df0e4b509406", "value": "RHL_19074279.rev", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7241c582-5939-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779823869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823869, "uuid": "dbc892a2-e3ab-41e5-b022-4f67cbebef09", "comment": "Malware payload", "value": "e886a22e533b48b5549492621fe38e6d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823869, "uuid": "907ec5ea-4938-4bfa-9b51-eb7a6c5acd5c", "comment": "Malware payload", "value": "4cce5aa6c0a0645054efc70da02fc793f7d6ad9ebabc873892867b69f229fa20", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823869, "uuid": "37c1933d-88d6-4a68-9725-6a2e586cc4e0", "comment": "Malware payload", "value": "5fa1b5549bb49a60879e95799f65000c2b6ad246", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823869, "uuid": "01a46037-fac6-4f0f-86ed-53886aee1388", "comment": "Malware payload", "value": "a2edba47447212f165304a1325b1000c70d4ef8a7d1914641797180559154c22680a5cbf435bfbbbfd5ff42277b76c98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823869, "uuid": "61a4c325-4660-42f1-b21d-47983edad6d6", "value": "T1A3364B12E2D05831D6F326B545AB3425EE5F6A306FA241C3560BD8A0FE212F17F35E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823869, "uuid": "40b1f296-4a8a-4260-ac9b-0caccc4b79a0", "value": "478e2962478fb36bd09a368525cead5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823869, "uuid": "8fd10a3c-1ce2-46c0-8a17-f53a71946ba4", "value": "49152:1hZT8VMuHM2tF3mx4rJQhHQiT5mHe7M0EcFGgWoIq91tuCWQjb5SQT1Cq2RCzfXu:1u2u03B7n1sfq7tzSQT1CqeUCF1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823869, "uuid": "23bb2561-037a-4200-a57a-60662ec57d12", "value": 5158912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823869, "uuid": "f0abeb68-7bac-4b2d-9907-aa4e77c69331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823869, "uuid": "593670f9-074a-4b0c-aa2b-9278aa1aa9ec", "value": "winmm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9811e6d0-593e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779826079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826079, "uuid": "b1db5fb2-1277-4c79-b83c-239e8ce49cd2", "comment": "Malware payload", "value": "9c7e1ccc87498cafa73f513e45e6356f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826079, "uuid": "7452b9b5-1072-4ad4-a6e3-2ab3bb1cf940", "comment": "Malware payload", "value": "4ce624f7418b53b0f5045025a554ff8c52d4227dd0d11f2b26c3f86b522472c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826079, "uuid": "f44c3c21-ff6c-4a07-95ae-5785bf86ebe8", "comment": "Malware payload", "value": "35fc0015369bb236067cff9990e87b1fefc0e359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826079, "uuid": "759e4e43-838a-42fd-b83a-11956de59914", "comment": "Malware payload", "value": "f58e7633863e6afb775b72d0a837e6b561c3d80c048b2349e5a109e7191768a0bf2e8e14d401a88c7b982d177eb5c59b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826079, "uuid": "51bc278b-cd8a-491b-9790-965b4fba605f", "value": "T15516CF0A1B29FB05D12E86B602642F705BE59412DF86C713B3C46D431AE1B5DBB1B3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826079, "uuid": "076d61c7-78c2-4568-a271-b7a1c0fd6a3e", "value": "98304:bbyvwXpZLTuczWTVmuXZKuCdKZd6pimon8:bbyvupPWTVmuXsuCmd6Mmon8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826079, "uuid": "5c845609-e09a-4907-93d9-2c4cc8838956", "value": 4026368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826079, "uuid": "dd93f3a2-fb84-4827-bca3-2343f09dc53f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826079, "uuid": "df617e44-48c8-4456-a330-88ad8043e9da", "value": "ZapretDiscrod Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1948f0b7-58a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779758436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758436, "uuid": "366dca75-6c47-4c51-9ecb-2ce47abfa504", "comment": "Malware payload (Mirai)", "value": "2b75bde6839e66d94743cb18f81da3e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758436, "uuid": "f796add7-f9b7-41b2-ad4c-aaeda2fb4d44", "comment": "Malware payload (Mirai)", "value": "4ce783c3e90beb726a07d4a7173a12fa080d81794bbe1c5cbd5d55079ac638aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758436, "uuid": "1a6584a9-c441-493b-8dd8-b38c88ba9b3c", "comment": "Malware payload (Mirai)", "value": "d2c3ceabcad1c1953ad4f6fc096925c54696e617", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758436, "uuid": "e0ac63f6-cfa7-4d7e-9393-8a3b0f63ab99", "comment": "Malware payload (Mirai)", "value": "2bebd2209904bb218fc330e7b6f22b02c6c37e935f4ebb4434218cfed3b5e5261934e9f54b9da36d60285249f25c826a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758436, "uuid": "b09e7ccb-2ee3-467f-a764-bd40d4072043", "value": "T10134B7193A11DFFFF56C863107B38A3056D936962AE19746F26CD71C1F2028E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758436, "uuid": "944c91a8-3eb8-47ea-9769-7b28fed91e2b", "value": "6144:d6SjNwbNtM56pNwnNNNNNNNNNNNNElXd6GnIAbT+Zy7K9LkUAStmebI:g5M5AbT+Zy7K9LkUAStmebI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779758436, "uuid": "37c9121a-0fd2-4c84-8712-dec2da04cb1e", "value": 242694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779758436, "uuid": "5ca4cfe3-5b99-435a-a79d-9e9b2deb023d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758436, "uuid": "2bcba735-7bdc-4fc3-84fe-3f12f9bd46c0", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454445d5-58a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779760657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760657, "uuid": "e764c772-40d5-48ff-88d4-676765f02ece", "comment": "Malware payload (Mirai)", "value": "a8744c8e1bba8b31c729664771f8c9e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760657, "uuid": "c6970633-133a-4bbf-8e48-f7c9253d33c4", "comment": "Malware payload (Mirai)", "value": "4dd237e75be1d37f1abf249378030a4d54880e6c9b708599365e0fe14ed7455f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760657, "uuid": "25737ee2-39c7-455c-b3a1-487721b0feb6", "comment": "Malware payload (Mirai)", "value": "afc592055b96ba26ec206deb7762c01dc2643ff7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760657, "uuid": "306316eb-25b3-444f-95f4-d366e9efc666", "comment": "Malware payload (Mirai)", "value": "0db5318cd2662a490bbb2fe7e8fd9128b549e192450f9ba0b649af5f416d7f5c780642b9c6222ea36c25677d6dc7b335", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760657, "uuid": "7dc9c2a4-1b30-4a68-900b-7b0746bd345a", "value": "T19934E6077B519EF7C89FDD3306FA860120CEF41725A4772A3278DA5CBA0A54F49A3DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760657, "uuid": "b648f5f0-b08b-48e7-94a1-9d6006884869", "value": "6144:JpGF7HMVHd118EENourS8SLQvAibT+Zy7K9LkUAStmebI:JpGF7HuHjvENo8SLQBbT+Zy7K9LkUASu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760657, "uuid": "859d2905-44d1-4da4-bf3e-b0c31d23f4cb", "value": 246371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760657, "uuid": "e146463d-d1bf-4e71-8bee-f2ed7fd42031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760657, "uuid": "7ae49b7b-bfca-4189-932f-c93bbc2639a7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "282c7b44-58ba-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779769198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769198, "uuid": "d4c89323-4a06-4ea3-92bb-73c7728797c4", "comment": "Malware payload (ACRStealer)", "value": "a6d802986b0a1c7520ca8dacb8f6a3d3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769198, "uuid": "c6f64fb5-44f6-448b-9cd7-b1bbbc1cfe3d", "comment": "Malware payload (ACRStealer)", "value": "4eccf6cf472991a1e8df2b0e5375a1677354914bf135d2a509226f8836433769", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769198, "uuid": "fe669be7-8a6c-428b-8ef1-f9a6690bf96b", "comment": "Malware payload (ACRStealer)", "value": "05a801452ff009691b57ccbad7dbf115198d8007", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769198, "uuid": "7dc1b7eb-544a-47e2-9ef6-f70cbfea5a5e", "comment": "Malware payload (ACRStealer)", "value": "f92c8a7416a2fcde6aa370c93dec5a34b9c1761d5127113b1d79a12e2c5df4f63746f0100cc5ad150da83dc5d58d107f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769198, "uuid": "be997552-7728-4d0e-bada-5b6831d2a51c", "value": "T193B64A13B5DB64ACC48AC474630FC966592038CA0B74ACEF52C5A5392FBBBF41F7A215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769198, "uuid": "de332d73-444e-45ec-90da-ea6af65b8895", "value": "2f307598ade8fe7e1696a56203dfaaa5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769198, "uuid": "1d9be7aa-3522-418e-abe1-ff124434cef6", "value": "98304:EH6CZz8a8BnJ0P/lYHXQyjSXGl5yEcl0WbG8KIqccMk/wH1bHL1c8W:E98BGP/4SX6RzLh/98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779769198, "uuid": "ce580e36-740b-42bc-97b1-bf0f15f12a1a", "value": 11322368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779769198, "uuid": "83c8d1a9-d675-4978-9923-fc69305b5c2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769198, "uuid": "ddea7355-3290-4381-be79-bd9a3cea7646", "value": "VulcanMessage5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8dec0d-58be-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779770902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770902, "uuid": "7b1f5035-6c5d-4128-9bc0-e410b27c638b", "comment": "Malware payload (ValleyRAT)", "value": "2f618c9fb28870f29543c04c0d98a16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770902, "uuid": "edf3f286-491f-4c05-9da6-0e75d01d1a51", "comment": "Malware payload (ValleyRAT)", "value": "4ef56fe1c4c570f02e7248013ab4b44dcdfdeff54ec9792a3bfca7abedbff4b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770902, "uuid": "0284fa68-22cf-4d0a-be6e-8806a9dbe307", "comment": "Malware payload (ValleyRAT)", "value": "d23a42294c9d07f94f537ca5255d97570e696ecb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770902, "uuid": "be50f215-d85b-462d-8b66-68d4dbba716c", "comment": "Malware payload (ValleyRAT)", "value": "25a5f1ccbc3821a6f857c3646afbd79e03b56125b4ca10ce4a502ba477619b49a476facb64c6aca67af2c85e1acb4eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770902, "uuid": "db1f743e-2b8a-4ce7-bfb7-bef9cace9d6a", "value": "T11E4633453BC14572D9A521332462D77227BDADA14F05ABD3B3A87A35E930CC0E739B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770902, "uuid": "29ebbff9-53e2-4bd0-86f5-fcad74a6b724", "value": "1a63cea75197fbe9cc550ab772692134", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770902, "uuid": "1dd25b18-5505-4427-98ed-d97f062bde66", "value": "98304:rtN/0sO6G+RQ6zAMkREv6L3tZ9jHr8zOXXxEHuW+Xthc/qH1M0feHYcsP7OunAqg:rta6G+qMkREihZ9jHr8zOXh8dqHae9DY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770902, "uuid": "1ac199b1-08bb-4591-ac4b-aad0ed718f88", "value": 5800803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770902, "uuid": "62c5e715-f861-4020-971d-f06e136afc10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770902, "uuid": "885d224b-8d36-4360-acbb-d7786cc334a4", "value": "\u70b9\u51fb\u5b89\u88c5\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d6098c-58ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778111, "uuid": "8987411e-5996-40ca-9286-5614603050b4", "comment": "Malware payload", "value": "78af003e591ea5cd2499bb7e5aa22908", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778111, "uuid": "a7271187-e81c-4bae-bf81-7459100fc8b3", "comment": "Malware payload", "value": "4fbd3e80f53154553542ad1ed0de07b6e9ab72d25808182362a3bd1c66e08e67", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778111, "uuid": "a457bda7-ce4e-424f-ad5c-a56055311810", "comment": "Malware payload", "value": "fb0c275bd23e4decc474eb6015cf7c275dd344b0", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778111, "uuid": "39598452-816d-436b-bb9d-afe6fed109a5", "comment": "Malware payload", "value": "df085bda843644f0c8d05be50e13bea418eb54fc4a2188e56465906fd1ec819c7d96f570014e7c2792dd9860b0274d3d", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778111, "uuid": "4f826601-6039-4135-a754-f505caee12c9", "value": "T1DCC4F0A8127E9DD698474EE05FE844A05143080E9BCC603FB6467D3DED12F6A3F9B1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778111, "uuid": "c94ea273-6e67-4b7b-9d5e-ba7a9eed962d", "value": "12288:ektl/NXlQBkUK1DvgdjZ+l5GGDpZmtsP9NDI+xyJF8:dx6k71D4T+7ddZW4XcbI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778111, "uuid": "9c74f140-c882-43cc-a25c-be12e9e9bdec", "value": 574063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778111, "uuid": "fe0fe950-f9df-4075-9eed-dc357aad2898", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778111, "uuid": "ba8815dc-17dc-4b73-8d94-fc4639dbabd3", "value": "Al\u0131nt\u0131_1436987_262026.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2627de-58ba-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779769284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769284, "uuid": "d8037731-0034-499e-afeb-062f6fe62ba9", "comment": "Malware payload (ACRStealer)", "value": "86d0c1fa0d13812c56b1da7522d94710", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769284, "uuid": "2cec0583-ad64-4b30-82cc-4dcbcf0191c4", "comment": "Malware payload (ACRStealer)", "value": "4fcab1259df5bcffb4f731d5acff1f406bb3081c7c5bc79f8ac26c6e92e785ec", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769284, "uuid": "093b1527-0c3b-4c07-8961-375f321cfb50", "comment": "Malware payload (ACRStealer)", "value": "b5e5da7a045e7dca14e3357e44433e258d6b5bc2", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769284, "uuid": "a9509ff3-af31-4356-8568-62491917b35b", "comment": "Malware payload (ACRStealer)", "value": "5234f2c68bf6bd98901aeaa93cb40f922eaf1c51b2a0d2d42aa0e403d49b7d6c813e4e0d59e40a20c856fd766c82b572", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769284, "uuid": "933b182a-a411-426a-af3b-8576a86e337a", "value": "T194B58D11FCC345F6E802233259AB62FF6339AC055F329B9BEA5476BAF9731D51822341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769284, "uuid": "3ba82ec1-b039-411a-b6c7-7d0d3ed9e605", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769284, "uuid": "d18696d5-cf46-4e89-af95-a02ecf81e386", "value": "24576:oEmYMLTYSp31fPy8ieEr4C3p2nzUJl4j+Yi+KLHnT/ZXIVYTHFIaIkVje3XPQjKD:WvFS/mj+YaLT/Z4VYhPSvp4skxB9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779769284, "uuid": "d18f470e-0373-4a2f-b9ab-222c7b6f26d1", "value": 2467840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779769284, "uuid": "72dbcd4d-ead1-4c62-91c1-bcc806598be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769284, "uuid": "d9ffc6c6-dc9d-4e47-a0fe-cd894c8e553b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49425bac-5935-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779822082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822082, "uuid": "c5ba3227-b890-4d4b-84f5-b7ad1d6434ef", "comment": "Malware payload", "value": "dbc2e742879a210f15a1efd4be9b1471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822082, "uuid": "56b2b2bf-853f-4883-a387-7f351cc6b0bb", "comment": "Malware payload", "value": "50ffa842a46aa1e05d792abe708be9fc85ade3768e0b09dab231af92ced18781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822082, "uuid": "2e14d43f-d9eb-4d12-83ef-67e384f16004", "comment": "Malware payload", "value": "504378039c341226953e0b66d2195ca7465cba6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822082, "uuid": "a93c23fc-9180-4a55-bd39-eed2b0a24d33", "comment": "Malware payload", "value": "da4e7a09c5c8a0d31a36f975165bc547559b35ad20a3d9463af1ec67e95afb6eb01ba8533b1c44b8debbf66882399abc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822082, "uuid": "ccb9f369-9d0d-4e95-81f7-d03a8d8d8ab6", "value": "T162B63307B39D06DCD56288357472A932D2B6BE574B64DA8732E1CE2E2F736884D353E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822082, "uuid": "007ceaee-4af6-4849-a629-26df3dc5f85c", "value": "020387d10d5936b3fbcfc8b4ba421f7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822082, "uuid": "4efb9b9c-f746-40f9-812a-9ef16d575cbe", "value": "196608:rWDiPpqKufySKGPVDTZBv18WioVcVWusXfZqYQCQJKUyCmgOh/MW4dB8Wl:r14N3ZBziocVRYQCoyhlUvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779822082, "uuid": "9aa86a4f-4d47-4bd9-bd78-d651b727d0a0", "value": 11212249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779822082, "uuid": "a66ecfc0-b882-4ee8-8446-f3ae0d5df0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822082, "uuid": "385eabd6-006c-4c05-85b2-ec809affed96", "value": "kopiyi_abo_nomery_pidozrilyh_tranzaktsiy.167.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c348b3c4-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779800382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800382, "uuid": "57f68e52-1277-4ded-9c0e-41e71a5324e0", "comment": "Malware payload (Mirai)", "value": "90ae44b635c1a1a35f50cb12926b4749", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800382, "uuid": "f5e3a2b2-1902-4dfc-b60e-34c1e78b69ef", "comment": "Malware payload (Mirai)", "value": "51973735afcf0f750d1dacc6402d4cf1282a7d84f28b73e71f5c617e68166662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800382, "uuid": "571aebbb-a0aa-4872-a311-65202b6fe5e8", "comment": "Malware payload (Mirai)", "value": "767de2055af6d8901bb32198911287074d8f6185", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800382, "uuid": "d1099c94-cdc8-44eb-ac63-833a575607be", "comment": "Malware payload (Mirai)", "value": "83ffbb4f1e39ef5bb619a34e30ba07bdc587ba0052dbf34dd1071146865652bdfd1066450d6d57c596ce1212d7b63942", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800382, "uuid": "fa172d16-be0f-472f-917b-a6192d7891ab", "value": "T1E2141883F901EE76F40BE37644A30806B630BFA219521AB671573CAFD97A0D5152BF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800382, "uuid": "27588ce8-0c12-49c0-9267-0d15ef60d08e", "value": "3072:UzmtRwo9Zo3U3tf/MBG7yTckBYechitBf573xOgKjpV9jbi7LiWx7eLO:+mtRwslE8yT5BYechcBfHxKjeLztey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800382, "uuid": "1b62957a-7604-47f2-8211-d5f8827e9303", "value": 202536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800382, "uuid": "cbd0ab01-3bdf-4d83-a55e-10f9fb14f84a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800382, "uuid": "ab837c57-7208-4440-8585-99c3c3b19a2e", "value": "wife.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e56530-58a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779759937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759937, "uuid": "192f4602-3938-4499-ab6d-25b3a17cea1a", "comment": "Malware payload (Mirai)", "value": "c7c780a46b8e7614bfb004b44b29514c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759937, "uuid": "e41e29fa-0608-49dd-b757-ead4b391c143", "comment": "Malware payload (Mirai)", "value": "52e2ccc814d30c649b1bbaeda8972f7d355780ba52450905d1e3f5033075017e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759937, "uuid": "e6b0f5a0-00dc-43f7-9d02-4b09bc23739c", "comment": "Malware payload (Mirai)", "value": "6bb2b3fb2d4c1ab746fbedacd801cc126501b960", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759937, "uuid": "36c61b61-f8c1-42c7-a885-851996960981", "comment": "Malware payload (Mirai)", "value": "3b5c90cdc14276e7ae371014d9071f1961920cad17cfb22feb7fbc15a0590a507c1463d41f4628f1dde29714605e8257", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759937, "uuid": "0e6d9b0c-9e94-4824-8c9e-b7f568ad1903", "value": "T1593302B33CC932258D1AA1760D715DF0BDB5C4A3AABA55D390F5840692FB7AB1363433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759937, "uuid": "062f0c51-1db4-4a0b-913b-07d2f7f32795", "value": "1536:KGSSrbk2a/E9MYbueRKNJ3sIv7n09tsdGeLkg4azm:/3rIFAbsnvj09tZeLGazm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779759937, "uuid": "75046f2a-018c-4074-a89d-b1e9f525c7e4", "value": 52200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779759937, "uuid": "df5691e7-f598-4e2d-9841-fbd99553049b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759937, "uuid": "f0de1fe9-2cec-4297-b555-86fd5d63addf", "value": "bin.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1753684-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824458, "uuid": "abdc68ed-271e-40dd-97b6-71393fefad76", "comment": "Malware payload (Mirai)", "value": "6e99085d065061ba777bed16542637ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824458, "uuid": "bb8c1ae5-d7d8-4aac-ad55-94a7eeed5a96", "comment": "Malware payload (Mirai)", "value": "53cf59945491bff9c1cab3b8eda0c838c4e9dcef0064dd5a4a8cfdbd392962ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824458, "uuid": "ee85019e-4faf-487c-b617-93427bd6f5e2", "comment": "Malware payload (Mirai)", "value": "3872cdf44522a2160f29d3b5239211da19c5b71e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824458, "uuid": "0d9996b0-303c-4299-b991-479ff31bc555", "comment": "Malware payload (Mirai)", "value": "50301cea0866b5725061f13f4115e6c2277737155e5d9159bc2063e2fdb3e7b9bcb406a81e2281267e42309d4c8171e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824458, "uuid": "5d3898dd-73ef-422a-803c-63a7e55df5ac", "value": "T1CBB3AEEBF64715A2C85243F013C79F8E3E232290AE57E4E76D1E167B19760DB1D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824458, "uuid": "825261ec-904e-4f72-9fb3-a8902da8294b", "value": "1536:pcdlYSuiBMW3zC8aRGGTtJM/qrlpmxJ6nDgDC/LWW:8YSZ3e8ZE3MYlphDgDCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824458, "uuid": "fdf118ad-d377-4365-b937-8c4bd0d37e0c", "value": 115992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824458, "uuid": "9b694b7f-e76a-4220-8fa3-9c7c13b227ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824458, "uuid": "7090450c-beeb-4ef8-9e91-4de5150f1513", "value": "Space.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822b66a7-58a8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779761618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761618, "uuid": "a8a293c4-9879-4490-915a-a0029479e8d6", "comment": "Malware payload (Mirai)", "value": "4402134a1664cb9ca55ef4ce7a7f65f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761618, "uuid": "19059221-52da-4444-be38-78e20b105f11", "comment": "Malware payload (Mirai)", "value": "543106cacc95fa78c110162631da3d860ae80065d59ad6881ae185c7214910cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761618, "uuid": "1ddbfeef-3f1c-4540-a1ac-160a34e93a1f", "comment": "Malware payload (Mirai)", "value": "bbe476a1c5553cd2d25829cf581fdd0232fbbb70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761618, "uuid": "b247f3eb-a4a7-491d-a6d2-cb9bc77f1d06", "comment": "Malware payload (Mirai)", "value": "8d191413413c051226ed293ffc42ed4483c519d09a8a94302b2ca60ebe0282f6c01cc2d17689ab1a2b65f9dc3695db0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761618, "uuid": "f0e78dd1-56f5-46a7-9e67-be6c826de03d", "value": "T1DFE3D71EAE219F7DF369823147B34B35A39923C623E1C645E26CD6101F6138E681FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761618, "uuid": "776226b0-bced-441b-a4f8-348683c44e6b", "value": "3072:g3CCVRrZVB3ZQtfzkmvoHAL266R2EZRhiRvE//v0Zi8:g3CAZQFwmvmAL2HjYF3Zi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779761618, "uuid": "4e2ab2b0-f6c4-447c-a69b-55db2e6cea1a", "value": 148108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779761618, "uuid": "7f59edc9-045a-4bcb-846f-73c57ea0a36f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761618, "uuid": "83bf09e9-094e-40e0-8000-0a8b433d9f95", "value": "bin.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dd6052-58ee-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779791708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791708, "uuid": "f856dd4d-8470-40d0-bb23-30b11eb2d24b", "comment": "Malware payload (CoinMiner)", "value": "863416473ff9957668cbaf6ec41efef8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791708, "uuid": "10e5bfeb-067d-4c7a-935b-a7acffe891bf", "comment": "Malware payload (CoinMiner)", "value": "5549d978e2e00768fc99d95bd7644dfebacc261284e3b19a79e6e4c1f320fa3a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791708, "uuid": "86203d10-fed0-4cac-a957-1f0b73da66ad", "comment": "Malware payload (CoinMiner)", "value": "913e692a9ddc20b967f15a94cff3dcd44efb64c7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791708, "uuid": "b60a7658-3e9e-4ea5-90e8-b5e1ee3a5f05", "comment": "Malware payload (CoinMiner)", "value": "28fe3dc0cb5e22d14be42bc4be931fc09e339f07780a906adecc3947f21f77b4881ea1bf3f117f514ee26fc9ebaeb17b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791708, "uuid": "aa5b2c33-a1a9-45a7-8d52-2d11ab8d80fc", "value": "T14A32E829BE810331E3A049B854794347957D2663E793E3EFF337A59E49A63488C41E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791708, "uuid": "87cc3b12-ae04-42b1-8185-25aefd63f800", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791708, "uuid": "45b434e8-1352-4e8e-a409-2473b2308b44", "value": "192:sIcofWXvy8BqOx+eEP9PFJxTEZmFhS+cHf:s3o2vyfOwLPFwZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779791708, "uuid": "85b2d9d6-82f2-4626-8e80-d3956a0f8551", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779791708, "uuid": "41b96e14-43bd-4d30-b107-991f4be4e026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791708, "uuid": "96007e6f-d543-49f9-ac58-086621712d5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57548536-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779777008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777008, "uuid": "a9794345-68e9-43c1-b685-863e8fc61f4a", "comment": "Malware payload (NanoCore)", "value": "11f31841e7a4e011922e64d3c1f4de21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777008, "uuid": "3ad61806-b8b5-40a9-870e-3559eb940e25", "comment": "Malware payload (NanoCore)", "value": "55612af5ef8854910b6321bf337fe0dd58c8b9a1682d595aff28a5360574adc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777008, "uuid": "4eae6ae8-c861-479e-8839-4fbd333d4c31", "comment": "Malware payload (NanoCore)", "value": "385f65eb9593b37d78a58ad7396c0ef2d94f4dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777008, "uuid": "2dd03f67-d6cb-4e22-9929-216a8c106a35", "comment": "Malware payload (NanoCore)", "value": "822f3f8b2ea8193d80c3a230586d0dc06b93b045bb58aff207b5e7367a8c3f81cfa15459be2d6876dd88940f50c078e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777008, "uuid": "11220d8f-2f2a-4096-a293-de8cae2d767f", "value": "T1BC14CF6A37A88A3FD2DF8679611202539379C2E799C3F3DA28D455B74B227E10B071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777008, "uuid": "0572decd-a502-47d9-b6b1-f92ce2411713", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777008, "uuid": "88a24f5b-540a-4d9e-b2cd-d359c06f755f", "value": "6144:MLV6Bta6dtJmakIM56NLiVdjyTMyIdWuf:MLV6Btpmk3kjyIfMuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779777008, "uuid": "a9831dc5-15c2-4c0c-abef-1d8ae2fe3995", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779777008, "uuid": "4707cf7d-d3b4-4dcd-802c-7915d039f60e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777008, "uuid": "0a3e13c4-058d-4bce-9624-f1b220459ab8", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443fb384-591d-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1779811765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811765, "uuid": "80f0e4fe-01d8-4e85-8887-2b188ae51975", "comment": "Malware payload (KongTuke)", "value": "433ebe981db602a938fd15e80ff9a71a", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811765, "uuid": "0b90eb49-dde9-4a50-b1ae-dd6ef37d3122", "comment": "Malware payload (KongTuke)", "value": "558e966566e89bd29e32f416db4e32ccb113249b8a76ab1d63f54cc9a05f65c7", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811765, "uuid": "b4c1a70b-54c1-465d-b286-3f92ea566012", "comment": "Malware payload (KongTuke)", "value": "9bfe84aef97896293fd2c37ce3c055ed56cdc4d9", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811765, "uuid": "460ac42e-269d-4b45-b2f7-ba138d01d759", "comment": "Malware payload (KongTuke)", "value": "2a5e420aaf69f6acf151e0a0a53b329d2f1c33ec01478292528c2bad37830d1fd5e40fffd56b69b35a66bda38779f9f5", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811765, "uuid": "a8bd3de0-36d5-41c9-8072-4581051d62c8", "value": "T171355C5AEBF64CE9D4E2C0F045B72311EA30399447605AFF566886682B2B7C0B73D778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811765, "uuid": "7432dbd5-7987-45a9-845c-0f1b6125a28e", "value": "24576:Wihx1hQVmTTY8DVE/DFChIV6JdwLWmi/PAgagXLzfRFBk/W:Wihx12VmnPVErkhIiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779811765, "uuid": "f937d616-be77-4d05-853f-94282e2d6e66", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779811765, "uuid": "4507ffa1-6a1f-4436-8470-65873faa739b", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811765, "uuid": "1b24ba9b-f16d-4e9e-9ddb-18ce2d516609", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec465632-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "4bfde62c-d0b7-426b-af12-5240eaf46db4", "comment": "Malware payload (Mirai)", "value": "20dcf87497bf50b9133eab000ededf33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "02abb371-bd0b-49f9-8df0-33c3f10a6eda", "comment": "Malware payload (Mirai)", "value": "55ae45c3ff8bf8f0c85cb1462e4b15896e890f761048828440b01347deea0e4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "6e7b0874-dfee-4dff-84d3-1723e71c6a35", "comment": "Malware payload (Mirai)", "value": "4cc988a4f9122a769298d2e92b00dba2ae6e8bfe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824503, "uuid": "0a29efd3-1e01-4c9f-a22e-4a7063a8890a", "comment": "Malware payload (Mirai)", "value": "549035d071ca48835de492ab8a6887e931447dbb824a90494ecdad1caa722db6674ecbebeedf6f0c4a9edaf87bd7ad74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824503, "uuid": "a5d4f3da-c7da-4254-ba6a-fbacb13b34dd", "value": "T1CAE30946FD418F13C5C321F7FB9E42983B266B6DD6FA310299257FA037865DA0E3A112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824503, "uuid": "6bc7ff59-82c8-4372-8bfc-070ff29557f7", "value": "3072:edlQ6kCl0wXdvE4X505M1TKRScPSSSSSSSSSSSSHVw29CjGtxj:edlj0YxE425MZKRScPSSSSSSSSSSSSHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824503, "uuid": "3af1acbc-f822-41ab-b56a-514faa7c649f", "value": 143008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824503, "uuid": "aa4197bb-f167-43a5-8aa2-a4d7c7726752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824503, "uuid": "fbfc20f4-1e76-43c7-a4ff-c503c0bf6111", "value": "wife.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89908d59-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (DungeonTeamBot)", "timestamp": 1779795131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795131, "uuid": "db14815c-ab9a-471d-9596-4e181f9653cf", "comment": "Malware payload (DungeonTeamBot)", "value": "336672f4646f8c18981dd07b5a47ba6b", "object_relation": "md5", "Tag": [ { "name": "DungeonTeamBot", "colour": "#DBB9BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795131, "uuid": "869e30c6-20bf-4fdc-a6c3-cb508bc2d45d", "comment": "Malware payload (DungeonTeamBot)", "value": "5653d5b7523e83757884c9d1241e41d8501937b5a73691f1a1a28f74b6103b09", "object_relation": "sha256", "Tag": [ { "name": "DungeonTeamBot", "colour": "#DBB9BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795131, "uuid": "4a09c1a9-b0f3-47d1-af24-3dcbf5899f42", "comment": "Malware payload (DungeonTeamBot)", "value": "8d35ac0e221094c24d6398dec89ab67d4a759753", "object_relation": "sha1", "Tag": [ { "name": "DungeonTeamBot", "colour": "#DBB9BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795131, "uuid": "bed81048-7605-4613-a094-49f866192f19", "comment": "Malware payload (DungeonTeamBot)", "value": "dcb6c03515ccd5f758fcd9573d4d1e8cf0bcb4b24fd69db9e03d0a525f1fb4ede9541ad22fba46d055c9e7bfbf85ced6", "object_relation": "sha3-384", "Tag": [ { "name": "DungeonTeamBot", "colour": "#DBB9BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795131, "uuid": "ad534bad-903e-4601-ad2d-f9a383b11073", "value": "T181562BF725E7F79DC51AC57F8303F8BE8A4F743A0925A4A3A158E11A5E16C943326F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795131, "uuid": "c9dcdb78-0fda-48c9-9642-85f4849bd322", "value": "559173d1fbfa98ba71e8531bea460be1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795131, "uuid": "3ffa208b-618e-46c0-8fd7-369427cc3b2c", "value": "98304:ZEn+lBoDLPcR5oVrzG1KM1jPGP4SlWGDP1xRJ:ZEn+lBoHERaVu1R1rGPbZ1xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795131, "uuid": "ab3eb7be-612a-460b-9148-ff4a2e366a16", "value": 6157312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795131, "uuid": "b3b360b4-9605-4ac2-9cd8-76f014b3177d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795131, "uuid": "218d331c-a29e-4da4-b55e-91f058247131", "value": "5653d5b7523e83757884c9d1241e41d8501937b5a73691f1a1a28f74b6103b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd36ad0-5951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779834384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834384, "uuid": "ff27d79e-3528-49da-8e67-4a67b1ec6f6c", "comment": "Malware payload", "value": "ae401ed30d65244770caef269bf607a2", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834384, "uuid": "b87e5680-cba4-49ee-90e1-b9d6bb5040a0", "comment": "Malware payload", "value": "57cb82998948b070e8deac5d5db876de316d585915565cf908a9bd08c66740ce", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834384, "uuid": "fbff74a9-26d5-44d2-b528-0df8541025c4", "comment": "Malware payload", "value": "4fcca00a3e1ecd8358f21ba3b5c2a223dc9a6132", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834384, "uuid": "72ff6349-fa82-48a8-8437-49406d9b462a", "comment": "Malware payload", "value": "b9f905cfc7027b6adb3ebea6e72d8f49921768cd857ef6cd8775eca1fad4bcf961db04316555b42a70586e62a8a4fa49", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834384, "uuid": "8e833389-c2e8-4b16-a69a-31987fd5345f", "value": "T12852C646B601C23BC589BF344E6ACBA543B67C44CD9A12073BF2730D6FB71907A962E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834384, "uuid": "d52ef511-15f0-4a8c-9a18-542f15902f43", "value": "192:zrBk34wHwzc/L5kg121qw4S0Hh0SwE/hX/j5mOJgBsq:zrBkouTegkqw50HhcEx/dmOJnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779834384, "uuid": "0e62be22-fb91-47e5-9339-39b89b350869", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779834384, "uuid": "90cfeb05-6a90-4685-a494-b805d47c1286", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834384, "uuid": "46556128-7be8-4670-815f-2621019c02ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d75fef-58ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779790825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790825, "uuid": "717ed98b-5199-44df-9914-b037ac4d48ee", "comment": "Malware payload (Formbook)", "value": "22e1319704b1ec040815e9e3a94bec40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790825, "uuid": "246fc74e-ccea-4e6a-86a3-a3c7cf7b4f0b", "comment": "Malware payload (Formbook)", "value": "580095fa81f7b8fb14fdaa9203137f8ee9299cca68ba011e6bd285f0284bb6c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790825, "uuid": "a6dc5f3c-6c89-4403-b19c-64191894582c", "comment": "Malware payload (Formbook)", "value": "75692a7d46a8b289c1c4caa3a598453ec583fbc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790825, "uuid": "7ce1e551-1f23-4764-a699-5b550228e34c", "comment": "Malware payload (Formbook)", "value": "0155e936af9bb350f9fba1fdf7d344d934fe6470e9975d3f85c1f620570be39c03b942ef1ac8b6343b7daeba01195f73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790825, "uuid": "830c7881-7bd8-4ea2-9995-480e1593d5ca", "value": "T141350204221EDE01E5F78BB91420E7B416785E48B931E3079FE9BEEF787678258193C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790825, "uuid": "0ea03791-2c43-4808-a40c-eb04875a124f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790825, "uuid": "f750dbe0-da6a-4f91-b6eb-0c87c9e501d1", "value": "24576:/XRokulrfFmQVXkYYZunWqC9NG1OUCQKbCPsq3hpxREh:f6lplnE27CNPq3h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779790825, "uuid": "ec171c59-e391-4618-b7d5-fad1b540bf5e", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779790825, "uuid": "149dadc0-9750-481f-afa6-963175feed28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790825, "uuid": "f3314ac0-9662-49bb-8b6f-027f044f1568", "value": "MV_GREAT_AMITY_QUOTATION_FORMS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455d1424-58eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779790292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790292, "uuid": "3239ba76-2dbb-4986-a7c3-368c7eec501a", "comment": "Malware payload", "value": "676af663967ebe880c06e2d6a5b0c15b", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790292, "uuid": "efc28195-3747-4f00-afde-76ede8f24923", "comment": "Malware payload", "value": "5831011440eff59dd2d1d3acf5eedf0d94495581cfd44b41cc305240f79bd2a7", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790292, "uuid": "9fbd3ada-bea7-40df-91da-9ed0c034966e", "comment": "Malware payload", "value": "14af14409c07c7a0416b5ded87b7a8fba6849dc0", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790292, "uuid": "25f20070-b5e8-4072-8815-365c332d4690", "comment": "Malware payload", "value": "42f70e1fa16e4d42d43607f69d6bc4ea3b83997a5076ac86ebba551afd6d39340525b6abdd617a724467f36bbd148c0f", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790292, "uuid": "23352767-755f-477f-aa91-28382ed511a3", "value": "T1F38733466CF49559CC6B443F63025B7D482D92DF0CE8EE7AE9B95B83E7638C406BB120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790292, "uuid": "cb056803-e366-4777-96ba-092ce83fc106", "value": "786432:ytZJ8bDPSZgbpEvqUSLkpTpGH5w176kD4pkMeZeHY4BNTW/:OJ8fPSZIp9GU6gkcmMEoYINTW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779790292, "uuid": "23bf4646-4ff9-4f00-863f-687808e9150a", "value": 36625341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779790292, "uuid": "e1e3a30d-d991-409e-83a1-9b16883e2f00", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790292, "uuid": "5956be11-9dec-41f6-a146-dcaeca909b47", "value": "zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3d22f5-58d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779779273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779273, "uuid": "53548af5-138c-47b7-83fa-5ea8713f15a2", "comment": "Malware payload", "value": "f1691d8b66a7813dc65d176d20b135b5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779273, "uuid": "445ee7f6-e659-456d-b345-38fc79813283", "comment": "Malware payload", "value": "5982ec94ca925949147929dfeb27fecd1a6a568a9f87a948555eadab1ef6c365", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779273, "uuid": "5d198c9f-d550-49c6-af52-28c36091ef39", "comment": "Malware payload", "value": "de94c0ad66d96bc984d2e7e4724fafac8bf376c7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779273, "uuid": "ada7ce32-00fc-4a08-8cd7-398395796cd8", "comment": "Malware payload", "value": "3074f2af254933868ef664e9022cd50bcf7e966f3b0c2ad2e1d4fa233c5b21b34d8a8298cfca4d4c27085945a9e8ac4a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779273, "uuid": "0d3ef24e-1871-4bc9-8647-f06783299938", "value": "T155A533E79D331DCD0274ABB1865E64FCB73ED52CEC4E64D29D56CEB42A1206CA88CE11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779273, "uuid": "5dc574da-e039-47a4-8f69-6be00934ea8b", "value": "49152:9jT/Qyi3pnw07EeOMLyqAMg+NNSzDIjIdz9sWf:9jr96pwJMHjg+N4zDIjIIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779779273, "uuid": "2321c2a0-be06-4ab4-893d-e73ba07a2800", "value": 2082031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779779273, "uuid": "b815cbda-6961-4f3d-9e0d-51417ef24a40", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779273, "uuid": "911cf84b-b08e-4e45-baeb-e1c04a343ec1", "value": "Quote Order-A09392.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84de6bc-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763910, "uuid": "e183c48d-308d-44c1-b82d-deb3994a7854", "comment": "Malware payload (Gafgyt)", "value": "87516a592f298e3b9a8ef747630c746e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763910, "uuid": "2e791f65-448b-4529-95ec-1792668500c7", "comment": "Malware payload (Gafgyt)", "value": "59bebfb7e2c968216b8f81e7633f5d0cb24256707d1744a90a3cc06af636c1a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763910, "uuid": "709988a0-c64f-4421-aaa5-96061cfc0532", "comment": "Malware payload (Gafgyt)", "value": "a2ec3bf1b7076331bf2b05672f7fb9bcb4bf46b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763910, "uuid": "eeafeee5-1e5c-433f-869f-4de0a30caf15", "comment": "Malware payload (Gafgyt)", "value": "3c419559b34b741ef5b23b8736ab03b5dffcdad5f2ea3cacc037aea673062596d60300bae03924f386b198f2ecd7f1a5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763910, "uuid": "48b15a45-6d52-4e29-b35a-425e82a4d041", "value": "T10B931A9BFA42CEB3C41310F112AA9F219D71F9FB4823D642E3646DB4DE154C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763910, "uuid": "18da1e82-4522-4500-8fda-6e7666d544a1", "value": "1536:W1+k82vFHl2qbZckmjWGw57fobEOQryVwCiUH1FVLx8rbrbUkmyukJ33xZTe0gw7:W1ldFF2qbhpRfobEOLVBiUH1FVLx8rbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763910, "uuid": "b9871462-68b9-4cab-9ebb-08f8eb258c48", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763910, "uuid": "e4b8e133-a837-4b66-bd92-1c80a518c185", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763910, "uuid": "1f3e924e-d576-4032-b1b9-33e0d494fbb3", "value": "FBI.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccff5519-595c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839053, "uuid": "7c3fc23d-1445-40e5-a16f-4b3a5edc397d", "comment": "Malware payload", "value": "4d8ea7b6943a8126320502b568e49b00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839053, "uuid": "8cf2d299-cecd-4fd4-8b7c-fff2bb0b2b16", "comment": "Malware payload", "value": "5a7aa4215a980ff644e445fac5647e3e00c1c831b2850b57ad4a2b7c30317377", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839053, "uuid": "66e0163e-8252-4dac-8e55-18480d1861b6", "comment": "Malware payload", "value": "c969f9a530d68387bbd47e56ea4ddf08779c1adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839053, "uuid": "745ce7b8-4ca4-4390-bcf8-f81e05e20de6", "comment": "Malware payload", "value": "a0a30d7ebfa50d5175ee32443980e6fcb854123974cccc34a518ea6a5082434e345337ea3ba348400cf2acd07dba00e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839053, "uuid": "abbf6f70-cd27-45ac-b8b0-8c28ed127f05", "value": "T1B0769E52FCDB64B1E652213208B7D2EB2331B9090F31ABC7D9547BBEBC776E10922255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839053, "uuid": "1dd978f1-66f1-4e82-be0d-ea3f0a565926", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839053, "uuid": "1eb9fdc2-c15b-470e-8869-c4bed9fff587", "value": "49152:LtQ1Pny451PKWI3YVqCpEaQn5em9vPnxEfJnaRfYyYD1s:LtG6U1yWWYVH6aQ5H9v5saRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839053, "uuid": "11afe4a4-8e14-44ef-ac0c-578252f9159c", "value": 7615104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839053, "uuid": "c0926bff-df62-4c26-a52a-7d406e6b643b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839053, "uuid": "126c47b8-d3cd-4aa4-8d33-b108d3ae5753", "value": "SecuriteInfo.com.Win32.Evo-gen.24761447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f9a3b8-592a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779817650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817650, "uuid": "9bc3cf53-5be9-46fb-9816-c552671d395f", "comment": "Malware payload", "value": "6b275a5148678b61b9692e0a5b23f8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817650, "uuid": "3fff9a69-ab41-461c-a9aa-f7ffd4847d0f", "comment": "Malware payload", "value": "5b5f7bbced70ace9663c378ad2921543cf8ad6c89e906e88c70a84c339d94b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817650, "uuid": "8ee91ab3-69ee-4f79-bb61-3ab12a707768", "comment": "Malware payload", "value": "31fec288a3ed3d2fa1878c2322176a040ae6b43d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817650, "uuid": "89a5c414-6a1c-4c3f-8bf8-e9061f1571ac", "comment": "Malware payload", "value": "b3db024809f91becbc786102a06a0237c73459e6d9a502353006ec4fb16086584d38bacfb43791accedb809e44245728", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817650, "uuid": "cb000d12-daf5-4f87-9766-3c0fb701e419", "value": "T14B18330FDB38EE35F17EF5F279922612884967B0E2B05D6D40D9A081F575682327F22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817650, "uuid": "ee4cccec-562f-4346-b75f-1c887c6519c9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817650, "uuid": "3d16c38d-321b-4f74-8bf9-4826d6389cea", "value": "1572864:tt9IKP9P0RxwVMKfsBbnZbPNw7qsab4bBU1awdD95eS417:tUKN2xgMKMdL4qs/u1aqZ4S417", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779817650, "uuid": "889d8b17-e313-4895-a973-d38ea0178965", "value": 88456278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779817650, "uuid": "b974f969-b3ab-47f9-8494-8122e5723756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817650, "uuid": "9ffde521-4f07-4fea-a5b5-c4b2a0e9f6a0", "value": "setu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d87f00-58bc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779770031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770031, "uuid": "e9fa48e9-5af4-4fc1-a0e2-a37253f68ab7", "comment": "Malware payload", "value": "68f7e70d91d407e51570466c843e2684", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770031, "uuid": "e910250c-b2e8-4d6f-806c-4d6e18b78d14", "comment": "Malware payload", "value": "5b966c4e900801e3fcb3606472bb9ad52aa1656aae141c03ce1dd5c57f2c927c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770031, "uuid": "9d2b497e-51a6-42b7-bbaf-4828fef12d38", "comment": "Malware payload", "value": "b1ee1ad1d68d27e1010600da843da0ee4e011835", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770031, "uuid": "90a01398-4475-4a3e-bf96-b58bd025a856", "comment": "Malware payload", "value": "7652c2cf11602118d1575da06f48e835157d4d9ff24bc9225fe74a65b24ff55975b9a1f27617720b939925d338ccbe74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770031, "uuid": "8546aac0-d3be-4f2d-9cc7-f1da9f5c64b1", "value": "T1D264233970A579955D4AED3EF7CBC8841728654450038F2C0EF4A3DA7ADD982FDA074B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770031, "uuid": "23399f28-8170-468a-b87c-bc06925c4a69", "value": "6144:rxlQYDX1Y23APHlrA/kPN6MjYRg4KQTtWw5254LcgP+A7BI:rR3Avu/klRYRjKwtWCGP8172", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770031, "uuid": "9d695b08-e19f-42ad-8bfd-422d97bf3eec", "value": 313352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770031, "uuid": "50365618-cf0c-41d9-87e7-b102b7a44e08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770031, "uuid": "37445abc-36b6-44c1-b7e1-f3251444b262", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a630c05-5909-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803078, "uuid": "ccb28409-b07a-4388-9cfe-4f4343b060f4", "comment": "Malware payload (Mirai)", "value": "7628481ebfd92f24862d422e6c304643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803078, "uuid": "e1ebdc06-e2fe-48ac-92ad-a91174cc9927", "comment": "Malware payload (Mirai)", "value": "5bb82c3e91fd13b4108d8f495149c9adea1cc455923da105b5453e6586e70439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803078, "uuid": "384aa482-ee6d-435a-a1cb-a6f1a9c6c1ff", "comment": "Malware payload (Mirai)", "value": "6e12ee5d287612a8bc97b2f0a3c775f76c03c8f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803078, "uuid": "4ec31676-ce5e-41e7-a40f-77c589da3135", "comment": "Malware payload (Mirai)", "value": "180a7d6995204010d35b3fa79651db94626a9772fe9b03ef810b12f12e7d8edaa91fa1395bb4f005317ec1948b9119a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803078, "uuid": "19127615-88c1-4683-8840-11d99ba71d2d", "value": "T12D043A02770D0F43D2532EF0277B17E183AFEDA619A19684741EBEC892B1DB22546EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803078, "uuid": "9a65f435-839f-4f37-a15a-b18739bdeb35", "value": "1536:Wh+xUapSx4bKAu4eSwaFl3nqskNzvxPFPK6wXgzxifG/W2uu1DkUl8Dq2nKfUgNY:qTAjnl3nxkpxdPS4CM8Dq3f+4AQ4t5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803078, "uuid": "d16c64d2-4125-465f-a805-d06a73314855", "value": 180200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803078, "uuid": "ae9b30fa-67f5-4018-a1d6-4d38f75cbf7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803078, "uuid": "43cd934e-6e92-4291-b40b-f098209489aa", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0bbb24b-58a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779759200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759200, "uuid": "aee86268-c645-41f5-83a2-c3f44eb85593", "comment": "Malware payload (Mirai)", "value": "2684d4b3c912472c28770ff36e6165a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759200, "uuid": "65f43db0-15bf-49d3-8f08-0e776db56772", "comment": "Malware payload (Mirai)", "value": "5c281f85d88e9e7d96c26bfe00594cf60ff5f5c9cc06d1cb49dba0049b4079a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759200, "uuid": "8208fd67-4c9f-40b1-9f88-e1e237e43b19", "comment": "Malware payload (Mirai)", "value": "5842651d6ddb81faf58e0438fa730364dade4bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759200, "uuid": "fdf1a1b6-bf56-47de-979a-fe711772f98c", "comment": "Malware payload (Mirai)", "value": "f6e15e147448023700009de176a7da407bb985c21fe28fe7e801270d589a00ef8e41e96a6af45f76936f042e739875bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759200, "uuid": "b1fe454e-9e3c-4b66-9c3c-07bd4650155e", "value": "T175730271BFD0B5C9C32A93F2A40017993D63A673D2DFE46F406E17E610636A1DA97888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759200, "uuid": "df1e0876-00a5-449d-8601-9e5efcfeea9b", "value": "1536:xp2z1kEQKizCw4iYGvdhIZgJptt40UH4p7bbX8zDpueunXFvhy9l25wY:xI1kEQKizC6Y2IZcp9vb5LUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779759200, "uuid": "71ac1230-2828-43ad-bc43-ecea49bdad39", "value": 79548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779759200, "uuid": "85a1e813-9e70-4727-bd2a-1f4b3ee7a697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759200, "uuid": "bf513b7d-1104-46f2-b4d1-c67debb3cb3a", "value": "bin.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef42965-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (ArtemisRAT)", "timestamp": 1779795140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795140, "uuid": "80b8d8c5-f97b-465b-b02d-54fead0cfad3", "comment": "Malware payload (ArtemisRAT)", "value": "76c04eaa39e35b299223f6d639437db5", "object_relation": "md5", "Tag": [ { "name": "ArtemisRAT", "colour": "#DE447A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795140, "uuid": "000c3680-0fbb-430d-a5ca-37969c2d3770", "comment": "Malware payload (ArtemisRAT)", "value": "5cc6248110a682068ca2046ea511b11c5eef3a31e188261c02bc2e4c5c4552ff", "object_relation": "sha256", "Tag": [ { "name": "ArtemisRAT", "colour": "#DE447A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795140, "uuid": "490964cd-a261-4a97-bb97-3972defc3bd7", "comment": "Malware payload (ArtemisRAT)", "value": "5960f70be8eb7f1ed7b9ff785282391ea9327883", "object_relation": "sha1", "Tag": [ { "name": "ArtemisRAT", "colour": "#DE447A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795140, "uuid": "fe3daa9d-563e-4318-aa0b-ed03d20476ad", "comment": "Malware payload (ArtemisRAT)", "value": "ea8ce57cd6d704fcd1f32ab2466f9690b544011593cd6f7e796506ee1da8fd1f6460a0753033148db2a5fa23689e1a49", "object_relation": "sha3-384", "Tag": [ { "name": "ArtemisRAT", "colour": "#DE447A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795140, "uuid": "325b0d30-87d4-4794-9d09-ed6e8f361048", "value": "T170C46B546BF84A04F2BF6F34A5B111858B73F847A932E78D29C954DC1AB2B81ED11B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795140, "uuid": "18e3f960-51bc-4ff7-af64-99acd763a740", "value": "12288:6PMjQNezkd9fd8oBuo1ZuZ3VeGFTTD3xqMsM:6KQNfdQIu8uZpHxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795140, "uuid": "1e1b69f2-3db4-46c8-9141-9923ad91bc61", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795140, "uuid": "6460c1a5-553c-4717-9ec1-6504fc12f946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795140, "uuid": "7aecef70-3178-44f2-9b46-5e1e65b1c50e", "value": "5cc6248110a682068ca2046ea511b11c5eef3a31e188261c02bc2e4c5c4552ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7615377b-58f8-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779795958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795958, "uuid": "ddbf3fb4-eb96-41ab-9562-b6f6d0ae69eb", "comment": "Malware payload (ACRStealer)", "value": "565cd7d1b2e0c39e2bd90d650b0894c2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795958, "uuid": "3660154a-53fd-4e30-acef-80cc0e79d818", "comment": "Malware payload (ACRStealer)", "value": "5cdbde2a6c83fa7afa2591aabe3f368a541f55248b5957190422a8e4f7532f7e", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795958, "uuid": "b5338ae8-c144-4276-b345-0b1d3e8c86bd", "comment": "Malware payload (ACRStealer)", "value": "cb920028dcfdcadb2d1939fa87e92a9d4bda5c19", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795958, "uuid": "323c4a58-d3c7-4736-8fc3-a48c2ffb3889", "comment": "Malware payload (ACRStealer)", "value": "b0658844d1e8b205e210ae1cd625e02168ac764882b31b20c7d1f8b99aec05c8b843aec02ff1062a790bd8c7036aa581", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795958, "uuid": "06f7bf7f-5ae0-407d-8f62-3ff6c8decc92", "value": "T1B7A59D41FCDBA4B2E652523318A792EB3335B90D0F319FC7D5046B7AACB75E00E22656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795958, "uuid": "70588ed4-4575-4d08-9ffe-fdde948d3bf3", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795958, "uuid": "8a28d9b4-5020-4ee6-9c64-efdb77be755b", "value": "24576:Lpz7dA3q+wfGCcQqT8gGJgZ+OJIn5q86E/FfI+98HWPi32NHcvGu0aJGUC/CnUKJ:Lpa38tOJkI+9n3EYD/ziehhxdYqYD1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795958, "uuid": "9d1ca476-505c-4192-a641-308f9f16e1db", "value": 2180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795958, "uuid": "28914532-05fa-4d5b-a1f5-7e19c9b1e124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795958, "uuid": "019135ae-d17b-46bf-915f-b5ec607a6d80", "value": "SecuriteInfo.com.Win32.Evo-gen.14998413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d27aae3-5925-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779815136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815136, "uuid": "fdca6b79-4e73-4472-bafc-4af4cc7c0844", "comment": "Malware payload", "value": "8a76fa39ad8b679c7becfb94f503efdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815136, "uuid": "5760f61e-5a87-4399-a4e3-303c85ed0e1f", "comment": "Malware payload", "value": "5d1d22f92b87dc8d5a4d0603da456b8b35432a1bcaa646fead9df2d5a5b01d02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815136, "uuid": "484216b9-cd41-4d7a-a1cb-4f6a5da8b415", "comment": "Malware payload", "value": "50cd3ac9424ba916616e78b022d3b013ac683610", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815136, "uuid": "132ea83c-0a5c-4b5e-8358-c7e42dca392d", "comment": "Malware payload", "value": "6742a573b5ca1b230a4d3b517f030e1b256c66926e82eabbfa784ca5abbf8b3055e93804bc8866ab2280cbf44007a7c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815136, "uuid": "ce1a8b0f-9ba8-4882-8eea-ac123ec70eaf", "value": "T1FBC401863395AB12C258B6F5CCD744A003EE999F3A73D7067A4523561F907ECCE12F8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815136, "uuid": "563fb503-101a-4143-9286-1d5ced4dc2b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815136, "uuid": "543d8191-55a6-4346-ba4c-241894565627", "value": "12288:i7cXTscDuz7OGNTZAzZRAyrkByT3wSB3H4O+7s9VcLI:i7cwcD6xtAX/rwq3o7s/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779815136, "uuid": "82cfaea9-2dbe-478c-aba3-a99e83903ef9", "value": 583680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779815136, "uuid": "bc646ba7-f5e6-4f1b-b93b-1e534cb3bf06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815136, "uuid": "b16fe054-e92a-4c39-996f-42dae3a8563c", "value": "Neverlose Cs 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f3191a-5910-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779806240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806240, "uuid": "eba00b3d-561f-4752-9ab1-4095bcf00fff", "comment": "Malware payload", "value": "8fceb756be3a09840913c9948b7e9a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806240, "uuid": "f362f3ec-33eb-4d08-b00e-25f0ad053d4b", "comment": "Malware payload", "value": "5d5e38f5e20612dbadfd68c291b11d0afb78566b0df1b3ed798163a3c0309940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806240, "uuid": "8bb19968-12f1-47ba-b6ec-0e85a5d9fcf1", "comment": "Malware payload", "value": "e3a131d865c60492da11d270b9c7b63ffddfd744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806240, "uuid": "9183cd8c-8d36-40d8-97ff-f1d3b5531dfc", "comment": "Malware payload", "value": "9dc1c98ecea7abf37f5d26d253e15a53a156369d8f848ab914b1d5a7751bda23c5b2fe0749e2b478eb4bf42e5c6277e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806240, "uuid": "30afad68-630f-4391-a936-f7f5fcba1570", "value": "T109A5AE51FCDB94B1E516123209A3A2EF2331B90A0B35EFC7C9147F7ABD376E11922265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806240, "uuid": "823f7337-3a8b-47f4-9f30-d1f7dcb41054", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806240, "uuid": "9eed8fe2-7135-49fc-8f53-4edb6b71de72", "value": "49152:SRvSdlNhjJIrG6qYN4Os3EfH9BGC/7/3rY0YD13:SRKLN5J6uoQEfig7/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779806240, "uuid": "05c15c43-52e2-4c11-8e9a-8fc465487e4c", "value": 2132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779806240, "uuid": "6be96fca-4f25-4cb5-b52e-6488a3fac8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806240, "uuid": "05f3ee2a-12d0-4344-9978-e0907aeb0209", "value": "SecuriteInfo.com.Win32.Evo-gen.71495522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14bd8fd1-58a9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779761864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761864, "uuid": "d6e05c7a-ae08-4d8e-85ac-5266059282a6", "comment": "Malware payload (Mirai)", "value": "3197e45bdf68837f9fc79b7ad7fda647", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761864, "uuid": "c7522698-3de6-4613-a520-8936bb41c3c4", "comment": "Malware payload (Mirai)", "value": "5df06179214d5bcfca64efde27e14ef9f9e10e2834e663839823280322ba04d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761864, "uuid": "c43a5935-ce4f-4c69-8367-5bc7f822c7de", "comment": "Malware payload (Mirai)", "value": "4b2bcc10539dd90b7c96a2b838b51556dd6361f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761864, "uuid": "f92705e4-fed0-4b60-95da-eb38d1e2e0b7", "comment": "Malware payload (Mirai)", "value": "a196c04e59e91b43bd29036b80dbcb69aff4392756cf42a9897931b6b8b442b41bd0d7bf198bb8ef095e3f3c3ea8fff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761864, "uuid": "485a6e12-2ac0-4358-84b3-2b83e89dc09b", "value": "T15B344A07B6D0CDFBC4869BB42BDBC1A18833F8391B366217B394BDA51F5DA946E1C211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761864, "uuid": "73da8c97-0b85-488b-b652-015df4d0ab4b", "value": "6144:6IZkaUIwjvF3TstfomNaY2csysZJY1BnSaJwfxu:6rvVWfoy2csysZJY1BnSaJwfxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779761864, "uuid": "bd46cac2-f499-4a8a-9cb4-9545f2f89fec", "value": 234531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779761864, "uuid": "52935c3d-5ae5-4843-b017-f76fc0e2ea85", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761864, "uuid": "4ca1c8c9-a237-4606-af22-6446e6960d40", "value": "bot-7040216d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "923bcda7-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (TRYMELocker)", "timestamp": 1779795146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795146, "uuid": "a267b316-71b1-4328-8727-9423382f0b03", "comment": "Malware payload (TRYMELocker)", "value": "efa0aeb1ee3dac26deb0ee1c4e233a99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TRYMELocker", "colour": "#4F5946", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795146, "uuid": "0f580a4b-e7ad-4dfb-af93-aae326728c13", "comment": "Malware payload (TRYMELocker)", "value": "5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TRYMELocker", "colour": "#4F5946", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795146, "uuid": "09aa4ab5-7983-44ce-a9c3-0d67b8747ff3", "comment": "Malware payload (TRYMELocker)", "value": "9eb66d1231c6c7e102ce91d207ada982e3e3f0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TRYMELocker", "colour": "#4F5946", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795146, "uuid": "37923156-9e2b-474a-9139-65aa0a0f68e3", "comment": "Malware payload (TRYMELocker)", "value": "d2de881d9d087d85d2e0734b5fb07aba0ea6061e0a3ec15f521e569807df2e66cd611de647b8984fbd01ead8d02c83ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TRYMELocker", "colour": "#4F5946", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795146, "uuid": "6f9fe226-3c61-4edf-aec9-c752ba0fe3aa", "value": "T17BC2D604B7FC4A24F2BE4F35197961404B3BBE169C22D75E0AC45D8E18767C88BA2B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795146, "uuid": "d2bf3b45-6274-49c8-8c24-4402e7b612e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795146, "uuid": "23a1c874-282b-4655-be56-5c315abe5312", "value": "384:KUlOyj1hF/q05ul9+K0b6SFDMH4YlTYbGGqTrJHehHQZJHljgCrPBXTl1nHBwLdp:Ka/q0Uvv05LYCbyg6llTlAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795146, "uuid": "797302bf-80df-4040-b2dc-6c04655d1ab2", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795146, "uuid": "5cfb31ef-9356-497b-891c-f8fc145c5eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795146, "uuid": "cbe53a72-b914-4f30-9e32-51c6f5943f0e", "value": "5f6382d6291afbcaddb90da37f6c1f6ad55cc4e9b3e17de6c75e62eff9598edd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402adcbe-5939-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779823784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823784, "uuid": "cc1b9f35-bc67-431d-af5e-be4fbc850045", "comment": "Malware payload (ConnectWise)", "value": "d910eb5231e450f2096babc391c2ff8f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823784, "uuid": "a930ee75-d7d5-4790-a9df-321fdf58fc6e", "comment": "Malware payload (ConnectWise)", "value": "604e1cc7d2a390a2d211239f4335cb0c0d80d8b9ee48c35f823a78d60e861886", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823784, "uuid": "ca6cf475-4186-496c-a7f3-2c1d567d4403", "comment": "Malware payload (ConnectWise)", "value": "78161bc1e7ae8a39f98a9428e05e16f61f7f8465", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823784, "uuid": "0a039275-a2a2-45a5-9bb7-3cbead8757a7", "comment": "Malware payload (ConnectWise)", "value": "3b31f34b1932b7a24cb456205bc7aa640facc82bc0b57df6bdd5fe40a9c08c8baf3c607d84ddc5d0b83e54324b75f0cf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823784, "uuid": "033e4975-6bf4-4f97-929c-ce1de8400fe3", "value": "T122646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823784, "uuid": "b7742cc4-2e13-4aa6-817f-e1643c6e269d", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823784, "uuid": "3b2db2af-fc0f-4801-9b3f-9502e3450262", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:o1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823784, "uuid": "8b741ec5-01dc-406e-9881-0e726cfcde63", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823784, "uuid": "0d9f90d5-c9c7-4bc6-b8fc-401f49d03621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823784, "uuid": "c07abd7f-43f1-46b2-a650-b9f355876b67", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73283139-58d0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779778773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778773, "uuid": "98b59ac1-dcf6-4e9c-a777-1c8b22eb8fed", "comment": "Malware payload (Formbook)", "value": "aea3f51bd097e70ba351cbba3ddf3543", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778773, "uuid": "3ceab669-e6aa-4947-8d46-a915cdd887d3", "comment": "Malware payload (Formbook)", "value": "605a824e4a96c54160bbff512687321fca8f06b0543e4136f13b3800915fd263", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778773, "uuid": "a845e405-388f-4111-bb78-32e228b34b4d", "comment": "Malware payload (Formbook)", "value": "0a03047884a9fda5e074217faa77cd1923a3a28a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778773, "uuid": "06dacc9e-f91c-4149-8608-3f11feda6feb", "comment": "Malware payload (Formbook)", "value": "5d4b34f27fa1be9e2b74428ecb8f5e29ca73f30735272e920bab4f90ea92eebab231424351947f8c033d02508eba39b7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778773, "uuid": "5c77109c-0898-45dc-ad9b-fc5751ba7721", "value": "T154155C919BEAE509F2F30F85AEB6B05159377DB62C3DD12DD008629D0BB3A45C861B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778773, "uuid": "05f64bc1-9d3b-43c2-8828-3f036925bcf9", "value": "3072:O7KeMYi6yg6Wyr8a6girkKs7jVpn4JXVYBmacam8B0fZkRAtuiDglu7oJNZWwC6b:mZgpTnWk21IhC6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778773, "uuid": "04895fb8-a267-4b39-a8a8-17d8f82c72e7", "value": 930892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778773, "uuid": "055cc66f-8522-40d9-87d3-4704579fc850", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778773, "uuid": "815fa261-30b5-424f-bff9-4f89e6395c7f", "value": "Fatura ve \u00d6deme Bilgileri.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377617b6-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778243, "uuid": "de529279-0cc3-458c-83d1-aab47aded55f", "comment": "Malware payload", "value": "1c67179f5185105599a045f76bdfcd56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778243, "uuid": "edc150e4-b528-4aa0-9815-6c51ddbe1019", "comment": "Malware payload", "value": "60996777bf4f37e0eec2a99d450664278f103077f12a4b59178ff240ccb1b803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778243, "uuid": "882b911f-20a6-4d62-b86c-972ca173352c", "comment": "Malware payload", "value": "b420d95fc5eaa93b46d283eb0e7b0ebedda2357b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778243, "uuid": "543545b1-ee2b-4cb6-b605-383cb5f12225", "comment": "Malware payload", "value": "720b67f369cd0393b6727442167a4a20ff224616aedc9071215ba1f1ed709ed2a52f7f787e597be3b48edcbaaa6d130c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778243, "uuid": "04839aad-2828-44a0-92b0-a3154002b813", "value": "T1CD931819B3A320FCC26AD17552A796B3EA72F4311125AFBF1398CA352F94C507F2D624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778243, "uuid": "1cad5627-14f7-4872-bede-2775ef09c662", "value": "57fc5739fc4b217f21e8f4161d3f9c08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778243, "uuid": "802ebf2b-87f4-485c-b759-13f05f1e5573", "value": "1536:yhaJdQSUCRSIA6jFlZahZRZtJbB/IAGfgNQq5HcaiyzAQxQRWiW:y4ddUCYx6jFcrTXGcjuaiFQxQM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778243, "uuid": "913f5063-699d-4675-9215-d7331f02a8ac", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778243, "uuid": "94897268-7bd8-4fee-9c42-1fed89b0908d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778243, "uuid": "61ee3c87-17a8-4b14-bc73-eefc49e7a36f", "value": "1c67179f5185105599a045f76bdfcd56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec069d3-590e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779805260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805260, "uuid": "62646ca4-c830-4069-acd6-6e40bea52a6c", "comment": "Malware payload (Mirai)", "value": "889aa91a0f3a138bd1ae805fd8755836", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805260, "uuid": "b9c13577-8b87-4190-a220-31d09ead3c6c", "comment": "Malware payload (Mirai)", "value": "60a6c07944dbec36c4b2054c13942491a4f73a4fb2a53622a0c92527e20a710b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805260, "uuid": "9619cbb2-b504-400b-9ac1-bd20ebe8bed9", "comment": "Malware payload (Mirai)", "value": "8b2ca7213bfc3487df919723838ef72c5b5208bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805260, "uuid": "4ac34d78-737e-40a0-90ba-7921116443ec", "comment": "Malware payload (Mirai)", "value": "9e9bf339a9e206bcbdda0d6727c8cbd62fb9641da1f954f4c4bac86bbc91d6b56bd6777e61c7267e6dd59f78ab5d2dae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805260, "uuid": "42454cf9-5038-44a2-8d3b-fa575f007b25", "value": "T1D234B50AAB519FF7D45FDE3305F9870124CCB85321642B3A7270EB5DB95A68B09E38B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805260, "uuid": "d62659cf-cfc4-4cc9-9b1d-7994d40b6ad3", "value": "3072:F+cnLJXYVGO5qNLHJ6lpzq8KQrgz0JBAj/Z7C1i:FwGOcr2q8K3z0wj/NC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805260, "uuid": "9cc4eff3-7f2f-4970-ad21-999cc22b26a7", "value": 253060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805260, "uuid": "c3cc0dc2-0e5a-4bbf-b02b-c119ddfb7b8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805260, "uuid": "3c43fa76-a601-4d8c-b4b1-ce48e27039fa", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92d066c-592d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779818807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818807, "uuid": "122caf90-24ad-438b-bc5e-90db9eb5a7f0", "comment": "Malware payload", "value": "cd533e59af3c364a3bd16a86c06c7c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818807, "uuid": "2b372fe3-63a8-4ee6-87eb-9d796f33ae0f", "comment": "Malware payload", "value": "616740a4ece7a72d3dad48c314db9e1f5b2f1cf2916c3de2eb27a707e1cbdccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818807, "uuid": "2ed2d837-e021-4451-b2b9-ba53653b5b01", "comment": "Malware payload", "value": "e56ff378f60d8d7a0948dbc331cd8abed1d336d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818807, "uuid": "3e5ab023-cca9-4492-887f-bcba275b9bb3", "comment": "Malware payload", "value": "32111642663713a7f48e63216fa1750d7fd07cdf5064417d1538b356728866ea4e92918d6eaab8d772cf6b6183360b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818807, "uuid": "f8b9fde6-9d01-40a6-99f6-b4eac3df30d6", "value": "T1C5C533996BE5C750C02C9FF753D84643DE384890DABD881633580ADE99383D7B6D0BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818807, "uuid": "39bdb93c-f742-4d64-ba09-981438e46c73", "value": "257136e96f144a32d5d76c1d27d6c1cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818807, "uuid": "42d33ec8-29d4-4ba1-b27f-143599a169ae", "value": "49152:uj2R05XY/QIrMOx/lLh4gAcFuuYSfLP1zJTxQbJCWcQh6IjwO9N7YB1Jv3C:cIhhycFzY071lTxbBQgIj19W1tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818807, "uuid": "f4025991-e0a5-4209-8aaa-f6daf97b93a2", "value": 2741184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818807, "uuid": "c3057c4c-33fb-488f-9308-e2d9c23ad8ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818807, "uuid": "1434521a-0ece-4806-ae4e-8d4a6c98417b", "value": "PrimeHub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b55ad66-58d1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779779028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779028, "uuid": "b9ce8d37-d14e-41ab-a4b1-e8f1dd05d44c", "comment": "Malware payload (RemcosRAT)", "value": "2c8c627be6cf8b1eafefab9aae7d4033", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779028, "uuid": "fc30e038-23fc-4230-bfd8-15f4dac48841", "comment": "Malware payload (RemcosRAT)", "value": "619db0eeccaff7792ef89c4c0d12cfede8aed386935450c285c02af96dedff96", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779028, "uuid": "89e56dd3-e176-4abd-bd13-72df8137b95a", "comment": "Malware payload (RemcosRAT)", "value": "eae6b47caf44dcd669e9230f31897c45b1f941f0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779028, "uuid": "2783d70d-ee44-4b39-8dbc-c7d87c88ad5d", "comment": "Malware payload (RemcosRAT)", "value": "9475138de1947d453d5c8b97dc72039605a267e598b9f604de347e655a8656bffd2afaae5d55c36b6bd97f27be4c69fb", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779028, "uuid": "c0e2263f-1546-4dad-a1b2-52675dc5c8be", "value": "T159334B31DDC017351D4B1BBDAC912674E278877A153500ECFEA97309600A6BC7B7EAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779028, "uuid": "97b07176-b97b-4308-943a-6386156b2068", "value": "768:8pO0Lv4jOK/tI00AlixRc/8pnD1O5fpKKp9IYVpJX/K6OSrhW:8pNQSitp0AwRw8pYTKKvVy6no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779779028, "uuid": "3e7571bd-9c3d-4267-8860-d24d9035e633", "value": 54009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779779028, "uuid": "11a917e1-c230-4220-ac9b-8ff1e6d1232b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779028, "uuid": "2d53fa08-46fa-4c45-8332-2caa823797be", "value": "Dolefuller.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978d5f65-58ca-11f1-a769-42010a9c0008", "comment": "Malware payload (Babadeda)", "timestamp": 1779776257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776257, "uuid": "e049152b-1240-45e5-875d-fd1680616606", "comment": "Malware payload (Babadeda)", "value": "538f1c500298415f3b5bf45d981f04ed", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776257, "uuid": "da356c9a-c6a5-4995-b283-8bb94d3c48a8", "comment": "Malware payload (Babadeda)", "value": "61f927364c55d922a88fabd3a674ef368a6c6cd155ad14fd75a51e146da63fe1", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776257, "uuid": "4e63e171-73d2-4b57-b2c4-cb264db08fcb", "comment": "Malware payload (Babadeda)", "value": "d464f089cedbd2f6ebe2a221d6223fba8c3174d0", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776257, "uuid": "7efe5e0e-12e3-45de-9de7-8b02fadf1610", "comment": "Malware payload (Babadeda)", "value": "e998d3047f4b9c651541778c08f42e5769a5d852bfacf2197265b4ca6249a0836439780f0cd4bfb4f3af0b0819ddb56b", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776257, "uuid": "8f8c5c55-590a-4081-807a-03ee363810fa", "value": "T174937D41F3E142F7EAF2053100A6722FD736A2389764E8DBC74C2D529913AD1A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776257, "uuid": "df2517fe-d08e-4362-9126-15ef02efcf5b", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776257, "uuid": "b46f2414-3fa1-43aa-9211-f8e74e187842", "value": "1536:P7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfMwd2sDaNROg:j7DhdC6kzWypvaQ0FxyNTBfM+aN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776257, "uuid": "1c9ae1f2-3c04-476c-9d75-6d905ea3bd4a", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776257, "uuid": "6ba23b49-13c9-4c0e-9508-1fbe8151ab8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776257, "uuid": "418a52f7-adf5-44bb-bde0-5dcff5f3eef7", "value": "solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d84f74-593b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824861, "uuid": "99a042c8-5c97-41ce-8925-39d8b6c71d30", "comment": "Malware payload", "value": "ebb3728ac5ca992ac9c5925ea476e3ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824861, "uuid": "4ac5dbf8-801e-4f2c-a644-8ff0c7548230", "comment": "Malware payload", "value": "63b94eb85e4d90c41e8598fddd4c9a6f143a8c4c996a01e59cf0cd5c25bdb8d1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824861, "uuid": "b2be2f4c-7fcc-467b-aec7-1623c2bbc344", "comment": "Malware payload", "value": "80d883679b93429256fe5f55e86e77672fd145e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824861, "uuid": "a5796728-39dd-4b55-8a94-7b4b0d83ef0d", "comment": "Malware payload", "value": "30abedddef49b6f60bc486edb530cc97ef896e275d0c8843b8faac99c7599a6030a65bf2639f689b18917ffd7140e444", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824861, "uuid": "587810f0-c56d-4c3f-81e0-ddb0f1510b68", "value": "T1E7F05ED3D27420B090ED08FEE7E2FC78626560BE9C1A8D64DCD5E4504399D8C28CE5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824861, "uuid": "0c7476d5-8752-4c83-90f8-79c9e66279c7", "value": "6:Tk13FQi3fRucDJZvucaucrcR/qwgMiCusEFNlcL/qwgMigJusEFNgKiMdI4d:YjvRxVZvxaxkbiBr8big0rgKiMWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824861, "uuid": "3b8f3334-d282-4cb1-9901-4f4647ef7473", "value": 542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824861, "uuid": "a1d09f63-589d-4c5e-a85a-f59bd5af7a54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824861, "uuid": "fdc78e48-eb22-4ae9-bc56-1dccab4fefb3", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1300493a-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779776894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776894, "uuid": "96d0dab2-f78f-4f8e-ad9e-d5898d24889f", "comment": "Malware payload", "value": "6186b51ca15b7885e38000b583892b5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776894, "uuid": "0386a87a-708b-4c77-b007-55e328c05f1f", "comment": "Malware payload", "value": "64021f1b6b5479cfb0f79d8bae14a0e4d8fb4b15663e4b8c1c7603c0a7d65c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776894, "uuid": "73bc4603-3a97-4510-8b23-82758e5e532b", "comment": "Malware payload", "value": "6995fa5aaf58ab6db61b353a40d10056272a9f9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776894, "uuid": "0f6e79f6-a13e-4fed-b9a3-6ec6471b512d", "comment": "Malware payload", "value": "5f632c452bc21510771d423b36a1bb3b574ba3513be2339e05516a1e517e79b1cc47e13369b5d22179ff773c22071068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776894, "uuid": "8f0c421c-4bcc-4803-b534-97c5a1c5e91a", "value": "T118D6F1FB73461C2DD02915392E7F570045366DBA5B01F801AEE3EABECB294711A3E64E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776894, "uuid": "5935fc27-2824-4395-bb62-b1cc191780b5", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776894, "uuid": "0d4980bf-4984-4eb3-8450-e4f58b0eef76", "value": "98304:O5/v5jWDyepepDBAeAvkvR/JCwoWIoV8tjZkDcJ1:yZ6Dan22gxWJSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776894, "uuid": "885cb2fb-12af-420e-8c78-adfb3d0aae08", "value": 13250474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776894, "uuid": "a9d051db-bc4e-42e6-afa2-9e77e9d9d922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776894, "uuid": "45978851-7128-44e5-bc6c-38593c815429", "value": "6186b51ca15b7885e38000b583892b5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cfe327-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784465, "uuid": "6de6fedb-0c61-46a9-ab57-31291a0b5e7b", "comment": "Malware payload", "value": "f806197c8011c7bee0eee752b42d9128", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784465, "uuid": "e2ec7a86-6e5f-41ca-9d3e-b2308d31b054", "comment": "Malware payload", "value": "64b8416c418c265ee1a7999470d9f688ad8204c1d85341e270e23649ee21e11b", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784465, "uuid": "3183bb32-6ebf-48e3-bf24-138513a16d90", "comment": "Malware payload", "value": "084a6633771c88a37b5ef939c46f6f3e6a6574e4", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784465, "uuid": "3cc9b22c-78d5-4b94-9339-5e994c2fa7c3", "comment": "Malware payload", "value": "125c9b9c73ccbbba85978a4c15be282a9a303d7725b4f86f001493f85f01a6fffb291b6d29cd0b37f72ec8b3f1256dd4", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784465, "uuid": "6e0394e3-0e83-4809-9de5-6e2c6b966750", "value": "T130D2E9004C691EB0938BC5BDBE999495B126261B1A197434FFFCD2941FC8B3542F8AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784465, "uuid": "1618046d-b6a7-42d5-a34c-43769e4e22c4", "value": "384:6zGO/0fbxyAXtAn/q8jU3NfVgO50z/OntheSK80KVgUyJqbTNRQmX4nXNEuN39/c:qcbOC8jQtb5MdUXbTNRfoX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784465, "uuid": "d5303824-8a9f-46b0-a43e-1d811fbc32e8", "value": 29000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784465, "uuid": "577d3b6f-93ff-4047-bb4e-6ebe11a009ec", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784465, "uuid": "ebfcbe73-f067-4774-bd96-398a7b86fdf5", "value": "64b8416c418c265ee1a7999470d9f688ad8204c1d85341e270e23649ee21e11b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd91314a-58d1-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779779354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779354, "uuid": "ba9002eb-94d0-406c-bff0-e97173ff2dd1", "comment": "Malware payload (Formbook)", "value": "5e057b3a6537aefff77105c9f05b58aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779354, "uuid": "308a3194-6b69-4bb9-aeac-bfe7fa36fdac", "comment": "Malware payload (Formbook)", "value": "64e2d169d90930905374a2f504cfa6a06276333533875b7a7d076cb2c472ae6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779354, "uuid": "74cc851b-9ed6-447b-aff2-a2623c1a8f24", "comment": "Malware payload (Formbook)", "value": "d1b7e1a009309ad7c07a8f7fdad7921efe72d50c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779354, "uuid": "4dc11cf0-2913-4d1b-ba22-f20cf3b7af09", "comment": "Malware payload (Formbook)", "value": "1e035c68d2d9e34770d543839e12c49334b1ba9c836d931b20aa57d896545706b2c3dbec4ee535b42e6bca997a14ebdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779354, "uuid": "2e0d5373-6685-4250-b761-4e2b20b1949c", "value": "T162251244A21EC813C8865FB44D31E2F01BB95FA9D510D243EFEA7EAFF97A7561406382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779354, "uuid": "0f1f5cf4-7d30-4d36-b8a6-85e6cac8a385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779354, "uuid": "dcaaecbe-2e9e-46d9-93af-29ba33d8d849", "value": "24576:VhwZtj1QA/Z66M1Gzz2NRVKpmjq8ovgTQzg8cvZj9DW:TwTSA/Ho2z4mZs8cvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779779354, "uuid": "4db86688-ca21-47c7-93fd-4332ff72f11a", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779779354, "uuid": "79e6ca20-54d6-42c3-9b06-dbeeb54db11b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779354, "uuid": "66140f22-ac64-4724-8864-4e2c8181ff7a", "value": "TT01650Q0986854CNAMX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c0c7b2-5896-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779754061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754061, "uuid": "530753b5-18e4-4e8d-82e9-13def50c8c0e", "comment": "Malware payload (Mirai)", "value": "99c0f3192da65235e3fbadcfd567e553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754061, "uuid": "5a8a341a-8182-4f31-97d6-3055c4bb5738", "comment": "Malware payload (Mirai)", "value": "65005a23c587911ce3efe7d193c29f3201c4388738b4aa93f3df7a95650fc1f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754061, "uuid": "3d5f2592-d40e-4364-bed2-1ea7504ad5e9", "comment": "Malware payload (Mirai)", "value": "afc5aca03159a4ce2b97ee007eb0a76aa1ba0578", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754061, "uuid": "8ae85872-ec8c-4cb6-a092-95cee352cdeb", "comment": "Malware payload (Mirai)", "value": "37e39395d153cad8b7d970309869873f07b3e979dfe57df3eb47a38a64be98f05af1d8e0ab38c46835b84e08ee345e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754061, "uuid": "aa5c0019-e241-4477-b24c-ab1b8bd20e71", "value": "T1E5937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754061, "uuid": "5a03fed6-28a7-4aa6-8d51-f8c9c73591b5", "value": "1536:W/QCZaxGdvts3i5JPhoRsxPu++4HRsUIKqI4FrS4LSv:WYCZa8dvm3oJPhssxP5lR+KfUmDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754061, "uuid": "19c38736-029b-4e30-9c79-3303f58c4dc7", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754061, "uuid": "abc525cd-dd1e-47b3-a179-0a7d58845619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754061, "uuid": "b56dbd34-adbd-46f7-abe3-6cc319280318", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b229dee-58f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779796422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796422, "uuid": "be5cb47b-d2fd-4592-bc4e-d15a580aabbf", "comment": "Malware payload", "value": "e26445e9ab87eb8bf78175854aac1170", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796422, "uuid": "87d7f7bf-4409-4887-9527-ea3b490b4783", "comment": "Malware payload", "value": "6506dbc9ed2f9fc514ccbc369a90d36cacc0e98862c6947d358cccace33959f4", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796422, "uuid": "315ec5e7-7596-44c9-8e0d-a9c8d2203310", "comment": "Malware payload", "value": "296109f692fffc93de7a0fc1764e2afef9a7887f", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796422, "uuid": "dea933ad-66ff-40c0-a244-e832575bc756", "comment": "Malware payload", "value": "225d0ecee0613b016a17873a06ca7cf4691588c2e227d16b4a7f3b93985d60c1dac4d7025ea965a9f2a5b49a3303b739", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796422, "uuid": "0870e083-6dde-4ea9-ae42-a2a5b0ba9aa0", "value": "T1E00533496C50131FD88DFEB6E4BACF8F3E950909159824AB46C80D7183BF6DFD86187A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796422, "uuid": "033ae89b-65d8-43c2-8b8d-ef4e53cad107", "value": "24576:GPlGfFOUu9kT+4SYAd+xGsroUgLLeowPZP1XH:G0fF29eAEToL2plH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779796422, "uuid": "432312b0-f881-4435-9d52-056c9a6575e3", "value": 835866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779796422, "uuid": "74ea6fad-09bf-4301-b34a-4ad85cd13229", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796422, "uuid": "96bd05dd-d1d4-4b82-bfa2-e3020fab9e2a", "value": "Arranging_a_visit_program_at_Battlefield_Dynamics.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415fa7cf-58f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779796299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796299, "uuid": "48e3026d-56fe-4078-a2d4-ad56d0e19ff3", "comment": "Malware payload", "value": "21f50481194dc4dbf7d8a5b1c34f8c98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796299, "uuid": "808559a1-8777-47f3-a0eb-42548c10ae99", "comment": "Malware payload", "value": "65355d892f4a68a49c34c692568f08a427b823d6b96db00ecfd4a898897b0c5a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796299, "uuid": "1ab47f2c-b15b-4a15-bb4c-02de3f060b32", "comment": "Malware payload", "value": "fb745bd62a945cf0ab3d9ff3e82549400681fccb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796299, "uuid": "cf688ff0-4be6-445c-a105-83b9dc12e797", "comment": "Malware payload", "value": "062b5ceb62c0bca3f34a81d150daec0693f88eb25eb66c57067fb6f60d6d8abe26f91ccaa218bd8400ccf4b79bf67366", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796299, "uuid": "4bbbc608-740a-4b51-83e1-b23e705639ca", "value": "T1FD53CC9C765076DFC85BC8729EA82C64EA60747B831FD203A46316ED9A0D99BCF150F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796299, "uuid": "bdc3e10e-82fa-46f4-b1f3-5cf4fdcfe565", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796299, "uuid": "da722967-00ec-4e6c-a0a8-fa0f9b9f8b56", "value": "1536:DxwDXjUVxyvmD4p/FcxcuL6jF+W0gl8OMNUh0AbI0:2mD4MIv0gl8OMNUh0AbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779796299, "uuid": "2e027fce-1f38-44bd-ad89-c202d922a826", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779796299, "uuid": "1bd5d437-19ae-4b58-bce0-1b88c64819d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796299, "uuid": "bda143cb-4f60-41fd-97d0-a27975078a35", "value": "65355d892f4a68a49c34c692568f08a427b823d6b96db00ecfd4a898897b0c5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f8b001-592b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779817855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817855, "uuid": "7e6f4b76-3ddf-4896-86cc-01d4920c9782", "comment": "Malware payload", "value": "eb67187281fc7425069a09c4fb90ff89", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817855, "uuid": "4d3da751-9f20-4f5e-9a96-67237b3130ae", "comment": "Malware payload", "value": "6648beb4d87dd662ec3af36ee5ea9572d37a993b42f8a5efa0c5fd735e58beb4", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817855, "uuid": "3ed0a656-7587-4d6e-bffa-d1bb62aa87c9", "comment": "Malware payload", "value": "a28a8dbad1deb1d4b3ce37fd10fb8f449de0ba3c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817855, "uuid": "449f474a-ca9f-4cf3-9f4b-bb199881fd04", "comment": "Malware payload", "value": "160bb01bf7e5133ee25732ce9e3a30913beb2307dd8627facea9d3e6b5c87e7360bb87222e588b710228ba0f224a14f8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817855, "uuid": "14168137-2674-49a5-a164-27d272c10a67", "value": "T14A23C7540949ECB29783A82E6877DFF1BA9BEF305B50866D34EE90E1430267015EDF1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817855, "uuid": "d24b0fff-544d-47b2-8e99-9c77d107bf35", "value": "96:t+cFPgGgVgHgwcF/kTgkg8QQZMfLPH387xsKicFqcFBGGNjK+xhcFQcFIQcFr:4UpUMPzZMfLv38tsKiUqUreUhUQUdUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779817855, "uuid": "d0b61ce9-faef-4a67-b2b1-543ad7637e5a", "value": 47740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779817855, "uuid": "05162b1f-abd4-4eb2-9956-b421ed3feba9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817855, "uuid": "d3387b39-71e7-44bc-a67a-f5ceb3f513c2", "value": "madewithbestsettingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036c8be6-5940-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779826689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826689, "uuid": "aa3ed54d-61e0-4a47-ab0b-dcb46372cc1b", "comment": "Malware payload", "value": "bb189beadf9637e1ae154670ff991408", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826689, "uuid": "795fbf94-4466-4944-a7d6-8c68c378411f", "comment": "Malware payload", "value": "684feb36c4f0d945a0a6af7999c7c1891f15e51b346ea6cd61dcc0183838f35d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826689, "uuid": "8fefdeea-8df1-4128-8e7f-ab0342375b22", "comment": "Malware payload", "value": "f1b319d07d7853fe54dce609154d89cb68f0ee95", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826689, "uuid": "2288715d-9a0c-46ad-831d-7730b9146b35", "comment": "Malware payload", "value": "329a688cb7b92e49e4c2104aee867bcc28080cda871de7b0cbbca87e38912f939e20add0d4e1faaa9562ccacfa337a87", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826689, "uuid": "85a2a9eb-f070-4d3c-baeb-0434e5f5a283", "value": "T1B4514CE884EA32539009990BE969A331E9D5883CF4D822DFDF47B8C4466DC3984AB10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826689, "uuid": "1cf6d4fe-96fb-40ce-a4ca-677c9b19fc82", "value": "48:ZSkJrKSa2y53VZZ0LjgKR0qOJFrQ/PKJhBxBtiLOWlscU+s3WM:ZSkJrKSa2FMi0I/yJhRcLNRUFWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826689, "uuid": "b8de16fa-32a7-4937-beff-39ba8208b4ad", "value": 2599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826689, "uuid": "5839d53d-b32a-451c-9f7c-3c41c24b04d4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826689, "uuid": "4c4bb70e-15b2-4a15-9115-f14f9efa8896", "value": "RequestXforXQuotation-RFQ50620260525_BOQXXXSupplyXCommericalXlist_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c7bd98-589b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779755964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755964, "uuid": "b8cf3b2c-1936-48a1-bb68-7bf0ca9aadb4", "comment": "Malware payload (ACRStealer)", "value": "d827baad91c91c5350b9c27cdcff0246", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755964, "uuid": "93c9f44d-495c-4e5d-8324-42b2a7da6590", "comment": "Malware payload (ACRStealer)", "value": "6871848bb724a184e393a734c9de9c17c41da1f26359755696f0df40685c42f2", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755964, "uuid": "501fd2d0-3773-4325-a968-713ee75aa470", "comment": "Malware payload (ACRStealer)", "value": "3450dda4bfd68e60ce2ff9dc9a3baa643475896c", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755964, "uuid": "daff1b32-8953-4d3d-8356-17d8793d250b", "comment": "Malware payload (ACRStealer)", "value": "a04ef95cb0200f8c9d033915cb18e3c51667a53489dd92f176a6d2d3c602894f2ae392545c310bef707a8c1bef67d7ea", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "laserlogdnsop-icu", "colour": "#415731", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755964, "uuid": "adfaacbd-184d-45c4-b55f-b15525747394", "value": "T122C57C01FDC394B2E402133299AB62FF2735AD451F329B97EA547A3EBA736D11D22305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755964, "uuid": "a3e7b1c6-56ae-4b9e-b609-6a5ccb4f6ab0", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755964, "uuid": "30d7572e-fdc8-46fd-b091-9946311e9e1c", "value": "24576:v4Oa7yROtnIr9/aewnKV+HXu6BOBojDhk9pLgL/dDkOKL8nX38bwgOcFKpUttRYp:v78vVt9kkLV4bhFKArkP1sB9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755964, "uuid": "5c66dbf3-e948-4f4e-af85-0a340be66182", "value": 2617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755964, "uuid": "ab89bc2e-29fb-41fd-8f92-adb2f7995cf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755964, "uuid": "f4568dc7-823f-4a80-8a02-d3c2efbcea15", "value": "ojujn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1d291a-590d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779805069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805069, "uuid": "0135faef-fffa-435e-9734-4a189fc5003f", "comment": "Malware payload (ValleyRAT)", "value": "5fc6b437d3fff539e70bd879760a093e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805069, "uuid": "cfd65d0e-6d5e-43ef-a8aa-31b9f9cd4f37", "comment": "Malware payload (ValleyRAT)", "value": "6913b11afb60e85f2e7bc574adb2f4880b4f2fbf881a1035cadc819ea482b162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805069, "uuid": "314798fb-91e6-431b-9449-3a3a1d27c8a3", "comment": "Malware payload (ValleyRAT)", "value": "b4b66b3ab728c2b788282760e7b0449657b74482", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805069, "uuid": "c73bbde1-3954-4507-b02e-b751966122f0", "comment": "Malware payload (ValleyRAT)", "value": "24fd51b0250184e656c41d39a674d8a409352ad2db54f7eeda9941f494985c599e1f2c46aa9f668589010963a1a56d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805069, "uuid": "d5bb64fb-8421-4c5a-9820-c8a759e3a414", "value": "T1E2836C12B5C2C871E57615311874EAB19A3EFD501F609EEB3788137E4F346C09A36EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805069, "uuid": "1be8640b-07d2-4781-9163-44ad219d5a50", "value": "43fd8af5cc554cf39136523b5d65e5ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805069, "uuid": "841de8fc-f844-4246-9eee-58ff06baf2ad", "value": "1536:ow+kWIahoGV0rJ+pvBQHKIj2F+ZNu8HVPshvmytPrA5gzWzsWhcdRptbhqwE7mKh:oHIaIrJ+0HKIj2Eu8HVshvmx50jRXbhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805069, "uuid": "c8771e37-98ff-4112-81db-c815daf295d8", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805069, "uuid": "f7a31f14-44ac-4724-872f-64c255cc55b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805069, "uuid": "ab11cdff-ec9e-4d39-954f-b22cf344892e", "value": "Feishu-win32_x64-7.67.9-signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5f88c1-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "3c67191e-0921-4ae7-b410-0627b4ad624b", "comment": "Malware payload (Mirai)", "value": "29bca31c2c41f535401cd7c558d36ccb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "5deef7e4-19ee-4ac7-aa68-6032a6c80ce4", "comment": "Malware payload (Mirai)", "value": "6967927c392e1a7ef539569332dd22b469532fdc897407c3462c45d4e18ef541", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "78d6389e-c507-463d-84d0-ff312580cdcc", "comment": "Malware payload (Mirai)", "value": "48b72ecd02b7a1931448ee70d8b81f27c69be27f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "c8009b5c-d98d-4dde-b89c-0735ad0e9539", "comment": "Malware payload (Mirai)", "value": "fdb360345f8a39a6afdfeaf6f67fb423ef59cfc38a81c6b37c33f43eb5a9803eff803f312190c1293ae2bc3415b95365", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "39e8a887-e237-4fac-8cf4-f14c69f981a9", "value": "T188F2D0D5DBF9C945C7ADE07C445FA90F0690C46C8D0443AECF59B81A2452F24EAB9FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "ea4bf64a-8aa3-4639-b7fb-55c8fe1331f7", "value": "768:4W/zEpEYEgHE+Tc6ryeinkUNnERhn+f4o6iu6j/ACGEqiBdAGH7jfmTnbcuyD7UD:J4B1E+Tca7UAhqR6yxLLwnouy8Hys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824451, "uuid": "b13e5938-a728-4fc8-a1ea-2c0f0755fea6", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824451, "uuid": "7d9d0648-0f19-4083-8e3c-e9c68cd2bd05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "fc94faf7-3262-47d6-9f4c-6c9da90f7b45", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0033fcee-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779776862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776862, "uuid": "29aea7ba-d177-4908-b6a2-79d78062fa23", "comment": "Malware payload (ACRStealer)", "value": "57f9ab8e6478d30b1850ddea5f9f9a9e", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776862, "uuid": "5069d719-8b63-4ec9-959c-45530c828753", "comment": "Malware payload (ACRStealer)", "value": "6b82cb8b9becd746aac0583fac20c3d5982e56b8ae5d39aa2ac60a5c80275d85", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776862, "uuid": "3d540c75-7318-428e-9812-2cc79e5ec90c", "comment": "Malware payload (ACRStealer)", "value": "c5fb16fe779b72a8eb76a70ae353e614b76d5371", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776862, "uuid": "87d5c67f-782c-4bb3-adeb-d590f5b00547", "comment": "Malware payload (ACRStealer)", "value": "54580b5fab809fdddb612e1288ba2eca1a5b724ccff1ca6c0f090133fb83249c31c165bf592dfc975e880a2fe8e2a5f5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776862, "uuid": "af2b8fca-bd18-44c6-b1d1-d830fa93892f", "value": "T11AB57D00FCC784B6E4025332C9EB62FF2735AD058F329AA7EA447E7DB9762D50926315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776862, "uuid": "d8f5bf6e-de45-49bc-af1c-02e7fd8f820b", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776862, "uuid": "8955cb17-bd3d-4c80-8d3a-b86398ab319d", "value": "49152:ihCvblQefLw2zhueCCkLk/1rLW0MYTMRPjbsG/bJmHG:AeBQefLw2VueCjYtW0MY3G1mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776862, "uuid": "49fa523a-9821-4ba1-ada8-7b6cf9036571", "value": 2426504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776862, "uuid": "1999f7ee-abec-4bf3-8084-15dfe7e0d82e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776862, "uuid": "9dcc2ffd-790f-4bbe-ad26-9618c54044c2", "value": "SecuriteInfo.com.Win32.Evo-gen.82758973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f2be9f-58df-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779785158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785158, "uuid": "bba4df07-3a9f-4918-86e6-1c676dcd8f14", "comment": "Malware payload (AgentTesla)", "value": "00c4222201ab023c32637707d091e643", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785158, "uuid": "42dafbe3-6e1b-42ba-864c-4e996f42fdda", "comment": "Malware payload (AgentTesla)", "value": "6bd7207841fad8f065ae5ea7f71082e4625ebbacbfbd5c836c88a12024c379fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785158, "uuid": "af5daf13-8e9c-4380-a2ea-e59fe4d70e27", "comment": "Malware payload (AgentTesla)", "value": "29e3b47b980d5202a5aa12ff5cc60df890f23792", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785158, "uuid": "2253998e-0e17-42c8-a7e2-4fe1664cd1dc", "comment": "Malware payload (AgentTesla)", "value": "552a5f5f9011b54d92e9e936702b2f53484b7e9f80aae7a3e3c18b9eb811d7e0775439087c2297c4e8843520a9150089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785158, "uuid": "e5b6a509-bde4-4131-9b1c-0043722b532c", "value": "T104340F027F88E715E1A93E3782EF6C2453B2B4C71633C60BAF49AB5524516826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785158, "uuid": "190491aa-5130-470f-bb15-bde80c69f732", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785158, "uuid": "b3d27bbf-a7db-4d59-a998-663068b4f728", "value": "3072:AAdyqayixEQhS9bpVmnM5XTHo9rG8KaG5jnThKqAufzz:Tyqayi6Z9lOYsq8KaWTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779785158, "uuid": "b2d456f9-986c-41a2-9a79-ae771d861ef0", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779785158, "uuid": "a29dc3f7-bf67-44bc-a334-be6c79777202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785158, "uuid": "cc9a703f-e64d-4883-bf45-52188533d1d3", "value": "origin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f188e8e8-591d-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779812056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812056, "uuid": "32e6a29c-8bea-4dea-9868-4595dd33949e", "comment": "Malware payload (RemusStealer)", "value": "562d60cae1b912a1ed3a0ff976d249f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812056, "uuid": "413e5778-4cf8-487d-ae7a-45340de75ab9", "comment": "Malware payload (RemusStealer)", "value": "6cbac6bcd1acb90031a31b9595deb4e9681450b9554a9e61e4fd20d81e450a0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812056, "uuid": "fce78760-8e14-4c92-b5d6-f855d72b4424", "comment": "Malware payload (RemusStealer)", "value": "e1f2764686e936cfc274deb993d79faef9d7e652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812056, "uuid": "9c02f11c-be92-4974-956b-46f1ab9d51ed", "comment": "Malware payload (RemusStealer)", "value": "6558bd9ce78341c56b8f892d3cf5578ce20b9acc65d6f1430558933d063ae709a0757ffaf613cd40de4d3dcd84843f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "go", "colour": "#35396F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812056, "uuid": "d1889b89-b288-451b-8232-41223cdea38b", "value": "T1976549477CD064B6D5EA923288B6A2917731F8590B3167C33F14B6BA2E773D04E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812056, "uuid": "a73dbb83-cb68-4e2f-a90d-8c4592e295d5", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812056, "uuid": "12c707db-6caf-4a64-996a-3b65bf59e0a3", "value": "24576:5EjiWtG33iFJ94IKUwD6IorXjQ6OgLP88WQHdQvLcD1Y:C2WA33iL94ITwD6/agLPycD1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779812056, "uuid": "a1664137-5d01-452f-9c9b-3c222a23af70", "value": 1542272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779812056, "uuid": "fcde6ab1-74fd-4f17-be3a-22ec821af40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812056, "uuid": "507ca9c6-6aec-4565-a83e-f2d1a0310613", "value": "V\u0435l\u043e\u04411t\u0443G\u042564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180b0865-589a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779755427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755427, "uuid": "ad438e26-530e-4a6e-8daf-e2c4bde7c2bf", "comment": "Malware payload (Mirai)", "value": "36073b0baa22e7589ca4c4aa2b108e1e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755427, "uuid": "538e4988-e331-4c02-9429-5b8615e263cd", "comment": "Malware payload (Mirai)", "value": "6d664c9de8994ebbc907aaec3546c1a4c4512347a23db294098cf01105a207c4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755427, "uuid": "aa56b54c-f297-421f-adaf-ddf159cc02fa", "comment": "Malware payload (Mirai)", "value": "9323951a39afde7a4ae4770082d5c38381e841ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755427, "uuid": "87b7c552-0ee8-4fda-9d97-52a0709554bf", "comment": "Malware payload (Mirai)", "value": "8d44e0dbcbca41f15bbf34c458188c7888d44f8483dec74faf7057705bf9cf4704e554d3eb43c56bbf123d746dca0994", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755427, "uuid": "44074dc7-cbb5-4117-87cf-eed1cb0a1c37", "value": "T1388170CBF1D95B721FE2991AF1BA984761D040E33182DF84B6FC24B24C49D19B9CAB71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755427, "uuid": "a045d8c8-7b94-43a1-bc0e-681893798ac6", "value": "48:T0fe0F0Dwn33ed7seSDGEDeh9RNeD70ie0I02Lw0Ce2p26Wjeop5eXkY4emK2ve3:2TZJaEXgjpLJbw93UvZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755427, "uuid": "5fe5aebc-a9fd-4ca5-b31d-1a214e0141ce", "value": 4000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755427, "uuid": "3447465e-6370-4ff5-a5a8-07928ccc1bb9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755427, "uuid": "7c455569-25d8-4148-a7d3-36d44394cc55", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbec45a-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "aa41dfc7-32b4-406c-9df0-3dc73ddd2130", "comment": "Malware payload (Mirai)", "value": "6f15b37cc6ab60f811fdb14959de274a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "66b50664-ca9c-4def-8b28-94f935927fab", "comment": "Malware payload (Mirai)", "value": "6dd3f08b88b186a29e70aa8bc32b2ff310f4cec0fcd3d54e5d2b04d875e2f7fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "8820a391-c764-429e-8744-82b0821b5ce6", "comment": "Malware payload (Mirai)", "value": "d416c3d3c2beeca9451be0026f82ddd8381335c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824450, "uuid": "17f991ae-15a8-4fb1-819a-3c1acdf49994", "comment": "Malware payload (Mirai)", "value": "4cc8eeee8300316d9b58f4209611a9b5af093c5539e282d962cade76a131718412140cebe97f0491eda31914f0bb4a53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824450, "uuid": "d226543d-c47f-4cfe-8004-acb37acdaeac", "value": "T11903D13C0A0904F4E57EC17BD6ED47E07935079D1A41CE563260F6A6E64ECF878A2AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824450, "uuid": "d82f201e-a48b-455a-b3df-2be3ba70a1c7", "value": "768:cgN29x3ZpzZ5VjNuvtE54Fe7GbxBDbYsPs4P5CuFaJgGlzDpbuR1Js:q9xJZZNKNFjBfRUMX+VJuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824450, "uuid": "3b09a65b-4bf0-4f4f-9d2f-0443812c01cb", "value": 38076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824450, "uuid": "6529d414-afcb-48ee-a5d1-0fc6115f9b63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824450, "uuid": "3818938b-9d75-4645-b6b1-e221a5c2b9fa", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300907cd-58a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779761051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761051, "uuid": "729af847-8cd0-4c71-aa13-ece0b9e89abf", "comment": "Malware payload (Mirai)", "value": "a58bfa5948a2e37c4fe9b370d3edb1bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761051, "uuid": "4ee3fb90-58b6-4a80-bc60-0e7254f95e46", "comment": "Malware payload (Mirai)", "value": "6dd9f50a558ff03a8fcae771902ed66025ffc7a2b52b36573e848c3f18bdb112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761051, "uuid": "59548305-7c4e-485c-a99d-2940f2f036af", "comment": "Malware payload (Mirai)", "value": "c345f46555877b9eacf8df9a5661024f4ff30205", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761051, "uuid": "60e34457-c405-4c7a-9f57-ac869aba91a0", "comment": "Malware payload (Mirai)", "value": "177bdf0789b99547423d8be11d81fe029a2efb505177e8830c9e94f10ba038c541177a860541622cc9381a0242a19b69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761051, "uuid": "8ede481f-f27d-4911-bc7e-2dfdf3643169", "value": "T15C156B5BFE5E3C07D2D7E23DAB4AC3B0522BB590D21351667A82032C95C6ADCCFE1691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761051, "uuid": "b36ee491-090d-42c5-8a3e-67a97c81ffb6", "value": "12288:6MXtRNu38tQUimlbTZkhY845p1HlSXn8G9hioFs5WtjFP3zxxuExz4Ri6Y1:6MXvkUimlIY84Fi86h1jB2ExURi6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779761051, "uuid": "f4c5a977-0440-4df7-9b79-4a4a2303403f", "value": 944743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779761051, "uuid": "694c4894-9966-4630-9532-2fc7433982f1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761051, "uuid": "44385cd9-9831-4ff5-bc55-20dd8030dec7", "value": "bot-aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c75fa7-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778237, "uuid": "80d18dc1-d78b-412d-bfdb-d10a24b92a63", "comment": "Malware payload", "value": "638bea4fda01066ba3acf3c2da423ad7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778237, "uuid": "59e36fd7-f766-42ef-95e4-f8c0de326e02", "comment": "Malware payload", "value": "6e8135639d4a6ba3b35859bbc2e73d0e232718dbf38ecf4313df4358fa252fce", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778237, "uuid": "3213cf29-bcd1-40da-a944-bf1353fdd2d5", "comment": "Malware payload", "value": "6f88471b0a24c0a9ea392cd2a26370910e3a11ca", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778237, "uuid": "d6a3228e-9f57-4a39-a4a4-eec03592e5c0", "comment": "Malware payload", "value": "36499fb5edacc37887d928b10525a90d6498c47c5e256db07b1e2c8849d65eba5813dcbe290f799276cb5423a2bb7d41", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778237, "uuid": "f836826b-ba54-49de-9ce7-fe472cd08493", "value": "T174217B41697383CC79B12A64C27D6101B0D2821BA4D0FD54F7CCA042BF25653DB0A1F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778237, "uuid": "ee794e5f-aed3-4e97-a9e0-6764f3385a8f", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG4jYq65ElESjLBKuYjxv:k4lL7wbTzBMXva4ZHrfo9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778237, "uuid": "afd37d44-4fcf-4a91-a760-5cf9270cc3f9", "value": 1307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778237, "uuid": "c0bcf941-e3b6-421f-8f37-a892a202f8e4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778237, "uuid": "2fdb5bb7-f701-4420-92b0-dfb6ac7502ed", "value": "file633871.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d723648-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779777018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777018, "uuid": "4a40f2b2-c99d-4f29-a0c0-0b047983d351", "comment": "Malware payload (NanoCore)", "value": "de52c0a0c0b60dee20c4cb43f5b42a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777018, "uuid": "34fb1afc-3b68-406a-8985-b5467ccfb870", "comment": "Malware payload (NanoCore)", "value": "6f15b90269632ec13a103642699d06159010c7b8f7ad774c007aaa175dba6967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777018, "uuid": "ac4cb961-997b-4af5-a6fd-6bc50f1084dc", "comment": "Malware payload (NanoCore)", "value": "7f122c4b211e17e5787992e0037a82157a71f51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777018, "uuid": "1459ca74-53a1-4868-87c6-6a62f175ad84", "comment": "Malware payload (NanoCore)", "value": "424279ef7f60969e90fc923d0d6e905f8c81c5f168aab1f4e48138d16e355003d8e3e873fe7067bbdbe9681a0abba172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777018, "uuid": "c27488e9-87a4-4d51-9d91-454f3cd3c3dc", "value": "T10914CF257BB84A3EE2DE8679612202179378C2E3EDC3F3DA58D454B75B267E50A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777018, "uuid": "de7b39a2-c441-49c3-982c-244896345a81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777018, "uuid": "89d51ff7-b535-4a9e-a6f7-d3eeeffee0fd", "value": "6144:sLV6Bta6dtJmakIM5IplNzULgm7SB7e+r:sLV6Btpmk/zcb87eW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779777018, "uuid": "ab71c7e5-889b-4e5f-bba6-a18d8c3caefd", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779777018, "uuid": "e0ec84fc-2110-43cd-9daf-3841a340d0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777018, "uuid": "51f96045-9336-4056-88b9-f4ccf45f9fbb", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ab28ad-590b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803990, "uuid": "d8df3ca6-1375-4b13-8244-90de5c828049", "comment": "Malware payload (Mirai)", "value": "a822737663818a643b94ff5e4d1fd619", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803990, "uuid": "2aca638a-a77e-4700-84eb-25774842d5fa", "comment": "Malware payload (Mirai)", "value": "6f2be7abd8ba53d28014356ab9d9360c2adf4e8e48fb72c119025363bd81c6b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803990, "uuid": "ac3abd5a-484f-447a-9fa6-ada4903ddc89", "comment": "Malware payload (Mirai)", "value": "7ac20b71477377ac15aba4897cc9d56ae19fc811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803990, "uuid": "ed8b115f-9313-4f2c-adbb-b6eaa019dc11", "comment": "Malware payload (Mirai)", "value": "cd7dad3723b2114f5cc94f4c530620d80caee8a4427ee0814d7b9e908f8d398639994b272ccae8b602e840d5ef77c0ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803990, "uuid": "7b3d404e-afec-414e-b5f4-6d4bdaeb0314", "value": "T1E9F33963DA26AF56C123A0F4A1F08F751B22AD6A09530EFEA477DAF45183CCDB109774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803990, "uuid": "1f950bda-494a-4ef2-a10b-9e7fa15a92d0", "value": "3072:RXwqhjmzH01lV68fuVwUgNKx+0WWhDlrWTf:RiA1lV68fulWWDhDlCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803990, "uuid": "4cdc8e1a-987b-4127-a01b-cffdce72fe7f", "value": 159644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803990, "uuid": "68d737b5-8b86-4a03-a269-bffdb8b87cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803990, "uuid": "a4810c7c-0001-48d2-a1d9-b0d5508707c7", "value": "wife.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec067fa-5898-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779754794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754794, "uuid": "ba9a2afe-b9cf-47de-a3e2-6bab35ea01e9", "comment": "Malware payload (RemusStealer)", "value": "d22008ef5f97d9f3a4f93e7642630596", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754794, "uuid": "2e6de01e-2b89-418f-854f-45426e40b9bd", "comment": "Malware payload (RemusStealer)", "value": "6f6f052595b109f4e8fdf42644b98f6380635f3f45f280cf85aacf6e30e30d2e", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754794, "uuid": "939826c7-764f-428b-b047-5994d49e78b6", "comment": "Malware payload (RemusStealer)", "value": "15b307e718515da11a94bbe0d37ea0e36e851e3c", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754794, "uuid": "7a11f251-e25f-4a1d-807b-968e88b1bfa3", "comment": "Malware payload (RemusStealer)", "value": "9e970a8f21f6bc0701d7bfa3d4fb3fd3d0a9c75b943c6d73d71359e53bde0e88070554b87471b7df3227012b32264c8b", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "orderre-shop", "colour": "#C59319", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754794, "uuid": "4aceb99e-4c45-4472-952f-f8b5c505c367", "value": "T181955B0ABCE048F6D06AA3328DB625927B72BC190F3223D32E90B5792F776D49D75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754794, "uuid": "c621d077-85cc-40b3-878f-5dadaa14b996", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754794, "uuid": "984de0e3-8baa-484a-bb50-d83d6cb3f393", "value": "24576:O2MTpumWDSc72i8bQsBpHQfR2XbCM7YPlfmrMtPlnqj5y:O2M0JDSc72vbQpfR2XbCSQAr6nAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754794, "uuid": "8835441f-3591-4406-ac10-a3773ce4220e", "value": 1892560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754794, "uuid": "e7903d32-81a8-4e00-bc0d-b87fad77164f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754794, "uuid": "e701867d-95d2-4d28-adea-40addb24ea9d", "value": "cry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852ba61e-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (VeryCoolRacingStealer)", "timestamp": 1779795124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795124, "uuid": "e37cd50f-e56b-464a-a45a-ae32f0c55238", "comment": "Malware payload (VeryCoolRacingStealer)", "value": "8691ee89020696052b5a716aa6aa22ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VeryCoolRacingStealer", "colour": "#53BF4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795124, "uuid": "8b79925e-093f-47ea-954c-747548884cfa", "comment": "Malware payload (VeryCoolRacingStealer)", "value": "71c631773b4ff5417754211ba483cf2e3a8b668ebae151016e5b695ede361199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VeryCoolRacingStealer", "colour": "#53BF4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795124, "uuid": "1fd3dbda-f030-45e0-9dd4-a87f35bee200", "comment": "Malware payload (VeryCoolRacingStealer)", "value": "0e87fedf4fba400fbfdcfe5f1c63175b66c57e01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VeryCoolRacingStealer", "colour": "#53BF4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795124, "uuid": "01d4a148-0d77-41c8-b0bf-c9a553f48780", "comment": "Malware payload (VeryCoolRacingStealer)", "value": "6523ef4807c0051cc85b73bc75733cf2056f3807711e65771610c9f68f36c273ba720e69f0f41e2c77e3f8b58e58b3a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VeryCoolRacingStealer", "colour": "#53BF4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795124, "uuid": "2b2dbaca-c4e1-4e5f-a305-a66dd5406023", "value": "T15CC5A525B3EA54A5D0AAC07999068767EE60305A533C51FF62C4C9D12F607ECAF3CB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795124, "uuid": "77f7f521-97ae-403b-bb37-8de301c6f78f", "value": "2af40c527a26d1156a62232efdedccee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795124, "uuid": "7ee7f033-2719-47c9-a232-ca63a34f004f", "value": "24576:Xlk8+L6N+mhUAFJpn8pj1qRAmCbFTbdC6a25:Xlk8+WN1hTB8pjDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795124, "uuid": "280e85ab-2487-4060-8a7f-e0e893d022d5", "value": 2697728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795124, "uuid": "df578045-bbdb-4a96-9e17-855bd75b148c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795124, "uuid": "97595a95-91da-4bcb-bd59-3f8c375d2e4b", "value": "71c631773b4ff5417754211ba483cf2e3a8b668ebae151016e5b695ede361199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d91ef8-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783074, "uuid": "3c183980-7fb5-4a3d-a518-d8c2f9955dad", "comment": "Malware payload (BlackMatter)", "value": "d7793d7c599abbe1d2c4c3883a9caa84", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783074, "uuid": "1492c51d-de71-4f11-be9d-62a350b65937", "comment": "Malware payload (BlackMatter)", "value": "73841818b8e0513e14f50d5e4b58061f3b3772f12926b6ceafe35df114231729", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783074, "uuid": "8e8bd6bc-bd0a-489b-ac33-410ab1cb3438", "comment": "Malware payload (BlackMatter)", "value": "17fa3b3394842596de86ddcc72af6fe8348c4dd1", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783074, "uuid": "c5c56348-116c-4a81-8e16-773c65789e2e", "comment": "Malware payload (BlackMatter)", "value": "ca1b6de2de7e2258af46d9cc53db3de8aa57e12c97aaa7d18c15342eebe523ee0101d1f3923dc0e82a453aa5104e65f4", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783074, "uuid": "d82b8e11-4d81-4309-829e-f8c12bd984ce", "value": "T14FE36D21F622D0B3C83718F137367571B39E8D6C29A96807DAE80F9DBCA58232F15597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783074, "uuid": "4bd9164c-8d35-4693-b4c5-6a40ba2ad434", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783074, "uuid": "b0e4eb24-91a5-404c-aff3-81336c9c6f75", "value": "3072:m6glyuxE4GsUPnliByocWepZq0mmw6Mkm:m6gDBGpvEByocWe7q0Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783074, "uuid": "62805827-5e9c-4102-b502-0fc0907e11d1", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783074, "uuid": "ec8c06e4-15da-47c1-84e3-7683da570ac0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783074, "uuid": "e968961b-ac36-4de9-8510-f62b8a278184", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cb9900-5939-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779823796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823796, "uuid": "bf3db5d7-e7d8-4572-add1-bfb456983e2f", "comment": "Malware payload (ConnectWise)", "value": "97d93f7079ce642dadf6e352df4843c6", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823796, "uuid": "c7f84f0b-69d7-43b1-8f66-0c8d77c43a91", "comment": "Malware payload (ConnectWise)", "value": "73a8126b8d5443295250815df160f550effeedf1f8adfd0ac2d5160824ca8f37", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823796, "uuid": "6f9ad14f-fc9d-4a17-989d-64ca783f0536", "comment": "Malware payload (ConnectWise)", "value": "b1fed1af986695457206e8ce350e7ba9bef4d846", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823796, "uuid": "d6ecf447-8dbf-4b41-a3be-684356c5009c", "comment": "Malware payload (ConnectWise)", "value": "a91b3ff82f649eaed4f04279efe6820636a4f85b15652bb61b0c620f36c983a092f36b53a5a5341056750c9c5c9eb586", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823796, "uuid": "92594e02-51e9-4f93-8291-ecb3dd50713a", "value": "T12046F141B3D695B5D0BF0638D8794266AA34BC109712C7EF57A4BD292D33BC08E327B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823796, "uuid": "2cbab44d-ed7d-4916-8405-2689626f4540", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823796, "uuid": "bd951ccd-9ea9-4ace-a820-5a409036dc83", "value": "49152:IfmLDKJkGYYpT0+TFiH7efP4yfy3Ys6vPHYs00Yrxl/jgq36+hKls/LG2XwygONw:Prs6efPRy3BIvY44TnDTGvyEvgVxe7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823796, "uuid": "15342052-add1-4630-a485-e9564ebc8e9d", "value": 5648336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823796, "uuid": "b2552b92-84e1-45bb-b885-d9385fb40bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823796, "uuid": "43f7bbb5-b60b-4c3e-ab36-1a1b3c3ce28e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1ef38f-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779776855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776855, "uuid": "7d5c8fe5-23c6-4efc-b1e1-32da1813fcdd", "comment": "Malware payload (LummaStealer)", "value": "f717f6b7f5665443ea1a886125eaa4c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776855, "uuid": "b0af9c4b-ad01-4e54-9954-669bbfa2c51e", "comment": "Malware payload (LummaStealer)", "value": "740904a5172b8453bf4b1c92cf6c2be8515b56d7e593d885dc7dd14834249534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776855, "uuid": "5d66765f-306d-4b99-83c4-09613078ff5e", "comment": "Malware payload (LummaStealer)", "value": "8c27f397412590ccdad97b98276bea0d60c648dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776855, "uuid": "cf4d8381-9c02-42aa-a96e-f2c8464a4602", "comment": "Malware payload (LummaStealer)", "value": "368a0d79487ccebc84e71f6ccbcbce8626066d0d9465cc8ce260672c6662bffd2d8b14c393b58b3410a41f74bc77e06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776855, "uuid": "ae3898e0-e5eb-403d-b0e1-442da9682d4c", "value": "T1A9C58E10FDC789B6E4025732C5AB62FF27359C068F329BA7EA447E79B9362D50C25309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776855, "uuid": "91e3e0d8-7646-49e5-b828-969970599b06", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776855, "uuid": "15247156-4b27-4c15-aa29-9517d4657879", "value": "49152:BJ0BMRQl7UGcZ3ACe7ilRK+yRfmmLUCTbsGBhPtmH0z:fdRQl7UhwCe7WRK+Of/AG/tmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776855, "uuid": "f557e798-9fdf-4d2a-9e15-87822be2c9f1", "value": 2556040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776855, "uuid": "ad39e894-bbb3-4b5e-8245-70f45fbc5b95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776855, "uuid": "0615cc62-c3fa-43f2-86a6-45ffdc4a1c93", "value": "SecuriteInfo.com.Win32.Evo-gen.35453759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc013b5f-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763916, "uuid": "42e224e2-644c-4f5e-9abc-296383738481", "comment": "Malware payload (Gafgyt)", "value": "72a9e5dacdb7927c03ee5fa6a0920896", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763916, "uuid": "dbbcb9fc-c06d-45e8-adef-0f9bc92dd2c2", "comment": "Malware payload (Gafgyt)", "value": "745401979abe0927afb529af9c37c86cc2b357a717685ab962f19ecc4e815c58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763916, "uuid": "722b35ab-7277-41a7-9b19-11b29d4fde1d", "comment": "Malware payload (Gafgyt)", "value": "2a67d3e202db4c88fb869d69c09984b36317bc9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763916, "uuid": "ea811b53-6bbd-42cc-aeff-c8f1fd4e05b7", "comment": "Malware payload (Gafgyt)", "value": "9cdeda168f22a02c5003c9b5fc2da1569bf57bcfd1305c1a6a6a7c9b574bfa67130f8db96448684eb4a91f6f9458d29b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763916, "uuid": "d40c6b7d-8fce-483f-8cf0-1be2513a8a1e", "value": "T153A32A26BD018F53C2C315F3BB9F47887B2667F9D2EF3203E925AFA027564D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763916, "uuid": "7298cce4-04c3-4692-b8ee-3e9fe0bd7912", "value": "1536:LqusRriLj9YwrFapnidqFR9K91fCL8r/OQ/WeUyNj4qG739y5hdppNq:Lqds/99RYfY9e895d4XbM5hdppNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763916, "uuid": "16c6c72f-01ba-4f10-89a7-9aa67b3af76f", "value": 104272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763916, "uuid": "6e652774-8bfd-45cb-ad90-1ba1fbb261e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763916, "uuid": "50abf34c-4c56-4312-b9fe-7372497a94fa", "value": "FBI.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b446ff88-589f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779757837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757837, "uuid": "250b0f56-cad6-4add-99fd-ecd7dc304f31", "comment": "Malware payload (Mirai)", "value": "570589f7e31e26d94707094498580327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757837, "uuid": "59c64712-7b21-4d4d-a0f8-5f5a159ffd8c", "comment": "Malware payload (Mirai)", "value": "74707438dea1265f4c5218df4a9283fd97af545ecec779f5a1a3d285dcde430b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757837, "uuid": "352e7318-9cee-4de4-a619-38438781b86b", "comment": "Malware payload (Mirai)", "value": "5f81830a60a0954fc847b055029d84bb98283575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757837, "uuid": "a7812349-0a52-49c1-ad4f-2aca9d690d4a", "comment": "Malware payload (Mirai)", "value": "2e8d14747441c8df7b49ca4038705688f6d111ad4aae1b868ff3d50bb80617aaa2842e6d6517beb19b667c9fef3ed4ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757837, "uuid": "f70c5e9d-918e-4074-a57d-78f01df3eb3c", "value": "T11FE3CF8BB78B10A1C06606F047C74BDE6EB320415F5B99E77C2D773A4A7A0DF1A06792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757837, "uuid": "47fa25ff-db52-4a01-8af2-f45a0019dfba", "value": "1536:HDkuvwX08WY65X8OBCtOQb4XnSYOuGqSl30jXdv/xXqDJUgJUwI+/LWn:jwmYcX8O8tOQsXSpuGHkdvsUgOh+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779757837, "uuid": "9cc8aa56-eb4d-41f4-a48b-795c88cc9035", "value": 149220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779757837, "uuid": "cd247d53-be42-4fc1-9d1f-0ebcd49b37c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757837, "uuid": "d6f946bb-bce9-4023-a169-f6f64c84bff3", "value": "bin.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f818c082-5932-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779821087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821087, "uuid": "9dcf482c-f03f-47fc-87cd-13b851c843e9", "comment": "Malware payload (Vidar)", "value": "852a99d04c113b14a601389cbb8ba0fe", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821087, "uuid": "56615137-157a-4aa9-b875-350d5b93904f", "comment": "Malware payload (Vidar)", "value": "74fb8defb665c5239b7055dc3b4ab7d1070d4f4c89c164f378af21ffe8526d0f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821087, "uuid": "b633ea3b-5985-458c-a112-3517d9e88055", "comment": "Malware payload (Vidar)", "value": "a82c76e59733b2f4f65858786a38d9c2cbcd5c50", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821087, "uuid": "91c65626-89be-4819-a1ea-5af979f8edd7", "comment": "Malware payload (Vidar)", "value": "cb6d649c11377578fdf18ebd5bceb751f2a926bfe0f640764ff5ae1d0dc4be307c9506f5f0f74f46dfa8188bb3ac3f1a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821087, "uuid": "2049f290-2690-4226-82f0-62994c8f7aeb", "value": "T18CA59D47BCD064B5D5BA923189B5A2907632F8490B3123C73F15B6FA2E737D44E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821087, "uuid": "fc023eee-49ba-4bd8-ad94-e48938c63685", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821087, "uuid": "ad70bee9-a854-4425-a4fd-8db12c7d3295", "value": "49152:WMj3FMNMc+RWBf7RbZ2fTdeu455qCgLPNtD1C:B3Rc+RKf7VcfB45uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779821087, "uuid": "eafbe4a4-5513-42e0-a8bb-6959ad8c4448", "value": 2221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779821087, "uuid": "a25fb162-1422-4de3-8271-6e0d88a557bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821087, "uuid": "7112a904-6d61-47f3-ba0a-c3d7368e16be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc6888f-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779776858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776858, "uuid": "864cc139-3319-45b0-ae9c-8a95b7ca27a1", "comment": "Malware payload (ACRStealer)", "value": "e28e4ad046e3d4e3ae19bd88890548c7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776858, "uuid": "bc961945-40e0-42ed-b768-b97c4608620c", "comment": "Malware payload (ACRStealer)", "value": "7620884e50fd7741417ecdb81b41f7c7d9452b89d6905a837ad30a7bc8dc9969", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776858, "uuid": "ea6115da-b041-47b8-9099-493a6265d926", "comment": "Malware payload (ACRStealer)", "value": "f00ff14b48f5594413f328dcb87b1e5aed4b5adc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776858, "uuid": "319dcbca-801b-490a-9ca8-bb10f7808203", "comment": "Malware payload (ACRStealer)", "value": "3521e177143d9acb8844ee556ec0c3787a31e33554f085bd015e659c3f4b102d290878d8295d67854bfc1f57695c5112", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776858, "uuid": "0f33df8a-78e2-47ce-a393-697bad9bce4d", "value": "T125C57E00FDC3C5B5E4021372C5ABA2FF2735AD058F369AA7EA447E3AB9762D54C22345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776858, "uuid": "a7cffdc0-af69-4d48-8599-7a7f7d4f0e6a", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776858, "uuid": "e009d4d8-dffb-4964-934c-6390c3fed561", "value": "49152:qJ0BMRQl78Xn6lUjpoGzl9dMLu7bSbsGOoumHL:8dRQl7Yn6Q9dyu1GMmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776858, "uuid": "0dd8a172-afb7-4b55-b7c3-129fb7f2b2a6", "value": 2556040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776858, "uuid": "66581dad-1b42-4c59-b1b6-636b6db8a38d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776858, "uuid": "139969f8-48c8-42ff-830f-67baadff51cd", "value": "SecuriteInfo.com.Win32.Evo-gen.71827147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d656fbb-5925-11f1-a769-42010a9c0008", "comment": "Malware payload (KongTuke)", "timestamp": 1779815217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815217, "uuid": "087b97b7-9862-4d7a-8f11-a91d6e2df11c", "comment": "Malware payload (KongTuke)", "value": "46729d8a0823e90cc51637f0ecd47862", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815217, "uuid": "0345d425-5f56-4e37-ab5a-baf34b10638a", "comment": "Malware payload (KongTuke)", "value": "767019409a67bd05b77a81dadd3e7b4430f5700bc24f68416828da508d26b061", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815217, "uuid": "eb874859-311b-4d24-bb74-cf9f92634408", "comment": "Malware payload (KongTuke)", "value": "c31a208682fb876cacd80eb0b1284cd3644a4caf", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779815217, "uuid": "9af04423-e326-44b5-917d-6d11415c24c8", "comment": "Malware payload (KongTuke)", "value": "0acd1039d603b52246c51a98f56814966b3db429d177836aa77c20742679c3cf52f875e6b2c690af16d57af6ee5f3436", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815217, "uuid": "49bebb97-9f1f-4325-9328-ce2ed02a9c2b", "value": "T157255C5AEBF64CE9D8E2C0B045B72710EA30399447505EFF566886292B2B7C0B73D778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815217, "uuid": "76db564d-1791-44b8-9b34-b46162bf2037", "value": "24576:Wihx1hQVmTTY8xtr8Qs+d3mGUCB7up658DW:Wihx12VmndtrAK3oeUct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779815217, "uuid": "eb865e7e-3918-47e7-a55b-ae94d2852ccc", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779815217, "uuid": "d79272d9-1139-412c-a581-3eb63e62669b", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779815217, "uuid": "c5880a7d-e460-4dd2-a871-c244a158208f", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6199ee5-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763906, "uuid": "9cfbb2ca-d25d-4b7e-913d-45480af34cdc", "comment": "Malware payload (Gafgyt)", "value": "cea537e7d8ede386b0f9514903998537", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763906, "uuid": "d5173be9-9067-4009-b1e8-754237548f5d", "comment": "Malware payload (Gafgyt)", "value": "7766c414a9bb72ece62ae26fd2af531c6f02032fba786ded349361020dcecf59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763906, "uuid": "810b1aeb-4eef-49fb-b54c-b90d0a9aacfa", "comment": "Malware payload (Gafgyt)", "value": "95fa4dee5d7954d68e6f64275547b56861274945", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763906, "uuid": "61172064-84a0-4e2c-ba42-003d9d1d07e8", "comment": "Malware payload (Gafgyt)", "value": "500ba65a8d2a1e86aadb8fea8cebbedaf49316dc6d2856b7f6ba1162bb3dc9d4324b62f6bfa2fe8c3b01ca38e01e2cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763906, "uuid": "3001c63c-6c86-4b8d-b166-68cf2ced179c", "value": "T18BE3871E7E21DF7EF559823047B38E30969836E636E18585F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763906, "uuid": "9fa4e158-413b-4a12-9dec-e60970cfe7e7", "value": "3072:27ip4E6s1gSpuIgQiRxaNkCEAweIcqs8Ek32o4KqKf5hspYt:27iV6s1gSpuIgQiRxaOOCZHBb7qi5h3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763906, "uuid": "c7620904-5389-4127-b4bc-4c0f4436fecf", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763906, "uuid": "9bf9a02b-407b-4277-9ffe-576e02057030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763906, "uuid": "2f3470c4-d4d3-4e2f-9d1c-3c2d71349865", "value": "FBI.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e93da46d-5951-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779834376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834376, "uuid": "975e4548-162a-444b-8d2d-059eb9b7c197", "comment": "Malware payload", "value": "82602c2f4081ad4c7777578c28c0ae09", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834376, "uuid": "2315c10e-08f1-47f7-9261-65a8e57b887f", "comment": "Malware payload", "value": "78434b53d284d4537e6d44a9373da8ef86d15c0cd36f32ce695dfd82db7eccfd", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834376, "uuid": "7079251b-a783-4167-81b4-5040b07d9181", "comment": "Malware payload", "value": "0c5cc32fc08242e9e1cc31b28fafeedc50314ece", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834376, "uuid": "15230035-2718-433c-af49-cab786b6f8f6", "comment": "Malware payload", "value": "6123a9b8f9113f27a5e85f23322d4c47e88a5e82ee21691ac1de416b4536568848dcd5e0958b403eb93a4715411b6dcb", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834376, "uuid": "d6db99c6-59bf-4c6e-be99-476c570cca69", "value": "T1A1F533BEDEC4EEA9C3337ABB871556BA0C80777C649019AC7937803B345F2055EA2B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834376, "uuid": "63017590-d4df-46f0-b108-bd60d97f2817", "value": "54770b5d3290f1851d3348f7a1ff795f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834376, "uuid": "ac9e0a85-f179-4162-869e-d46321c440ba", "value": "49152:mnCeXTi2AIGHN4eH1YkU9VIvFKTzkLBCFWzQy0xWlLGcj18wvvTwt1jFX71PHhHx:mnTTqNPHekDFOBwzQbWlCizTwtdFX/Hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779834376, "uuid": "86f534aa-94b1-4b15-a49b-384bd984b491", "value": 3338576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779834376, "uuid": "6c40c23e-6479-413f-bca1-065d3339187b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834376, "uuid": "9296d963-7dd8-4a10-810b-499048fdae3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de906fd-58b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779767141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779767141, "uuid": "e3cbc20b-2b80-4f43-8fc8-ca03ba356955", "comment": "Malware payload (Mirai)", "value": "c3d71863a47e37abe1cf720913bf4058", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779767141, "uuid": "bf572ed1-bedb-4e52-8617-ee93f1e327c6", "comment": "Malware payload (Mirai)", "value": "791076f484b2d1c719fedc6d80dae349e3c817ec6cc2bda7e79da30118c554dd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779767141, "uuid": "0e3a8668-1936-49bb-99d9-fb0d1b1d6927", "comment": "Malware payload (Mirai)", "value": "f28c0760886e7f21d1f47eca4f7df792200463c5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779767141, "uuid": "00818440-9a6b-4a3c-9663-24a1c56b6dee", "comment": "Malware payload (Mirai)", "value": "65ad861032f2539d45dd9e3117180ff8b655b711cba24a84dea929036a6c4dd74c371b57364104a08f76c188c9dc7509", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779767141, "uuid": "53923cb6-9800-4b4f-879f-15a306a6bbd5", "value": "T1E921F8AD0873D4FB9E195A0172637405D24FE1F15378C72C68190C33A49FA316D6AAF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779767141, "uuid": "d630cfbd-9ff1-40b6-bc30-dacc7bdf4c33", "value": "24:vPKGuwyDwLNIWQ/wEzK2wgR/w9HWKYwAyW5wB7PKCy6LNIWQmEzKRgRm9HWyjAyA:XSuQZzPRYHWgNjQ0Qfz5RKHW2b8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779767141, "uuid": "74dec6b8-5d67-499c-9f1f-6d73ae543435", "value": 1418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779767141, "uuid": "1a33fc24-913b-4611-8ee4-284a49ec616f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779767141, "uuid": "5e2abd29-ad7e-49ff-b88f-75bf54525885", "value": "to", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36c23b7-593f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779826582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826582, "uuid": "c25ad4a0-fbb7-41f8-86f2-ce354c9fa9b3", "comment": "Malware payload (Mirai)", "value": "ce6e06076343fd30770af54ec516f711", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826582, "uuid": "80474710-d82a-40f7-997b-0f858420db1b", "comment": "Malware payload (Mirai)", "value": "7ae0ad60b51fc84c62db5a67b030f78308a2c122e5b04c89b7bc33671b9635e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826582, "uuid": "8b620077-b7db-460a-bad6-0dc2f74a8853", "comment": "Malware payload (Mirai)", "value": "6b1ec2d09d761e26bb4a2a5a074f20a5f3ee5857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826582, "uuid": "c79cb382-3ceb-4d45-bfc7-97091d09c63e", "comment": "Malware payload (Mirai)", "value": "0f2872f504c0c7507e41f9d22f6e78e7b1618ddec8baafc19835d93febe6fd8eb7db5bc57cfd06b651073cd14afa0296", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826582, "uuid": "379b1a44-04ae-45ae-8fed-e6a28c95c69c", "value": "T1EA735CC5A643D0F0ED664274107BE3538E7AE4368A3DEB53D7A53A33A813B609A1735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826582, "uuid": "c0667630-d164-4cea-b4bd-7f8c3f19ad82", "value": "1536:qpLK56RYf6UrlnaJlfvLgNYqroTrjPd2rXH21+cBw4:qpLc69mKlfvLcvgPdgXW4c64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826582, "uuid": "bc2a492d-ffd3-49d6-92e6-aa091682342a", "value": 74896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826582, "uuid": "df5b9406-74ba-4482-94bb-160f1608bb11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826582, "uuid": "4e105a3b-e212-47c7-8e3f-be79d564cc07", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff670459-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779776861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776861, "uuid": "b11f28c3-4e4d-470a-ad5d-73a9f9b170ad", "comment": "Malware payload (LummaStealer)", "value": "52da8d5c22155053dfe23ba36025906d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776861, "uuid": "b8171603-a8f4-4f5c-9d53-c298344878fe", "comment": "Malware payload (LummaStealer)", "value": "7b74bea75be45d0a798732cdb54674811c207a3b118960c2146e9e97fb35c94b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776861, "uuid": "f21ee192-aed3-4607-90eb-e96ac2cc5aa9", "comment": "Malware payload (LummaStealer)", "value": "5f0680056ee7f8a912725e1e3dbcf8e360c30826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776861, "uuid": "423932b5-fdde-47ad-9fb9-46734301c2cc", "comment": "Malware payload (LummaStealer)", "value": "8ecc9c8783b3e5d9d10a413e6d4c37ad3ba7abdfe0b33f90ce453bebd442727cb283cefe8d66a6bb7b91be18bfc88c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776861, "uuid": "0277d61e-ebb8-4dcc-86a4-c783fa7dd061", "value": "T1A8B56D11FCD794B6E0025732D8AB63FF6339AD064F335A97EA443E79B9362954C22309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776861, "uuid": "de0b042c-723b-4a2b-afab-fe6609047f49", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776861, "uuid": "c0e2ab5c-6671-4765-a2d9-9edb3f72b720", "value": "49152:xE8UFgsoA86HD6dhe208dJtw6QA3bsGhKmH5:i7FgsoA86HD6d8VCwXAgGMmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776861, "uuid": "bc80d072-092f-4f35-9bda-02d8bd9a37eb", "value": 2378376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776861, "uuid": "f5840156-e6cf-401c-ad5f-b159ede35b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776861, "uuid": "1483509d-572e-4b1e-92a0-340ff44f4126", "value": "SecuriteInfo.com.Win32.Evo-gen.16954526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0180e54-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779784432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784432, "uuid": "d938ed60-7ff8-4746-9046-b853a9deabad", "comment": "Malware payload (Mirai)", "value": "362f92825ec0533b1290774a5b5abce9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784432, "uuid": "d17760e3-74f8-4110-b1e1-e769cc9df24b", "comment": "Malware payload (Mirai)", "value": "7c6e74abfa3ea821194699d7d5b0480e08dcf863143d083fe68cdc51c198826d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784432, "uuid": "7c110829-4fdc-42e2-82f2-8467a249355e", "comment": "Malware payload (Mirai)", "value": "5b3ed1d3f2ccd4876ef99215367307a22186eda2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784432, "uuid": "7ac6f29b-311e-4eef-aefc-2b852b1394c7", "comment": "Malware payload (Mirai)", "value": "12c60ec3e39fe7b84f7087d2fcf1efce126e1bc1408b056ce6a8021858fcc51f4c67b3a057501203b91901e699c41f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784432, "uuid": "c0b0bea4-ed4b-4732-8b1d-93cd4410ff5d", "value": "T1C74533A752864FB1EB92F93DD01834CAD3B4EF701A3EF385B67087250A53AD1D6B1825", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784432, "uuid": "698ca647-e714-4b9a-aa0f-cedfff4bf02d", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbo:EpCKabVQ+9qlNlpjN8H8JZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784432, "uuid": "5f0f3a8b-58a0-4458-b125-1e89c4108b36", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784432, "uuid": "b6feba57-de8c-4b74-884b-adac35c4f287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784432, "uuid": "8d84c831-faf6-49c5-ab9c-df4ae91cbe1e", "value": "20260523-225027_sftp__root_redtail_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cee9fd9-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779776883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776883, "uuid": "b766ec07-f6bd-4ff9-b47c-3080375638c7", "comment": "Malware payload", "value": "633273345448ee416049dbb43a6f0785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776883, "uuid": "7e89294f-6a68-4aee-a2d1-c5b3cd3468e0", "comment": "Malware payload", "value": "7cafd62021af9fcffb0bbb10194e9c9decb6b58dfc673499672edc0186714064", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776883, "uuid": "2b12953b-a68a-48b2-af4d-c5cf87e75c08", "comment": "Malware payload", "value": "48d1916a5c6d259fe84caa00783b796fc9b05d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776883, "uuid": "c27a42a1-df1d-4668-8a28-62d24b84b901", "comment": "Malware payload", "value": "03a631b0908ddaa11e7a21e9e93fe77dd92951d619ae7bdcd02d134c0cba6ae2b2122bdb4f1e2b5577662cb68cc1aa52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776883, "uuid": "bef360e0-c81c-4ba2-affc-9ad5bb31d616", "value": "T1F1C4024AB7D01751C66455B6C0E3987443F2DE0B3AB3DB493F8947856E823E4CC9ABCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776883, "uuid": "2b8c124a-3a3f-49da-8e43-a77bee206ab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776883, "uuid": "a9c615e2-4fa3-4f3a-b7ef-e5e0a6ef813c", "value": "6144:VkOmunR/SN5rvuA7Ou+DsFZy7W2F9BXRMeHkOcxVwEuHBBIs7COSa+EknuzVSXbL:vRKhwgkrv6uTIqCOSa2uzArJvaPOAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776883, "uuid": "8efd0def-4967-4252-8c7e-608c8e11d7e3", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776883, "uuid": "00ed08fa-f2d6-4b0f-a651-316080e88363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776883, "uuid": "d42e2b0e-8c1a-41ce-8ff9-572f1eda4e37", "value": "633273345448ee416049dbb43a6f0785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270a52c0-592a-11f1-a769-42010a9c0008", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1779817300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817300, "uuid": "cfe54cc8-3e59-4f87-b86b-c0ce5e2b0d5a", "comment": "Malware payload (ScarfaceStealer)", "value": "059d34eabb660f5fe6b95d5e8fb279e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817300, "uuid": "be00fc19-d547-455e-b5da-c6541a5fec58", "comment": "Malware payload (ScarfaceStealer)", "value": "7e2ec66524ae16dc658bb533ce6ac109782b43ce055b329a0937729ee0549faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817300, "uuid": "c67b2c48-a948-40a0-8fce-8c454466098f", "comment": "Malware payload (ScarfaceStealer)", "value": "f727366aff474bc6ad3aab6cbb1016d61f4c0db1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779817300, "uuid": "3e96cc83-4970-4b26-a1aa-8587dfaf7d94", "comment": "Malware payload (ScarfaceStealer)", "value": "cb158faf106bd1718a518c95d13b86978f990aa75fc1a623b03d2bf7cfb95ab48e385e5f6271244a01380b1ef489d1d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817300, "uuid": "fd2e63bc-b428-4550-8b3e-28f2b8f1aa1f", "value": "T11D0833164020DA86CE3915733BB6A732F6B4C77BDA683C6F4180E750EE6124BA5EC5D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817300, "uuid": "13a2903e-9f8b-43b8-a016-47daae01819b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817300, "uuid": "08a60958-3370-41b8-8e70-0f028bac96be", "value": "1572864:1t9IKPuhgpRRWYP91aLpxuxvKsxseKz2NgHZMyl1+n7:1UKugpRRWhCQsbKz2Ng5Mnn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779817300, "uuid": "fadf5460-47ba-4704-88dd-602226ac50f3", "value": 77534311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779817300, "uuid": "5edb4398-30fa-426e-8365-22a6c308551d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779817300, "uuid": "bd3caa2e-f890-4c81-9702-234c0820faf4", "value": "Cryptex1.4.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6715b7-5949-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779830919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779830919, "uuid": "a2ce7762-647e-47da-afa0-ca8b752d5022", "comment": "Malware payload", "value": "eab27047a424e0325ffece2d2fa71d94", "object_relation": "md5", "Tag": [ { "name": "files-developedindia-ink", "colour": "#304900", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779830919, "uuid": "346ba8f3-cb32-48f9-83c4-edeb6951520e", "comment": "Malware payload", "value": "7e40643c5b3da6c6134312bc80fa8cc27d6c932b32b64b11321abd0da0d82609", "object_relation": "sha256", "Tag": [ { "name": "files-developedindia-ink", "colour": "#304900", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779830919, "uuid": "5274d888-257d-4c44-9bc6-a62c4cefd87f", "comment": "Malware payload", "value": "7053960e7bf9edd9dbfabb8af82f33051e9e5f35", "object_relation": "sha1", "Tag": [ { "name": "files-developedindia-ink", "colour": "#304900", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779830919, "uuid": "b524683c-7213-47a1-bc94-326b9056d719", "comment": "Malware payload", "value": "87f07da96e70afedf1f8de5230e00b0a6511fe3d98b663e3f8f5aaba46154c9e1aa93398e27eed8a33bcb5e364ec55f8", "object_relation": "sha3-384", "Tag": [ { "name": "files-developedindia-ink", "colour": "#304900", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779830919, "uuid": "b1b673bb-50b8-4d56-926c-f1db57f12d3e", "value": "T1EE72B0549FBA109BCC25FC3480A601A2213D827232EAA7511D39D02BB479DFB7A6935F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779830919, "uuid": "400e300f-e669-46c0-8ed5-770981a8cc37", "value": "384:8M020kkG4VoNFCYpIGG1xetqNzDh5F+nQRf2pfBYX:8M0ZSEoOIIGGlzfF+n024X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779830919, "uuid": "89653202-96be-42fe-baaa-f25ee4c91b96", "value": 16353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779830919, "uuid": "ebb17fdd-46e4-44d8-8836-6fc4efba1704", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779830919, "uuid": "5602e64d-4fa7-42f6-a713-d749423f626e", "value": "Technical_Presentation_Guidelines.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba1e143-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763782, "uuid": "47dc01f3-21a4-4f1d-bc18-51e34e0c724e", "comment": "Malware payload (Gafgyt)", "value": "3fc2f80273e680286a79c6ef4ccbb20a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763782, "uuid": "ecbcbb6f-5d2a-44c4-8fc3-a1cd8190cd9e", "comment": "Malware payload (Gafgyt)", "value": "7e520534922ce97a7db8740c221d3b16b3545bb86a24bba936684d4db22d28e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763782, "uuid": "3ccf1994-f5fe-46e7-b8a4-0f16abdc1f02", "comment": "Malware payload (Gafgyt)", "value": "73355aff5caefd9f50a489c41a289b2b99d92f27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763782, "uuid": "52a85e63-a762-4f7b-beaa-ddae2cb4687c", "comment": "Malware payload (Gafgyt)", "value": "25de1f9704d0bf9b2eb999bc1bcaeef503d1d64a348692828b11f052653461fd87d9bda6c9f8823f473d3bf3bd9da7f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763782, "uuid": "521c6bd8-3803-4378-b8d2-602435fba1ac", "value": "T1CC934923ED125F0AD20B64F060F59F351F22B8FA89975AD9E065DAE46543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763782, "uuid": "3b25e854-7a21-4981-abf2-620924448478", "value": "1536:mphGraniwlXVZsKIdkS/ZD2iI4WCPG68Lze15hsZanmppm:2yaflXVZzIBD2iI4Wn6Z15hKampp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763782, "uuid": "ca6d7a68-bc64-4103-8ff3-568e3010ab6c", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763782, "uuid": "090bb595-8433-4214-b647-4619196e29c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763782, "uuid": "690aecae-37a6-41ae-b7b6-4d591c4410fe", "value": "FBI.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8388e865-5902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800275, "uuid": "3781aaf9-e0a9-40ea-b9c0-2f5b97c2008e", "comment": "Malware payload", "value": "5776841b4b0539901ee8b8a0d7dd5450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800275, "uuid": "87751e3c-d898-42c6-92ec-839544b4c702", "comment": "Malware payload", "value": "7f7bbf3140da87669d82e80a8b58c1a982fbd864fbaab92ec14b1c063574972b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800275, "uuid": "2581bbf9-f794-46e7-8c78-ed3200bfd5b9", "comment": "Malware payload", "value": "ec52659299e80b3f8f5a7256396d47fc6e99c558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800275, "uuid": "0b6f86c0-a1fe-4afa-90c3-ee832cfe0735", "comment": "Malware payload", "value": "3c3c13d8359edcf27a03c1acefb015c44cbad451a5198ffb725b0b9dcaab549eaeb71d5d9029cdd85cdb732c715616a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800275, "uuid": "120d4a9f-0de6-498f-ab6e-bc38d991434b", "value": "T103330721EDD0077D1D5B0BBDECD077219678C6AA043100FCF6997709A909A6CBB7DEA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800275, "uuid": "ae15121c-dd1c-434a-87c4-ed087b84f1e7", "value": "768:8NMI5drg03+tVLBAZkTHu/hTy3SSbpp6i5qSeKpjBYfIRg/KRSa5R3LC:8NhNmVLBAZD/hW3SmzBeKxFJQKhLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800275, "uuid": "aaea7af0-67d9-4e28-8c7b-44210417f8ee", "value": 54633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800275, "uuid": "aff54ac6-6600-4450-8c64-7da1e7e618e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800275, "uuid": "fb4d7853-4daf-4aba-b0a0-c7496aee5b0a", "value": "stethoscopic.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6115ce54-5930-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779819974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819974, "uuid": "4cbaefac-e067-4506-9231-93b592c896c2", "comment": "Malware payload", "value": "f78ba70df446d83b591055c3003b6603", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819974, "uuid": "540672fe-c2f8-4aa2-a083-73fd46f7f19c", "comment": "Malware payload", "value": "7fd8cda9c84e7e3836e2bd9391777677ee7aa33df1c14f5164f79621f9c4438e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819974, "uuid": "9ed02887-ae0f-45b3-bdfe-a285d55899fd", "comment": "Malware payload", "value": "b62daadd6b7084ef1759e452b6b8e866248da539", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819974, "uuid": "efd1b149-406b-4144-933f-a31dee67e1c3", "comment": "Malware payload", "value": "d5155e7b20bbbdc5155475b47629ccca50fdcb9c01929ff7a95ba78921e754984a1d3a8a42f665816c6956cb4f69e23d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819974, "uuid": "8a1e3769-6c91-450a-af9f-01f9510e1c92", "value": "T1555188D375B8E0713A4B60A8FF5D235058D220473907BE6C70E13948DD6521CC1BD0BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819974, "uuid": "c1d78024-d1c9-4930-9650-4910c23c5e23", "value": "48:QRYZSnB7DADlf46Bc5/wrjkQbsygW15bqqTP9wd:LMm464GkQbFgw5bqqTPed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819974, "uuid": "64dab2e7-7047-4693-b5b5-b1827da08a7e", "value": 2511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819974, "uuid": "7f207366-c43f-4c99-b776-46a5bbc14244", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819974, "uuid": "2cad488c-8329-46a6-9e71-49fa2109e532", "value": "4.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de3ae93-58a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779760779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760779, "uuid": "63a8af9d-bfed-4e15-a987-3e4ac1953253", "comment": "Malware payload (Mirai)", "value": "876e67da5ea7b11115f3d8ac9f9cabe8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760779, "uuid": "501c9b3e-2180-43d7-ad6f-14f255098d5b", "comment": "Malware payload (Mirai)", "value": "8058bad2662970ca319e830e507accfb3ba11eb7d03bebfab5d54e2f598eba67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760779, "uuid": "dccb5ad4-32a5-479f-98e9-e45975d9e82c", "comment": "Malware payload (Mirai)", "value": "5edf028ce872f492bb4f143cc2f60069e5856415", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760779, "uuid": "b80a84ed-bc8d-4f09-9794-eeff473d9120", "comment": "Malware payload (Mirai)", "value": "6e16ccae1b2b784a3ddb167f493e530896ea34a863aaf1805427b69bd446a6399751c83675ec9f1cb15d182e9d7b3018", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760779, "uuid": "3d181d20-674a-4315-8638-0b8a4e6fd6ce", "value": "T1EAE3280AFFA10FFBD86FCE3342E90B15258C595622A53B3A7574D418F25A28F19E3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760779, "uuid": "c831370e-c2a2-421e-87aa-62a39f090c8a", "value": "3072:XrNT71gmcFeUyILeSWKkm6YQ7QLQqCwg58dRX8O0+0oWBWbt:XrB7eNFISWKkB7QLRNg58dRX8O07Wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760779, "uuid": "35357316-9018-4ead-ade6-0bd0053ac172", "value": 152204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760779, "uuid": "681abba7-f9ef-4385-994a-263a78aa4494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760779, "uuid": "1a2283f5-24fd-4bef-8d4f-4eac3148dfa7", "value": "bin.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef05ff5-5902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800133, "uuid": "f799b81d-1995-48c6-87ee-86bde4a1885d", "comment": "Malware payload", "value": "ab5bf24e5a1628d643962445c5816fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800133, "uuid": "7124ed93-9c10-47c2-a72b-3abdd4c0613d", "comment": "Malware payload", "value": "80a0ff884173a5eec0d395547608a92417cfdef990d920fd6b453e9044877d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800133, "uuid": "0a5f5fc9-3fc2-429e-9e3c-52b7d6bd859a", "comment": "Malware payload", "value": "a8fc153bf3538e47531d9dd8123622318c79ec40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800133, "uuid": "2980e372-a4be-4197-bfa2-66775cbcc28f", "comment": "Malware payload", "value": "dd411cb97ab2e12cee4f098bcd080f8b8d5058284f6bad0fc84139b99f791b6bd5a86b6459190648fc30c396e84b92a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800133, "uuid": "52dcbd44-3b4a-47d0-addd-d5ba70a0d0c2", "value": "T1F1D4BE2C2B1E9605D6719BB9E9275B6523F0C0135ED3D33BEFE901B4865BBF2AC12211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800133, "uuid": "f739987f-c970-4256-82d5-3cfc84c0aeb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800133, "uuid": "6b29080b-19b2-41e5-9537-bd3e239cdbff", "value": "12288:WDDYIv6APfcs02BUqtAxFNvJoUqTrXoqFr0zu5Z:WHYS60k6UttJoprYLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800133, "uuid": "b4214872-40b4-4194-b4c2-0c26283c9245", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800133, "uuid": "9132c819-af6c-48b5-9aed-70d9dab41aaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800133, "uuid": "588b26bb-297c-42e0-abb0-dba6154b7bb4", "value": "COTIZACION PARA PROVEEDOR ARES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91070262-592c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779818337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818337, "uuid": "43fa4d42-277f-4833-9c4f-c8e360c38d36", "comment": "Malware payload", "value": "5c2c75abaf2b77a64575483aa8af380e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818337, "uuid": "537be9f6-9af0-4479-8ffd-5a04c3d018a9", "comment": "Malware payload", "value": "81af4aaca6c72ce5e2a59361c17bd9f3a0f4041ac03ebdc99caf00761aeee73c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818337, "uuid": "4affe7d1-ae5f-4e48-a2c3-9fe172942e8c", "comment": "Malware payload", "value": "469e5c74c09b98fe286b6e79647a6ff853c2cc2d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818337, "uuid": "6653fddf-8527-4172-8476-7b20ffe53f84", "comment": "Malware payload", "value": "d9831aecb50293eb6d6ab935ea698fa7105a03ca929c851a047208c228a16a52e952d8fbec6fbc58ea0e3001a6c11035", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818337, "uuid": "5f9647c7-e5a6-43ab-9df6-49f00096df6d", "value": "T1251464C986C652A935165C7A4A8F9242737E70832C259E44BFFEE3832F39D1075A5EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818337, "uuid": "6b75788d-9163-41f2-b830-7cd1ac69e7a4", "value": "1536:VKObtIJsUlVMVRrL6px+hYe5dFy2solslBkkLBnXRLuHzGXvt9yPZnEQE9fmwjHT:BIq2TtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818337, "uuid": "c3c77a34-8f1f-4345-88c7-86c89df5280a", "value": 200859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818337, "uuid": "4ec89550-6b78-4b90-abba-176047a31e79", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818337, "uuid": "55ebe57f-0f13-4ef4-8699-93f5bfb05b27", "value": "Beta_Video_School_5758.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0c989e-591f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779812743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812743, "uuid": "48327e2d-40f6-4374-8345-e4d8d24e38ff", "comment": "Malware payload (ACRStealer)", "value": "07e67abc0249d00e24485b33abffdafe", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812743, "uuid": "1024d4b0-ca5d-418d-b16e-4a26cc850ba9", "comment": "Malware payload (ACRStealer)", "value": "828405d66881b770753d58349534c978672cda97591e8eb393beca734896539a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812743, "uuid": "3bdbf3c2-611d-4795-b0ba-5d056f1da3aa", "comment": "Malware payload (ACRStealer)", "value": "4d894688dee78aefac3e9fc54422efc6e64286f7", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779812743, "uuid": "56ea9d34-a5ce-408c-b650-6a7bcaff27eb", "comment": "Malware payload (ACRStealer)", "value": "4f6a86d24a13d0c4181953cb4abedb90ee4e1778b81f2b396708a5e16b43398a29b188968682a1e088e85da3bb00fff5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812743, "uuid": "ca1734f8-50c6-49cc-8e44-83db49e37465", "value": "T1F5767C43BC9065B6D6EA923189B692917635FC4A0F3027C33F14B7BA2E776D40E39358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812743, "uuid": "1a598b24-d31d-4fb7-bf97-57f37a9c59ac", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812743, "uuid": "625bf79c-4715-4da9-aa0f-84b7b49aaafe", "value": "24576:V5wU3VR2Y72nZiOT/HzFcaWaSCsHVqlTVqajQ6OgLP88WfqE0q7MD1/N:V5N377kZiSHZtWVVyT8dgLPQMD1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779812743, "uuid": "32679eba-599b-4e2f-ac79-c0c4e92d5563", "value": 7256192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779812743, "uuid": "44178e33-cbbf-4b3c-b3cb-6d15fec56a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779812743, "uuid": "752af49f-3d1d-4e1e-aace-f852f9825920", "value": "SecuriteInfo.com.Win64.Evo-gen.99884189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff9a8e7-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824509, "uuid": "c123a332-aba0-49c0-a029-6f815bfa4fee", "comment": "Malware payload (Mirai)", "value": "c6b5c67e9dde4fbef30b7c35967381a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824509, "uuid": "19ce65af-c425-42da-b171-b39b9fd3dd4d", "comment": "Malware payload (Mirai)", "value": "85231b84b63edb3b0d31ae66a285cfa63465f7798c281e43f6148d7dbfe020cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824509, "uuid": "32cb5e37-f5f4-41e4-9832-b06e25844a9c", "comment": "Malware payload (Mirai)", "value": "c50a903b5402f49986f26c1343a8c0a8f299fae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824509, "uuid": "1344af4e-ef15-4fc8-80e3-1303301c7d86", "comment": "Malware payload (Mirai)", "value": "5a90b4c667066af49ec9f4fd9604573439756497ed92e4739ec667042bf7276494e289fe292be5ba00c528e315e02100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824509, "uuid": "89f2999c-5c1d-4886-a544-e7c41e9520b6", "value": "T1DFA3B509BF510EBBD8AFCC3709AD1B4228CD655722B93B797634C528B64B24F29D3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824509, "uuid": "bfe20b04-7209-410f-a839-b6cfd5972fd3", "value": "1536:YOt9m3pPRWNqq28QDSfIMFQfgAZ+0u8vZjemPT9ESKhC7/C:ht9OpPRWu8ERZ+0u8vjhh/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824509, "uuid": "87bc03cf-824e-49f2-8685-fd10993e89b6", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824509, "uuid": "ca2fadd2-bd86-4b35-b1fb-b08a5454f3bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824509, "uuid": "4febb70b-7c7d-48a7-bc48-999816118402", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c17250-591c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779811419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811419, "uuid": "0b1c0b3e-0d90-4d8f-a6d7-982513a95932", "comment": "Malware payload", "value": "afd97bfbd0b001cf3b589faa307754c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811419, "uuid": "b6aeb62e-e9ec-40c1-87da-b4ff3e0743db", "comment": "Malware payload", "value": "856c1fe349ab6a3cee2782f02b18e38c56e12b9c32778356d31efd2a52b4945b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811419, "uuid": "45975ed8-c925-4ae8-a9e9-0906a1a829f7", "comment": "Malware payload", "value": "8935bda49f1551d2f95569bc875bff822229c9ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811419, "uuid": "078cc1f0-ff63-4b1a-82d3-b0054f0add68", "comment": "Malware payload", "value": "ddc64a6848ede1b1bb2c6fdd8a9034573dffc80c8654716d0172a9531be9eae9a6061064aeb191b659dd49aa261b201d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811419, "uuid": "2dffc5ee-46c7-4747-bc14-7eb913ce01c7", "value": "T18635226ADBD91109F4B78B14AEB70032983B7F52293DC95C1198154E0B73E4CE9ADB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811419, "uuid": "92ef71c2-3cef-40ff-8827-cc8f1fb2e687", "value": "12288:6OvfDBGNjfw08aI1gwpbYyL9aXVSl0jiK:6OPZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779811419, "uuid": "464bd7af-be54-4b0f-bc29-80a02b00e348", "value": 1151938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779811419, "uuid": "b0f97f3c-23fc-4e73-80f2-950fded20287", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811419, "uuid": "d2838392-79af-42c2-9994-3d46627a6606", "value": "Pre-Alert# 44722 Booking# RICG38895300.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0641e0-58a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779758680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758680, "uuid": "3a66bd82-dc2b-41f1-9b6c-5b5c55c97084", "comment": "Malware payload (Mirai)", "value": "6813589d9d953e47a6d47aca6edfc63e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758680, "uuid": "f79f4e9b-7523-4d92-b157-93625a97ac88", "comment": "Malware payload (Mirai)", "value": "865373c1481c618c825e2876c187826dcc1f1ae325be9a8e34dd49cd9f4fee44", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758680, "uuid": "48eadbf1-0990-4535-b9d6-21ef0a842510", "comment": "Malware payload (Mirai)", "value": "456f1309e66204d70a8064b5434ef70643ec70f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758680, "uuid": "d8bf44ed-3f43-4b5a-9de9-2a300da747a0", "comment": "Malware payload (Mirai)", "value": "5c02eb0297c2184c10f5c450b579653041c0d98aa0f7dc08aecb80248a735bec023f0082878e9ffccad8c35b9b581dd8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758680, "uuid": "03fc3bba-bf5f-4035-9272-f6373f7209fc", "value": "T19101DEEE0C72E4FA5E056E0072E33900E14FC1B15378D628D9890C6BA4AFB257DB5EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758680, "uuid": "3f5e50cd-9d23-42e0-ad8a-4573837c1c97", "value": "12:vRBADRNyJ4DR1NIWDGDRm9zKHDReaDRjH6HDR6yWg6DRkGHIBL:vPADyKDLNIWyDEzKHDgaD9H6HDAyW7DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779758680, "uuid": "f6b44dfa-9d49-4513-92a1-833581a18133", "value": 694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779758680, "uuid": "b4d32462-b9e1-4aa0-b61a-d7ecb02ce917", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758680, "uuid": "f00cb291-5b67-41d3-a846-038a1346f933", "value": "rdlink", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af73a82b-58f3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779793906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793906, "uuid": "2e58e7a4-5587-45e2-ada8-f1299d62d184", "comment": "Malware payload", "value": "f103e2346a8a6ea7b55924d82f3e1aad", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793906, "uuid": "bad55675-ff4d-40eb-b42b-350175d58f47", "comment": "Malware payload", "value": "86de0f5734076406f1568898ac68acdbb344f7a4acc89efe4accddcae310ccaa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793906, "uuid": "c52e812b-65c8-47f2-a08f-dd4da47367c7", "comment": "Malware payload", "value": "8178e605ea0d5fe7cd6d20353a3db44fcebe3b97", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793906, "uuid": "717cb44d-9799-47ec-8b7c-2db19ed490c0", "comment": "Malware payload", "value": "d67ed4e766ecba7b4ac3fb9595317167b78e8377c7cb120486fc3f4ceb381830fb33683a59e6d893380d89e03b6333da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779793906, "uuid": "42b9a0d8-6040-4f03-9ac4-f82c3734efdf", "value": "T154137D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBFCA3CF18C15A9CE318759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779793906, "uuid": "795fc6f1-f50c-4d68-b5bd-a900bc77914c", "value": "768:er9NyXsZztCAU9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:oHusZ1Zcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779793906, "uuid": "8d499178-827c-4ccd-885c-beeb0fa0bc0a", "value": 45502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779793906, "uuid": "02fd0b46-f531-4f17-8828-d6e292a58744", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779793906, "uuid": "ba8512ee-4b0c-4530-8b2a-89c2a74f27b2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82b272d-5907-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779802484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802484, "uuid": "940a34d7-aff3-4c59-89f3-0b8eed5b6aa1", "comment": "Malware payload (Mirai)", "value": "f0a16ae582898f87c53630ec22b2975e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802484, "uuid": "f62691b1-bab1-4325-967b-d0c5fec5f990", "comment": "Malware payload (Mirai)", "value": "871ebd0b8c908a54d4c2fe087421b5222b77d0738d57042dd381f78b5abbb9ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802484, "uuid": "24e5b4b1-e59e-4d02-aafb-601e0f804ba6", "comment": "Malware payload (Mirai)", "value": "3e18a73064a22b64e60d7cb0d1751a07b1370615", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802484, "uuid": "322016c7-c569-4898-98ab-b81895aaef0b", "comment": "Malware payload (Mirai)", "value": "b1b26f41e7c313a1554ff1541395e545455a0c4def7d2c90f8acba798267c7cd164a2cffc734cfc55da7cb0b1b80ad0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802484, "uuid": "fcc81bce-9aab-4841-9f7e-6f7010022c67", "value": "T19AF34B83BF83DAF7E55300F141F69B221A31ED3A0422DA5AD7B47DB5A8516D0E60A37C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802484, "uuid": "71ed2b6a-25a9-4a2c-8bea-c25946881774", "value": "3072:XrFEgyPA+a9mf1tRaBqZxv3i7LE4FcBG+R:X2PA+a94lZ34wYcLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779802484, "uuid": "a0c8a469-dabd-49cf-94a8-37aee0d3eb27", "value": 159432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779802484, "uuid": "91937ddf-dad0-4475-941f-8741d1f0494a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802484, "uuid": "2267660f-5a21-4136-bd0c-4ba958034028", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1eb8669-58d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778851, "uuid": "e4de6494-4fb4-4e8b-bdfa-daa258d65757", "comment": "Malware payload", "value": "9ff64d8f95feec93083f4793b9ddb46d", "object_relation": "md5", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778851, "uuid": "95b4e72d-d12d-4570-9ea1-908c02991376", "comment": "Malware payload", "value": "886e220a87322d3df6b783db87dde6b8023abfdd71753bbeabcf78da60be7a5b", "object_relation": "sha256", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778851, "uuid": "4ee96a64-6a61-4053-9483-a34a3e3bde5e", "comment": "Malware payload", "value": "3d33f94d879279082b4ea212c5802e366b854376", "object_relation": "sha1", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778851, "uuid": "c596d334-0970-41ab-bbf8-3eb6fd2d0e23", "comment": "Malware payload", "value": "12afe7b0ebd810bd8710e19860c7fec0b545d329fff8263465d08620f698eaf4b4cc0411a5de805cd2f5785ef3b70ed8", "object_relation": "sha3-384", "Tag": [ { "name": "jse", "colour": "#5074D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778851, "uuid": "fe36ce23-16a2-498c-a5bd-10d279f7b4b8", "value": "T108351029DBE9C119F1B28B10BDB53412A82B7F76293DC95CD189128D077390DF869B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778851, "uuid": "bc6b0f19-f01b-45cc-a215-169687977b8a", "value": "6144:AY/qGcydoEp6bnCete0aq57rYYQMPVtIaMPyHRJNmAz9N2EDmuBHjC8CxyZhyzkz:SGdOE1ceq3Q+tm6xBdNHTmhjCD01+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778851, "uuid": "fe013f45-5794-4659-a02c-9d6c7c1d51bb", "value": 1119712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778851, "uuid": "bb6688a5-f7c3-4a6d-8ed3-e44350735b31", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778851, "uuid": "37ffc046-a077-457e-99f1-05baf138d94f", "value": "NEW PO M20875990.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e967a47d-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload (APost)", "timestamp": 1779778542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778542, "uuid": "f496266b-81e6-4af5-b4d7-e82f59ac5f31", "comment": "Malware payload (APost)", "value": "0e8965c1aea9b42a3a34cddf0bbc3767", "object_relation": "md5", "Tag": [ { "name": "APost", "colour": "#52EF85", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778542, "uuid": "24210531-4c5d-4967-91e1-786880402420", "comment": "Malware payload (APost)", "value": "8a2247462598c070c36e83cf7a5944ca86c0bfcf1b9abda90192b23f9214d616", "object_relation": "sha256", "Tag": [ { "name": "APost", "colour": "#52EF85", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778542, "uuid": "5fbf0786-2842-4897-9540-9d6f7be21ece", "comment": "Malware payload (APost)", "value": "48195e76a1f78afb8cf623fbcc5fa84d9217d483", "object_relation": "sha1", "Tag": [ { "name": "APost", "colour": "#52EF85", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778542, "uuid": "d3cdea9f-b10a-478d-b190-025dff659b25", "comment": "Malware payload (APost)", "value": "f1b1d940c9602dda39b5f2a199061bc141219cdd163eca2004eaf64aa0d878ff78da02885dffc5a0f3a2b5e2f4b27899", "object_relation": "sha3-384", "Tag": [ { "name": "APost", "colour": "#52EF85", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778542, "uuid": "9d1c4d31-bf4f-4a87-a9cb-de7be40ff7a0", "value": "T17E256D68735079D6EA25C5BBC161FD401676B863A33B822F58D302B99C233D8EE43E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778542, "uuid": "0babaeb6-47c2-4d70-b792-7b00833246b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778542, "uuid": "3371a316-f57c-4f17-9231-f10cc903df78", "value": "24576:ASCSEYP2vQ9FrIJJpCNoh+7G+/3qlrCNoh+UqgIwhCNoh+J:EYRoGf/iJe2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778542, "uuid": "c52a8ab6-707f-44c7-89db-fa7bba55146f", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778542, "uuid": "de38a256-efbe-4f7c-95ba-bbb48edf85c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778542, "uuid": "d3de7b9d-79ff-4ba2-8339-a782c6ce0dfa", "value": "0e8965c1aea9b42a3a34cddf0bbc3767.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13297c9e-593b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824568, "uuid": "7d9c23c1-4a95-4ab0-9aff-347b199bd7ee", "comment": "Malware payload", "value": "88e027ee253ef5bf44e02c2943796a3f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824568, "uuid": "d1acb5a5-9ecd-42bc-a698-97db5d8a9417", "comment": "Malware payload", "value": "8b7a7499868a04b27e1385d26be59b742b8af3f76241bff1b49e740b71e0fa0d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824568, "uuid": "9f245d58-7ad8-4a71-8ed0-54b2cea4bebf", "comment": "Malware payload", "value": "ac62d615d26079b22e288a6a6bdf6f5d5811723c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824568, "uuid": "f0680da7-6887-49a6-98f7-247aa5d625a1", "comment": "Malware payload", "value": "0fa19f86f4cc228276d2b9730c489ebc1398d30767c67fa7efe9a7f14ed041501ff841fd06440fa8efabd0ad397b1438", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824568, "uuid": "f55f8dc9-934e-4954-ac6d-0d76e5ac96f4", "value": "T1B923B53E47144CE9826324D2386A34C31AE9D63B776CBB55B57D4457332428E4C3B9EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824568, "uuid": "4e1ec73b-8377-4362-9e39-268434d00a2f", "value": "96:WNfQ2k222gnMvI3GB2AevI3GShg9lNTediWvI3GTvz62Rr625RRIdjiqm2Hp+:WfQ2k222gnGB2A9GSavGH62Re2y82HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824568, "uuid": "a69c6b42-d95a-41e5-bb5e-e163244b8488", "value": 48141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824568, "uuid": "616030ea-8496-4c3e-8fdf-298952222dbc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824568, "uuid": "3a3dc583-3fe2-4204-9fdd-66693f14f0c7", "value": "enitrethingsgoodformybesthings.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85e3907-58a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779758327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758327, "uuid": "340f6690-21c0-4874-b949-3024be8ed2b1", "comment": "Malware payload (Mirai)", "value": "a535d77002181af2e6d52e7801d251d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758327, "uuid": "b5e8ed7b-f1ae-4a5f-9dcf-ae8d1bf6d5e0", "comment": "Malware payload (Mirai)", "value": "8c20a9fd18836f0cba2bb1e6552b179d2038cbe3fa3023b3f250800565368a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758327, "uuid": "4153255e-bb99-4f21-99c6-b849663d4b9d", "comment": "Malware payload (Mirai)", "value": "14abebdda8d405982fdfe478a4fbd2dd13366a37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758327, "uuid": "7ba7473c-7705-48b7-bd96-c4af038fd785", "comment": "Malware payload (Mirai)", "value": "00fa09d796b91230297ebb1851a03d7a77ec7b477239930bfbd851f239f5c01a8c04907123312a2be2cdb40393c9da9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758327, "uuid": "c884c54d-c703-4b09-a2c9-8763d6f9b8af", "value": "T1D8F2F1BC3F78CAC4C47564FA1389472066580FD18C12CD6EA449EBF2EEBE1A529673C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758327, "uuid": "7553b0d1-4cf0-48fc-95cc-b453464102da", "value": "768:4NYKyukZoTMKey7du1310h03jRdozIIc8Il7xZrRJgGlzDpbuR1Jd:iYdWleQda1WetdozIIfuxZ/VJun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779758327, "uuid": "7e97f13d-7eb7-4321-b755-b620f664f927", "value": 37068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779758327, "uuid": "3301e872-4e09-451c-820c-a06ba891de98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758327, "uuid": "72c55b35-e4d4-4917-8b1b-5c0bac3ee39d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40aa08eb-5939-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779823785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823785, "uuid": "78a66031-3ea2-442c-b44e-ece858a17d3d", "comment": "Malware payload (ConnectWise)", "value": "cb68061721f09f8b3f83398c593ee470", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823785, "uuid": "fe17ce71-9f85-4992-9b2f-cbb88b2094b1", "comment": "Malware payload (ConnectWise)", "value": "8c8e60afcf9e8896ab78b89c9da45eb2ba466d6d5edec42423b1a91eeb4c2cb4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823785, "uuid": "6332e9fd-dff8-40b8-8a2c-4fcb24186cbd", "comment": "Malware payload (ConnectWise)", "value": "23553b8fc298d9179bed494360c338eab8a95e2e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779823785, "uuid": "a641f104-c796-4056-bcec-eedf8eea3ff8", "comment": "Malware payload (ConnectWise)", "value": "6826542dc53b03370da4e5423399f5b78a7e5aacdf4c30b99c531bf7ca5e0d86aa0afa042dd2d77f67ce7ba8a229de12", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823785, "uuid": "dc2661fb-e857-4786-9184-3eff21e34203", "value": "T13B46E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823785, "uuid": "eff4d03a-9cca-45a8-ab6a-594007207d59", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823785, "uuid": "cffa64a1-353f-441a-852f-0ce3bb75b2cf", "value": "98304:KzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:KhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779823785, "uuid": "57b540ca-7b11-48a7-940b-9b02ac355614", "value": 5641560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779823785, "uuid": "b7704c90-1f4e-47c1-addf-318a32b4a405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779823785, "uuid": "0cfddb27-82b7-4c83-99fb-e3f6a304d090", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0793798-592e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779819329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819329, "uuid": "f57b7147-9c8d-4cf6-b3ca-6f7808f7b16e", "comment": "Malware payload", "value": "5c1d17439d20d0343a3f66e17aabdbec", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819329, "uuid": "970bcb63-b050-44c9-93b9-46ff88f4d661", "comment": "Malware payload", "value": "8c90ba5ae6137f8f2c0389dfd4d496b2d953224242e3fbcc42d02a48d9834cfc", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819329, "uuid": "c23d38a1-db47-4dd2-966f-036835c0b9cc", "comment": "Malware payload", "value": "734847368ec11c236e06e8d2d746bd041f2a4bac", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819329, "uuid": "7cda791d-d5c0-45ed-88b5-7a57ed05ad56", "comment": "Malware payload", "value": "2fd1b148fcf4bc3bc0ab88d48e141ebed163429e4b5fbac982e9d2906ecb852f5f14d6f0bccfbb34088366b8a7949b4e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819329, "uuid": "a0572349-1186-43db-b1d8-d862cb4394ee", "value": "T1D37513C78AC11D87DED51938AC6B4F745A61C89AF806CA138F32A76E9FD7794CC1A04C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819329, "uuid": "251352ca-e0f5-47d4-affd-9505a32864bf", "value": "12288:NGKSUL5+jMQcBvI3yqQqHyhpIa1vOHjo3NSM5LvkOBcAu1sVFFsd8:NGKF+j6BvI3y57sa1vAQSMW9Au2Lse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819329, "uuid": "86cdb1a2-6956-4e61-837a-efd5c04d3610", "value": 1614200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819329, "uuid": "3d9550d6-046e-4180-a2ac-8a01c8614a15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819329, "uuid": "e200a2a8-e6d1-4d11-9090-3a1fa60c86e2", "value": "\u0412\u043e\u043etsexecs64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b04e88-5916-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779809062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779809062, "uuid": "354e492d-65b2-452c-ba2e-6d73c63a4ef7", "comment": "Malware payload", "value": "ccd64a6e0184dbc9bec90150cd794f54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779809062, "uuid": "42850ce7-22f6-4d68-9e11-e0a524b974e5", "comment": "Malware payload", "value": "8d745a21402f6681fb38e08b00412212c7a925dba9d321dc138c5b08a53acfb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779809062, "uuid": "6363ac8d-5351-4607-83d9-52aab1987a74", "comment": "Malware payload", "value": "8a647bb918543c88c97039ef7633fd8508fb7f3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779809062, "uuid": "28e76424-c006-49bb-9e2d-432c24b14308", "comment": "Malware payload", "value": "76caed9b1e0fcebabafe4e8dfd073931e00e543e20eb1b5fb74124b27038b726087e1606138fc5f97f2d6e4eb250d252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779809062, "uuid": "54bd0865-9cb8-4bc8-8fbd-63fe37cdf5f1", "value": "T167F4335077255EB0D3B4DD480ACCB8EDA3398881522B1FC7F9514DFF06DAA132B9AA5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779809062, "uuid": "9253c399-0704-4345-b9e8-b6489e6358bd", "value": "12288:Cq3fzffTItBUXwVdDPOjS1tbozv/pRxKGAQeA+XZAlLSInbt3qHXUlXQs:hzfEtBkjj8t0D/p5fAZ6LNnw3sXQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779809062, "uuid": "f57c3323-4a4a-43af-a094-e138ee1e8b7e", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779809062, "uuid": "a48c61b6-fc11-4508-bde5-1508ec7dd77a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779809062, "uuid": "2774a244-c1ce-4f72-83fc-f94806b9b9c5", "value": "8d745a21402f6681fb38e08b00412212c7a925dba9d321dc138c5b08a53acfb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e8fd22-58a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779759697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759697, "uuid": "71615509-7e9b-4dd6-8f07-e9433c5aed3c", "comment": "Malware payload (Mirai)", "value": "6b88fbb83d41db02010bf8207cfe0862", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759697, "uuid": "e5d9e655-99e3-4ed9-b47f-dc5e8e9fafef", "comment": "Malware payload (Mirai)", "value": "8d96b483c2160fe40773128c508323d9eece127e845ffcce853077971fae54d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759697, "uuid": "227514b6-890d-471b-a57c-40878c59bb70", "comment": "Malware payload (Mirai)", "value": "cf33358f006b57710bba96c14f92329d5528f7c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759697, "uuid": "862b9697-8abc-49a6-ad4b-6289fe968413", "comment": "Malware payload (Mirai)", "value": "634960f1d8b5aad58c24e472f729b0bf27c8b084a99fb787348fd027eb26acba4b10d32e54e74fb85670022853bc5b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759697, "uuid": "f20f0e30-d60e-4673-a22c-af2ce169dcd7", "value": "T132B3CE21DC152DF8C1690AB4B4B09E7C9723E69182576FFB0685C97A908BEC8F50F7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759697, "uuid": "b12527e0-ce3f-4273-a937-7fc198244040", "value": "3072:27QSatmf6tuR1XarS/vk/KvlrPc6TPSBAx6w:HSF/R1XZQmlAtQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779759697, "uuid": "08b6e4a3-622b-4e3b-8703-8a8f13763e43", "value": 108360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779759697, "uuid": "a6b09b35-6131-47fc-ac77-b6a97e128587", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759697, "uuid": "40ed3ab8-6d37-403b-92e3-9732ea78439f", "value": "bin.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc568f58-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784479, "uuid": "fea6fd58-e8d5-4c87-9755-4afccad0ceba", "comment": "Malware payload", "value": "131885f70f0da9c801643a77ec611c8e", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784479, "uuid": "6b958abe-a448-40da-bcba-37c755cb8350", "comment": "Malware payload", "value": "8db103466c032c12d0b945bc1f86e62039f9b2f44779c7450eac9e52251fcd62", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784479, "uuid": "b6d2917a-0ec0-41a6-9992-97b2548eebdd", "comment": "Malware payload", "value": "8c1ef8b59a877201b3a1dd6c14a19548afb93a72", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784479, "uuid": "7b1124bf-b1b1-4cf9-92e3-8d7e4bbcc386", "comment": "Malware payload", "value": "2c59d85368ca0923ae2d0ee0a6cab3161b6f7eb7f6eb127eb1b7a27e88df8ce085d486414b2f892d261d99e7cc891bf2", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "proxyware", "colour": "#408B9A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784479, "uuid": "5a28d601-a34d-4a65-bc16-6efb16ad851f", "value": "T1E1E1849A1C6118F57B4FC8198E6B8115301F38172A026C24F5DDA4E96FECBB58373E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784479, "uuid": "983bdb80-1785-4f5b-81b9-b8f6a7b6e475", "value": "192:Wpf2n2Sg916x2xxMfNtg5uoqdfeqDWochsdy65:IHICEmudd2qDWoek3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784479, "uuid": "4c3958d6-2a28-46d7-9230-79ac1110ac0c", "value": 7114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784479, "uuid": "8d849cba-a34c-478f-a96b-aeae347d6149", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784479, "uuid": "12079656-c650-4043-8364-73117bf73f85", "value": "8db103466c032c12d0b945bc1f86e62039f9b2f44779c7450eac9e52251fcd62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f0ba39-5902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800247, "uuid": "c4b6e78c-1c92-40a6-8f89-74bd3867e287", "comment": "Malware payload", "value": "128ac1a42f8d28931ba9b39d81939813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800247, "uuid": "f73f6a7e-768f-4970-8ac4-080bb90fb59c", "comment": "Malware payload", "value": "8eb07e3ae06150c7dd7770f383a4816889a2f335e4bff6beae1b5e2296f7170a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800247, "uuid": "981648df-f43e-4c57-ae2d-d8e533e4deaa", "comment": "Malware payload", "value": "7d83b10c5029ad920e32e8ade9f36d18a9c2b76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800247, "uuid": "a9c35939-37ac-4c97-b94c-7fd19503b55e", "comment": "Malware payload", "value": "6bca8a0fed603a89b364c8eb45bb8e414640e58c275979c16e2cb4a8f81c60bbfd62dda2d6720be42ad9d6e80094b0fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800247, "uuid": "47fceeeb-cbce-4393-91c9-16edd68c009a", "value": "T122F4F97F9966512ADA4A80FC354A4B625971B33B03B40FF300669131271B9B2EED73F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800247, "uuid": "66a00b52-709f-482f-bc4b-6b8ecd4c52eb", "value": "12288:bJYubMYLGu/hzzLdbsWFYs1GSwdGvnKodBzNWPKAie/wZFf:beub1LGu/hzzLdbRFYs1Xwgn/d7Tjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800247, "uuid": "f59d2558-a577-470c-bcb9-8ed784b9c619", "value": 778424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800247, "uuid": "df43d259-a438-40c5-a038-227759e10e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800247, "uuid": "e51532da-65f3-4f2b-a83f-f2948f52cd24", "value": "license.py.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e32875-589c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779756286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756286, "uuid": "a1a12717-6b2c-4afd-8fd4-80b8c5f1042a", "comment": "Malware payload (Mirai)", "value": "3a38f91b713604cab7217d268f1edf62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756286, "uuid": "1ea28c55-6c3c-4191-95d8-f6d5ad1e7fba", "comment": "Malware payload (Mirai)", "value": "8eb657882fbefd59d613ccf70b7ebc1c6f0e25f28a9fd674b7b20438b6cb48cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756286, "uuid": "82f1b083-9c65-42dc-86a4-246551160bcd", "comment": "Malware payload (Mirai)", "value": "332b655fa6a3be75b638a350251f3a79d1306a91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756286, "uuid": "117de809-2a55-4ad3-b95a-ea95dfefac15", "comment": "Malware payload (Mirai)", "value": "3744f8f605421e2c268ad61c5780048ccaf7f907ae6f208ab010bc4711a2ff98c36068be6ade5f07a1b083aece30ad01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756286, "uuid": "13d28755-57fc-4202-b1f3-c62a6115c992", "value": "T100B36C02B7180A57E0671DF02A3F27D5D3EEEAD110F8FA84250DBB8981B2E725546EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756286, "uuid": "c31f15ba-216f-42db-8668-7b875470b906", "value": "1536:7EWHf1abDxaLk6dQT02rLR7F4AmesrwLJA6d1Z8B1es3iWPG94UqYTtlnUCnit6Z:7T8AwTr7FZMMJAq1c33ZIb3UCittQDRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779756286, "uuid": "013214a2-ce2b-4641-b286-f12a5021eace", "value": 116588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779756286, "uuid": "6ebac24c-a56a-44e3-82c8-f53556798436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756286, "uuid": "cfb40669-4207-48c9-b370-550e63cdadc6", "value": "bin.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1468b20a-58eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779790210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790210, "uuid": "8113eea7-8b96-470a-bc34-b13f3accf3ef", "comment": "Malware payload", "value": "e57fd46d6f7c8ab9d0a3107fb828f6c2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790210, "uuid": "07fe68c6-340c-4beb-8453-6a3016c9db36", "comment": "Malware payload", "value": "8f27c5093091ef34e1bd0114ba3f5bd3ca7ae5d5417d907dbda1cdad804b4630", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790210, "uuid": "f487af5a-eb24-45bc-a30f-3eeed23a5142", "comment": "Malware payload", "value": "ec7bf2b3f41e5212ee06412808fce1762ef05504", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790210, "uuid": "17b0fab2-3a3e-4c62-86e5-ada137b506e2", "comment": "Malware payload", "value": "805017533db3d239479f5f0afe84d37c2a0ff801adf02cae1c12092eb6c9e82a5d626bb0332b4f3f9208e972fed88e04", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790210, "uuid": "532459cd-c827-4a23-ab76-e9398b56a683", "value": "T16B31080457BB0714E2B38A38949E730588B67C25DD718F0963E5554E00A4A13AB7AF37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790210, "uuid": "4fb9575c-2c3c-44a7-a627-62ef2604ecf6", "value": "24:8lLJ/Bqk+fzbi6jNrSjrE6l5kHLCw180BBwNFrEuAK6r3pZ1z4h2zFVrab0R:8Nxo+Sr8E6buFnBBArHAlHBVzFRaQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779790210, "uuid": "de8f54de-b652-4694-9ab7-a6da0ffbe34c", "value": 1758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779790210, "uuid": "022001d0-9d10-412d-9c0d-467e0113f529", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790210, "uuid": "1003e45b-712c-406f-a551-bd268dac78f5", "value": "MR List of Required Items and Services.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d227ec43-595c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839062, "uuid": "ea892abd-009f-43d7-b0bf-e85983a1e8c6", "comment": "Malware payload", "value": "8337526558ec96f7a7582d446d48b8cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839062, "uuid": "f3600614-6cd7-4437-8ef7-ab94032a50e2", "comment": "Malware payload", "value": "8f3add069ccd037e62de2db21914945ab025319a0719e3d5f5bc2df359383a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839062, "uuid": "df494dc2-2183-4a61-8634-5e7267b89ec3", "comment": "Malware payload", "value": "19a343658458be66b5911801d402bb30572e9e8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839062, "uuid": "25eac98c-ba4d-47ad-bd80-e400895e6cfc", "comment": "Malware payload", "value": "55cb5b1fa3efc5ef3cad6de25996bb14238c45b9501ef2bb47407690936b7e6c3af7c4bd4cb31a4163750a535cc37938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839062, "uuid": "26f67000-62e0-4585-a3b9-de61b653485e", "value": "T19D76AE51FCDA60B1EA61123219B3D2DB2331BE091B30ABC7D554BF7ABC375E10932696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839062, "uuid": "0aae5d13-403d-45d8-b747-e37fe2843a11", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839062, "uuid": "f164d5a8-a07c-4ea4-939a-cd544edefbcf", "value": "49152:FEds7ud+o+LBGeKYqkDeJL/9rvOWnZYD1/:FEiq8LLtKYs/9rvU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839062, "uuid": "9cdd70a4-3fb9-4a62-a91d-d12f06021b66", "value": 7571072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839062, "uuid": "0991305e-c996-40ba-8a2f-1e875c7f24d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839062, "uuid": "566235ef-6a64-4816-9b71-e4c8e279d5ac", "value": "SecuriteInfo.com.Win32.Evo-gen.26818672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dca08a-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779776865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776865, "uuid": "83939914-9021-4107-a519-b29d8ebe9711", "comment": "Malware payload (ACRStealer)", "value": "26b65bf3c0418404290a3965039147e9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776865, "uuid": "297bed4a-e716-46b7-864c-32190c128cc1", "comment": "Malware payload (ACRStealer)", "value": "90d54589bfae10deb74fa349668a5af649c546b8eddb75d5000174601920cf77", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776865, "uuid": "87a8b708-f937-417f-954c-1a07fac3fe69", "comment": "Malware payload (ACRStealer)", "value": "098bd844784b0c59c8c97d253f11b9f2f89ec616", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776865, "uuid": "a752aff1-255c-470b-9100-4d4003738fb3", "comment": "Malware payload (ACRStealer)", "value": "5fa16742b7d1128679a704823ac54becbbca4322658b2df0740864f832d6c4774e070355dc43500daa02818006b3c8db", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776865, "uuid": "ef09b4c9-3699-4fe6-b7f0-46be371dac42", "value": "T152B56D00FDC7D9F6E4069732C9AB62FF2335AC058F369B97EA447E79B9761910822305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776865, "uuid": "320c1b8b-9206-474d-82cc-6c8c4db6203c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776865, "uuid": "5cbdae32-f5bd-404f-bf00-e0ed6b11a976", "value": "24576:ZYNQ/0V4LhRg/LhmCWskpzifnJIcQorQmZ5CyYAHRPKiQDuVbovffUob3cGsGVtl:Z9/apkp+FRPUUobsGsimHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776865, "uuid": "c0cad72e-f2e9-4920-a23a-22df8b846689", "value": 2330760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776865, "uuid": "b0aa06dc-158f-4b98-b541-2514431e6bce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776865, "uuid": "7615afd6-3c0b-4d30-bfbc-c14ca24766f5", "value": "SecuriteInfo.com.Win32.Evo-gen.81186478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e347387-5940-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779826734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826734, "uuid": "21f30f45-3e42-44e5-9a28-79ccf327e023", "comment": "Malware payload", "value": "234ca919ff8e6a029f3b290f47213061", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826734, "uuid": "98bc19d1-2d75-42f8-9a17-33afdefa4a8e", "comment": "Malware payload", "value": "90e984b5f05b4425a37f8af3dedc27d4333c1fcd5e1efb4d577b889145073b22", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826734, "uuid": "03cfe165-9369-47e7-a3a4-c8d5efb86ac2", "comment": "Malware payload", "value": "a7fda82f5e4f4b6ddce10f0c0dad164a81bc8389", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826734, "uuid": "e167e1e3-de17-4711-be67-af63e70fd75e", "comment": "Malware payload", "value": "d60b0b4abd8b5e632aec7993250146067f4227010c1acb30868c3c91b3ef912b7463e5fc1e24c266ab9f2d515c3a1721", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826734, "uuid": "53e4d6e4-8add-4103-904e-9180bb7366c0", "value": "T1EAC41201F756ABA6D48BF83E8AC851DA145CEC285F26F00F715A3B8D23377A64B5E01D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826734, "uuid": "bd611cbf-3170-4bd2-95ff-1b67effded0e", "value": "12288:YY2EcwekXheleGoJYK4UVIGDDmbHBVnrJmC/VvUMBTT2m:+HteJAUxmbHvrQCtvUwGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826734, "uuid": "fe187e3a-21c4-44ed-ab5d-421710b21d20", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826734, "uuid": "d5eefb39-8bf8-46cb-9280-698b192275ca", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826734, "uuid": "a05e890a-18fa-4757-add8-fb4806b6e1f1", "value": "NewXPOX38359257N0.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e76e0b6-58a6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779760780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760780, "uuid": "ff1cd56b-8ec5-4518-9a89-b75bfe5cf1ae", "comment": "Malware payload", "value": "30f217436b95ce13b2eea65d87a01571", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760780, "uuid": "2ced0399-ab74-43bf-b94c-52a4b1ebabf3", "comment": "Malware payload", "value": "90ea0d1516d2ba4bfa92d60605d3288c9623ee39c68ab08d858d254884038837", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760780, "uuid": "bdf47257-bb7f-45db-a3d3-2c334c86d693", "comment": "Malware payload", "value": "af097dbaf1ac6579f66c4a7a48477c10158d7c62", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760780, "uuid": "3ef8d35c-1566-431a-a03b-4fb540666650", "comment": "Malware payload", "value": "9d5cca636777c783cf5af57958620cbe6fbbcc87ba16615e3e0e361620edb1f7ac39b015c1451b9fdf7d89734aa55e01", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760780, "uuid": "023d7cf8-14ae-483b-9c41-a6d465d5859b", "value": "T156F02719EC8848BFA03FC89EBBD63D9D120F51111A8B2E2D96B51C07B8B9C4850D1833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760780, "uuid": "ecb2c5e4-8da6-407b-b7b2-22478ec0d3a6", "value": "12:/VJ+TNLI5DXYEzicKXCiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASNyiiuyw:NwTNLI58Ez8EZrTBEGCnuoLpvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760780, "uuid": "b24aa562-ffee-4040-a063-83f49c86e3ca", "value": 471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760780, "uuid": "370790d8-f171-4209-bc5b-485210dc1701", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760780, "uuid": "344b1274-fc93-4e01-ab67-38c40266b359", "value": "thk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb369304-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824528, "uuid": "94c7253a-e7b3-456a-9bd4-06142409fc0f", "comment": "Malware payload (Mirai)", "value": "c4ce88ab13946c6b38892918aea818be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824528, "uuid": "913d97ee-62eb-4d60-a380-9cbcb7cbb15e", "comment": "Malware payload (Mirai)", "value": "90fcf7caed3913a0dd4c3fb931692776f43dc59c7582bb84e3f822d8e740b589", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824528, "uuid": "ab60112c-ffc1-4d76-bd8a-eca6e0c0ee16", "comment": "Malware payload (Mirai)", "value": "a6604797b793111b670cc2e38bc04b56cbee36dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824528, "uuid": "6db9093a-4ec3-40de-a72e-4f5763c25321", "comment": "Malware payload (Mirai)", "value": "2c4e398a21f404154a4a5218f6064846d291560172b03fa943b053cfaf29525506b67dd9047a92c56ed3321c49c3bc8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824528, "uuid": "b97728f6-b96c-4524-a536-e3f1a2fd3146", "value": "T118733A55FD814B23C6C1123BFB6E068D3B2653E9E2EA72039E259F2133C751B0D6B895", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824528, "uuid": "b0f179b3-6094-46c4-aa15-2eb42e56f3d0", "value": "1536:OZWLxW3i3jV9ZJpcO72Rbu1U+qhxp8f8vNv:OZWLnJpcO72RDRZNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824528, "uuid": "ccab3cd2-9b5f-4a33-a5cc-6339890c5e0b", "value": 79168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824528, "uuid": "7b26a47f-5210-4ccd-99d3-ec7096271bf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824528, "uuid": "85a32d47-44bb-4bff-a2d3-3d9ac071aac1", "value": "Space.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7609535f-58bc-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779770188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770188, "uuid": "14bd66d0-6549-47b6-a891-08d5920fe311", "comment": "Malware payload (Mirai)", "value": "39697a2050f144c294cedc76b8c917b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770188, "uuid": "b5ab43e6-4c51-4177-8056-8a734648628b", "comment": "Malware payload (Mirai)", "value": "91ad53e0873eed107e45492ba83f0dcc202ada759d1d42ea4b65881bd85510a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770188, "uuid": "617ae2d5-fec1-4587-b882-bda56c3afd44", "comment": "Malware payload (Mirai)", "value": "4b9567f8239abb9258a57acc647af5e1dc768d0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779770188, "uuid": "118f4a9c-dc82-47d2-aac4-ea6cb06c9365", "comment": "Malware payload (Mirai)", "value": "03a91c182505ab810fe78c6515293cccb13a82f41f5f9f31279d7560cdb8d1b0b65e0fdd64b630ae3a9d9bb937119601", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770188, "uuid": "0339d847-a58e-4257-b373-d1a01170a8b8", "value": "T158258D2AB2F3F6BCD007C03447DBCAA15531F0756A312D7B22C4DA393EA6DA51359B26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770188, "uuid": "da173c69-d5b6-4609-ad12-1873784b467d", "value": "24576:/lB4QNgL2+mCn6IyUWmPcqdLm0TglzBGcT:/lOQNgHmC6IpfcISRlzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779770188, "uuid": "d1db8425-7d98-4873-af96-a37e2aeef553", "value": 1054248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779770188, "uuid": "e6471592-8ed6-4c7c-b2bb-2a5572a79f65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779770188, "uuid": "4483a4c6-5810-48e6-954b-8007fec435e6", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3547c8-590a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803915, "uuid": "804d5e20-90f1-41e3-ae3d-ccdfaa6d539b", "comment": "Malware payload (Mirai)", "value": "6b01ef803b684acf51b679c2f9f081dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803915, "uuid": "988d9f88-5cc4-4744-bfab-bce4a2e12210", "comment": "Malware payload (Mirai)", "value": "92adf2d00bb0ac1911a40c86eeb57cc54a55e9b163f49e754efa6271c387e1f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803915, "uuid": "e9d1aad5-c8e2-475f-82c2-23f698ab5320", "comment": "Malware payload (Mirai)", "value": "9323679a92ab8e65be59d4731952bbe541b3927d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803915, "uuid": "ec4273b7-9ae9-40e6-91a1-8fa047dc8f50", "comment": "Malware payload (Mirai)", "value": "ad5543b5eed165afe7f14b43098615fa7da24f3997223dbba90efa66f857d81e2a054ba1bc91afef32630f3294c0dbdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803915, "uuid": "a5788b01-f290-4645-bfb1-d12a091f1cc8", "value": "T1E7F31806EA41AB01E4D735FAFBAE414533536BBDE3FA3002DD209F6523CA99B0F66511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803915, "uuid": "22c072ff-2389-4818-8fcf-22747334d1a7", "value": "3072:K0BxaqYuDAiIDEZqxHbFkOaXaraBUm35kG8qpe+0gQPP/ei:zx/V4x7FkOaX2aBUm35ZLeDgQPP/ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803915, "uuid": "75efad70-2b8c-43f7-be2e-2c0a5e0894dd", "value": 167260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803915, "uuid": "74debd14-b2c8-4df8-bab9-5968e452c8ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803915, "uuid": "293d3b13-7a10-4baf-b5c8-2c9cca7d5b70", "value": "wife.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56550aa-58a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779758376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758376, "uuid": "8c61171d-8929-433e-a1d0-43ce7b29c35f", "comment": "Malware payload (Mirai)", "value": "759ed67e6aece0ec0cf9c7fe1a0971f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758376, "uuid": "8b077bcc-3ba6-463e-b928-cbb6b0923a99", "comment": "Malware payload (Mirai)", "value": "92b72364bc4f16166d90b94ef6a4c372f1a975bd3b1226c22f6d027c2babdae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758376, "uuid": "937ec25a-dcf8-4015-89b3-1296a539ac0c", "comment": "Malware payload (Mirai)", "value": "ff21544bb2163df7e8b99bf6a10a67eea668e06d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758376, "uuid": "44b9890b-e4af-4767-8bde-12e3cd7d19f1", "comment": "Malware payload (Mirai)", "value": "abe312959493c4eb46838df96a6dbb8ccf41ffd835fff8a203aa735cc6505b4fa3f07f94ed57c9662b42d0ef4e2ab006", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758376, "uuid": "0fc578ca-8c33-4264-85d1-7e48b50af5e0", "value": "T1D1A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758376, "uuid": "d11b71f1-cdb8-40b5-aa08-73a1a793989d", "value": "1536:yk8NZJjWAagPfcve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBagXzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779758376, "uuid": "fe48b98e-4d6e-4a20-a766-549ac017de88", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779758376, "uuid": "f7f945bb-613c-4ee7-ab3e-ff9599d29667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758376, "uuid": "0b342f76-c8aa-484a-8199-2037f0ea4658", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7905bfc-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763909, "uuid": "7834a33c-0615-4862-8244-dfc4bc6cfabd", "comment": "Malware payload (Gafgyt)", "value": "87d96c1673f8b6316649a56708a9f297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763909, "uuid": "f2370160-c1cc-4945-8f8f-73f26990a5ca", "comment": "Malware payload (Gafgyt)", "value": "9319d7e9c34bfb654694d662d26049bfe4f08f21ad310d7a6a3ad780e5664090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763909, "uuid": "896bb753-a854-420d-961e-15ffc16c45e9", "comment": "Malware payload (Gafgyt)", "value": "8f64802149e83e12ff44bce09bcdd4253f3a2127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763909, "uuid": "3f18844b-9211-43d5-bc5b-0ac7ef9f8afd", "comment": "Malware payload (Gafgyt)", "value": "2a84734c573975f021030157150e2957b9f34e5a6d35d5e624662053eb02408eb453338b2b7bc6edf13682f9d4cfb9fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763909, "uuid": "8d2de037-3940-4805-b0d2-761849c5c53c", "value": "T10FB30997F801DEBBF40BA67600A708157130BBF60E931672B2667997EE761D12833F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763909, "uuid": "cedfa585-0efc-4661-ad2e-a37ec0784ffb", "value": "3072:8m3ZoUl+fZV8yTd0+kU9ZjFILNOxsJ3MZC91:B3S86wyTq+kU9hgnJ3f91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763909, "uuid": "d17c782a-7bca-4156-8814-3fc5e517959b", "value": 114596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763909, "uuid": "a1b837f9-601d-4181-b1a1-73ae8001e01a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763909, "uuid": "14ba0eba-6be9-457d-81a1-7543256b1eeb", "value": "FBI.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28edfa28-58d1-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1779779078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779078, "uuid": "d61330d9-95a6-4659-a558-31b52dcbceb8", "comment": "Malware payload (VIPKeylogger)", "value": "31d385ec5f65aefdf08f7da9c3c800dd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779078, "uuid": "ae651802-c7c9-4bd7-914e-b9e5e9b511f3", "comment": "Malware payload (VIPKeylogger)", "value": "93aec3da641e8a2d7191e5ec96e1678984c2441f129d6e91ad5741c896e1dfb0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779078, "uuid": "9d40d21e-b120-4013-8108-91bf430e26f6", "comment": "Malware payload (VIPKeylogger)", "value": "ad19bee37d50f8ae48dd9ea4a0ddffa901005135", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779779078, "uuid": "cd1afe0d-e5f9-4dd7-8a76-415fe88b3cd0", "comment": "Malware payload (VIPKeylogger)", "value": "ca3fc875277774b594bb4d8e674b8b98372b24590c9a7ad4f9fb80acd15b5da2bf2d6293b6d17b08673c818ff179656e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779078, "uuid": "5ae62aa7-d897-4cbf-a870-db057d555626", "value": "T1F381B649AAA91A756DC2298D9C0E538CCE13C0C0956F032C83DE766454692D7F1DEFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779078, "uuid": "2cefa93c-2854-4a94-89e7-393fe86d1151", "value": "96:e0jGbpnoAQX55yRwRKpcTigi8rimi0C/VuU7DfmNzrzcv42XYDY3LYdni:ePNoAQX50Rw4CTigi8rimi0gVzn2nz0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779779078, "uuid": "ab01c27c-bd6e-4a46-8ae4-787c0cbaa60b", "value": 4134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779779078, "uuid": "ea0a10b4-f8b7-40fd-b912-3e863158ed40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779779078, "uuid": "431295a1-7c74-487c-836b-bb5eabe75a58", "value": "PO# ATVHCWS26-387 HANSUNG VINA..bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0742cd-595c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839055, "uuid": "33b4d33e-ff94-4017-9308-f78324c287b5", "comment": "Malware payload", "value": "c152a8e127c02ed8c88d2a8304ad4a97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839055, "uuid": "53eafb86-5e1b-41a8-ad9e-dce96f535344", "comment": "Malware payload", "value": "94104ec3db9b5795eaf97d0f292dfd0a458ee3b871c25067e6d90b7e6c870732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839055, "uuid": "57f2802a-f5c9-49b3-8399-75425d8affdb", "comment": "Malware payload", "value": "114f166674fc15d11ccd843546ff680c5204763c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839055, "uuid": "b99ec84c-8efd-48a8-892b-66d47ce571b8", "comment": "Malware payload", "value": "78e29c40415e34563ad63f3422f5912496f46e268322a681874f69f26f59b15fe83de80c5fdd076b7c427ca4d36dd94c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839055, "uuid": "56521bf9-0b49-41fa-9fe9-73cb0448e44b", "value": "T1CD76AE41FCDB54B1EA52123608A7A2EB2335B84A0B36ABC3C444BB7BBD775E10D33655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839055, "uuid": "c5ee72d1-59a6-4b82-9537-f1df449363c0", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839055, "uuid": "ff74ca77-8e60-4d7e-a50e-20a1770c7c81", "value": "49152:wYazKHOthKYXEREy6naGgYjOtJ6KjymYmYD1n:wYG2OtsIEr6aXyXGyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839055, "uuid": "45544fda-9560-4f32-8e77-75b5bbbd0b6e", "value": 7655552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839055, "uuid": "ee376486-d26d-4238-b55b-8bb708745d86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839055, "uuid": "0c4a343e-558b-4097-8688-5439af259edf", "value": "SecuriteInfo.com.Win32.Evo-gen.15799627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e31b7804-58d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779781108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779781108, "uuid": "9c4ec075-cf24-4596-8f15-730bc239e0ae", "comment": "Malware payload (Phorpiex)", "value": "358026099daeacb32bd7d7297c8cfe86", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779781108, "uuid": "a463d842-d2cd-4cef-8093-6b6c8d75258a", "comment": "Malware payload (Phorpiex)", "value": "9570038453a8b3caa9e7a0af56ef77cee9cfb314c357e62f4350fb99f6afc51f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779781108, "uuid": "3cf9acd3-d499-402c-bf49-39999175f826", "comment": "Malware payload (Phorpiex)", "value": "11cd5a6d65871d9e8f5715d5e8306ddbfc0e7ff3", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779781108, "uuid": "34d9e19e-7595-42aa-82d1-37d47cda2f79", "comment": "Malware payload (Phorpiex)", "value": "45b85beebe84c83489e4b6d2b7e8ca6ba92d4b26a501a211393f85356130f85b4613f51b517616189bfc890c0abd8a03", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779781108, "uuid": "df5c2f62-0dc8-498c-9516-c202f8d69713", "value": "T1DEB39E1034C1C432E566117A88EAC7B58A6DFC310F75A6DBBFC406BD4F266D29A36387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779781108, "uuid": "d9715a61-8cce-45d4-85ec-b41e844ebf5d", "value": "c6cbbdd643acf2dc6daa2bfb97e98d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779781108, "uuid": "9980b596-655e-4da5-8513-7005d6a439da", "value": "1536:J5UDS80TzdtyxeX38YmLfSFLQfeciC0iU4aIxl5/A26E87:zUDS1T7fEfSFL+eF7Ixl5/Auy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779781108, "uuid": "0812cf9c-467c-4878-a50b-32d03e3f49a2", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779781108, "uuid": "033fdbc2-0c8b-4a6d-aa1e-f8f3b8d659c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779781108, "uuid": "a001a630-dad2-4933-8cf8-cc59d4a73829", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3b2502-592d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779818599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "2106eab5-9142-4b01-b105-76eded9a7768", "comment": "Malware payload (Mirai)", "value": "60efdd614739886086a9d406645a4863", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "5a379a24-b4bf-4ae9-af47-3f8d4f8b0746", "comment": "Malware payload (Mirai)", "value": "958d0e7b0a236ec27a85e49473730330e32519bf34ef31ba2f16ba457f1ee0d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "7d85c0ea-846d-49ea-91ee-53f401a14155", "comment": "Malware payload (Mirai)", "value": "6015bb53ee02138c92d324309ec1b9cc9d80b136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "db9c6398-703b-42c5-b946-b6bba9959cfc", "comment": "Malware payload (Mirai)", "value": "9664d13997ae005cb1cbca0f00c8fc83c43955a9eebb6cba939dfccc15c6fac510c949154123d62c170aef0e486cd820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "4fe2b753-0eb0-4e0f-9d7e-f57dc0e050b1", "value": "T102C3E81E6E659F7DF769833547B74E22D39C33C62AE1C241D19CE6101E6038E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "3126b794-e7f5-41d2-99d9-c3969ee911ad", "value": "1536:DJr7Y62WvbgQ/cLf357U6/LJFbXKXnNnoph9D4z9zvVwRxVeKUDg:BY6hJc1dtpXKdngD4z9vVwRxoDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818599, "uuid": "7384ae8d-0b77-431a-bc9a-b4b179537c85", "value": 118472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818599, "uuid": "a6739391-9bbe-4bef-bc16-0c902fcfb5c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "cf7d03b1-c67a-4c44-aac8-1d16d0888cd7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ce5724-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763913, "uuid": "92881a5f-322b-4bc6-bac3-adfdf157be2b", "comment": "Malware payload (Gafgyt)", "value": "630b757432a19b44b61b4d9e23a7f796", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763913, "uuid": "53db093c-09e5-4aa9-95c3-03198a073f9d", "comment": "Malware payload (Gafgyt)", "value": "95ac5f324acd8d78c3e1535214a01ca1ac205943eab62bda62892b35dfadcf51", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763913, "uuid": "0ed0e38d-b4cd-4b63-ade0-33c348fd924a", "comment": "Malware payload (Gafgyt)", "value": "cad07361c1ba5fffd75f09617af089bbf1ffe865", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763913, "uuid": "07d6f4a5-e6c7-40c0-8842-6711e989ef1b", "comment": "Malware payload (Gafgyt)", "value": "c0d090ee5f1af192fce64656c280fd6654decf70e5451804d27ba295a31d871656714bb6f16c9d87969d9aa19a6ef449", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763913, "uuid": "1981421a-df1d-4d50-bde9-d6c2dcf7038a", "value": "T15C3191CB1590A463F0BDEA5B7771E6885020E5F331DB9ADBCCC8B479C8C9918B045B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763913, "uuid": "70b59e5e-c58f-4a9a-a332-50f9fa61928a", "value": "48:SpotoipoMoJpoBoOpoToIpoaovpogoP1po9ofoHpokopN5poTo6bwopofoaDpoCg:SQCswOiKHSSbvMDp4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763913, "uuid": "bb7d0ae1-7961-4fa4-804c-2d3337dec9e9", "value": 1801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763913, "uuid": "1533edde-491d-4742-b718-243620f99a60", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763913, "uuid": "bfe8da91-269f-48ef-93f1-7a73b8183de8", "value": "mis.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a35d75-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824515, "uuid": "6125e36e-8e76-4657-b080-d76ba73b2c81", "comment": "Malware payload (Mirai)", "value": "457ad270a4e8aebad24af8528744a3f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824515, "uuid": "0da85be2-e204-4e8c-906b-251c19726de9", "comment": "Malware payload (Mirai)", "value": "95efadd0967012ef0a6941765e5eace69154f6df45a80d3b21b78600d4e45fc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824515, "uuid": "06c37be7-1d84-4cca-b1a9-417cafc951d7", "comment": "Malware payload (Mirai)", "value": "5a79363bb3969bf2a3a61fb0f68b231e77f11a2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824515, "uuid": "1b477702-0604-43c8-8c23-51632c596b45", "comment": "Malware payload (Mirai)", "value": "a0b7fe3dc612dd56736de98d42a6927067b9c74adad5bb7ba8be28a4fde51d12c44013efbda63655604428d7eebf65df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824515, "uuid": "7ffa787d-118f-4f43-82eb-3e090b2c1889", "value": "T1F0733985F987C6F2D4474830426BFB3FCB32D8A511B19B0DDF569F35DA33602AA22649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824515, "uuid": "c30a4b95-ca81-4ee6-a3d0-79c3020bfa21", "value": "1536:8A9Uqtm/qzBpzah2tYeQmP7uW2wORzBbkivom3aJ2+dLNn:8A9U7KB9ah2tYe3PrXORzBbVvf+dLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824515, "uuid": "789a2c12-de6b-45c1-aefe-2023afce5ad4", "value": 74836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824515, "uuid": "955bbf05-5e33-478c-a011-7d333b54f3c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824515, "uuid": "6255db52-580a-432f-854a-634230a84067", "value": "Space.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49db2da-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763904, "uuid": "2bf747ef-e0fa-4e79-a128-ad585930cd94", "comment": "Malware payload (Gafgyt)", "value": "41630c73987ea19985fd67f14821bc55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763904, "uuid": "898ee0c9-7085-484c-a8a8-1767972015d8", "comment": "Malware payload (Gafgyt)", "value": "97f2be2f95ba20aa43081b901218abe5c94b75b0fb789537dbef7e015ce74de8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763904, "uuid": "c24351f9-19f3-43ca-99aa-e97f92bb5b01", "comment": "Malware payload (Gafgyt)", "value": "ddbfbd799bcd04a09c199e7f25312e329b68f76c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763904, "uuid": "0604c752-3ed9-479a-8fe8-29fc40f9b862", "comment": "Malware payload (Gafgyt)", "value": "e71478900faf707f400921b35be99394b7a0f264726d37aca3164b3eb1dac7290dac84caf48d08ad36fcf288469012a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763904, "uuid": "dfffaebe-6c34-4a30-8be9-32e39de4a34f", "value": "T18EE3D706BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763904, "uuid": "01bd93e7-9897-4a6c-ae27-174ec7ef851d", "value": "1536:JIYDb4Bo+0NFgNShEyX2zJuoaZ8jCSRCt6+5Jx0XJwqo5hspJ6xD:/thEdzPasCB/eBo5hspJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763904, "uuid": "443a2778-8866-4460-842c-8f8b9c7a3c1a", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763904, "uuid": "6009babf-53d8-4b9a-8e68-1df995c76570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763904, "uuid": "e0c2676c-ee9e-433e-b98d-ee4e21ab849c", "value": "FBI.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1e5b49-5912-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779807004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807004, "uuid": "838407af-f454-485d-89cd-c2356597e05d", "comment": "Malware payload", "value": "7a29f99ae690482716c500452eb8463d", "object_relation": "md5", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807004, "uuid": "10c930eb-b472-4e77-bd43-3231d9261e12", "comment": "Malware payload", "value": "98389cfeb115693cc512bf737749d780c82839b3242837807438c2975cab9db9", "object_relation": "sha256", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807004, "uuid": "0f697413-5e20-41d0-bd99-d1b99cbb54ae", "comment": "Malware payload", "value": "bde0728782a5ec45991db98742eb402a86fe88b9", "object_relation": "sha1", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807004, "uuid": "ea4e4b9e-c990-4efb-bcc9-a13abdf7c120", "comment": "Malware payload", "value": "0d1f59685e8f557ecca4f252ab3f5fc4b7b1496ed72c2aa7cf1caa94c87c4906e82d740c8492d784b390659710b4fca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe-in-archive", "colour": "#0DB10F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "spamtrap", "colour": "#0DD606", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807004, "uuid": "d149b4ac-a79d-4cf0-ae55-590789a9d898", "value": "T18625433DDAE90019A1B2CA14BDF51032E8677B572A3D897C1DC9028E07F394DA9BD71E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807004, "uuid": "12294ed3-7fb8-46ee-ac4f-d99216e5c680", "value": "12288:YEAO/txNWbShFg8O+sw526VzZ0hwCg7Q8JDGSACYCtQSyajYIKGlpfuaB2UroG3m:DNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779807004, "uuid": "7486840a-eb65-4cbe-9cc1-2056b28a311f", "value": 1013104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779807004, "uuid": "612ab20d-f04d-4744-ac64-3eca89613dfa", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807004, "uuid": "83ecdfe4-7e8c-499b-99f8-cb6a770cd636", "value": "output_8z3u3yis.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0ca258-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1779800266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800266, "uuid": "dc67b785-06da-4f2c-8b3a-7478edb38294", "comment": "Malware payload (DarkTortilla)", "value": "2a905f057a4231c5417183a8fc8ea6be", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800266, "uuid": "47e973ae-4e7e-42f0-bf65-8fefdb2d2798", "comment": "Malware payload (DarkTortilla)", "value": "98e383fe1a46c68e47372e14aa68069adc1dd1f222988b8cade631c95b3bf46a", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800266, "uuid": "68ce2a94-f7a9-4ca3-a9bf-4d5b925d17cd", "comment": "Malware payload (DarkTortilla)", "value": "75c4296b70f05717c632376029bd37acab391cdf", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800266, "uuid": "4c61c467-4c6d-402f-ac33-8e285806cfbf", "comment": "Malware payload (DarkTortilla)", "value": "fa9ad11b748dbe349eb48b6a4e383aa245184b4d38adf0e9549c4fd66eb3dadc024ed1f4971ee41ef75f563ed0df2476", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800266, "uuid": "535e3d6a-881c-4edf-91cb-4d318091d2f3", "value": "T191F4DF150E972B94D5EB0BBCC0521494BBF0CA5783DAEB9B6FEC90F49AA7F44CE41406", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800266, "uuid": "bf3cf228-7e9b-4b1a-88dd-580f4d1324b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800266, "uuid": "73acc364-c11f-4031-9584-7d6e81020338", "value": "12288:i52xapdPOCqzWsE4wPeiMxsefO+Oicj58bl1M+ptwQ0k/DIY3AzueC3iKY:iUNEhFMxO+Nm5olKEKUwonY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800266, "uuid": "bbb23ec6-14dd-4285-bdae-43bd5167ee2b", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800266, "uuid": "679626db-7c9f-4aa7-8031-fc963d23a7ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800266, "uuid": "c78a35cb-2c6a-4d46-81bf-bfbbf50799cf", "value": "SOLICITUD DE COTIZACIONES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23969b4a-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779778210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778210, "uuid": "1ad05bc1-de8a-424a-8d05-dd8c26cc5dc2", "comment": "Malware payload (QuasarRAT)", "value": "6828d778a57df3285cde194e271c5e5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778210, "uuid": "e2f5b118-4a3c-4b72-a7cc-7e0bc0bc9e96", "comment": "Malware payload (QuasarRAT)", "value": "9ac1c1dba1be97cd28dd88c4c8b33a7cb08d7601157278e49433eb9b1c283cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778210, "uuid": "f99840a0-f801-4d99-a3a7-016c68164c4f", "comment": "Malware payload (QuasarRAT)", "value": "6d7c3c4be6fc4d4c47341edb9e097d9745a829e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778210, "uuid": "bc26b590-1e17-4f55-a99a-f25fd48c496e", "comment": "Malware payload (QuasarRAT)", "value": "0c196ed08790ba3cabe8dbd9b189101fb659df843e5bc3ef0163136747429b55ea9b9aff4f08a48900c371908bd7e70e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778210, "uuid": "d8db00f3-ee29-4c74-b621-4a5f49e80f91", "value": "T16556122127941828E1798B74583A5583C7F2FD0D5B71CB2E368AD16D4A32B46EF92F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778210, "uuid": "f6d1a6b9-a404-4d03-8993-6018f4737986", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778210, "uuid": "e181cf25-4d0f-4ce5-8f60-92f3b41c4e33", "value": "98304:AXoFsj50Ix7rP7MRvvk0rCvzRfEXW9C34K6UACDX:01/rPIt80rRW9Z4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778210, "uuid": "cf46f37e-0675-482c-9cbc-c9a88bbb9f90", "value": 5972992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778210, "uuid": "e9eaad7f-32f5-467a-afbc-7a1a3389910f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778210, "uuid": "79257323-ab00-45c3-a78a-6c94fc6d1786", "value": "Especificaciones del presupuesto _ PO-20260525048166 E2S A105N.pdf(783KB).lha.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710c453b-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783064, "uuid": "4e5cefd4-e293-4812-be77-b1a23141e009", "comment": "Malware payload (BlackMatter)", "value": "fe2c37e526faf7a7a9e504b24288bac3", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783064, "uuid": "6b4399c2-33c3-48e5-8bbc-5b503dd4ac60", "comment": "Malware payload (BlackMatter)", "value": "9d8526b0ecc2081eab5ec68b7063fffe8dbd987681b77b2e8d96a0c8979b1f8a", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783064, "uuid": "b17d1be4-c8b6-4c88-ac7d-e8baf7c22604", "comment": "Malware payload (BlackMatter)", "value": "088794419c22b08a11dc3dee449a2a8a2b900c78", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783064, "uuid": "a7ae17de-79c9-4d6f-b144-b33cbdcb0921", "comment": "Malware payload (BlackMatter)", "value": "9ddbc3897eed7415b6c20f1bccb249904fb2d299e4193798fba63ebf3aef3a4fe3b1577af02d7d2378b765e6a7794b57", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783064, "uuid": "2ee8832f-198f-4831-87b1-be28527fa6ca", "value": "T1EDE38E21F612D0B3C87718F13736B172F39E8E2C1A956857EAD80F99BCA48232F44597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783064, "uuid": "05bbd1ed-a069-4c25-a99b-e288446dec1f", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783064, "uuid": "9afb2135-b820-426c-954a-78fc1ff0d7bb", "value": "3072:06glyuxE4GsUPnliByocWepwmfFcN70NyVXNk+HcU8F:06gDBGpvEByocWeSmmNiSX2Kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783064, "uuid": "21303ff8-5e68-43b6-9809-ea397d14e7b8", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783064, "uuid": "c2c97821-ce37-45a1-a136-d1b91f468aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783064, "uuid": "e85a6d28-1151-4a49-ae70-5f50d195ef60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a629d2-593d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779825401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825401, "uuid": "f7016210-9331-432d-b4d7-821b54035242", "comment": "Malware payload", "value": "ff9d3067cf1e1f5ee470044c250771cd", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825401, "uuid": "772b7537-5a18-4fc4-8cca-2e48e0061295", "comment": "Malware payload", "value": "9dbff94d0f6f1f8fbbffcae3737610494f16b2a0b1a1e02dff4e6930aa84b1c3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825401, "uuid": "68d5b01f-b373-4e8a-ba2c-9b3b1b86742f", "comment": "Malware payload", "value": "8fa3fa67b47b7221aef6ba2c8a050892b31b5049", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825401, "uuid": "3869aee1-e97b-4f04-b797-3a4357958068", "comment": "Malware payload", "value": "4959013047d54a5cbdd0048247ad9f915b417cea98fb4b15c10e43cf2c9dc80c4454e2a64ed6d6a514f70a2bf6fd9d48", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825401, "uuid": "b467d7ee-1093-40ac-9d53-92dc0d206aaa", "value": "T140B601C9A71204F4C389863485E38E672AD36D0016EC258B5B79A31DBFB12F55BB1FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825401, "uuid": "3b9f184f-41ce-4fd5-bc19-d99ee5d8fcc9", "value": "196608:PjsB0mT1nCerbI0qqdxN2KevdPC5MJ1yaj:PjDmT1CerbI0qkdevdPCaoaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779825401, "uuid": "22b9570c-b404-4c2d-8270-2fa2d3d72d5e", "value": 10878976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779825401, "uuid": "0716fc7b-b521-489e-8e34-c11523ffbeea", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825401, "uuid": "73b96144-5968-4681-a223-e5debb81c746", "value": "Ghost_Edition.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82c025f-58a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779761279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761279, "uuid": "6afa9985-b9ff-4f60-b827-0931a7074eb8", "comment": "Malware payload (Mirai)", "value": "cb0dd1f7fa037985a0295a4dfea64276", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761279, "uuid": "bf346188-cb1c-4260-9c9d-72246736b7ab", "comment": "Malware payload (Mirai)", "value": "9f3391882a45a3b3cb488b4ccd2cb368652faf44d4894a2901da3f3a2d7a7074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761279, "uuid": "4b34e599-a59b-4d81-bc8c-5e1f5d9a81fb", "comment": "Malware payload (Mirai)", "value": "8d0e1f931faeaa3ae27bc243170d3689115ec951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779761279, "uuid": "0999f8f0-87bf-4b5a-8412-5d7e3476f9d3", "comment": "Malware payload (Mirai)", "value": "2ff66e947c2a82867e64fcc552a44034b3e9e16f1f08372eba4b8387ced9daf37f5daef7e929526efac23347e0ab58e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761279, "uuid": "85c994ee-71f5-4269-8b80-b67473bb8cb0", "value": "T1AAD32C01B9414B23C5C227BAFBDF479C3B26B668D7DB3302AA196FB41F4669D0E1A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761279, "uuid": "8692c77d-9ef9-4ee3-aea3-b01dcde657a9", "value": "3072:ZBD4to7mSzBRi19JAB0nfazftY2fwsHEmYgHMMQXVXx2lx:zgoiSc9JAcfabtPfwsHEbgHMMQXVXx2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779761279, "uuid": "37825197-5f83-473e-9b91-150605093768", "value": 141034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779761279, "uuid": "83434fdf-f8b8-49c5-8700-2e4576401f83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779761279, "uuid": "76114b48-66ee-44b1-8542-42415bce189d", "value": "bin.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2114a36-591b-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1779811198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811198, "uuid": "1c33d189-6348-4a92-abe9-1b199b4fef7a", "comment": "Malware payload (DCRat)", "value": "bdb8e993bdf95c14af306dcfdd0f63cf", "object_relation": "md5", "Tag": [ { "name": "bitbucket-org-mywtestwusbect", "colour": "#E6917C", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "envinewrat1-duckdns-org", "colour": "#540912", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811198, "uuid": "435bc598-2ff8-4084-bcb6-d37c5b48366e", "comment": "Malware payload (DCRat)", "value": "a09e7790157785ac318b2895ef8bd370c4d1e4e40138435f12367259caf83a6c", "object_relation": "sha256", "Tag": [ { "name": "bitbucket-org-mywtestwusbect", "colour": "#E6917C", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "envinewrat1-duckdns-org", "colour": "#540912", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811198, "uuid": "cd2bef6b-89f4-4ea0-8642-1e99dcbb7ce7", "comment": "Malware payload (DCRat)", "value": "d7b5f3514616b38a8f71e51a63006315b07b2386", "object_relation": "sha1", "Tag": [ { "name": "bitbucket-org-mywtestwusbect", "colour": "#E6917C", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "envinewrat1-duckdns-org", "colour": "#540912", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811198, "uuid": "f452864b-716b-438b-af95-ceee95894498", "comment": "Malware payload (DCRat)", "value": "ba1c9a2532e0fd6068c6650817e5737617a369e88452ca36be7ea690fc8299d252f5855177101cf3e6a8e4c7e8fa3777", "object_relation": "sha3-384", "Tag": [ { "name": "bitbucket-org-mywtestwusbect", "colour": "#E6917C", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "envinewrat1-duckdns-org", "colour": "#540912", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811198, "uuid": "dc9922a7-903f-4b82-af5f-2a912119b444", "value": "T1B473107C002B1944CFFFAF196864DFFE0C1BC26119DA6121FB2566CEAA44CF6345EA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811198, "uuid": "afb70016-745c-413e-9817-f23e7c4baed7", "value": "192:Lfu8Qdoo5BCYrG9p5XYvIMX1HrvSA+bjmM52vtuZuCem3NZU9nm/prwgOfDBScpx:LmKo5AeX1sbMrpS/FjN3WlStgubS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779811198, "uuid": "5aaa90c3-3e6d-4afe-b13a-79680d9ab576", "value": 80057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779811198, "uuid": "48cab0e0-cdb5-40ac-965a-85bdfe6d653c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811198, "uuid": "813bc86c-6e27-43be-a4f6-cb69a97629fb", "value": "a09e7790157785ac318b2895ef8bd370c4d1e4e40138435f12367259caf83a6c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f58ab05f-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824518, "uuid": "823f3fca-cd66-45ca-916e-7ffcf347c601", "comment": "Malware payload (Mirai)", "value": "15afdbe304bdfaf4b60c5a04d031c73a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824518, "uuid": "634a72b2-209c-4c6a-ac65-841722611bfa", "comment": "Malware payload (Mirai)", "value": "a0a7a260a1b4561f13794284695b8a8ff60913e51e7b1d3d172205a1d55ec373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824518, "uuid": "6f96bdd3-c153-43e2-aade-edc93f9645c4", "comment": "Malware payload (Mirai)", "value": "427bc7302cc78a89ce9a158c2a845871aa927b9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824518, "uuid": "3263b582-48f5-458d-a3cf-f516e10ab8e6", "comment": "Malware payload (Mirai)", "value": "a771a5bac564f8090c4db7f4f8933e41033d0a8c5650dd4c07fc274ef8080745f71f140ce3bac73daa9e52393eafd825", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824518, "uuid": "89197ad2-6974-48fa-9e98-7e44b984edc5", "value": "T18AF33A46F6418B13C0D61775BAEF420533239BA4E3DB73069928BFB43F8679A0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824518, "uuid": "471ac49a-6339-4a41-8565-af6f03ca526a", "value": "3072:w0jlwv74BRae/xGPZ06v/mYp+C9T6MjhHDjyoM/9Rv03:w0jlwyRae/xGPd/z+cT6OhHDj1M/9V03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824518, "uuid": "ba661743-83c9-4f57-849f-c1cbc3a9d7ad", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824518, "uuid": "efc4c3ff-04d3-4c22-9ff6-09b0d708987a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824518, "uuid": "47ca2b94-a5e9-44e0-abab-ecc3c94a3be0", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cfa72d-5905-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779801695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801695, "uuid": "241ae54f-a8a0-4024-a8c2-6626c1db59df", "comment": "Malware payload (AgentTesla)", "value": "cb7382553bad89884e187160e022c4f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801695, "uuid": "74211b7e-12d8-484a-9347-fce0af531c31", "comment": "Malware payload (AgentTesla)", "value": "a0a891123af74ea1f6e4508ba6166d22fd0777287a4df30c98b78155b843d9bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801695, "uuid": "1492e63e-840f-48e1-bb57-dec42dbdb5de", "comment": "Malware payload (AgentTesla)", "value": "0befc5a2756b87ad4e23e5156f150ff9c3c75636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801695, "uuid": "b22f27d4-63b0-41cb-9bb0-192775b52c48", "comment": "Malware payload (AgentTesla)", "value": "4b557d24cf150a1abc35569a094c53acfdf37d05f026ff0fc6f09368816f5401c9bf730ef9531512b47121ac9f6c1182", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801695, "uuid": "3fae3d1d-f61c-4fb3-b5b5-2d0325b73722", "value": "T160250145131BDE06D0F79BB84871E7B406745E88B924E2039FEABEDF78367916D08392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801695, "uuid": "35f0a2bc-5d4f-4a12-b1bb-44917f9b35db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801695, "uuid": "17f87c54-56f1-40a0-93fd-9817a7cf58d2", "value": "24576:2eJOoWdTuaLBnSqkNAv1RDeLXWwd09VdvR:blyua1nqmvz6TWwd09Vdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801695, "uuid": "b7045081-e01c-4a2e-b125-2ecd2001611f", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801695, "uuid": "67a6e976-1e6a-40a4-9707-73a59a55978f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801695, "uuid": "d132feb2-61ac-40a8-b1c5-ef5b539b0acc", "value": "transferencia interbancaria (BBVA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5a5d2e-595d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839183, "uuid": "1de23782-3b0c-4493-946d-626481ca7f3f", "comment": "Malware payload", "value": "f565d6532025980fcc9d3582d83a18f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839183, "uuid": "6e1e24b8-e239-4894-af0b-b2c0080fe49c", "comment": "Malware payload", "value": "a2167bd258c1dae2001aa41cd1cf8ab9debd427301656e21512197b045d729b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839183, "uuid": "e74de7ce-5c9b-42f2-b92d-150b09c1d0c8", "comment": "Malware payload", "value": "f0319a58c8cc76992c9624446ee6f90568a6f313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839183, "uuid": "1e5f4f42-eabf-4de6-bb39-fc083759b4d9", "comment": "Malware payload", "value": "58d53653f1dd9ca2e3bf43cc446d5bb62d8fb16550156b71a16f8a6d47c1c25b8f758b46bedcc78c34f5ffb7367fbd11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "policiacivilmg-com", "colour": "#20C6F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839183, "uuid": "79758085-a6b6-4c3b-9248-9c16b1667821", "value": "T11AC73337F298993FD12497315AB28165553B7A10BC02CD4E92EC78D8CF762A13E3B64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839183, "uuid": "d85cec0f-0496-45b8-8e20-1d3511b1b345", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839183, "uuid": "9138191b-ca8b-41cf-b984-80c520cf5a7b", "value": "1572864:rZT5vQnGbS5OtUIYjFbUTtp3+ngP5VsVkY9:rZTVLZuFbQlPjs+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839183, "uuid": "883498ba-aacf-4015-9573-c4eaa8a05943", "value": 56584672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839183, "uuid": "e6af96fc-9969-4672-b12d-6acad966e2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839183, "uuid": "363e2738-f14f-4b8b-a4b1-16d482f290ad", "value": "Oficio_Digital.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edda0f7-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783087, "uuid": "82af8577-1ba9-4770-87d6-6dbfca62a2af", "comment": "Malware payload (BlackMatter)", "value": "adac55670f8cc7cf9d131c1e8bc86744", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783087, "uuid": "8c5e9e37-19e7-4841-85d3-e661adb096b2", "comment": "Malware payload (BlackMatter)", "value": "a2dca6efacc34720cbfeb2e75b15ee587bd2263f1720f63f373bc1632c603553", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783087, "uuid": "bd686eca-ecb2-4975-8e3e-c5aa9eb372f2", "comment": "Malware payload (BlackMatter)", "value": "be29a713dd9f68ea8ecb1ac7c0243880db790c32", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783087, "uuid": "b42c915f-83e8-4e70-bdfd-d6725cb88375", "comment": "Malware payload (BlackMatter)", "value": "3777a0553ae7b996af70a66d427d366fbc4ca2fffd4235d6f2cc50fe50cd6f8b320d6331e214f7383757d5a749234abf", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783087, "uuid": "b4c8f070-26ea-4206-ae16-358f9f9eb9b9", "value": "T107E36D11F212E0B3C83718F12B367572F39F8D2C19A96957EAD80F59BCA58232F05997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783087, "uuid": "0e123e90-d023-490f-8f97-f2a65f145b81", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783087, "uuid": "5a15286d-8f98-4bff-9c94-ab9d15c5f6e6", "value": "3072:U6glyuxE4GsUPnliByocWep7vGe7AfIY/280rr14fW:U6gDBGpvEByocWepn7AQK28O4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783087, "uuid": "d63f74a5-2bc0-4d2d-aac5-6cf799bb8909", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783087, "uuid": "f4e292c7-811f-4933-b3c3-f24508950d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783087, "uuid": "8c936615-ba5b-47b0-855d-e9673b62e848", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6fc255-590b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803991, "uuid": "7e006299-5b78-4f2c-8d79-9e177130200f", "comment": "Malware payload (Mirai)", "value": "253687068e871cb8f3c2d38a64b44622", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803991, "uuid": "9b61136e-7230-4f61-a79e-45508bae4f65", "comment": "Malware payload (Mirai)", "value": "a328e31f8e52c2baa93c367a35ed25deb8a7a249ba36dd61ed9850d3cf99eaf9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803991, "uuid": "95f9dd8c-6216-46e2-ac97-d2ffa01a315f", "comment": "Malware payload (Mirai)", "value": "aaf5ae03c85518aa2f03b2d0809f3defade22342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803991, "uuid": "6d9bdae4-0505-4fd4-b585-ad0b98d23914", "comment": "Malware payload (Mirai)", "value": "62dc16a50088ddf1cf4ea244b0851fb83cf9a0a989d6cdd05d6c44a7a0ceb112a7a0b154bf3fc84e5fc6db608bded1a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803991, "uuid": "c8185083-ab91-40b6-a79b-3b1bb622ec8d", "value": "T11F831791BC829A1BC6C5137BFA4E42CE37267398E3DE3116CD265F2133CA96B0DA7511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803991, "uuid": "e5b12dda-e905-48e0-91f0-e7fcd136d876", "value": "1536:HpyfACMmNHcHmwmGnvKvjLyw9docZI5/VfVr:HEfF8yGnStdo5/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803991, "uuid": "39651072-f1d8-47c1-8fbe-237aa8e7c4b7", "value": 88364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803991, "uuid": "67401cc3-9445-4d76-841a-7d77bd81fcc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803991, "uuid": "fb982965-849b-4fdd-8739-fb8ea6d17920", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1a3fe6-5935-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779822009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822009, "uuid": "1feba9fa-cf25-4e1e-baba-85a147266861", "comment": "Malware payload (QuasarRAT)", "value": "99ad21828b3790dd280ffc9f148c286a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822009, "uuid": "95b76afc-9cd7-497a-93ef-9d93206055b1", "comment": "Malware payload (QuasarRAT)", "value": "a3b3c9e9c1c68df7a1902750cef695b9b5518f19c5ecbb8e3796f5b80468e361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822009, "uuid": "daaa43d2-edca-431d-8ef3-e9f258f81e81", "comment": "Malware payload (QuasarRAT)", "value": "c31f7bb2faa00fc44a132b1d759c4d48c6f9dad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779822009, "uuid": "57ab211b-6888-4c76-bb45-36580d76013a", "comment": "Malware payload (QuasarRAT)", "value": "a32b3db59d056811bc31c82fd98959560d20a9454743b4311b6b289b81aee9f7715a2c9853c07bac9d8418034ad34fe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822009, "uuid": "86eec140-4d6d-4032-8854-ce0e57336bc3", "value": "T1E305028EB6C18D74C91B4E3480302D6442339F967D5AF345EE68BC3337B3ADA249599B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822009, "uuid": "c28c4c76-9268-418a-9a2e-4d7dc549a910", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822009, "uuid": "da13dbc8-5bd3-416f-baa7-c9aca7b7af40", "value": "24576:yMB64zqlq4D5Wd2J450tX2k4FNMLWSCn53nHh7qGAeVHa/SUIr:04E9L+50xeFuqh7wuHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779822009, "uuid": "9263bf5e-d4a0-4e5f-a53a-0905dacfcfa4", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779822009, "uuid": "71d71895-7eaf-46b0-bc30-cb050ab56c69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779822009, "uuid": "f5e79eab-fd29-43fc-905a-5d7abae5c043", "value": "rPayment_24_05_2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ed3ce5-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824499, "uuid": "0b67a55f-2c7d-49d4-af34-0a699808a078", "comment": "Malware payload (Mirai)", "value": "1c88a720295123d0ffe31f87f163f182", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824499, "uuid": "a6044f96-28c1-4052-886d-4ec882bbb616", "comment": "Malware payload (Mirai)", "value": "a3d4c80a987a70488093b3bcb3f58cfbabbf6c367913760c27239c0d584cbeca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824499, "uuid": "1422d35c-4471-465d-b4e9-1fad1382daa0", "comment": "Malware payload (Mirai)", "value": "1bc428f5c810fef0087c87da536adf24f8602ece", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824499, "uuid": "f84f5b0c-7f06-45fe-968b-6d7af8f3b892", "comment": "Malware payload (Mirai)", "value": "e5afa8d3d25bbc6aaf78db5e68c7f8538036f147dfc2e77357f56cbae6b0a0ce0934fb44bc4cf81643f5db3692657c0e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824499, "uuid": "1db501a8-9f97-4b75-8dd3-db8c8fc4e4a1", "value": "T12C933B8AF753E4B1D90711B001ABEB799B30EE520620C95BC7A4FFE59D31AD2B14632D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824499, "uuid": "0e9bfb80-f8c0-49ce-bd08-ad9a7da2719e", "value": "1536:9olP8zjXapOPxgP1LbU031sCmouuXkd5NhNY/0fr8:YPir6yxghquu1hYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824499, "uuid": "da0093f6-7f10-4d34-b383-be35f5261bb5", "value": 90544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824499, "uuid": "ea0a4585-894b-4a3d-a158-a98303a7d959", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824499, "uuid": "6f44ad2c-5161-4539-92b0-0df2fba8d73f", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167d9eb0-589e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779757143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757143, "uuid": "b4ea92fd-e1fa-4194-b1c3-fb8bdc0f4173", "comment": "Malware payload (Mirai)", "value": "54adeee9eb1e40e607df875e49e76812", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757143, "uuid": "a172db92-0fdc-4fb0-b8f9-d5b7ee9a81f8", "comment": "Malware payload (Mirai)", "value": "a3f93172f66b74d549aa8e08c2459d87a71d98612cea666b3e783a489fb7721c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757143, "uuid": "d93e9735-61e9-4d81-8950-1162d2588eb6", "comment": "Malware payload (Mirai)", "value": "66ca02f129ded7965e5dea2c897b90d57631eb50", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757143, "uuid": "54be1d6c-a273-400f-8da5-440f283bc026", "comment": "Malware payload (Mirai)", "value": "a289a0bb25c521b6dcc1079dd0155e34904fae933459879d0be27302ae1c68858e9b78f3615e274bbcf2281a99457368", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757143, "uuid": "317d8350-813f-4bdc-abe4-ebe7473fe21a", "value": "T171D017CE22548882040EC9C2308D9808E6889FE0F1A8CF3964ACAB72308B818B905E08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757143, "uuid": "1dea07cf-e5dd-4f15-acc4-30afae73d93f", "value": "6:1P/bKR/6y9Kt76y96kIMBUVP/bKRGKtZrBUVP/bKRoD9KtkWAMBEMs:1P/By99DTAUVP/xiVUVP/VD9BWAAEMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779757143, "uuid": "d7cc1d6a-ac1b-4ff9-a268-7243922c22d4", "value": 265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779757143, "uuid": "126b74cc-6b1f-4653-8fc1-a11d37e63159", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757143, "uuid": "68809f2b-e800-4c77-9a51-eff42c64e922", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c789c84-58c0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1779771943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771943, "uuid": "f24e814d-51b3-479c-bddf-29d0cc89bbc3", "comment": "Malware payload (DarkComet)", "value": "d05b9a51d278e43ec931b79323bd1abe", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771943, "uuid": "20db5026-eb8e-4946-9f73-b40c14879cd6", "comment": "Malware payload (DarkComet)", "value": "a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771943, "uuid": "91eecb17-3035-4db4-af39-45cc0ff698ea", "comment": "Malware payload (DarkComet)", "value": "c8962904c0b41cd194567e15cdc8e03c4dbb4c87", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771943, "uuid": "531771a6-b5b1-4da5-b98f-5d6236777a9e", "comment": "Malware payload (DarkComet)", "value": "73c62e616353b491615a6ffafff0e35201390eb1e10f3dd715d93ed643ab59fe5588c54af96a3fefce25d5469b7651e5", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771943, "uuid": "45575749-71ba-4db3-a2cf-ddf98e3cf27b", "value": "T1BF748DA0E295ECE9E41572F59C2AD9201153BDADE4B00A1E307E722E55B3393DCA7D0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771943, "uuid": "66ebe245-18d7-4b00-bb99-242b89cd31d9", "value": "a38ad86d74cafc45094a5085e33419e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771943, "uuid": "2277e232-c426-4d3a-ac75-247dee6f6128", "value": "6144:7FRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsBTUPlbL:hR72EqluswR45JTnaEY2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779771943, "uuid": "0cf43b27-4bb0-471e-acbd-1473e90e10c0", "value": 354816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779771943, "uuid": "927da9f3-e4de-4aa1-83d5-68f26517c566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771943, "uuid": "b0890133-d155-4be7-bf48-46ce2a172fef", "value": "f168pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8707a001-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (MegaStealer)", "timestamp": 1779795127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795127, "uuid": "06714ea6-e803-4675-a6e5-541b5cca5432", "comment": "Malware payload (MegaStealer)", "value": "c16e5fb2fd56097a7fad20d2a59d5521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MegaStealer", "colour": "#70FE38", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795127, "uuid": "02812638-e426-41f0-999f-b4730c945922", "comment": "Malware payload (MegaStealer)", "value": "a422552ff214245be987b969e1119a07be6814396c7d6a49e05a5533622f0d49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MegaStealer", "colour": "#70FE38", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795127, "uuid": "9daedb7d-f464-4a5c-bf45-bc1966277819", "comment": "Malware payload (MegaStealer)", "value": "784d687c77b5336e4370eaea26b9c621a4eb4028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MegaStealer", "colour": "#70FE38", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795127, "uuid": "3e74772b-1678-4372-95ef-9f61a874a40c", "comment": "Malware payload (MegaStealer)", "value": "e7f328bc961f05cbcccc01a1f43bce37ca0dcefb655c8827408318d15db131e31fa66acba82fd87a29b5b00076c6ce12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MegaStealer", "colour": "#70FE38", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795127, "uuid": "5eedc27d-9d62-40a9-9460-d17e975e10b9", "value": "T148648E16BAA410FCE1BBC174C9524D06EBB6F85B0761ABCF07904AA71F236D49E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795127, "uuid": "018812c7-cf35-4961-ac21-b2923c8a0b7f", "value": "c4dbd36b19f85cbed17987ccf2b5eb57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795127, "uuid": "235a3b22-f3c1-4f1c-929e-ac7a1ac04cc7", "value": "6144:lZ0WUglM4BKcKJazDo1DV0QMOGyeoZOACtw:3IEMMKV0DaZ5eoZEtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795127, "uuid": "e3fb9440-fd2e-4596-95e0-2116e15b6a14", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795127, "uuid": "0080d370-8f70-4e1b-953f-173cc95bce28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795127, "uuid": "2bb895f6-d2ad-419d-b1aa-fe4e56ee534a", "value": "a422552ff214245be987b969e1119a07be6814396c7d6a49e05a5533622f0d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e6cd2d-58a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779760928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760928, "uuid": "b0c77170-e70b-41af-a2c0-8223c3e5bbb1", "comment": "Malware payload (Mirai)", "value": "5ac60f71d6f8a3db9c3c96cf7c1c80f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760928, "uuid": "dea07ce8-9d96-487b-89aa-33ffb29db053", "comment": "Malware payload (Mirai)", "value": "a505f0cba7716b65888bb6d7d60cdf54f29e560bd59570213dc3003525d22ce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760928, "uuid": "ec74f245-d041-4b4d-a1f7-2abac7d91740", "comment": "Malware payload (Mirai)", "value": "14840b4fbd079b24ffa4213ba6adff09add09d9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760928, "uuid": "31d1c5ec-30d3-49d2-b7cd-bf6159604813", "comment": "Malware payload (Mirai)", "value": "8d3b2d6693fa91e102069a71a57490985b7fd478bdca7af5c295f264a76c2638eb34c0dbad4bcf3875dfb8d5e41451a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760928, "uuid": "df3b40d5-5394-4465-bd70-e0a74c8a3a97", "value": "T17AC35BD7F800DDBEF81FC73788530909B171E3B54A420B3663A7B927A9360955867F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760928, "uuid": "aec578ec-ff72-4795-b585-ae5753d03d83", "value": "3072:l62l2NjkN7l81GyF/7pcyqURLMWjNzqN3aLPy:lP2N4N7l8bqyqILMWJzvLPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760928, "uuid": "33adb5ca-374a-46ec-8568-db877c54757a", "value": 123008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760928, "uuid": "7766cba5-38e9-4357-a53a-d592522c18f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760928, "uuid": "40afe8dd-af35-4a37-972f-99ebb8f56ba3", "value": "bin.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9c93fb-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "775dd731-8a47-4747-8fb5-21447d164afc", "comment": "Malware payload (Mirai)", "value": "2f240aef727428d1cfbb109ad47985bb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "acb1dff6-0aa2-4c7a-9f3f-541589adb1ad", "comment": "Malware payload (Mirai)", "value": "a5096bb946abb6356e00d99a49d68b69d180ad59204f790a6b2d3d9290655c00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "a760fa8b-86e8-47e4-a497-bc2433faee13", "comment": "Malware payload (Mirai)", "value": "9efb83d90be3fd3a1bd4bb389333b9b0684526be", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "5130e051-8a92-4158-9cfd-738485e72e83", "comment": "Malware payload (Mirai)", "value": "0db05d8ced262820887b551ca3a3138839567cf1825926d02941f4223b10340f0e10b39fae9031b55193a60d88c4f213", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "e05f6301-da82-4377-ac62-b31bba288ac3", "value": "T1BD530266850368359B137EB7BAF00FC3F54E8B3271ED547C21656068F6F896128613DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "1b063615-016b-45e2-b4de-63110d6298bf", "value": "1536:O7XduYshWhq/HIEy6Og3Nwz9hAynpLSM5Tfv83KJGTb6R4X:QdpssMPR9w4ypLXTX83K0Tb6R4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824451, "uuid": "985aa9ee-8126-41f2-a647-17500b249f1c", "value": 61848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824451, "uuid": "9037be8a-3fe6-464a-9f32-dfa8e8bfa539", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "c8f8490b-9e05-4895-b735-db174131e0c9", "value": "Space.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694c218e-591c-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779811398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811398, "uuid": "013f7377-eb6c-4bfc-b1fe-3bf492d653c6", "comment": "Malware payload (XWorm)", "value": "6834138943dac69686182b7c04de11df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811398, "uuid": "a5233f37-823b-499d-afd1-ae46739088c4", "comment": "Malware payload (XWorm)", "value": "a5ebbaa4a872d243346d6782105ac90537577d63fe490065b13c8eca8bfa91cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811398, "uuid": "0354a47d-cbfa-4ac7-bb4b-943b9d33f8b2", "comment": "Malware payload (XWorm)", "value": "e3d9c49786b3632776da305b42bdf925f1f81173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811398, "uuid": "9c52fe08-1d9e-46c7-9143-fa2320380b9f", "comment": "Malware payload (XWorm)", "value": "e1ad8aaf2c107ec8a40ab71a5ae54d6bc321da10007646527c1513bd31172bf86d7d3c972c1ec83e612562f4e3282b30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811398, "uuid": "673b4fce-bad7-4f77-93f4-605c37394fd2", "value": "T1C205E008235ADF01D4BF4BB84861E3B407765E88BD61D3838EE6BDEB783A69158543D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811398, "uuid": "4560a1ae-3026-4d94-a026-c98f5043f3ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811398, "uuid": "3e56e4bf-12cf-45c6-a960-65233c254083", "value": "12288:RfuNzH8lKbsRBiWs/HMKUOaaaj34dG661ZEcPhNjXc4YJNKL9M:d23iBiF/sK0ao4dL61W2hNLHYJkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779811398, "uuid": "e915476f-1d8d-49d4-98bc-6656af849350", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779811398, "uuid": "cf1ddf60-d809-40ad-883a-5cd533d48a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811398, "uuid": "ea5d9a9f-1b6f-45ee-9669-1de7e9c8cfa5", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18197eb5-592c-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779818134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818134, "uuid": "a5f6eaa3-93cc-4e05-b3f0-8ce05c72a42c", "comment": "Malware payload (RustyStealer)", "value": "2943100ca3c58044cb6b26950fae1c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818134, "uuid": "3c8e8ff3-5c1d-483b-8c61-1d524e2d8704", "comment": "Malware payload (RustyStealer)", "value": "a644caa3a8987c99db378b31626c803d46441ffa2f5b59ab082d127bef809774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818134, "uuid": "18193bdc-5b1e-4214-a61a-93eedf04828d", "comment": "Malware payload (RustyStealer)", "value": "6a8452524ac24759f8b267b99858ca20ac9d614c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818134, "uuid": "8d31c5c8-ed53-4000-b3e2-a5f634aad811", "comment": "Malware payload (RustyStealer)", "value": "0b29ba814283a561b6d6504588c61a2250a31c8c22c92fe9a68300bb73c552188ff33c5be47d473d112803b7d6a6890e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818134, "uuid": "e5e0cdd1-682b-4baf-b95d-7398c4a64814", "value": "T1A967F158020CE388785F4636F3D4F83FF2DC25993776E8A9BC39D1DAA412285D2B9587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818134, "uuid": "da0c0cea-4b6e-46c2-a1df-66685ab70c2b", "value": "0bc1b1e557f4a4387777840b7c7925ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818134, "uuid": "4fb10122-47eb-4385-b42c-72c43844ac14", "value": "393216:QzjNdVptojz5R4hWCs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBhz:qjNT7ojzIWCahDLBtVbD1DT9SfhMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818134, "uuid": "d1e87499-d68d-492c-a1b2-bb69bd28e261", "value": 32621056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818134, "uuid": "d12a4ee3-b0cd-444e-b389-34b4ecd9c626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818134, "uuid": "5839c62b-3d36-481d-bdf8-bddfac213f26", "value": "exterial.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d670bbf4-5899-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1779755317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755317, "uuid": "652edea7-61ce-4007-b907-ed3907246378", "comment": "Malware payload (GhostPulse)", "value": "81d77907c33da994e5ca80dfdc1115f7", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755317, "uuid": "1e66a222-e46c-48d0-b0a3-452606826914", "comment": "Malware payload (GhostPulse)", "value": "a7a9205e561af4ee6961ed357c8b2320dd035bd28e73c94847ccc58282d19504", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755317, "uuid": "d5a7e67b-1283-48a3-921e-13704e65e0c0", "comment": "Malware payload (GhostPulse)", "value": "b16fec7b72667676d2f46739f70420a1ce4e90f8", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755317, "uuid": "9170ab83-2b1d-4a68-bce5-8e0c2d3de5d1", "comment": "Malware payload (GhostPulse)", "value": "b0c81d0cd6cae794c68a3135161d8eaa206a865af0ea9ddfe6a71e0c50fa3a04cf704cedfb3f6596187fd2f2e2af13df", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755317, "uuid": "f56125ee-70ef-460c-9f2e-cd02bb78775f", "value": "T10EF63391B7882571C234D533CF9BEB66503AF21272E58E6755DA2E3E1CE3166B3078C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755317, "uuid": "2f91d7ab-ba52-4e04-bce1-31b47bb7ba96", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755317, "uuid": "6afc3816-4fc2-4b4d-acb4-4ad766886b84", "value": "393216:+pgYJQyuedPuzNL//zGb0JQg4KTARTawLnIBzx4:egaQGA/rxJR5T/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755317, "uuid": "6cf4658a-f17c-4176-a43e-ca23466ba76a", "value": 15724201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755317, "uuid": "b6169424-a0a0-47ee-a059-55598a8c591f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755317, "uuid": "9c3ed269-776e-4c4d-967e-9a72d39eee1a", "value": "JUFPRUJS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c9b6a1-5913-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779807653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807653, "uuid": "6c8a2e22-dcae-469a-9079-5d6588966f36", "comment": "Malware payload (CoinMiner)", "value": "2f8e3f152d1a8a8c1a936134bf481d0e", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807653, "uuid": "8c96a831-82a6-4889-b93c-21c1675251ec", "comment": "Malware payload (CoinMiner)", "value": "a80c26e2ddd396cefdff71ba1b3fc8700e884b95b0889b229e2cc1cee96dd8e4", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807653, "uuid": "800dc027-1a9f-4c35-8d9d-f3d5509a396a", "comment": "Malware payload (CoinMiner)", "value": "d60ee173f82b67cd537f35a119de6dcca034d994", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779807653, "uuid": "e481599d-6d5a-4d9a-a797-eb68db6c96ed", "comment": "Malware payload (CoinMiner)", "value": "c0560cda605d4d69b271c7a150e44039d31dc8c89d202cd1c45a3e54f19909630a81a4a3b6d0f5606387d9f846262ab3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807653, "uuid": "ee257444-8ecc-4206-af80-081929f6eb58", "value": "T161763317568772BDC26117B063ACA170F2B26D5FD7C98EDDA88BB9B0AC108083F3D955", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807653, "uuid": "d0d2a4b0-e1b2-4402-ab83-c7aeab98a217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807653, "uuid": "94d6b0b1-79ea-4f59-b74c-9ac96cf26444", "value": "196608:Z1v4Bb/JcgkqsR7tIole3lHWXzLlt33XCpyRqe2nkR2:Z0b/OlC3lHWXzhtypy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779807653, "uuid": "cd5b8e37-5741-4d2c-918e-fddb4291c80b", "value": 7447040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779807653, "uuid": "78b8bb8b-6560-42be-ba7a-6f6af6045388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779807653, "uuid": "cd6e74a3-4c57-41c4-8eb4-664a1b93c3c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc191c5-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763918, "uuid": "2dc9caab-07c3-4e37-86cc-856b5f75e932", "comment": "Malware payload (Gafgyt)", "value": "0860f96449ab8b39f5f9f01d8246901d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763918, "uuid": "37eea4b5-a43b-4ea7-84db-07ade8270986", "comment": "Malware payload (Gafgyt)", "value": "a81b4478f1d7d49a83d9e38dabc32b5e761a690215cf6e3019c388615c26e22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763918, "uuid": "6892b57c-400c-4883-a765-f6b47a48d40c", "comment": "Malware payload (Gafgyt)", "value": "b0337c2bddad3bf009406739cd19f47d3b24baad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763918, "uuid": "2ab2c6f1-3c43-4d1f-b471-9233a4d9632e", "comment": "Malware payload (Gafgyt)", "value": "28957de70796223c66dddc078d0d7d2056476805360d608d4921517e1e264d3d8f58ad4b31fccdcce4d9177e6af30716", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763918, "uuid": "c7b09be0-061b-4243-ad30-a1c028122270", "value": "T1E2C33917F9419F41C1D325BAFB8EA64933136FF8E3EA7102D9209F60278699B0E76941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763918, "uuid": "75f0ae50-b139-4749-966f-7cac074f0113", "value": "3072:syJ9yVznJoEsaMD56iNwaQFgei/oCkRXY5hTpZ3n:syvyVzneEsaM96iNwa8ggCkRI5hv3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763918, "uuid": "a7ba4d1e-b5dc-437b-9abd-58a32d0d3bb6", "value": 129968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763918, "uuid": "fb307f70-3340-4768-a3f1-14f9aedee2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763918, "uuid": "055ebcd9-0e12-41f5-afe3-f04b5a20e957", "value": "FBI.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82eb8fd5-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (ElyStealer)", "timestamp": 1779795120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795120, "uuid": "b3ad84fc-556e-4805-be44-4a9b0b7c4735", "comment": "Malware payload (ElyStealer)", "value": "84821a2f4f1178cb84adde13f5c1ac7a", "object_relation": "md5", "Tag": [ { "name": "ElyStealer", "colour": "#A1B19D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795120, "uuid": "09c209d2-541e-4c03-a32b-557aef53082a", "comment": "Malware payload (ElyStealer)", "value": "a980066f91318344114fbb05ce78ab3c741f71b6daf7d2722b26c36be7445351", "object_relation": "sha256", "Tag": [ { "name": "ElyStealer", "colour": "#A1B19D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795120, "uuid": "028e9921-de02-4daa-9d2f-9e19795c17ad", "comment": "Malware payload (ElyStealer)", "value": "ca4345aac0eb4dc5d62f3c0c561e83fe19bed1c6", "object_relation": "sha1", "Tag": [ { "name": "ElyStealer", "colour": "#A1B19D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795120, "uuid": "06a6e3a3-7e9f-4be4-abcb-2ff63656452c", "comment": "Malware payload (ElyStealer)", "value": "760f8680ff2f9d2ed1d0b98bbaeb34891912a44ac1cf0a5778611f5ecc2f2552da5a5ee7664a7befe583884ac62354bd", "object_relation": "sha3-384", "Tag": [ { "name": "ElyStealer", "colour": "#A1B19D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795120, "uuid": "bc6bcd47-a7ab-44e8-9186-55b0ec6226b5", "value": "T1E133A55837FC8618F2FF4F358DB15668877978972E26DA0E0AD644CC0E3378599A0B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795120, "uuid": "45cd675c-6891-4a96-8759-2b8844c296b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795120, "uuid": "3dd2680d-9e6f-45b0-9d46-61ed9a0bc082", "value": "768:vvC8LbedBJ1s7HOsMN4XBVnc2smLOBJQodzg8s65IY4nRgbcNigyGT:vvlezsmN7myBHd1+YO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795120, "uuid": "52c5ffb6-2c6a-44fc-9a95-2dc9ddeb3563", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795120, "uuid": "68497af1-3226-4c15-a2a6-ec1285086b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795120, "uuid": "e0dd41dc-40e9-4d3f-9551-bf82d20c3423", "value": "a980066f91318344114fbb05ce78ab3c741f71b6daf7d2722b26c36be7445351", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675a8f13-58ba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779769304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769304, "uuid": "64a8b0bd-d20a-4083-8f4e-b9784e4b9442", "comment": "Malware payload", "value": "a18fe03c22b6b0727a170c55d8a4a4cc", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769304, "uuid": "59ba30b2-f3bd-409e-8e7a-d17acd97d308", "comment": "Malware payload", "value": "aa0a144620467804767811f4db8a020743fd89a75d86c94342695c0d99414226", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769304, "uuid": "918db2b9-27c0-451a-b1ea-26438f7ffabc", "comment": "Malware payload", "value": "9efc3772b1622fdc38f68db4072fcba58c35b765", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779769304, "uuid": "ba8c5364-1c31-43a9-b989-6bb35fcb78a4", "comment": "Malware payload", "value": "252974347b16a5f516ecb18394a833076703ffa18f9ecf4d4772017d1abb5d6315d12e41550ac2f8e83cdac4a6e67834", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769304, "uuid": "268d4893-2bc5-4a7b-9e25-be34f79f4d2c", "value": "T1B5C7D0C92282C9DBC6880F78894BDFF4D8ADAC0B003556D75AD83D2F1E77AF84D16952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769304, "uuid": "57f1b15a-c8f6-457a-b39a-b4e59918f21f", "value": "154e283e694e5fc75c2bd54e533abe38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769304, "uuid": "71b1011b-3865-4c63-a274-3dd118f41007", "value": "1572864:vsJJs/zu0KsJJs/2u0KXwyRiT2bQEnTRS/ulKKLeCe2YET+BDVpPmy:uC/zu0PC/2u0KXwoyZ+R6ulKKaCe27Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779769304, "uuid": "960bacb3-0053-493a-8307-0b9e9aac4790", "value": 55297536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779769304, "uuid": "64e016c5-637e-44a0-94d5-e1894030d398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779769304, "uuid": "24af0b9d-6267-4e4b-a166-b1e9d01af93f", "value": "borlndmm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b537fe3f-58a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779760415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760415, "uuid": "9d931bda-8e63-4abe-b5f3-20e64815ecc0", "comment": "Malware payload (Mirai)", "value": "9f19cfe71f9f263a8a91d2225f996efc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760415, "uuid": "c64f9d0c-72ce-46a9-8ea3-02e2af93a074", "comment": "Malware payload (Mirai)", "value": "aaf0d863f775f3e5a24d7a7737b3da398ad24cd4740f87d116fe0438d0e06e1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760415, "uuid": "c616750d-4c83-451a-8502-236c3c0e364a", "comment": "Malware payload (Mirai)", "value": "200d393bb87efb23403e6ced32cf81add0a5a908", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760415, "uuid": "83b9bdfd-541c-49e6-a16f-43b461e8cff2", "comment": "Malware payload (Mirai)", "value": "b7238c446c32368557346358ada4cdc0679bc85c6ed485e21050256012f347985392f278e3c910caf04661874b91d052", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760415, "uuid": "cdb1d0b0-40c6-4733-8cf2-1641c38f9bba", "value": "T17BD0C79E2355D8C7561EC9C2B19D9409E788DBE0F5B8CE35B0B8AF7170CB1087854B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760415, "uuid": "f42b7bf8-a4cf-4de2-8fc9-afe6d8070429", "value": "6:3J3SP/bKR/6y9Kt76y96kIMBQSP/bKRGKtZrBQSP/bKRoD9KtkWAMBEMV:3J3SP/By99DTAQSP/xiVQSP/VD9BWAAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760415, "uuid": "e7f6058f-f0fd-4c29-af19-4271c9f8afcb", "value": 239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760415, "uuid": "aceaa341-9de2-4a54-9156-6593c8e45cef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760415, "uuid": "8e8ca381-53d3-4a92-8ea3-c47db2306e72", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9456632-592c-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779818377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818377, "uuid": "9b2ee40f-c428-4368-ab75-19321b3bbfec", "comment": "Malware payload (Vidar)", "value": "1fedea210c178c435c8de4dcdabe3828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818377, "uuid": "d41efcee-d797-4e1a-aca5-1edd032a3921", "comment": "Malware payload (Vidar)", "value": "ab6e6b38913247f0b3130ab45225b6d2191780e171549c5f7924e78784a589cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818377, "uuid": "0d249241-ffaa-4a04-a0ab-b09de1341f4b", "comment": "Malware payload (Vidar)", "value": "a77db66b50c6901ffbc24509b96654e6682d067c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818377, "uuid": "f161c5d0-ec2b-446f-800a-df48541664cc", "comment": "Malware payload (Vidar)", "value": "829b953de1311aca3105be37298eb375c72dab86265d62796abdf5f45f3bb96bbeb0952b21b5df05f86d2f2ef70a095e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818377, "uuid": "021d4479-5fae-4c17-aac4-92b2d38219cf", "value": "T139A5AE4BBC9054BAC4FA923548B5A2907731B85A1F3137C32F15B6BA2E37BD04E35768", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818377, "uuid": "3c81af2e-9925-4961-9eda-c3c41d178528", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818377, "uuid": "12adbf3d-69e2-4d50-9935-cb17e96d39c8", "value": "49152:R3H36MY1cfnyXpFEEO1l1AVggLPYuD1+J:l3icfyXpFXLVrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818377, "uuid": "b8b68e4f-7f40-4d6e-959a-5074d5037569", "value": 2222720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818377, "uuid": "43d72ee1-9cdd-4954-82be-f01a3e71387e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818377, "uuid": "8a5ad6da-30af-4b92-a8ae-40156d2a0665", "value": "bytearmor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf682a0-595c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779839051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839051, "uuid": "127469fa-bbb5-4ce8-8542-3257b54ce511", "comment": "Malware payload", "value": "ffdf3d5535d2130028808599fb133dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839051, "uuid": "99db844b-3e6e-4f06-aab8-e6d88c67bb5f", "comment": "Malware payload", "value": "ab9f6e17e46f95364f6704db5003993cbd384a5fd61f99ef9a0f10113dce6ab9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839051, "uuid": "5780cb02-e8d1-4f15-b240-68784049e8ee", "comment": "Malware payload", "value": "71c1278b39f3852bcb7e8d1a5688bc65df2fcf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839051, "uuid": "82fa4193-28bf-4acf-869d-0f7ebe2fd474", "comment": "Malware payload", "value": "0304889b78da0e996f8a6b8be32926d94ecce78b7380a6663d0e70c4d6cc2b09a68705724d79343530c4b0736e21ffc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839051, "uuid": "76d3bbdf-17b5-4f5f-bc52-34729b76f3a4", "value": "T16D76AE52FCDB64B1EA62063309A692EF3331BD0A0F759BC3D9447B7AAC375D00D62295", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839051, "uuid": "ad8a7eb0-f80e-4435-a732-a1cf0bce2994", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839051, "uuid": "f617a25d-a064-4b83-8cc7-4fda87a2f0ba", "value": "24576:5RVAFYv+vQq3KGCc6sktMAFuT7y+/IWo98IvzrcLcXLUMDVFVO2hm5XschcSMIRP:VAHmti0cg3LQe1ctMIieoQeYdYD1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839051, "uuid": "b0a5a034-8fb1-4efb-a988-9afa09cefd13", "value": 7584896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839051, "uuid": "fd64b51c-2fe6-4e1d-85e0-b609d6792ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839051, "uuid": "6bacfe1c-5fd3-4047-92aa-446e7ea7ab72", "value": "SecuriteInfo.com.Win32.Evo-gen.46711198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a97c9bd-58df-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1779785067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785067, "uuid": "efa496b6-f435-4962-90a3-7a9c01c988fd", "comment": "Malware payload (Gh0stRAT)", "value": "88146c7406fa9e87cf42e76c9528052b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785067, "uuid": "dd281767-f785-4677-b170-06042f743d32", "comment": "Malware payload (Gh0stRAT)", "value": "aba9585e07ed0313fecc0678db78ece271e63c773f9d3695f36f36d565ba3b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785067, "uuid": "40313a83-1f33-4069-a366-67d9410cfb0c", "comment": "Malware payload (Gh0stRAT)", "value": "0d4e7ad463c1e8b449c8737d1532664e7c36251a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785067, "uuid": "2383837d-6874-45b3-ba78-c7f862323afd", "comment": "Malware payload (Gh0stRAT)", "value": "b580b26321e55abe14be531550c230abd16760c79cc79517f6705606800d498b5a92b43550b3f2ea8fa6f2f36de2cf5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785067, "uuid": "3321a581-cd00-46fa-bb37-cfd60d680734", "value": "T1361833A3B18B663FF07F483649A6E151193B7A6161234C2B83E418FDDD164CCAC3FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785067, "uuid": "9eb8cea0-1249-4873-9305-e8b0f2708ca5", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785067, "uuid": "187dcee4-f12b-4fa8-8744-e5ddd2991c29", "value": "1572864:4iL2cH3FzCtoTBVjVKu4jbmGIbdr1okBYiJWRlMCF561eEvyAp8Md9t40JkwP:fLXXFzCtMjVKjXIb3dWRll5619qAp8ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779785067, "uuid": "a12b0721-1530-4221-8ca8-8760fc5f7098", "value": 90614826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779785067, "uuid": "c4e9cbdb-b651-42f8-bf0c-a5c37e28c482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785067, "uuid": "1cf7881b-1b6f-4ced-9dd2-51714cb35550", "value": "Hfox_win_x64.15.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2361049d-595b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779838339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779838339, "uuid": "d4350efa-3f8d-4a31-9d91-3d7ff44d07e5", "comment": "Malware payload", "value": "4b025aa78f4dd86cc720a37144de0be0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779838339, "uuid": "ae881f47-8116-45e8-8207-107c84ae507a", "comment": "Malware payload", "value": "abf62033c4b913bf8368de607fdc4dd2677f9441541db3c2a9375dd9130ff9bb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779838339, "uuid": "8d9571f3-3be2-48db-8c42-65db644a00c8", "comment": "Malware payload", "value": "581a2ab8997f6fd8484250d1b97e189241b66972", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779838339, "uuid": "a62734ab-74b3-4cad-ac7d-3374fc907406", "comment": "Malware payload", "value": "caa825893149fba35f6fb0e027c844921ed41bc0d4a5ce73eb93da26364c2cf1ee872733c98f77c39aa8715771e2e5dc", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "FakeChrome", "colour": "#A5868B", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "Overlay", "colour": "#F9DA28", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779838339, "uuid": "b1a4f1ee-0796-413a-aeee-23fbe63bd89a", "value": "T1C63701F832C60038E2B4B2B798F69D9767541E1CA387C0C93FF2711A29D6D792562877", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779838339, "uuid": "667f4123-60bc-4f40-8fd9-d47aa7fe6db0", "value": "393216:wr6iHeI2cF9iu4+pxMckb5TIT/UG3REMjENKBk4uFsFKc:i6CF9tzMckJ8sGhjjENKSpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779838339, "uuid": "44d830f9-1ce6-4771-9bb2-36e5e3a87ded", "value": 24126077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779838339, "uuid": "d512bc1a-3650-47f8-8d52-48665ec5787b", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779838339, "uuid": "151caf3b-7847-4363-a01f-5d82922684b1", "value": "nouveau_chrome_v1.7.684.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee4ee4d-589e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779757237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757237, "uuid": "f6d92ec3-fe94-41f9-a928-b34d0e827957", "comment": "Malware payload", "value": "36412d96cb5efb5ebe1bac8c20be03b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757237, "uuid": "e83ec57f-d0a4-444d-8515-38d6db9e2897", "comment": "Malware payload", "value": "ac1cc326d8ffcaaf08a9fd45acca0446e6dcd12dbc7cb46ec3a97d86eadd77cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757237, "uuid": "4d2d116d-69f3-4c11-90ea-3962931d4124", "comment": "Malware payload", "value": "c9c979c8356d1ba9e72b86a4fac7682af040e260", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757237, "uuid": "ff87e619-d649-4fe0-83ba-94305ea64a2d", "comment": "Malware payload", "value": "772eb61df70d9f753117a4473759f98fe5fa0f85117ea35e8e241cfe2ba5778f46f7d2209a64352d000d17898f2381c3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757237, "uuid": "268fc238-457d-45a1-ade7-2b16c39c262e", "value": "T1B8137D6526953C25AE9988375D7F2F0CBDA983E1300491DDBFCA3CF18C15A9CE718758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757237, "uuid": "126a4470-ff94-42e8-8929-48a0661b7145", "value": "768:9r9NyXsZztCu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:FHusZGcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779757237, "uuid": "bcb7ec4e-94cd-4eeb-973f-fa142faa2aff", "value": 45510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779757237, "uuid": "d6af89e5-1ec4-47f3-b401-4bf384c37da1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757237, "uuid": "3eb84452-46ba-4cc0-ab27-2fb58344c63e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4960f409-5933-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779821223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821223, "uuid": "4aa1a39c-ca50-4342-91db-327da94c67ab", "comment": "Malware payload (RustyStealer)", "value": "ceeca74c68d29c8ad4ddc849d516b454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821223, "uuid": "51e78de2-e6b4-4394-9dda-e532f1a8bc7c", "comment": "Malware payload (RustyStealer)", "value": "ad7ec08e3118c2221291247df65a86dbb5929bb6092b57fbab3dc8b07c9157fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821223, "uuid": "8f6966c0-76df-4d2c-a9ce-39bfb8225198", "comment": "Malware payload (RustyStealer)", "value": "4c72d20877203c7a44da2d663dab36a87d13f2b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821223, "uuid": "2954b61a-7a2c-4753-9649-0a9720099e9d", "comment": "Malware payload (RustyStealer)", "value": "1029c20e6b5decb0cd2df1db16d03e3db9de2f45cc9c8d2f882e5f4612f26357b1f5f9cb66cb69c4f216f5ffb5278cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821223, "uuid": "3598a328-8aa5-43c6-bfbe-17b79701ec53", "value": "T18B864A43F6A280ECC06AC079935AA632FB72784D072576EB47D087313E66FD06A3DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821223, "uuid": "fb51b0ea-6834-48ae-9e2c-013760820799", "value": "3442475535227cc257183bcb13fc2b30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821223, "uuid": "0ef4394a-d75f-44ea-9fe0-d8f84d21fe2b", "value": "98304:8/CZfEJEkuxbNqbptBzBUBAqLC3QYDCru3VbCelNrmtIul+Jn+dP:WEku+XpnYenyWcqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779821223, "uuid": "97ee0a63-65af-4c7c-b908-dbaa68afa123", "value": 8567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779821223, "uuid": "bebb5eae-845f-47b7-ad5f-32983c4c9531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821223, "uuid": "02537480-713d-4b46-8cf4-f751ace336d8", "value": "dllhost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d84b05-58ff-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779799041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799041, "uuid": "8bf7ff59-5690-4039-8ab5-871680e4fbaf", "comment": "Malware payload (AsyncRAT)", "value": "916be459a3ab6a0d599a3ae26334be2e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799041, "uuid": "aa635d27-457c-4f79-80f1-ae2a4fbcbed0", "comment": "Malware payload (AsyncRAT)", "value": "ada3a2598dc763b860c98236f6ff09f8be2890da1c5fb53539a6d19b065d9620", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799041, "uuid": "10994562-b4f7-4521-ac4b-6f0e6cf1091b", "comment": "Malware payload (AsyncRAT)", "value": "e6412aa7e7a8571ae397c8680f27832b0e02e00e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799041, "uuid": "9d1d9ad3-00a5-4c7c-b7a4-85afc48c8477", "comment": "Malware payload (AsyncRAT)", "value": "a2d858128d5ced0df80ce90340fe572d3e37c27557bb62935507a61625a72e1e853991676ddde2e8f362916537439e99", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799041, "uuid": "75016e91-82b1-4074-bcb6-18c8799b2ac4", "value": "T1C6232B0037E9812AF2BE8F74ACF26105867BF6677603D64D2CC451975B13FC29A426FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799041, "uuid": "3978a4e7-6f88-49ef-930c-a353fac50aee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799041, "uuid": "4512d553-1521-43d5-9d6b-84421d9bca93", "value": "768:PuqhJTP0GkEWUm9Raymo2q16Z0xWrDkqG4cWPI/yYQ0bt+6Hdj94lzJONBDZtx:PuqhJTPNY72/YRf/y2bt+ud8Jwdtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779799041, "uuid": "94de3fb1-7bca-4225-bc2a-f321474d5b5a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779799041, "uuid": "1128d507-c718-4abe-8d4a-719494f44e8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799041, "uuid": "2f785bf5-9ccc-4e97-a874-62d0ba546e48", "value": "meridablancainc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5fdd5a-5907-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779802434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802434, "uuid": "365b15c6-dd08-4be5-b750-932158109d9f", "comment": "Malware payload (Mirai)", "value": "6c6f34c2f0d826b11030b65ab247ca77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802434, "uuid": "619bb883-9b86-478e-8e6c-ee1091048060", "comment": "Malware payload (Mirai)", "value": "b0052e67e2105141269dfd9cf5ec8efcd47df65e44a220634dcc3ff09a0aded3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802434, "uuid": "8e677545-a6a4-44f6-a84b-4368ce3d1cde", "comment": "Malware payload (Mirai)", "value": "4b3b7ad1eb86b90f1e45622e56d47cffc27dfcfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802434, "uuid": "7a682273-2018-476b-96c1-5ac568c8972d", "comment": "Malware payload (Mirai)", "value": "3cc2e4a77ab26e139f6dcdb4abe0dd7e307e3f7225155bad958fc2270bbd6ca046cc12094916ce8e5f470f6c1ec694fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802434, "uuid": "a79defcb-98f6-455c-a4f6-6935c3b2aa9a", "value": "T17F736CC1AA43D4F0EC6256B4013BA7129F7AE136863DEB52D7A53A339C13B505E1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802434, "uuid": "5a81d305-e61a-4ec1-93a8-52f3c7ca48be", "value": "1536:KuS3eerjUVE4X/furyL6j5YqmRlNrpdDujmyCrOOsSu:Ku+prQ2ryL61+RdDwmpqOTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779802434, "uuid": "5755d4b0-d2cd-44e7-b13a-da3d1c560fde", "value": 74896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779802434, "uuid": "99f4d0e8-b2af-4eb3-82c3-19ea4a484003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802434, "uuid": "ef786499-6a59-417d-9488-3b09da68b840", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112cbf53-5906-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779801801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801801, "uuid": "f76ef7ed-900e-494b-88d3-6dc463bbbc40", "comment": "Malware payload (RemusStealer)", "value": "9e9dee5b3c5c350699335e004361b0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801801, "uuid": "c622cd16-4d04-46c7-b78e-9577c79bdb9f", "comment": "Malware payload (RemusStealer)", "value": "b07675273cf972fa942b988a087cf85e52eb6f4451248e49dd6827c96ac83454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801801, "uuid": "41409715-12b4-41fe-a913-fa6e4eacb772", "comment": "Malware payload (RemusStealer)", "value": "f60c80148214ce14148df68866bbaece7634185b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801801, "uuid": "336a9cf4-e9fb-4514-929d-1928a2ac8521", "comment": "Malware payload (RemusStealer)", "value": "e328147074bed4e829eb07740ee9224c5d06b279218671b98ead815f171bf52128e9ee512888264b121dfa36542918bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801801, "uuid": "d06d35af-eebb-4906-a639-a22bffe204f1", "value": "T1AAC559477C8054BAD9BA923288B6A2D17731F8590F3127C33F55B6BA2E376D40E39358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801801, "uuid": "51fe1569-bdb3-4cc7-a4e2-35989abae0bc", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801801, "uuid": "c3c99530-7a90-4fce-8858-e33843c3bff3", "value": "24576:MI0Sn3IXFHCNHizZpdwjQ6OgLP88W3moAFcyD1K:N083IXNCNHqxHgLPwyD1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801801, "uuid": "44973133-4db2-4555-ad68-35fc95eeda81", "value": 2590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801801, "uuid": "9d3578e0-cb9f-466f-916d-453f9a4770d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801801, "uuid": "820d8f77-a378-48e7-90a8-6701084b1037", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33a06c4-595c-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779839064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839064, "uuid": "2acf05a7-aaef-4abd-82a4-d1cfbd20d190", "comment": "Malware payload (ACRStealer)", "value": "71ae3306526b70603f9b6800c9e05261", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839064, "uuid": "eb642744-e7d5-4396-b780-8ba1940fee9e", "comment": "Malware payload (ACRStealer)", "value": "b0bc17dda19e36d395e354f6a861e93a70780029bb35116ea3616e316c588710", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839064, "uuid": "abb6c0fa-804d-4f2a-82d5-11efdaf75379", "comment": "Malware payload (ACRStealer)", "value": "c87e5cb221a82e9771a4f53f373daa2656706959", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779839064, "uuid": "7735cdc0-9fd9-4ec6-b342-c261a58b4bec", "comment": "Malware payload (ACRStealer)", "value": "79b5d13a369f67c39e2bbce11464b4fde0234b5ead32b47f66533ba66d9d614f886695974618d7ca8f3f04f99f574c91", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839064, "uuid": "6c080e13-d2e0-49a0-8a19-166a2dcfddc9", "value": "T19776AE81FCDB54B1E652563208A2A3FF2335B9090B31DFCBD9547B7AAC735E10923266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839064, "uuid": "0a024ab7-1209-4048-a459-9dd7d2ff9b80", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839064, "uuid": "246de183-ec3f-4e33-ac71-05bb7dadd597", "value": "49152:h/tF00KW1nNX6Mo/f9PABcJJ4DUD2GU4mhYmYD14:h/7TKWBAMon2cb4DUDvUHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779839064, "uuid": "80f81d26-8cde-4483-8fc7-f49d6c8e4958", "value": 7655552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779839064, "uuid": "9a6932d7-105a-435e-aa51-d43dc47d7818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779839064, "uuid": "3c6d0f60-0ea0-4ebd-b0d6-d6091a71a5ba", "value": "SecuriteInfo.com.Win32.Evo-gen.53286139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e533c0-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779777011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777011, "uuid": "b5598f2e-b270-44d6-bdc7-79d9a6e449e4", "comment": "Malware payload (NanoCore)", "value": "8ac5ea0bd8e9019fbd318db47822c622", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777011, "uuid": "006ed548-23a3-451c-a984-bf260023f369", "comment": "Malware payload (NanoCore)", "value": "b168936cef0efd92d0e49637ecfcc33f6377a251f28ef1c5b70e675e6a708b93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777011, "uuid": "0eae7586-53b1-4019-908d-81430fe5574e", "comment": "Malware payload (NanoCore)", "value": "40b3c4b4bcac507af5b23db95cbfe16dbd1ae9a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779777011, "uuid": "df84933f-e50b-4f30-b7c8-bc527277e599", "comment": "Malware payload (NanoCore)", "value": "71e2eab1bd60ef3da0b3fe9c29ff569fdbf6d53356e824828ed1747e6a4f899f4eadccc104d120ddc8897b57740fd3dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777011, "uuid": "321b7ef6-0ed4-4980-8868-19074e1dc91a", "value": "T18714CF6A37A88A3FD2DE8679611202538379C2E799C3F3DA28D455B74B227E10B171D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777011, "uuid": "c3f49c82-3414-448e-8aba-1e4d210d11f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777011, "uuid": "a76beeeb-4024-44fc-b62f-3e078ff97c48", "value": "6144:MLV6Bta6dtJmakIM5ENLiVdjyTMyIdWuXI:MLV6BtpmkxkjyIfMuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779777011, "uuid": "4c4475bc-187d-4165-9ab7-ee9b326a3ab9", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779777011, "uuid": "f8b027c0-1002-4565-99da-73e618c24163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779777011, "uuid": "7d43ba1b-d194-49bd-b44a-baa594acad30", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d559c87b-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779763905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763905, "uuid": "e1b8aeba-aa45-4c22-9fa8-12360454929c", "comment": "Malware payload (Mirai)", "value": "2e6a4e7cfda490533b289b95d594bbc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763905, "uuid": "e978dbba-e6d3-4299-83ec-c2f0c7292e73", "comment": "Malware payload (Mirai)", "value": "b188505a034e2706dee63fb0d3438f7f06cdb54e4bdf65fbf200fea4dd1ce313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763905, "uuid": "85c10424-958c-4c1a-999e-af97537e828e", "comment": "Malware payload (Mirai)", "value": "d4287874c6cb6cc3b4765982c44df0c2400233c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763905, "uuid": "65c2e0b1-da20-4ac2-b1b4-6739d0966848", "comment": "Malware payload (Mirai)", "value": "2a2f214e43ca372af77e996c2a78125cf4ebffef74b7656cae00ff30d16b96e8cc14179798c8b28b345a9af41ea6c224", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763905, "uuid": "c9ab38e6-1393-4886-94b8-4ccda14b22cd", "value": "T18D933BDAFA42CEB3D06310F116FA6B218971F9FB1C22D682D7647DB09D111C19A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763905, "uuid": "ffa708c0-ddab-4211-9e1c-8cecd9c4b53f", "value": "1536:OD6HhBPQBM6KXMar9wEeHo7mUvsEyabYB5bqNd2xOyQJ33+ZPEg:mmesMar9eo7MEY/qbVJ3uZPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763905, "uuid": "04e2131a-9d8c-4da8-b878-440fa83a6bae", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763905, "uuid": "5b96a92d-4683-4a2e-a3a5-821253458f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763905, "uuid": "fcd22b49-45b2-48b4-b7a7-1bc095e3951d", "value": "FBI.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc4ab2dc-5944-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779828744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828744, "uuid": "f6263581-363c-4a13-95ef-0a372e0add68", "comment": "Malware payload", "value": "23177b69b8c70651f53480ecdd06fd24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828744, "uuid": "9abe6070-362b-4c3e-bda4-6ab237f0bb27", "comment": "Malware payload", "value": "b2f6c3cae05d4b7f071719425c38bd4a8a817acc65882863eb9a683235318816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828744, "uuid": "03037b9d-f36e-4a03-a90f-f0c95aab81f7", "comment": "Malware payload", "value": "5ba00a77686b2ebef6d55422a7eba59b3fd9abd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779828744, "uuid": "10a81585-fa07-480e-b8c0-866be53938d5", "comment": "Malware payload", "value": "d73fc4562dbb06a829ce02ac7863d7192c5abbb7943b6f32e024e81b99abb3e79c391d8e5abe5fe64ce36fce8823fcc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828744, "uuid": "6fd3aa8e-91e8-42f8-9d5a-e9254ea82163", "value": "T1A0083304E47D8126E52E1DFC47019BE0908DEE0D3CF7399D79F6172278632A698B2E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828744, "uuid": "cfd9b9eb-3445-4926-91ec-5ba587faf119", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828744, "uuid": "c449fca9-e402-4140-9b5d-a2910055bc98", "value": "1572864:it9IKPj7pUg/WJcyBXKssIqXFxRZXrDagzdhNgkzJKjI73ScFj7:iUKyge2KKssIOx/agJhNgktKU7CEj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779828744, "uuid": "cf124eeb-ce82-46ef-b0ee-e1fcceb192a4", "value": 77577170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779828744, "uuid": "c18b2a46-62b1-4805-9526-6f806f666d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779828744, "uuid": "1b49a755-0b55-4c6a-b4ab-99d640b04619", "value": "Sakura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513fdf04-58f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779796325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796325, "uuid": "e37dcf90-896e-4064-a108-076792da6eb7", "comment": "Malware payload (Formbook)", "value": "29a6883b1c9b7894dc0f0d606151b95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796325, "uuid": "3a90bfa3-7aeb-441c-b3af-f1b09a421b82", "comment": "Malware payload (Formbook)", "value": "b3c9df5682e0b9c75fc30d6d02d0b52cc1b12b39532f7a9a4dcc23157a1ae51e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796325, "uuid": "07f9f1d2-95d9-429e-aa7f-059ee54f56ba", "comment": "Malware payload (Formbook)", "value": "c7545e9ee0eafc0f658ea6304902c8164ccffbfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796325, "uuid": "fa87cd63-23a8-4375-af74-b0679d617990", "comment": "Malware payload (Formbook)", "value": "f9e2e53c3d93542ec0c8797955546bf805032f946360f0c0892baab0027af5c90ac377343c56b5e44409e73e1a18f025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796325, "uuid": "519264b2-35ad-4470-8513-7e5669b1e521", "value": "T1C9541209C7527527EED4D1B4DAD7E773E68CFA71260F4D6FA963090EA39BAC07804602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796325, "uuid": "42282f96-887b-48f1-bb00-38b85753e455", "value": "6144:n68dBAt0UYp4Yp8RnZzYHQInmTWYmTdBx4i3pxbKYtQnKxezUt9zk:nbBADYp4YpuWHxmTlmTTx4i3pxbKoQnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779796325, "uuid": "82c7931d-6d7f-4bfe-b966-1ff8b58df0b6", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779796325, "uuid": "d07a6b19-fed4-4154-aee4-f0ea3c88b03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796325, "uuid": "90a817de-eeef-48e9-b7e9-ee49ef55e96d", "value": "b3c9df5682e0b9c75fc30d6d02d0b52cc1b12b39532f7a9a4dcc23157a1ae51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eaa3f37-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779776484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776484, "uuid": "377ec3e0-3bd7-46fb-a472-c11f3042b480", "comment": "Malware payload", "value": "45069dd4b55b566c157c8962734ddeb5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776484, "uuid": "84fad178-0cde-412b-a478-0cc6b0b728a1", "comment": "Malware payload", "value": "b4d94ab199ea01639f6a350941d54d3b03b962dc1cd6a9f2a66239014365988a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776484, "uuid": "45419679-b1be-4b9f-b50c-7961a0c95881", "comment": "Malware payload", "value": "f358f9a13d6c3a79d4c952628a455818c4dd91e3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776484, "uuid": "e182c0ab-f001-4ee5-89ee-f47afb63e4cb", "comment": "Malware payload", "value": "211998693079e439e3c53a3f6a32cfe2ce60d48adca3b98b197c421c9cb6227c07eb3bd752a1d798edaeb966cc4648ad", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776484, "uuid": "632da5af-bc8d-4ff8-a51f-1328c686ba44", "value": "T18EC08C62AE28D0B0048006C384FADC0EC66A00092A00E208C982C8CE20CA2292D4A081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776484, "uuid": "f2e5cd99-445e-44fc-95b5-c122a4da8d5c", "value": "3:YYGRXkZ6Pcw+KLJM0NmopvF4/x7D/ecOGAyYdss:5WAKLJJfuJ7yjGApt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776484, "uuid": "2f9e5cfb-4516-4a02-9019-10cd7a619954", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776484, "uuid": "98140d21-d3bd-4e90-9c39-6001c20fb2cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776484, "uuid": "334a9ae4-0176-4a6d-8a82-80d53fdd283f", "value": "YVRZFW98.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9785d5-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779776859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776859, "uuid": "39d4379d-0e92-4051-b07d-35216a21aecf", "comment": "Malware payload (LummaStealer)", "value": "1d4a33f8fc6e55ccc1ff7e305ddffc8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776859, "uuid": "3e2f75ea-296d-4635-b32d-e22ade63a6c1", "comment": "Malware payload (LummaStealer)", "value": "b501ba0d14d6513412a1b98344c4f316cc50ac0b319226a624c48524b7a01a90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776859, "uuid": "6e21cb66-84ab-42da-9d2e-7c6c971c30fc", "comment": "Malware payload (LummaStealer)", "value": "f299120ce540d5caf1580aa9cc60951b5e295d54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776859, "uuid": "434887be-dbce-4112-9a3b-7ab2e80946e8", "comment": "Malware payload (LummaStealer)", "value": "a7468ac725d442d0d88e41ee365d310f8599f700b2ad3c137049d49403fd6a3cc38d5c508e04e1b731c1cebe42f5e6b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776859, "uuid": "67cd67ba-25cb-4e70-9ca1-f850f699b2f8", "value": "T170B57C10ECC784BAE0025732D9EB52FF6735AC058B325BA7EA447F79B9772D50826309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776859, "uuid": "b88f8893-f842-4b53-bbcb-eb3a3f742bf2", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776859, "uuid": "10fba0b1-32ca-419c-b767-3f220c5f59d9", "value": "49152:ifbFiD2n552Mc5z6QIi/eDMEXbsGR9rmH5:ypiD2n557y2Bi//bGvmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776859, "uuid": "7fa88151-b056-4966-9a1b-3a0823c753a0", "value": 2471048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776859, "uuid": "acdedd5e-bb3c-4530-95c8-934acec11ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776859, "uuid": "594445d2-7920-49ac-aeaf-b92a4bc164f5", "value": "SecuriteInfo.com.Win32.Evo-gen.53842166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b04d83-593a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779824498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824498, "uuid": "d23cbca3-173b-4edd-be0c-325f0a9f95c5", "comment": "Malware payload", "value": "cc90534e7449cc1a121399c602547409", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824498, "uuid": "1b6a8136-518c-4cf6-aea5-27540c4ecb0e", "comment": "Malware payload", "value": "b54c9c427aee2953df878bb3f664ec3f8cdc6e6ea6abd6611866582b3c2ac243", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824498, "uuid": "8477ec5c-c90c-4a86-82b9-9e015f15b060", "comment": "Malware payload", "value": "4883c8b89d9548b5e380bf013b37ce18b4dd7eca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824498, "uuid": "c488177e-284c-40d5-8ec4-2538cb1874d7", "comment": "Malware payload", "value": "95ea149470dbb4be954b2b826faf3f62941837c45678f5fb0752baf5b94be5183acf6b4383b452f33c9f56dd8111927f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824498, "uuid": "d6e465a3-882c-46a6-8215-859a33af7280", "value": "T153C33882FB43CFF3E44300F152B65B364B30FD2A4836DA95D7697EA5CA539D1A206368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824498, "uuid": "3c66634c-aabc-40eb-8f54-bef8d4cebf59", "value": "1536:bmuvNJz1Z0snUOQUSERm8e6fWuBcjpdUFT08qxc5IRP+hzBNL9Z:b/1OqQLERZguujpdUFT0P+hb9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824498, "uuid": "dcc155c0-ed18-45b6-ab0a-e601fd9d4bbb", "value": 126472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824498, "uuid": "c2b64d02-a7ca-437e-befe-d88ebc22ae98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824498, "uuid": "a90f0e54-1b1a-45eb-8e64-f1d80e7ecf96", "value": "wife.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacbb2e2-5896-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779754009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754009, "uuid": "55eed2eb-73d0-4a0a-8ee6-114dd39b61cc", "comment": "Malware payload (Mirai)", "value": "f254d95391d2523892663868d400453b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754009, "uuid": "2bf7bbeb-ffe8-4def-a6f8-3acc2719c1f0", "comment": "Malware payload (Mirai)", "value": "b5fa1d756bf90514b753bacc59f293143258aaad6e9ef6efb8b5b5231e826ae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754009, "uuid": "ea18d154-04d8-4c48-8657-be2e10ef0048", "comment": "Malware payload (Mirai)", "value": "3ef84642e2713aeb41192a31f543c9f2dfbe2729", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754009, "uuid": "2e6efc3e-68b3-43be-9aff-baa61ed84ead", "comment": "Malware payload (Mirai)", "value": "f16db82c2613916576caa87da7879c9cddf8db58ded5cf2dfd25d7d90bd6774485282b2e1a8ce62ca14b773565127fde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754009, "uuid": "f8f64b34-5d60-4b1a-9231-cebbeb24a495", "value": "T17303F160643708B5C796B576638D04B5AF5B9D0337DAE0480CCD5D33A0B326DB368BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754009, "uuid": "d7e4f58a-2911-4bab-a6a4-366b5a7fede5", "value": "768:BEgrNnu3ns2KLhQWiVirnN9dZlQoDvJdAru:6grUhKLh3iuLZl3AK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754009, "uuid": "b2ddc1a1-3af1-4bc4-b9fc-55076405fbc6", "value": 38872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754009, "uuid": "f16d7b6b-a8b3-4b25-b7f1-a800ff1f8258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754009, "uuid": "4bd88063-bede-4fac-ac92-58b07d538464", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2403009f-5929-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779816865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816865, "uuid": "21b177e7-8da8-4b0d-9650-ead05d29dfa8", "comment": "Malware payload", "value": "eac51203ff87260fa904e5c33853237c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816865, "uuid": "df271093-0409-43fe-adae-0073d8d49a72", "comment": "Malware payload", "value": "b776849398a144c97f6b903d2376f06c8fe06564e64412048410737e45f133e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816865, "uuid": "51287682-a163-490f-a7fe-ae413d9de458", "comment": "Malware payload", "value": "d0565b9ca7b1cbf37c91dda08d584bcfb5b44dcc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779816865, "uuid": "f7ee1023-1cb1-4a49-861a-f8aa2625448f", "comment": "Malware payload", "value": "f35430623bc309236dc832400ee6e2fe42d73664d4313c3c3f26475d1f7e59e136d072233cf9fa569912a2f77988177f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816865, "uuid": "45e9bf83-b1d4-4f2c-8709-c7ebc939185d", "value": "T1475733A194EB8BCBE43BC4349AB4B1FB22787D509783442B366577D01AFB7B031B9416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816865, "uuid": "9acdceaa-a15b-4663-9d3c-292f74255e69", "value": "786432:c0cXjvIuFLSDwc7z/GGyNvxDHD94F2E9v6QaqhW0dZf4zNV:c78uFLcwcv+GEJp4/1RhWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779816865, "uuid": "e283c14f-e3bf-45ee-8a81-f9979598fcd8", "value": 28995584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779816865, "uuid": "e6d17054-41e4-4e1d-8790-b93704830f79", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779816865, "uuid": "a2ad0a6e-63a7-4792-a004-8488210f8251", "value": "Bebra.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2918a7-592d-11f1-a769-42010a9c0008", "comment": "Malware payload (Babadeda)", "timestamp": 1779818599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "1d6e52e1-1a20-44dc-b6fe-801e5f47a729", "comment": "Malware payload (Babadeda)", "value": "04589553352c32e2cfbac99b139b31cc", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "9757a0ea-9abc-40cb-9552-bc749124c97e", "comment": "Malware payload (Babadeda)", "value": "b7bca4411c9d5f491093fe7fd56a2fe4cfeee811a7514b5bcc4b4f71989b7562", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "6ce6997b-cc5a-45a0-942d-4bbf28006701", "comment": "Malware payload (Babadeda)", "value": "b3bec0072f34b4aa591da853eaeb0b9658e3d968", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818599, "uuid": "574eb5ce-865f-415d-9da2-7584610cde9b", "comment": "Malware payload (Babadeda)", "value": "50eb9f911e27b75eb1df63d7f911274bb60803fafbea34c1b693654f1d859ecfe0ceee85b827c71e8508003d75e187c9", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "1613c2cd-fa63-4c23-b812-d02f5fb53525", "value": "T1C9373395B1881279E2F52A7522893AFE08491B13579E7BCB53136CC351D2EA7C83C6FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "fe183ced-026f-47a5-97c5-a9a8782dce25", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "3f1935fe-5c99-4cb6-aaec-27c7b3c4bd54", "value": "393216:Z00m1cbeJD6/EwT5pD7OivIxZ/5kSOdjkRQoBp5c52mcbKYNk:+7mbeJD6h1p/lAxR5Sdcjc8mcKYNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818599, "uuid": "9e52d955-b2bf-49e9-a886-48b0fe64f3d8", "value": 22760960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818599, "uuid": "45678dd3-140a-4e6b-b9e4-6db8f79f1caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818599, "uuid": "e4ae6b68-c476-4de7-b97b-d69da920ba8a", "value": "Fuxhack V3.1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898f2411-5907-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779802433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802433, "uuid": "675337a0-1c36-42ee-abfc-b5ad3ff73fc3", "comment": "Malware payload (Mirai)", "value": "2f41b92e59af6ac1c6ec025e34891c4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802433, "uuid": "cb977a31-1a12-4948-99c4-d15e47da2696", "comment": "Malware payload (Mirai)", "value": "b8efa6c815c8e10d68b92d571a5a7eecdd74accd9525c22f05a1f71ff8bbc039", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802433, "uuid": "a7f54bfe-2554-4fa1-a834-0bb57a1e0cf9", "comment": "Malware payload (Mirai)", "value": "0635fb63a7703d291fa5faf2e097f0b1feb68bb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802433, "uuid": "52b7b595-2cce-4966-8edd-56f4b7229ee2", "comment": "Malware payload (Mirai)", "value": "f56daf941baa4ed5bd36535fed0bd3690949e4e0f1630fc9f4331745b2f4c8008c259c0f3c4b05a1da35cb3c0686425d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802433, "uuid": "3cd9c4d8-66c1-4a5f-ba1c-dee6269f67db", "value": "T10953021DEA8E01C1DA8B167D8C8DBE26764EF77C67F08E215EE8113150277291573B1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802433, "uuid": "15caa8c0-e532-4d87-a49b-910739dcdfa8", "value": "1536:wx+GXudpe+d8iIHja3yiLc7/BTL4nouy8B8c:wxkdp5d8iejYyiLkBTLwoutB8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779802433, "uuid": "969eb5bf-701a-4e90-ab07-60adf00822d0", "value": 60956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779802433, "uuid": "9270fc83-4237-48b0-b777-18be53c9fb28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802433, "uuid": "9672eabb-39ca-46f3-81dc-ddc772da4718", "value": "wife.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad37fce0-58c0-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkComet)", "timestamp": 1779771998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771998, "uuid": "db3dd501-9b23-4fdf-998b-ff6c5b891edb", "comment": "Malware payload (DarkComet)", "value": "ef5fb48c0f5d26272002fb779dec0c47", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771998, "uuid": "5b3f9e0d-89de-4966-b4ab-6480c74318b2", "comment": "Malware payload (DarkComet)", "value": "b9b052dfb2f19bf15aaba81f07861234f91a72a5c38d83c176a7a4dcdbb2e8c1", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771998, "uuid": "6b8e0e0f-e6eb-4dbf-b855-873d8f877a70", "comment": "Malware payload (DarkComet)", "value": "9aa83c470353c448750b5cee34a1a7034a76d3c4", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779771998, "uuid": "2b1ee4de-a169-4f69-8c9d-b8c71ef6699a", "comment": "Malware payload (DarkComet)", "value": "276b426f598d9512792f6db13033a844264ce876cd9ca4b726254b5eab57ef7a71176c0356395e1ed56abd1da547eef8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771998, "uuid": "627dc317-6956-4440-a6f2-830d8091b8df", "value": "T153F45B21F280C877D82239F59C5B81A55427BE252D35790B36FA3F0C5A36293FD6628F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771998, "uuid": "a6d62dd4-dcf4-4f9b-ad79-9d0401815105", "value": "2908e707ee592e48fac7cf066e87d007", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771998, "uuid": "3b71f58e-ea1c-43c4-88b6-e93c65b4d90a", "value": "12288:d8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/:uUKoN0bUxgGa/pfBHDb+y1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779771998, "uuid": "a6c8db4e-2880-4bd3-a393-9a44a98feee5", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779771998, "uuid": "fb653387-570f-4f4a-9b8f-c95b2b5459a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779771998, "uuid": "d4ec0b07-9e55-44b7-8d1b-d885420e148d", "value": "f168pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c9e20d-593c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779825034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825034, "uuid": "8a46988e-084e-4c2d-b45c-3c37b23b2f6c", "comment": "Malware payload", "value": "147bc8fc5d4132235e213486f6e00ea5", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825034, "uuid": "af8beb2e-e3c8-46ac-a2fd-7ac475069e3e", "comment": "Malware payload", "value": "b9df0a8ce035f833140fa6790176fcbac56bc5abdd7a1b28bc34d7c7f33ed8d6", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825034, "uuid": "236c0bbb-1bb1-4530-b0cc-dc59a8112e84", "comment": "Malware payload", "value": "38ae17f916d183c949959915e9bdefa7bf22f479", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825034, "uuid": "898d2c45-bac6-4e71-937d-dc004efeda1e", "comment": "Malware payload", "value": "83d1e4581a27fb7205f680771f851a103c52a94449143a0da3da59bf3fa0ec1e538e5421dd9b3f2fc58bf427075a43e9", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825034, "uuid": "d36a6f78-d928-4415-b9a8-871295b5510f", "value": "T16B9733F6D013291FC9FBE5318BB8D09ED2F18412A700C57BE59627AF44DB7D222AC54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825034, "uuid": "d3590d87-055e-4b12-9137-d7479ea1891b", "value": "786432:qBuToFsrps/k5rHuFGBYp5mIaO2esS+3Pu48p5txDgcJ00SeI4AN:qBuToudsa0mIaO2e+Pu4w57nPSeYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779825034, "uuid": "242e6ded-1a68-495c-8f4c-80b536cd10d8", "value": 41680408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779825034, "uuid": "6d451c81-895c-4e74-b080-aa7fc42ebe7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825034, "uuid": "f7530190-adba-4177-8b0c-85ab67deabd4", "value": "Spectra_Menu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be252c9-5906-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779801927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801927, "uuid": "606ec2b9-f8e5-4dc5-abf7-0e58c526a292", "comment": "Malware payload", "value": "2d9c60640476b550cddb0c6b8804fa83", "object_relation": "md5", "Tag": [ { "name": "optawn-bandoleirosmc-com", "colour": "#60E4DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801927, "uuid": "882b9811-2ab5-4bd7-9b11-9f95e9153f62", "comment": "Malware payload", "value": "bbc0895b0faae42074ea3303499ad4ab1510e1420e281b2beda65ac1f3ec7448", "object_relation": "sha256", "Tag": [ { "name": "optawn-bandoleirosmc-com", "colour": "#60E4DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801927, "uuid": "60c0691b-a1b6-4c9e-bf24-ea7a8420979e", "comment": "Malware payload", "value": "643573002f4f63f835fa921b4828f875fd316d62", "object_relation": "sha1", "Tag": [ { "name": "optawn-bandoleirosmc-com", "colour": "#60E4DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801927, "uuid": "d93501b7-cb0a-48df-84e8-c05fb303cc13", "comment": "Malware payload", "value": "c94edf5e9538820af610ca8b5567c860311afc056fd8e8b25121b8cf18b443c7280ed6ec5f89fbf30a806a2005b3de55", "object_relation": "sha3-384", "Tag": [ { "name": "optawn-bandoleirosmc-com", "colour": "#60E4DA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801927, "uuid": "7d61b434-1f29-4b96-9adc-98a8693bb23c", "value": "T1B2513A607B8E3E70C36A27FE5AAEFF95008782516191E54D356004AC6D0EDF538A5E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801927, "uuid": "afcc725a-b450-46c5-b5ba-3d0b94c39414", "value": "48:9krNe2oNSO7RrAhTBABpSMtVZL/S82zQBaHw1LfQHuEy7R6iDIDy7mdpb0yboixa:ORYNSOV8h4pSMv5/S8YOkeLIHa7YWSfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801927, "uuid": "276ab259-0c45-4428-99bf-e00188ee39e8", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801927, "uuid": "c01df43b-f7ef-4b3a-ae02-87d3dde9c1f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801927, "uuid": "0d6cdbae-3fc4-4cbe-975e-a814f1a24be2", "value": "84751966283966956194.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc6f80ab-593d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1779825711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825711, "uuid": "e9f0a6b8-bb94-4e33-b2b2-48ef8e58e27f", "comment": "Malware payload (SalatStealer)", "value": "5e3e511aed9b7b585ba91690e05ad010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825711, "uuid": "fc91cacc-6dfb-4265-a359-e3b5f1987cc7", "comment": "Malware payload (SalatStealer)", "value": "bc9890927e2ec0a0aeed1f1cc8799a7f6426522f7a958556020e008772aa8649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825711, "uuid": "b93d21a5-a5f4-4be8-b453-6e491fefa662", "comment": "Malware payload (SalatStealer)", "value": "f03ef4fe1cadaaa23d97611ab8e42aff647957ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825711, "uuid": "f5bb67e7-f635-48e8-9597-353b1788046d", "comment": "Malware payload (SalatStealer)", "value": "4111bfdbbaf93a485bc26b78298fef651d3e3e9190944a1998b7113365540837458273c923653da6bf136a75e8b364b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825711, "uuid": "76f359fd-f54e-4531-84a5-c60d2433f2c5", "value": "T194C66B11FADB95F1E9035831406BB37F23315D048B28DB9BEB547B2AF87B6A11C6A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825711, "uuid": "cccbb35b-339f-4bdb-b512-33bce8f57a01", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825711, "uuid": "7909fa7f-8e1f-4062-8091-bd45ddbd270d", "value": "49152:2ZeFBhTZznYYaU8andRiM6SCdRfgRVA0y3IzLTydF90f123pxE9VVLkYLmLdadjp:HFXTianDB7C/gzTP03LokPVT4npEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779825711, "uuid": "f0769563-767a-4181-9360-55c16e6c40f9", "value": 12573184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779825711, "uuid": "38494fd0-f779-4def-a210-e471d88884aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825711, "uuid": "be4a5ec6-49e0-4ca8-8bf7-a88bb5f7e23b", "value": "Solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1d723b-58f9-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779796287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796287, "uuid": "5535cde3-86de-4eb0-ae4f-0716f1ce185e", "comment": "Malware payload (Formbook)", "value": "2f41eeae533947e72083213b76ccdd7e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796287, "uuid": "89f2242f-a44a-47eb-9e8a-6e10c086460a", "comment": "Malware payload (Formbook)", "value": "bcb89dee4c0a20d59a291fe017196626a6536b90e92f14cf20db0c8a38c45a71", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796287, "uuid": "d958828a-3e16-4e73-b133-7b82531d7e1e", "comment": "Malware payload (Formbook)", "value": "2a95e0e2da8b1e29f45981f6b887d6a9a9f0934d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779796287, "uuid": "3ba36377-0a77-408c-88e5-27f53978ba19", "comment": "Malware payload (Formbook)", "value": "353706e0dd529a67d39549ad3c4d606f7adcf1901c70fb214a5d4187779e1acee4df05b84bfbbad31a6a8a3e2464b8d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "www-pokerdom-kdp3-com", "colour": "#9C461B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796287, "uuid": "ed259b19-0bf9-478c-9350-bf683d6362d8", "value": "T13BB5BFCED16E48D29C053FC998142BC78B2546328A7400683A6F7D499F7B4FEC15EEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796287, "uuid": "65d5f4ed-bff5-4b04-bf93-a90544ac3236", "value": "24576:HLBu12hEcH1PdZMPZ6OE5Sso76ZJ9uipwdj2GSiikPfk4d/DMq:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779796287, "uuid": "42706345-9428-4d98-acf2-9f2076136792", "value": 2294480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779796287, "uuid": "313814d9-9c8b-4cb1-97c3-4a915472655b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779796287, "uuid": "70ee4eaf-1738-4e84-a50e-a9b6deb0a5cd", "value": "bcb89dee4c0a20d59a291fe017196626a6536b90e92f14cf20db0c8a38c45a71.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22597f9a-5906-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779801830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801830, "uuid": "1c95890e-018b-4e12-a806-a6cdaf3afc00", "comment": "Malware payload", "value": "00f78209fff04279c62d292b5a291260", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801830, "uuid": "1724b023-ddb9-444a-b6be-8c7433906c49", "comment": "Malware payload", "value": "bdd75c7d17a4211aadc048a1c4348ba4eda7581ea3edabaa9052169b7faf30da", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801830, "uuid": "ef43c0d9-2e0e-4b30-92be-25fd8c2fcaf7", "comment": "Malware payload", "value": "8c7595d824f0d19e3461d5e7fd3aff304064f407", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801830, "uuid": "f83f0338-0e5d-48de-9ba2-a75f1e0850f7", "comment": "Malware payload", "value": "782c62b440acdacff283edebd68741b14d87cac989cdf1024722d90c32ca25498cffacc5aeb23a9be1273183449bbff5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801830, "uuid": "17a8428f-9063-4323-a603-e1bfb73a0cad", "value": "T18E137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801830, "uuid": "0755ff11-d4a0-49a1-adbd-a00683bb45d4", "value": "768:X+s9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:X+Bcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801830, "uuid": "1a025cd9-294f-4a7d-86f5-f2ff39ba4842", "value": 45518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801830, "uuid": "54d18471-fd01-4177-96eb-11cdd9c3777c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801830, "uuid": "449feb71-ccbf-4879-959e-35a5e76c315e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b4d508-58a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779759938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759938, "uuid": "16d2dc25-84cb-42db-a06e-3c5528f4a0af", "comment": "Malware payload (Mirai)", "value": "8da7f09ef5d8db32cbd4fd4d0cb01a40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759938, "uuid": "bcffba63-67c1-4112-a446-13e28309c4fd", "comment": "Malware payload (Mirai)", "value": "bdfb82c74f3b88c66a03c49e53eb74117025fab26adceffe483019973dd2f619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759938, "uuid": "83c4250e-df9b-4965-813a-6dad4fa31fc8", "comment": "Malware payload (Mirai)", "value": "b65229951466e4d04b5b4992f0985fea229a59b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779759938, "uuid": "2d7765b0-f814-46d2-977d-c6e1821429c3", "comment": "Malware payload (Mirai)", "value": "5dd3c2cb150a2e83ec51d208ea47f80ede73afaaaf9e2ac812dca66571be7da5f21fc62376eb5b9cdd3a97bfcec11ba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759938, "uuid": "90b6d90e-ed20-4673-864e-24eeb40dcd86", "value": "T1C63329036452D1BCC958C3304A7FAA2AD533F07DA732F65A33987E266D56F201E0F59A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759938, "uuid": "bd62de59-5c8e-4c50-bcd6-eb3e3aa9e167", "value": "768:AFTaLRRv67Kp31eLpMBVFQj0NXHxitUTQt7NS3v7R0WQ611gsp:GTqRR+K/YMaINXHvy743v7R0e1gsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779759938, "uuid": "d0cbe223-d429-4774-8444-e085ef29c5a4", "value": 50647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779759938, "uuid": "5ab74eea-081c-48ee-8703-a8f0118f6d20", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779759938, "uuid": "ddb912c8-41e9-45d8-bba3-a727bee3d63f", "value": "gbhnj.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f2afcc-592e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779819093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819093, "uuid": "fbdb3df9-a489-4b08-a17d-828b0f4124ee", "comment": "Malware payload (RemusStealer)", "value": "2318f6b101a6a0901d5ce999372ee37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819093, "uuid": "6c65f195-9f75-41f0-8d0e-7205e24a8ba3", "comment": "Malware payload (RemusStealer)", "value": "beff95d5326762401e1ea804d3c75f8cc71533f152a5711361476ce466b39b54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819093, "uuid": "4fb2cd90-ca61-4811-8a49-5582ce408b01", "comment": "Malware payload (RemusStealer)", "value": "91ef70d735a286c752784d364557d257a943f03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819093, "uuid": "49ae1e62-8b9e-4cd4-aa69-9b1066701f65", "comment": "Malware payload (RemusStealer)", "value": "1631e0c82a8a345f66befe1b2a629a76bd2ebce72179217868c92cd9eb4eaa1884f0c02863f060adb93880e59bd217df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819093, "uuid": "75446076-54f5-494f-8943-1f4d805ed8ad", "value": "T154655A437CD064B5D5AA923288B6A2D13732F8490F312BC32B55B7BA2E777D44E35368", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819093, "uuid": "bc1fbb25-09fb-4b02-bc30-fd47bce463ff", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819093, "uuid": "44319bb0-1c9d-4023-b05c-b02612decec4", "value": "24576:NEjiWtG33iFJ94IaBU7CnZ2JM7fjQ6OgLP88WqXVsAisD1l:W2WA33iL94In7gZ2iygLP6sD1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819093, "uuid": "b5e4e8c1-2bfe-45d9-9682-dddf1563828b", "value": 1542272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819093, "uuid": "a0e0e777-daa9-45df-8305-95c8d7984038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819093, "uuid": "78103009-bff7-40b5-9f88-4e5893243717", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75464252-5903-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779800681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800681, "uuid": "0bb61e1a-f945-40df-a88f-9f7e7de4c7c7", "comment": "Malware payload (AgentTesla)", "value": "10ebeb295f620fda263cd8478b7f19d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800681, "uuid": "56ddeef5-0fce-4329-98c1-56405c0409a5", "comment": "Malware payload (AgentTesla)", "value": "bfc340faba4a6685ee6fc715e8ae6d43add6651934a0f225c013303fc3398ea3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800681, "uuid": "a7764ad3-6d46-4442-8278-47b9cfc5b3f0", "comment": "Malware payload (AgentTesla)", "value": "5f2ce3a2a6e411dde1efd0a2afd007c9c02e0e1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800681, "uuid": "8d81cbc5-391f-435b-ab7b-348beaf4dedf", "comment": "Malware payload (AgentTesla)", "value": "814f439b8c72149a7a0049ea89034ad371de2faebcbae69da506569220422b053a96d27c454b7ced027ce67041804231", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800681, "uuid": "549e250e-6cb9-40a0-947a-b68251323325", "value": "T1B7064BC254E392637721DBEB5A39FE30A40E9C0319958B347A4EE63B351DD47712A3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800681, "uuid": "c45d2b27-2f21-40f9-a28e-12ed3dfaf721", "value": "98304:cCAVJyOvxi9mhOgDfE7zTRQ9vkXbXp60rqoWVFKWAUU9gub83EX65e3xoE4gpl2b:izvxi9mhOcfE7zTRQ9vkXbXp60rqoWVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800681, "uuid": "f1a54449-3c66-4a25-8709-c93139ffaffd", "value": 3823815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800681, "uuid": "4fb8c395-ec13-4ad4-bb08-c0c00f786f3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800681, "uuid": "09350a49-6abc-4fe3-ab87-c75881b3ed39", "value": "Purchase Order EDG6453.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2299dfa-594f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779833478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833478, "uuid": "6480917d-5f81-4f58-a6f2-3720d6926de2", "comment": "Malware payload", "value": "d8cf5509c9eac724318ea42881a65bbb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833478, "uuid": "413dbe5c-1aa3-4f7c-8e74-3f9ccc863e8f", "comment": "Malware payload", "value": "bfe6e5455ddb5481730b00fe63af98eb5a35d5d45d56be1a94aa5e5488d8445f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833478, "uuid": "107f8929-1b15-47f6-a5f8-aa6654a3b59a", "comment": "Malware payload", "value": "9e0e182e615a71ad67bcdc4f4943774ffdd782b9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779833478, "uuid": "f42608d6-64f9-439f-90c3-fc8de2180c4d", "comment": "Malware payload", "value": "3f82f6a7cc6a1b2f7f6afa64cc5589ddfc4e42300c062798ba0fe3f78153b1df4b54a64b151cd8c6c7e6c11562de92d3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779833478, "uuid": "f952ec8d-c402-4a5b-9c82-b2909f434f6f", "value": "T15CF02EE1AC29407737AA446EF0C15C5C17A6181B844528D0391E58F2DF5FD48E526D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779833478, "uuid": "bb61f577-ed56-46f4-9def-af5e12004385", "value": "12:VAhriHic8J+TNLIWxGg91BeQZFB0OC6HaZYmtFw91+4yK:VAZiHiHwTNLIO9h7B+9syK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779833478, "uuid": "5a64cfce-4853-41ab-8a60-eab8ee1a114c", "value": 473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779833478, "uuid": "6212db11-0bd1-47a1-8bd6-b9f9fc39f784", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779833478, "uuid": "617170fe-e6b7-4f25-bb3c-6cc0e01a78af", "value": "utt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6993635c-5906-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779801950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801950, "uuid": "de258578-f210-48cd-847e-d89a9e0c12c6", "comment": "Malware payload (ValleyRAT)", "value": "75f5971c764e5ea9e3cd1f33badfadcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801950, "uuid": "3fd90424-df9a-4f78-b244-9cf6e3c60dfb", "comment": "Malware payload (ValleyRAT)", "value": "c0074d9eb2ce8ab01fba82b01064d0197dd40637fa7c40ac24d4da03f187a1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801950, "uuid": "993f9115-0efb-4627-9c25-585601d6c642", "comment": "Malware payload (ValleyRAT)", "value": "2bb45ff52243da920babe0faccfacb7f62b6f14b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801950, "uuid": "3588121c-8730-4705-a7b6-c09a5c7fa4fd", "comment": "Malware payload (ValleyRAT)", "value": "fb6e604824df99fa3e1b5ecbdbc8499713a251788ae00db102694db949f2a2c2f607a1b60f64238a9eaf6774d0c8457c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801950, "uuid": "d3c64b45-0839-43ec-91e4-9ea234dd4ab5", "value": "T1AE069E4BA2BD40D4E9A6D079C6074A0FD7B2B821073197CF15A5CB9B2F372A24E3E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801950, "uuid": "c3c3dfdb-2daf-4904-ac87-0af5fd959786", "value": "e307583b684469ca0e0546163caad136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801950, "uuid": "b8ef0f49-54ee-436e-ba16-b4cf904b7746", "value": "98304:kxm0yoHYY3RMHn/+2wwW+v2s7hmK9ET4dQfX8lMSnvdpmwxjRTL:Uy7NHn/+2wwW+v2s7hmK9ET4aX8RjxlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801950, "uuid": "bfd7dd90-2ebc-491b-95ff-55fc8248b05c", "value": 3907335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801950, "uuid": "3458a0ac-9262-44af-a621-70cbccbfd405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801950, "uuid": "e6026b26-4472-4aac-bec2-02d33e5f41f3", "value": "\u6296\u97f3\u4e24\u767e\u4e07\u7c89\u4e1d\u6a21\u7279\u7f51\u7ea2\u590f\u84dd_\u6b27\u7f8e\u98ce\u5973\u795e\u88ab\u7206\u5a5a\u5185\u51fa\u8f68\u9ad8\u6e05\u5b8c\u6574\u7248_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccfe71a-58a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779760535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760535, "uuid": "e4c1c395-2439-40c9-92ef-300ae5f1e79f", "comment": "Malware payload (Mirai)", "value": "ac1e108465552ed993f56e639467390c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760535, "uuid": "ca7925f5-5a04-4189-a229-65bcd76c14e0", "comment": "Malware payload (Mirai)", "value": "c13546199f17a92edfd030689582ef51861b9b140216f35a6a98a70ee76e67c6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760535, "uuid": "da6eb6fb-1865-4e6f-b5cc-0d791cc9ac83", "comment": "Malware payload (Mirai)", "value": "bfccf684f644c8ce4b2722192e791d5229e28e47", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760535, "uuid": "6298de9c-69e3-44e1-9251-5ea4b578b1ee", "comment": "Malware payload (Mirai)", "value": "37c577e661865b38a1d44f442537baa6d968826b2f6f21a0f5c1266e92ae0eff0be7a629402879894f425b3bca2c3a02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760535, "uuid": "9dd48ea1-3322-4531-a4c6-d50a173f1a38", "value": "T102D0A79E2310988A000EC8C2308D5900C388DBE0F1BCCF3964E86F3330CB008B808F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760535, "uuid": "cdfd3700-5b14-4b0b-b1e3-4504f011db5c", "value": "6:S8P/bKR/6y9Kt76y96kIMB+wP/bKRGKtZrB+wP/bKRoD9KtkWAMBO:vP/By99DTA+wP/xiV+wP/VD9BWAAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760535, "uuid": "8b703647-d190-4aaa-bca6-5f7bf27a8a12", "value": 237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760535, "uuid": "631393ec-5e57-42eb-aa6f-334d0ed313e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760535, "uuid": "59d255b4-30d4-4f18-af33-5d837229f511", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a477d87-592e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779819104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819104, "uuid": "ece643ff-df3f-4a4f-96ba-55648bc79265", "comment": "Malware payload", "value": "1326ecb7beb11437f4ed7ce41ef0fa6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819104, "uuid": "ef802707-718a-4469-8077-84676da568f9", "comment": "Malware payload", "value": "c1a201cf95536c5c9a63f69793515c296e7db0b289328786e8b1cb7a03714b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819104, "uuid": "be08a4cf-5fa5-4d7f-80e3-1c3a1f8cdc46", "comment": "Malware payload", "value": "f286e2d05dbef706120b32cac265f1f17d570330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819104, "uuid": "f263d7ff-93ca-4ad9-8906-b5e520399fd5", "comment": "Malware payload", "value": "83fa4403872af0d87d3572f9c187a0ceaab31601aab75514f10d1fab7b00515d47b764b0509fdfe0fcb06c1d219a0ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819104, "uuid": "7d36a8d3-cead-45bf-81a0-7653ad137d4b", "value": "T1FD158D117581D033E66201310A78ABA580BDFD355B3136CFA3E47B6EA9316C26E32B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819104, "uuid": "742b4f70-b3e6-458e-a2a0-e27d0bdafdac", "value": "bdf784e9065eda3bff1e267d1cb699c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819104, "uuid": "8340ae5b-6f39-48c1-902a-d3dbb63e3051", "value": "24576:2ri8bo/mHtxH/Yt44/JhZx2N0+wk4fia2iBkQfQlj:L8qmHtxm/JhZoxwk4frxyQf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819104, "uuid": "1e386975-a667-4d09-b853-73ba9e4c31d0", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819104, "uuid": "238f5d4b-f345-4368-a6fc-e11adf791af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819104, "uuid": "089a566b-9ff7-4d96-9829-1d1a54d2b862", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54f8a2c-5902-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800332, "uuid": "1912a568-cf66-4e1d-b032-c26fcb74bcd7", "comment": "Malware payload", "value": "d4b962ada25b5c045113822b2a174b30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800332, "uuid": "fbcf9cf5-d723-42df-b0f7-4321fb6efdaa", "comment": "Malware payload", "value": "c2d5502f7d8959af25ab2e2b0f50501c2181c37148568f4c17b325618dd57854", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800332, "uuid": "a97fdf16-e24c-400e-a539-d8e8e35c289c", "comment": "Malware payload", "value": "71203714d6de942a8e1ef3966ea0e4570a3c7ffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800332, "uuid": "4fd35bba-c831-4f49-bb1c-182188f794fb", "comment": "Malware payload", "value": "9c6bd409e691c45cba9e1c198c7a3f4b5270329f342a6b8c8773490dc651f7b09fcc5b9763774bbf7104cea7f92fd5bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800332, "uuid": "c74bdb36-955b-46d5-a9dd-e2d4e1369e63", "value": "T16F252C82A7FA163CF9F74F9CAAB8445559BBFD661D39C55C0118098E0AB2E44CCB1B33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800332, "uuid": "926ed4ef-8736-486d-bd56-7cd06d3e0fea", "value": "3072:TjcCokLUhS+wd3pAaGVJrHXWGmQ44/UMXfo2vvtB4c+CjyOZt4phMc8+hj/nrI/U:7Kwd3pAalG14cYK/lu25SnJqcVFcptlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800332, "uuid": "c5d40d8c-edec-4c5a-aba7-c21ef9a0f0fb", "value": 982650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800332, "uuid": "9b4b94cc-618b-4333-b4fe-8eb37f5e3c36", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800332, "uuid": "3726276a-bc89-4031-9eed-4ad2defff197", "value": "618074350.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b41ae13-593d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1779825575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825575, "uuid": "dbfb2488-eeeb-48ef-9537-0e84d9f13d85", "comment": "Malware payload (SalatStealer)", "value": "3cd4e408fe9fddda09329c2a4603cc71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825575, "uuid": "98fb4740-5247-481e-a33f-0757102cd494", "comment": "Malware payload (SalatStealer)", "value": "c2e0b4e5f40675e152412ef7073861f4da825e35b16227a285630bf3ef3b7f20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825575, "uuid": "d21a90d6-cd56-489d-b9a6-d9a59079e8c1", "comment": "Malware payload (SalatStealer)", "value": "8aa7231867b835e934b12aa408325e4fddf47101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779825575, "uuid": "412faba0-eb07-4bad-8333-a0c519f793b5", "comment": "Malware payload (SalatStealer)", "value": "3a3107ec340b6e1bfa736042f4d8975b9ed7bfe710552d384b0fff28b03e72f2b19a1c1ff443c86ee40154826bff83dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825575, "uuid": "32cb6145-387d-41e6-8a43-0827cbcecf2b", "value": "T1F0F533C074E5A741E43ABCF6FA416E76297D03B4125E125A5DFB0BB4EBD60C93E848C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825575, "uuid": "757583d4-6bb9-4c84-8de2-984fc0b7668d", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825575, "uuid": "34f7135e-2ad3-4cef-b463-225a4ec13cb4", "value": "49152:5YXlXGtBwmvDWakRPTyi/wH1DOaHFUYzLOUnXifaJ7uDZ3f5XGq:eV2tBDbWdbLoVDO0iUnSfY7k5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779825575, "uuid": "7fb311e8-b160-484d-9a3b-04d71ef994b9", "value": 3595264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779825575, "uuid": "3d6ae2a4-895c-499e-9cf3-52a127a12684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779825575, "uuid": "29b9debe-87d1-425e-a030-43ba160f3aec", "value": "Solara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18c5b2d-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824512, "uuid": "15dc2ab5-e8db-47e9-95fb-3be81a06c31a", "comment": "Malware payload (Mirai)", "value": "e694cc2f8691f94e1ce7e0fa589537c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824512, "uuid": "b1f58cc5-dbab-4dbb-ba2f-5365c653cfbf", "comment": "Malware payload (Mirai)", "value": "c2ff6492e76a15ff711639b5e914c47d7d08d04eea107c8ef248aab25435d6a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824512, "uuid": "6e7276d5-1228-4d7d-b9a7-6c4249825d40", "comment": "Malware payload (Mirai)", "value": "c4eeb6ca9a9f72ca9a0650ad2c6bc4b7e0f32474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824512, "uuid": "2b04b9d7-c433-4892-92d0-b08be245ca8b", "comment": "Malware payload (Mirai)", "value": "f979efe2e9b8f9bad5f789b51a4c30dd01454a8ba23fc5bbf1ec0355f09c22fcd10a0b0da5fb339bdf894971b5b96e5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824512, "uuid": "4462d480-e579-4601-8a31-5472eed0ce2a", "value": "T115A3B44D7E318FBEFBEC823447B39A12A65927D533E1C585D2ADD2011E7024E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824512, "uuid": "5de74725-bf8f-4c93-9216-8af10b6c9995", "value": "1536:SpaZOuj/Q30SQXa1r3J62yqPy/RWLW0edmpwj6nNYK:5ZzjJa1rZ62yqPy/ULWzj6nN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824512, "uuid": "fb59e611-ebc1-4909-b5ac-20488ff96d2b", "value": 101188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824512, "uuid": "c66cad92-7505-4be9-9d10-0b11fad5531b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824512, "uuid": "9aaefbd3-7662-4727-8636-19b988f61a8d", "value": "Space.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcba8d70-593b-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779824852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824852, "uuid": "ab448f88-8869-4a19-a3a1-6c0907cfb8d6", "comment": "Malware payload (Gafgyt)", "value": "52af14473b9fcad2d140d9b365bc1a3c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824852, "uuid": "663c1a68-4912-4f93-a644-0ace15c6a769", "comment": "Malware payload (Gafgyt)", "value": "c348afc647f8b4b46885fb04a34efb1df58365d1ab8fd50d0b8ff1b742188ae7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824852, "uuid": "fac51ead-df93-4a71-9015-9b946ac1df16", "comment": "Malware payload (Gafgyt)", "value": "d400aa265ef27364d15c4429840c58ee4117c3f7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824852, "uuid": "60501a7f-7023-45d4-b3f3-c29a0d18a1af", "comment": "Malware payload (Gafgyt)", "value": "cdf82c3a8bd9e2fa5e73c29865ad1a4cf2b79b0f2d83865352a1b2ed3422972ca79472f001ac002f983ec41537873f3e", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824852, "uuid": "a2faa626-c6f1-420f-ae78-d16bdc8bd146", "value": "T137B30823BA260E27C0D264B622F74731F9B5A7DA18F885077E615DCCAF641C13663BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824852, "uuid": "13af8f0a-93e0-41bc-bcc4-75d1539415fd", "value": "1536:wp+rVAO1on5WEkdspyeaAo95I1tPCt85rphasJlsr:wpsZo5WEWPeaAoPm1hrphasJlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824852, "uuid": "ebe8834f-80a5-4c83-88ad-56d3d7948205", "value": 112292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824852, "uuid": "70e6da81-fd1a-4496-a45c-c7d6e85c96c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824852, "uuid": "f524a4a2-7304-46b8-9d61-6b82ea0c4e17", "value": "FBI.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25901dba-589f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779757597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757597, "uuid": "612c6c86-a087-44c8-9a95-d9de4064fb88", "comment": "Malware payload (Mirai)", "value": "1a5f796fb4628167fa9881235be3ac03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757597, "uuid": "2497a222-1fca-4322-9853-3c374bf2ebce", "comment": "Malware payload (Mirai)", "value": "c3f72893130017c64e475cc01e5f776cee9722c53287ca3dd36fb41fe8aac565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757597, "uuid": "c613e8d1-cd3a-4e37-b525-f8a6e2ba1bc7", "comment": "Malware payload (Mirai)", "value": "a9dae198d38746ce4ccaa3694a15cfaa60e20eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779757597, "uuid": "419d44e8-99fb-483f-9f2e-cfe685e4d559", "comment": "Malware payload (Mirai)", "value": "748d7f81aa84fa02fbb2c8ffa01f7eaaab8187a766004207aee45949c96d46323b38781088934e21d910fc175da33b86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757597, "uuid": "5df45b19-e831-4a47-8e53-101c104a2710", "value": "T11DF32A41A656CAF3D4830FB512A757754A33E8295F2BDE05F32DBCF48E465CCB20A628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757597, "uuid": "d107565c-7fc4-443a-90ac-0c52dcb12985", "value": "3072:lsDdDDkCataz4k2NKgWvqk8P2AsetOSIy6zilC6aMxa27D9:lmMjNKgWvqfOEOSIy6zilC6aMxa27D9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779757597, "uuid": "234ea959-226e-4bc3-8ff0-78aa061be24d", "value": 160742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779757597, "uuid": "815f67eb-c136-4c2e-b1b3-0b87e899ab45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779757597, "uuid": "4d5f48bd-d844-4cc1-a690-a95fc5ce07fa", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b225da-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779800416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800416, "uuid": "0a0f4c8b-7792-4bde-9831-7b28fab8c503", "comment": "Malware payload (XWorm)", "value": "0fe4a5be34fc27c5cdcbbc011ce237ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800416, "uuid": "f4234034-fc02-4605-be26-c575143c0e15", "comment": "Malware payload (XWorm)", "value": "c46fb5ba26a3d86088e348980056f53a5967e319d185d63af8d75728f2ea7de9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800416, "uuid": "f778bcd4-3d75-40d5-aca9-5d1ecc2891a6", "comment": "Malware payload (XWorm)", "value": "69174a4421c8cacf4537df3952758899015c2cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800416, "uuid": "6cbaac4f-e020-4005-bfe6-e2109d50b33e", "comment": "Malware payload (XWorm)", "value": "798c0e6717a231615686fe15d8c9b740893d502ca7c56039a63f1d07c108d34e170bf83aa326317ecd8084c0c0c5c78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800416, "uuid": "cbf79b94-4e12-422f-9dd8-998fc902947b", "value": "T19EC51EB3C9D5D4EFB1E89C9C046A95B9071C3E6E0A1185F53EFC3EFD072AAC0A941865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800416, "uuid": "1f4cd896-6a1d-4ea6-8862-f11a5bfe2747", "value": "96:tn9sz6wA0WxhIWguxidBlda9OtKKM4mcWVB:TsOS6WM9OjqcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800416, "uuid": "0c496bd1-5853-477a-bdc5-403c23e5925d", "value": 2674652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800416, "uuid": "210a8ea5-0f68-4892-9253-565db0c8e3a1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800416, "uuid": "0432caf1-00e4-4dfb-9110-483382c98245", "value": "Revised PI.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679ee09b-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1779800228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800228, "uuid": "8c260e50-2b59-4c96-9dc8-4ebd477988d0", "comment": "Malware payload (XWorm)", "value": "56d9070dd6df18c3fe8a0ca7433e6a17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800228, "uuid": "b6433101-4456-4e99-b49f-74e2b26400a8", "comment": "Malware payload (XWorm)", "value": "c4ac52caa570bb4ce0964a9ab44642334df1c26ede0682174097d588e4c970a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800228, "uuid": "91edced8-daeb-4f79-86b3-0d2d55172de6", "comment": "Malware payload (XWorm)", "value": "29387980256edaf41701a020463f2cea9e8dd573", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800228, "uuid": "6d710e56-477a-49b0-9df3-67248e7b8bcc", "comment": "Malware payload (XWorm)", "value": "d7bb7f8bbcefc0ce61f09a0b723db9a9dc0df09366eee82647e6d78b59e6d7e5a56c43b98900cd06c712163067413708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800228, "uuid": "b41e5172-3160-41d4-b77c-4b59e2b70697", "value": "T1F8D4BE2C3B0E9505D6319FB9EA274B5123F0C0165ED2D73BFFED41A8965BBF26812221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800228, "uuid": "0d33ca46-ffb2-4ffb-bb99-016f92f5cde5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800228, "uuid": "fee15ad0-e2ba-4950-9ccf-90e1b91bb062", "value": "12288:Hu+y+ik3bB0sHBUqtAxFNvJoUqTrXoqFrDzuURX:O+7ik3bFUttJoprYuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800228, "uuid": "1c4a59a5-0473-4ee1-886b-b80306a331ae", "value": 632832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800228, "uuid": "8d57eda1-11e5-40b8-93ce-bc0884da4835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800228, "uuid": "9974172e-ce77-4e89-ae02-e788f5b9bd9a", "value": "SOLICITUD DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8914821-58af-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779764796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764796, "uuid": "0fffbf5c-3058-4637-b762-cedfbf516d2e", "comment": "Malware payload (CoinMiner)", "value": "08f0c33944deefa37cba646e2128d4da", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764796, "uuid": "3b7d9b32-0a8a-4d21-83b3-ebe07dc67748", "comment": "Malware payload (CoinMiner)", "value": "c4ac74268abff27a68f363c4d64cdbb4f743ce5b3dcb1551bf83f4d974ec2326", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764796, "uuid": "f9e79792-fc2c-45fc-8dcb-b20b549d09db", "comment": "Malware payload (CoinMiner)", "value": "6d267ed94c0ef1c0f3bd7646c8e3143280c77859", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764796, "uuid": "5c9672a7-4729-4078-8d3e-d0d12b6bc2fb", "comment": "Malware payload (CoinMiner)", "value": "edb0e281724dd44d1a15282584e39ec18bdd2f59b033d24c7d712bbae1bf6621ecc192eb540e984028de9e7993539fac", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764796, "uuid": "8341f191-4f2d-42ed-9c28-bce27da1fe5b", "value": "T137463386BBD2A5BDC5CA147159289BB607F8DF442B11C2D343107A216D343DADE7B2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764796, "uuid": "218f19cb-26b8-45b5-90bf-012cc0d594e6", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764796, "uuid": "4e3ec90e-38d0-4590-b5b8-5504f85e0a6c", "value": "98304:5n5VJ19Ci0FFkbVjsxry2fokUnhlbkflE5CMLp9F0B8DldAqcN1iMpQzD/k:5ntB0Ciy2fokUJLdEKTkpG/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779764796, "uuid": "b6585d59-9e7e-4215-a85d-033bb85cd60d", "value": 5673288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779764796, "uuid": "b867a46e-477d-456d-b782-8c790685e76d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764796, "uuid": "38286d2e-f557-4161-8f5a-da1934ed2e0d", "value": "cmake_16.7.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb96fc5b-589b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779756131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756131, "uuid": "1fbcc72f-f8b8-4785-b88a-80596c817baa", "comment": "Malware payload (ACRStealer)", "value": "d7764dfc94844fc7ea9e9ae771e36811", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756131, "uuid": "dbbc2d88-869e-48e7-903b-717e714e58f3", "comment": "Malware payload (ACRStealer)", "value": "c577c6c87bd8a143598000e63d53c8e09b4f7d7a8b8c5de36f7479b5f4411274", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756131, "uuid": "c6cd4e04-b361-4fea-988b-1931b3c7bddf", "comment": "Malware payload (ACRStealer)", "value": "f09848e0b687d8247a2813f49decf6733a84b7c7", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756131, "uuid": "410a5a0f-70e6-435a-b685-d3a924fe7c55", "comment": "Malware payload (ACRStealer)", "value": "867379f8871d07dbf2a3830c832a5bf8b7203c2da43c912d9be2e30da7c08c281b1d6ece39eb97d120f4d69c20d24a8b", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756131, "uuid": "1c809f40-9e73-4f14-a6a4-1e7191741b1b", "value": "T1AFB58D11FCC355F6E80223325AAB62BF63399C051F329B9BEA5436BAF9735D51832341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756131, "uuid": "1149e876-8bcd-43e9-ae5c-847ed587885d", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756131, "uuid": "080c6474-c2d6-4863-a699-5e83688465c0", "value": "24576:rEmYMLTYSp31fPy8ieEr4C3p2nzUJl4j+Yi+KLHnT/ZXIVYTHFIaIkVje3XPQjKP:RvFS/mj+YaLT/Z4VYhPSvp4skxB9rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779756131, "uuid": "faad6544-4f70-4cd7-a7f6-e11645d7794b", "value": 2454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779756131, "uuid": "61b8159e-e7cc-4bbe-8c6e-706a586461d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756131, "uuid": "0ba2f7c5-8e57-497c-8610-44751fa3d79d", "value": "VKkQj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d28707-5905-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779801586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801586, "uuid": "ae39f089-14cb-4e24-8a05-a712675aeaca", "comment": "Malware payload (Mirai)", "value": "c99025e006ff54a5484ed35a268f1c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801586, "uuid": "640a9370-3137-4a80-b11e-31ccc8177f25", "comment": "Malware payload (Mirai)", "value": "c64fba9bd16d48cb15852e716aa4fcc69577e697d213943e6c093057d820d9b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801586, "uuid": "96eeadee-a646-40c3-bdb0-c80de15cb70d", "comment": "Malware payload (Mirai)", "value": "a141b12ad749173145435ad012902773a948165d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801586, "uuid": "fef48b45-d631-44bf-bac9-418e5ef27eb2", "comment": "Malware payload (Mirai)", "value": "d57ae80e651b560ee37d42263feca97bffbad1ccf635bc8af05e39f4910a2c32905399eeaedba52f3c83f19b235d1814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801586, "uuid": "0d0ca539-d11f-488e-9b51-1d3187bfe4c2", "value": "T1F2C3D60ABB500FF7E82BDD3B06A51B0A348C651A12F57F767638C92CB95A50F06E3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801586, "uuid": "b1f3d774-5a37-4386-8a7f-0113992ad6e2", "value": "3072:SQ9bLYesNOsURll/+r8nN5Xn25kHw51RsnbgoqYj0k1:Zq3Glf5Xn2qQRS0oq20s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801586, "uuid": "83778c3b-eed2-4514-be05-00289196e67a", "value": 121776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801586, "uuid": "58860e58-a716-4f45-94b8-f94fbf88cd6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801586, "uuid": "9087276a-5237-4aa8-b392-1cfadae3b216", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e03397-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1779778529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778529, "uuid": "060d70ec-fd41-4459-86b2-908e13b895cc", "comment": "Malware payload (QuasarRAT)", "value": "96f9e3808d6d452609b6d1f8e1c2ac60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778529, "uuid": "64b4bf26-0777-4ae4-86a5-26bc8aef4471", "comment": "Malware payload (QuasarRAT)", "value": "c65fd4c218ee4f11072c79af6e6663c9694cf746fae75641b6b75db0ce7d555c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778529, "uuid": "914ec799-9dc9-4b5e-98df-b06ce223929d", "comment": "Malware payload (QuasarRAT)", "value": "caea575cfc7ef3faa6d628e00274a10dc19a50a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778529, "uuid": "b16674f9-fdf7-4387-974f-17c782202569", "comment": "Malware payload (QuasarRAT)", "value": "9157bc33bf5403157aca6bef6cbb4d5526cac7083e6c19465cd64d2b2468d34a6b0e7a4ed9c922b69e7494068b5fb0af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778529, "uuid": "a6da2427-e747-45f6-bbb9-b9bd64a7d42e", "value": "T1EDE5CF2039EA401AF0B7AF75DBD0F4EA8A6EFA63370A965D14C107475E12B41EDC713A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778529, "uuid": "f4de0a9b-f684-4cd2-bb65-b86c9e83bf24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778529, "uuid": "983e40fa-5bfc-434f-91a0-3a3d94ee35b4", "value": "49152:xmiNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRCKh:rNgScVIxpLlwZNnAKSb7L3w0Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778529, "uuid": "30eea305-cfe2-47f4-83f8-0a7ad4c77958", "value": 3191808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778529, "uuid": "abe3b177-0e69-43ab-b93d-74c3a5e4647b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778529, "uuid": "06dafe29-89f2-425d-82a7-f5deda501883", "value": "Lulsec_Roblox_v1.0.0.5limitedbeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832e071f-591c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779811441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811441, "uuid": "0085ef1e-a552-444b-9c2f-fa49378d3018", "comment": "Malware payload", "value": "ccb15f9bf59f8e529102767e508545b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811441, "uuid": "762c52d9-968a-46c2-abfa-b084c36bf278", "comment": "Malware payload", "value": "c69204119150a73dd5191aadfbb68032f250aed78a95831e2cd59fadc546359b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811441, "uuid": "db9d928c-3c73-458a-9e5c-49ea178748cc", "comment": "Malware payload", "value": "85223193a8728b0a16d5b04075677afbad74f4c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779811441, "uuid": "66158728-8bc9-4330-b8b8-3491577dd9b9", "comment": "Malware payload", "value": "d45a587e03e9bfec001136fff5b087094839e37ee66519351f8633e3597ef087e4598626695a34a78e9cf5aff37a1595", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811441, "uuid": "c80d9af3-c626-42c9-afba-34784cff07e6", "value": "T10D35002ADAD9110BFCF38F14BEB50002A42ABE561D3DD95CC299168D077354DE8ADB3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811441, "uuid": "b2048632-bc6a-4616-b979-e4f56a19c2de", "value": "6144:V5uEg0mlSYyRcm80zD8tAfYJ1o2O2fP5cYh+td1P1K:V01lNvm3z4u2qtd1P1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779811441, "uuid": "99fc2676-789e-4f32-988c-3cff670360c0", "value": 1074530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779811441, "uuid": "314f1cd5-4f82-4e02-ba72-796773577ad2", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779811441, "uuid": "628deb14-e21e-498e-a434-592dd6e578ea", "value": "SKM_C5582605211000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce427a01-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824452, "uuid": "55eb185b-eadb-4e33-b81f-cce5186a0348", "comment": "Malware payload (Mirai)", "value": "a4aef27cf0b1329a07f75396015a83c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824452, "uuid": "a3330732-7470-43e4-b44f-801f3d09d295", "comment": "Malware payload (Mirai)", "value": "c84a5d3aad64f4dec45f8992855ec7fe7a05c75f5d9b94ba7563944cc645df53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824452, "uuid": "ea12b99f-f6cc-43d0-8f66-1e80912b202c", "comment": "Malware payload (Mirai)", "value": "4acc787b130d9e06aef1276fa193a0bb1528b200", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824452, "uuid": "fc264d49-4162-42c2-9943-d10bb629b506", "comment": "Malware payload (Mirai)", "value": "4142b53eb922cc1e6a1ec61849591c9b613f1257c1a33a82832720538a823de0bdb2a9c12c0217be4efc6ab80b4cc57e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824452, "uuid": "7c2e8af5-6935-45c7-8982-2e60da21a880", "value": "T16592C0700537B8F2C7216833962F8602995503FEC6BA357A331869A4DAC694F2EB55CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824452, "uuid": "c5d4c414-7321-46fd-aa30-defbdc208070", "value": "384:kn3CFDMsFGg7EMUTmli2KvZw93KmQxPitrsnIns0t2dfNH8J32ukhymdGUop5htg:KCyEPgoKRwZGx04nIns0t2y32Js3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824452, "uuid": "519e8222-a1a2-4baf-8cfe-a7aef67a55a0", "value": 20540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824452, "uuid": "378c9cc7-9f79-46c9-9fa3-4bd6ff46bc3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824452, "uuid": "c733bebb-3e70-4cec-afc1-cc8fb949642d", "value": "Space.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbc690d1-5941-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779827482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779827482, "uuid": "6121b29b-0628-46c6-9db4-f1ab6d71a198", "comment": "Malware payload", "value": "a348d22dabd61454ec6a56df4519f472", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779827482, "uuid": "ffbe1d45-665b-4c84-8494-9c2db72b3a69", "comment": "Malware payload", "value": "c8ad98095fdaee0150d763e182ac365cde18eeb10e1677dce19120fbfdc7f954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779827482, "uuid": "a06fd0a2-f597-4cdf-be4a-5b8b6241d222", "comment": "Malware payload", "value": "519cc350373fd6f541435d285ed5fbe181509708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779827482, "uuid": "1738d594-8689-4e1e-bcbd-f8128e79a4bd", "comment": "Malware payload", "value": "7f7ccb2413d898f029eb14bd11b68cd7288dd1f2c7e807533b1a7ef0658abdf7df1723983eb716c760f8517a40e5c2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779827482, "uuid": "2be3c0cd-dfe2-45c9-a985-84b66e1286f3", "value": "T18F1633A62ACE28F5C0D6CB7481A2697E313B7F7196A09D0B32D9B9810D137D0653F74B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779827482, "uuid": "7cfbc9d2-83fd-4a92-bb05-ab703d8b6d42", "value": "e3df886ef218e7911c057fc415be8829", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779827482, "uuid": "08a14e69-06cf-40f7-954e-eb3fed6a8fa0", "value": "98304:gYNfBdJOFQEM7gYy2y65glrNRudew/gTUozYaIS71PIBonm:xfBdJaQePmdvcFEe71+onm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779827482, "uuid": "4b447915-005f-48a1-b22d-1886a37129e9", "value": 4277248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779827482, "uuid": "1529f416-40af-4ac1-83fc-5007dc70dbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779827482, "uuid": "8c1cc02e-68d6-413c-b66c-fa65db8a9f3b", "value": "ClientLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9197f0e4-5905-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779801587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801587, "uuid": "ec698045-0a8f-44e7-994f-a479a92301dd", "comment": "Malware payload", "value": "bba3e7973cb7bfadaa61d0289470aa15", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801587, "uuid": "40911c9b-7930-4584-b795-1de10d04b88a", "comment": "Malware payload", "value": "c92baeecc96888995580d295c2fdb3a767c59fabb32cbcb90e8f52ec944d0c71", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801587, "uuid": "db55634c-d5df-4b08-ae55-3b397bdeba32", "comment": "Malware payload", "value": "506ca82e72a2c14561b0cb644561187fbdc1edf8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801587, "uuid": "50c2720e-3440-4b55-9160-c388f59a77a4", "comment": "Malware payload", "value": "06f97ea8e7c1dafa5b17d500d67a0c778932b43dc3fc659c80a6a09cc2d5a20dc95713116d3956c58297986d0cd61db3", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801587, "uuid": "a03b4eb3-66a0-4ff4-8634-d175d7f9604d", "value": "T18B141045838B00F4E4A91837CDAB828135F76543692D99707BBC7FD02F66CA9D2707EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801587, "uuid": "a8bd6d06-f093-4bd7-9c39-89acaf532712", "value": "1536:Qtx4agmEWFGT0uxRhgvoaPf4x1AdzRIN48EVtIuvchqSr/W0:Qjoc4xT1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801587, "uuid": "10a22b07-0aff-4876-9412-a41e0a46ddbe", "value": 204378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801587, "uuid": "c1501e38-3035-4da6-b224-6a12b1eb71b6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801587, "uuid": "21cf19ed-1b80-4e12-8b16-41fc05e0ff89", "value": "Config_Office__94.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a393b79-590d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779804957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804957, "uuid": "2654d20e-cfe3-465b-baa7-b5cb40c6ceef", "comment": "Malware payload (Mirai)", "value": "e70efc775274e2b5cbac986079bb0c13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804957, "uuid": "02fe5866-c0f9-4d19-88a2-034b952efcc2", "comment": "Malware payload (Mirai)", "value": "c949806414a3c87d0720ac7b146a64361d11100d13c018745fbb5e1036db5b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804957, "uuid": "8804241a-6386-4db0-9be9-96791827f280", "comment": "Malware payload (Mirai)", "value": "46e7960d77089c9d8819e9ee8e7378708f27af44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804957, "uuid": "b0585264-8336-49a3-8b64-daa706bc33ed", "comment": "Malware payload (Mirai)", "value": "fc33453aad41accc994d5a804fcd2400aa75c37ec0406fbddb586c8442ce031c5721a1291f3354adb91e614cb75bf565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804957, "uuid": "45ac0534-d549-438f-b429-ce37a77ea9f8", "value": "T1966302C9DB119833B2400F3D43A9D2F940CDAF84D0C535EA362DB565BA8FD5422AEB66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804957, "uuid": "0ef07fc8-c1f9-4211-b749-c808a9da2e04", "value": "1536:2gzp80uguRS98GDvHUtlv8HcDZH/dTdFvkEJrU4BJu9:HVhCS984UD08V/dT3vkEtJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779804957, "uuid": "9110cab2-4419-4b88-9851-d446ede1e085", "value": 69040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779804957, "uuid": "2862fd25-0ecf-40b6-86d8-ae6e06db47d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804957, "uuid": "a5ee4837-53e9-44a4-90a0-bf778cfb898c", "value": "wife.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3223c305-594b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779831492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779831492, "uuid": "472250b3-3185-4120-be15-83b2c9cfe512", "comment": "Malware payload", "value": "759d6cea485f2b091d99eb194fe0694d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779831492, "uuid": "bc1b63ec-e37b-48e8-a0a3-1ab52e028e68", "comment": "Malware payload", "value": "c96b83fa0b190f3e09f92507e04b821b98eeed9f51a866a75c188ff08baa3b36", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779831492, "uuid": "e521c039-6ffd-41cd-8380-80615ddb576b", "comment": "Malware payload", "value": "b9fb925b1438c70318ab97c582e0b912a7777828", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779831492, "uuid": "18929bbd-2a75-41c2-807e-6feb40a8c418", "comment": "Malware payload", "value": "78ecaae37a621e155d7399448c1f6382ddf5d396bc79a7d412324f16bac3a4a39f4fb1603deaf0f37c72448f1ba82553", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779831492, "uuid": "2ff95f31-73ef-4022-a37f-fce9a38e6e6d", "value": "T112361996140D40E308F9DBB2F825AD8A7B9E02FF5012959C35D0DCA86B6D18B46FF1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779831492, "uuid": "83caf7e3-f705-441b-94ac-754f162a6851", "value": "49152:AfyWx3KfyfJcn3+EOxYsByXiAWaucZWAdyPtNViJSG:PyAWaucZ8PtNViJSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779831492, "uuid": "4b318661-8f4f-42d0-9f18-0933089a555f", "value": 4904838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779831492, "uuid": "d5b41cc1-6457-4f2f-aa98-fa4a5ccca6f5", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779831492, "uuid": "210572d0-9dea-4a9c-a4da-f45babc52257", "value": "wJ3y8ADs9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3d4f08-58ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779799052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799052, "uuid": "049393dc-7308-43af-af6a-4a0f5b545720", "comment": "Malware payload (Prometei)", "value": "948a6509a17c5ef40df9e9c3a3a80ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799052, "uuid": "aa2acbc2-79a1-406a-a4fb-33bf4ce5bfd6", "comment": "Malware payload (Prometei)", "value": "c975fb5bda7f0fadd52896c63026d7ad432c6fe45594b869c9624cf6a2acace7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799052, "uuid": "61c0746e-6c9c-484c-b3d0-7deee6a142e6", "comment": "Malware payload (Prometei)", "value": "48cb7566a01f394a299dc1f23f316fe37d2641a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779799052, "uuid": "f2d180ba-e51b-434c-84d1-cd466177cde5", "comment": "Malware payload (Prometei)", "value": "c219eeb2352abf5e045f28991c95e5965c8d8b02ec91417c9f4b4386fb0e982951934ec63654f0273c1ae653fe133984", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799052, "uuid": "b105cb5e-2fc8-4ded-b477-e23f902c77eb", "value": "T10C866C73945624D8E1ADC974D5141212BEB8388B573863CBBBC476F51BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799052, "uuid": "de9bc539-50ed-4bd9-9334-563cfadf3423", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQc:cqYUQuVDt0TZED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779799052, "uuid": "7e0c61c9-dba5-4933-961e-1e293d35e2bc", "value": 8093696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779799052, "uuid": "d122909d-478f-4b5b-8d85-def0dbf194fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779799052, "uuid": "9012e2f2-1a8f-4103-ad8f-0144d7fdb5ae", "value": "c975fb5bda7f0fadd52896c63026d7ad432c6fe45594b869c9624cf6a2acace7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34eb89f8-58c5-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779773944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773944, "uuid": "6ece2d8d-05f6-42ca-b5d7-fe143ab92d36", "comment": "Malware payload (Vidar)", "value": "6a0f86528d65be2678978f3c70d2cc51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773944, "uuid": "5c7ce33c-f813-4c12-b59a-a2f9cedbc914", "comment": "Malware payload (Vidar)", "value": "ca326af30c7cf7a23b8b05b821da2a9fb741a25625ce37220f9b72ee1d0cbf0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773944, "uuid": "4b35ef34-8102-4bb9-b7c4-d82847b1a3a6", "comment": "Malware payload (Vidar)", "value": "463a67c48f9015be48c111d8b383822e8f19e1dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773944, "uuid": "9b6a8bee-475e-4bb5-a853-4e4e2ec377f4", "comment": "Malware payload (Vidar)", "value": "f1642f2858888710f04b9e45b19852d92ca0389e88b2abb778ed0dfec8443c0b82a2877d41364f9e469e6ccd50d2a4f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773944, "uuid": "297573e1-29b2-463b-b745-20cc14823e82", "value": "T138B58D1B6CA008FAD0AA633289BA52917BB5FC451F3223D72EA172783F767D49D75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773944, "uuid": "dbbe5c3d-dd73-4b47-8a5e-f09f666678f1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773944, "uuid": "9509731d-7085-4ba1-9334-3d34e14cf3f9", "value": "24576:AuiB+dGkmwU5v0XywEaB2hoXymmUXhQIfxE9uJa4tUE0t1SMuhinIP/KBele5SKD:9iBOGJwUGXywhcoi4GQzRSStUnIX1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779773944, "uuid": "46909ba8-dd70-472e-b17e-72b3c253cf98", "value": 2299072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779773944, "uuid": "4d448356-9ac1-4609-b828-b4e00c660317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773944, "uuid": "c0c6fb55-29b5-4d24-bb71-d16c2fd3e415", "value": "biletors.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3dd9a8-5958-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779837097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779837097, "uuid": "bcda0003-4a50-45b5-bae7-e3727301fcfb", "comment": "Malware payload (MassLogger)", "value": "97bb5040962322ea115136f86e1416f9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779837097, "uuid": "1b0c8025-4bcb-4028-9f22-3c32b7da8848", "comment": "Malware payload (MassLogger)", "value": "ca687401049c4fae9fc3d278008361f470f79dcdc20fda5e9e4c482d2a9c7df7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779837097, "uuid": "8f212590-3b35-4672-91ef-49863f12a631", "comment": "Malware payload (MassLogger)", "value": "1f07962d8061a69607c7e830b4ec049cf9fe7e92", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779837097, "uuid": "4946f835-35d7-4c96-a8ba-d09de46b7bf0", "comment": "Malware payload (MassLogger)", "value": "08354c4519f542d04853b63d1c7b6eb6952fd5261b4abca8a9bf0ccb7cd12808e57175cf2e0215ebb40596e90d0b0cf7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779837097, "uuid": "77f0297c-5b78-4f8f-9266-c7c08b7a7dd4", "value": "T1AA65CF5073E84226E1BF5F75E47249048BB3F8A29636DB4F099561ED1EB3780DE207A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779837097, "uuid": "75ab48f2-32fc-4dfc-974f-ab5cfc17941f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779837097, "uuid": "2a892fb0-8cbc-4111-b828-8a2e69bb62c5", "value": "24576:8fedx38vxbIRxJzck+uGW/yFoBkkAxg2jFjHmGOpy+X9zAE5Fw:8fex33RTYjqqanRaXOQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779837097, "uuid": "1f250d8d-0a4e-4115-b207-f2e1677e3aac", "value": 1412608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779837097, "uuid": "a08e6312-d887-46d0-a89a-b648b8e55a5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779837097, "uuid": "67c039bc-8027-4136-bef7-3b8a268701d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5966d91-58b4-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1779766939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779766939, "uuid": "af1931a0-91c7-41d7-af74-eda564e7cadb", "comment": "Malware payload (RustyStealer)", "value": "efdb83670223d1f10f5af92e35fe8ee8", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779766939, "uuid": "c51e5864-5f3c-4181-bf5f-2be8c07260ab", "comment": "Malware payload (RustyStealer)", "value": "ca6be0bf2f87f1998bfe4ba762d59bfa43a574fb011b4d19d587d83763c5c64f", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779766939, "uuid": "0e736198-db2e-4a61-ae23-df2136ce3524", "comment": "Malware payload (RustyStealer)", "value": "b0d52c22a6b6a3c0549e64546bbbc614299fed18", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779766939, "uuid": "5fdd851d-461a-4358-88c6-53490e39089a", "comment": "Malware payload (RustyStealer)", "value": "182108d53008e0d84c4f4df2d84054cc142c5d9338c4b2fa7857d2c7fd8f1b6ed9cbf7d8f530ed6dc01e34570e17c6e5", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779766939, "uuid": "2c226eb7-3e50-4b9e-b438-25005da47139", "value": "T11B566C03E69541E8C09EC075C35B9637EB72B88A4630B2AF5BE85F222F65F605F1D709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779766939, "uuid": "15f0c6f8-d0d3-4043-82ef-d4f39f3be75e", "value": "b8a3ee88e6947271c2cd6a9e64b27469", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779766939, "uuid": "f289645b-c50e-4beb-96d8-cd7cd5d029a6", "value": "49152:MVWPes4fKZ40Pb/+Fk3N80ZNfJHvWyyLiXQtnqb/XMEGY+4jqr35cTztTbN6Alna:MgG2eW/FKH35cjNfBhTGeVz1Jn1BnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779766939, "uuid": "036f78b4-6edd-41be-8b33-dce75c36dae2", "value": 5949440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779766939, "uuid": "713cefe2-86cc-48da-8597-616bda598e3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779766939, "uuid": "6ac7485d-a32c-4231-8a98-4e064a744255", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaba144-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778222, "uuid": "62c9a098-1381-4110-b4d3-a26d2bb5681c", "comment": "Malware payload", "value": "29d5660ff17e11315d264a53cb0d8a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778222, "uuid": "d24ac69e-91b6-461a-9330-95489fbca5c3", "comment": "Malware payload", "value": "cace58e8cbbc1ea316d590f6762c516aecd314bc8499f9b819f3f76cfd4d84d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778222, "uuid": "4566a630-f589-4f65-95c1-402b8baea263", "comment": "Malware payload", "value": "1e4d46ad0e6831d5f8bf1c214a49dd23cf132189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778222, "uuid": "9c16c058-21d3-4072-8167-f6b54550542f", "comment": "Malware payload", "value": "8e10f370cdaf8dfb2cff02ee31fa8d4a71a28c9e3df90176c607522da9327552f7fca676069f1e08ec9a387f994d3455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778222, "uuid": "95e9a1f6-1fcb-439b-a7ed-88cf44bdb881", "value": "T109457D07E693E072EDC5417441BADAF68C2A6219471964E791E06C9CBCE30F13A7E73E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778222, "uuid": "9c88fc4e-c449-4532-8e11-8a18db24e6a9", "value": "d3fe1f5e974a9246a151102afbf605fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778222, "uuid": "08455c4e-119f-4409-9ff7-63b0b03b4fff", "value": "24576:pvYU30gjp9lyaoSWYwVpkJIs7NUaFwugnn3SHWYVcuB:+UEWp7gtPTnn3SH7Vcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778222, "uuid": "8e0429a2-f8de-454f-bb6b-05c5ca7d4a17", "value": 1202688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778222, "uuid": "22600d53-a7bb-4845-b732-0350c2ab4cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778222, "uuid": "ed42028f-a89b-447b-bb86-238436474484", "value": "29d5660ff17e11315d264a53cb0d8a56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc4f23e-5906-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779801960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801960, "uuid": "bf26f1ee-99d7-4a87-8d4e-0a16e1529590", "comment": "Malware payload (Mirai)", "value": "d18af99bcf6589b47e86b4719d746f3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801960, "uuid": "c262f808-6ebb-4b3d-8f98-f629fc7ea861", "comment": "Malware payload (Mirai)", "value": "cad50090e0b22beb375242a4d32befb4b0ca721860a927b4187e7c6eb1341f27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801960, "uuid": "fc421811-8b07-4043-b743-9c112f58ceaf", "comment": "Malware payload (Mirai)", "value": "1f3be3278833ff7a3b00a8bad6bbf1ab0fe1d3e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779801960, "uuid": "81b1af16-7c4f-43c5-9772-c02ebb2f9470", "comment": "Malware payload (Mirai)", "value": "91c75171928f17d2af51dc69581faa51910d68b511d28e09c9ae688a854fecc3c7e8ac28cdaf5b902575f9fc02be9ebb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801960, "uuid": "05fbd649-2d29-482d-9608-b9d54f7d47ea", "value": "T182331A73467ED907C0C2963A02CBC312B1BEABE25318894FBD514F5D1AE43D06667BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801960, "uuid": "c276d5fd-af53-4bf1-9a3c-5a08077a1880", "value": "768:6GRFE4+zA3aVx0VnXwz1gaoe9JUKms80bEe2xEHjg:6GvEgxFj09qvqHjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779801960, "uuid": "901a0103-515d-455c-8ef4-b0be8613b07a", "value": 54144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779801960, "uuid": "de49f410-72fa-4277-a675-cb355967fe3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779801960, "uuid": "d9aee942-2837-4a86-b0a8-f60b3d7ab3ca", "value": "wife.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37796a26-5930-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779819904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819904, "uuid": "031c408d-25b1-4dfa-9051-85c1bfe3509f", "comment": "Malware payload (NanoCore)", "value": "98d1c2050e518dd67c652139fff1f461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819904, "uuid": "4adb3b7e-362e-4b51-b2c9-082c522f4364", "comment": "Malware payload (NanoCore)", "value": "cb2aa2757374dcf03c6dec4079e6b4f6eaf68fdd61731e7e922eba679ee6fe07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819904, "uuid": "414d41a7-f786-42c9-b3e9-b891c4fedfc3", "comment": "Malware payload (NanoCore)", "value": "09b25f67ebc5df9898e61eeeedfe2b78de2848ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819904, "uuid": "3ca7d87f-f043-4730-9c4a-8c6b24c54a6f", "comment": "Malware payload (NanoCore)", "value": "5fa1fce5d33023e6b64298065ce0066626d2ce71d23cb6abb722385183f6a84ab05a3852e3843c0849885292364b16f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819904, "uuid": "f48dba86-bd54-4904-a6c7-8792c83daf6e", "value": "T18014BF2677B94A2FE2DE8679701206539378C2E398C3F3DE28D855B68F167E5060B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819904, "uuid": "28924d0b-4809-45ca-879f-921d4a289279", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819904, "uuid": "5cdee6bf-cfad-47d6-b783-b6dd6aa88448", "value": "6144:MLV6Bta6dtJmakIM5gBGmPDZ1ZgJB6QUWQ:MLV6BtpmkZBGmPDZ1gB65WQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819904, "uuid": "2b873616-366b-45dc-a6be-f56f297fad9d", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819904, "uuid": "29a0d78a-f77c-4217-841f-ab48ebeb6a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819904, "uuid": "d5e7a7a2-a69b-4ebf-b186-5fae81198111", "value": "moocow.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc3ddb57-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "235b1617-520f-4c49-af16-8a23216efbed", "comment": "Malware payload (Mirai)", "value": "467f4af284f81263e37fe30956372b88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "ea87f389-f9cc-4f84-b752-176557a3c3d0", "comment": "Malware payload (Mirai)", "value": "cb6764bdc4076374fee9aba73f3010ecef7358d573bf258ca2c411892d9fccbc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "4a03de4b-db46-4aab-89e3-89a0dac72e9d", "comment": "Malware payload (Mirai)", "value": "a128fa0a8ba1049f175b7dba95515d0ae4d72501", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "24b12c9c-285b-42b2-bf4c-40838b690bfd", "comment": "Malware payload (Mirai)", "value": "0459acae85517d1fa9c56dbe2f9e6dc0e164eb762b4232df8c5e9c61c36fed00d3bc78af09553bd0d05730042b37108d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824449, "uuid": "4c0d5809-c555-428a-9518-8deccd22636d", "value": "T11303E109B5A0B01BCA1F1C3E629A01AE0AD0F1D6715A2B6B5364CCC9FF36D4F94DD8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824449, "uuid": "8e6030f9-33c3-4617-9dce-cee6002fc2fb", "value": "768:jF4o5gt3IEG6Ks1mqDUKf+8hr89kxcEDV/SLXQlov0zBZLvad4mwu0bmQvWP:Rl5JnsrXvrKy9QjyBZLvDmR0bmQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824449, "uuid": "0f1e84a8-c66a-4cc2-90b9-34bb0e07d168", "value": 38656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824449, "uuid": "84dd7342-c08c-403b-bc8c-5263327c0407", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824449, "uuid": "fc6fb4d2-1f25-44ce-9bfe-347ecacc1ad1", "value": "Space.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fda23c8-58c4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779773506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773506, "uuid": "3b990d9d-1bf3-48a6-9dff-65c18b27b584", "comment": "Malware payload (Mirai)", "value": "619c9b4ffb2d11c4c2d6748c9369e225", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773506, "uuid": "22add1a3-c8cf-4b0d-aeeb-e6d9732e0878", "comment": "Malware payload (Mirai)", "value": "cbae20dd4517eeddd0616af03505c0e416f45d0d4da36ad84035dbcf3a94128d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773506, "uuid": "5631b535-578e-4538-bd9e-3ae801aad8c0", "comment": "Malware payload (Mirai)", "value": "7c42684073f6723e6e0e888dfd5db5092549b811", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773506, "uuid": "6124883a-25f0-4897-ba24-77a2e48d0b29", "comment": "Malware payload (Mirai)", "value": "f26f0fa2a81191f95277b58910659f739a12b31177fc08f4fd80d00a6086edfd2fb4082fd39767ac9e9d09e47239d84a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773506, "uuid": "e5c927b6-36bc-48cf-8ddc-e6786026e430", "value": "T12834B71A3A11DFFFF56C863047B38A3056E536962AE19746F25CD71C1F2028E681FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773506, "uuid": "da7f30b9-d683-4b8f-9407-ed6fc730347b", "value": "3072:UnSqqa7/cbPKAJglx8mkg6xAGqxj52LbTiZySK9LkQvSt/2ZI:U0pu38KAAj12LbTiZySK9LkQvSt/2ZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779773506, "uuid": "1d906c16-9a0d-4486-b6a4-751c67870355", "value": 241676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779773506, "uuid": "25269b18-3689-48c1-a0e4-ea061b3c6d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773506, "uuid": "57bd9cb9-e741-44fd-aaa7-5a71a8b0b1c6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060c6fee-5904-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779800924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800924, "uuid": "d8eb54ef-f54b-49a1-af42-4e70cd51bea3", "comment": "Malware payload (Mirai)", "value": "7278d1f6667fc2db83ea6b60f82ebe9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800924, "uuid": "ffbeab88-90d7-4462-9e0c-d76aa63bb109", "comment": "Malware payload (Mirai)", "value": "cc29000e9ccc5ea92cb1f442fffe55839a9ad182f5ec9b090c755f999e27ad3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800924, "uuid": "b5b8eaea-67d9-4706-a42d-b3b919c4f5c9", "comment": "Malware payload (Mirai)", "value": "f85c2bf70c126644ec97735b746389a08c95340e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800924, "uuid": "a3ca0fc1-a8ae-4d69-ba9a-497ed77e4579", "comment": "Malware payload (Mirai)", "value": "cd8117872c862a713fd1263119855056170d0f8ca97e52370243d93deb204e9de5f70c1c730c8135b18a8fedef112049", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800924, "uuid": "876e86d7-686c-4b4e-8128-77c24a3416e9", "value": "T15534751A6E22DF7FF668863047B78A30579877D63AE1C585F15CD70C1E2028E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800924, "uuid": "e34fb19b-7066-4350-b775-5181f462cbfb", "value": "3072:6urnGTh0oIklHQIGl/ZYP5tx4nZ/gF9ALldZ:6RjIfxmWnO/ALHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800924, "uuid": "5142fb28-e336-4414-81ae-b185507d8394", "value": 249476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800924, "uuid": "4dbaacaa-ba3c-486d-8320-be84d76062cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800924, "uuid": "a926d351-8788-4f5c-b4ab-75970ffca3cc", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2702478f-58af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779764472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764472, "uuid": "c1d729af-acbb-4f5b-a2af-73948364ba67", "comment": "Malware payload", "value": "80c0ac801277fe6ff9327722c57cb8ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764472, "uuid": "58858f1f-329e-469e-b847-681a9d77fe48", "comment": "Malware payload", "value": "cc6155c1a3d90100e62c6dfce63089b23527aace541809c29f32a08e9e63479f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764472, "uuid": "ad02769f-5c26-47eb-a649-81d53a176271", "comment": "Malware payload", "value": "8041f86920e16ee80896923e0f81c42541913e28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779764472, "uuid": "6dd1b8e0-11c0-4ba1-b069-1c67520a5586", "comment": "Malware payload", "value": "23643c670ffbe9b570ec66827cf1209dee265ce849eb45acfcb2c9904049d573389ea6ce658083a143c68fd581e5b4fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764472, "uuid": "42bfd7ce-3da3-49f8-bc46-71b56dd341f4", "value": "T1E937CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764472, "uuid": "e360d25e-436b-482a-8529-1110381d52a0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQy:cqYUQuVDt0TZEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779764472, "uuid": "e6520cec-9c54-44a5-900e-1eedbf011817", "value": 23166976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779764472, "uuid": "f1018488-3bc9-4c3d-a700-7d4d388dfef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779764472, "uuid": "93c5b74e-a5d4-40f2-a7ec-304399008363", "value": "cc6155c1a3d90100e62c6dfce63089b23527aace541809c29f32a08e9e63479f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44be8d9-58de-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779785002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785002, "uuid": "0755dc94-2448-41cb-b64d-7c9a5597d275", "comment": "Malware payload (AgentTesla)", "value": "0834c84166d65d40eecd8d22eeb66463", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785002, "uuid": "6d6437f1-5fff-449e-a618-d588add3eda9", "comment": "Malware payload (AgentTesla)", "value": "ccefca3dadeb0decf23622014cf1f40c5ab762cd7d45b8f88f86c4c17e7e6263", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785002, "uuid": "4560ea74-3a9d-424b-8fe1-3d9ed52f787f", "comment": "Malware payload (AgentTesla)", "value": "d3a9cbfa8c77dd0567ba2eff75d0c6d1ae9bc5db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785002, "uuid": "63fc9e82-eb0d-4955-b879-543c0995627f", "comment": "Malware payload (AgentTesla)", "value": "7f822e49a90bfa6fd569a960240c54e755019c5113802b73343a6af047ceecfb4014c4d999553d9dd08903ce82154a47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785002, "uuid": "aa07b089-ccea-455d-abc7-fc1590ebffd1", "value": "T14CC6F1160BDA1E99DF604D9D30392BD90E93BC337C5484FF6AF5300B862E9DC64B661A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785002, "uuid": "9eee9c7e-0aef-4aee-b0a6-1dd38157d8a6", "value": "24576:WCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCg:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779785002, "uuid": "a3e98402-b465-4eaf-8f42-5f0c5110c7af", "value": 12362095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779785002, "uuid": "84900c1d-41a9-45ed-9745-86819daf76bc", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785002, "uuid": "f5005d85-8794-44b6-9b70-5e153cf4ccf8", "value": "Pedido del grupo Cevam.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30afda16-593f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779826335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826335, "uuid": "3b48b270-2c8c-49dd-93cd-7996aa780db7", "comment": "Malware payload", "value": "533daf3f94b91078d5f72aafab0acd47", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826335, "uuid": "0f144efc-7dab-4c81-bf36-33df702c84b5", "comment": "Malware payload", "value": "cd3039264912be93c9d3411b8f2389b3fa609207631105264ca245d067dfdeb5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826335, "uuid": "ca8a36d5-ae09-4faa-8615-c29b56e67f0c", "comment": "Malware payload", "value": "ea704522bd11c548bdc9840a078d5b8a57bba045", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826335, "uuid": "d8b56b1d-01df-4462-ae7e-420f37254c38", "comment": "Malware payload", "value": "f4fa504c64086f7cd0632202910bfa5d9f51e37fe2807cfa7e5c604c631d39539d4eb76c41a18cb293e922178c2876b1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826335, "uuid": "e47ab771-2dde-4770-8a37-6e44d8f5527c", "value": "T1E27513C78AC11D87DED51838AC6B4F745A61C89AF806CA138F32A76E9FD7794CC1A04C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826335, "uuid": "7ab9d8ca-2659-403a-8f05-7c53ad53f11e", "value": "12288:kGKSUL5+jMQcBvI3yqQqHyhpIa1vOHjo3NSM5LvkOBcAu1sVFFsdj:kGKF+j6BvI3y57sa1vAQSMW9Au2Lsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826335, "uuid": "ddeb16ca-a54f-482e-bedf-a4a78de0d9d1", "value": 1614198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826335, "uuid": "8cdda6f9-b767-4921-8a54-e03402e79108", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826335, "uuid": "79f7f730-6fc3-4b97-8834-2d8ad38be0c2", "value": "KiddonsModMenu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce612132-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824453, "uuid": "12fb569d-bbbc-4244-a639-d490d33a19fb", "comment": "Malware payload (Mirai)", "value": "39d0341be1c678e6f4ba44df415256dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824453, "uuid": "dbb0be4a-1730-4adb-8b94-14171d956d8c", "comment": "Malware payload (Mirai)", "value": "cdc0b12db73e31fff93f4e3f4c6ba78a9c5d3b36ab93b5a9f28044297628d1f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824453, "uuid": "9044501c-2795-4dc9-86c3-c5fea8279281", "comment": "Malware payload (Mirai)", "value": "af3917692f2a18d5e73f00ba3e34f378c67a4260", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824453, "uuid": "608a01c9-3234-4e60-b5f7-a75b9cd75a17", "comment": "Malware payload (Mirai)", "value": "6debe4106f640386c9f753b38e99c057e3c8fe6f1a5cf1a287483ff947ea0096e424e808fbab6601f10d6d0a395b9092", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824453, "uuid": "ac858efb-a4f6-45a6-a3f8-b5c40f42d490", "value": "T18F03020BD45A6485D55480F3DA6740823A551BE4E4F972A37350CAE5ECBB8DB34F4F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824453, "uuid": "14eae1ea-a550-4001-bff0-df5d013a033b", "value": "768:KWVVasPGxpBnekBYlk8i0fPkD+bk4nwx/RWUiQ53dic9q3UELyf:KWXasPGxplekBgTP654QwGd0L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824453, "uuid": "d3fcffa4-5e96-4b06-afe6-8c44e38b7269", "value": 40348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824453, "uuid": "7b3bd5ea-7162-447a-a85e-df13d50ff477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824453, "uuid": "a5ab60f5-90e1-49cc-ab05-2523333a89dc", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819f3a19-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783092, "uuid": "38cc9f8b-c594-49b3-933d-25e0e7769dfb", "comment": "Malware payload (BlackMatter)", "value": "50b2838c53073e2ba3b97befe6880e94", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783092, "uuid": "7f99f3ae-46e1-48a7-91a6-87f018d933b3", "comment": "Malware payload (BlackMatter)", "value": "cdc7d79ae4215dccf60882afb6c3abee6b95d9db7c1587746fc8d533d1631e9d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783092, "uuid": "b56715e1-1b34-4539-9a25-a63b63530cca", "comment": "Malware payload (BlackMatter)", "value": "2de73dca581ed0f4bb0308da1e3c8a3f0fa7fad6", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783092, "uuid": "19e75e1e-14b9-44ef-ae1e-e746f7694301", "comment": "Malware payload (BlackMatter)", "value": "83ef220ce2c7e2a54afe850b19b6741dcee01a350bed809aa23f19bee4721acd2b23c7c94025c3e0e0dd418d97b48a68", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783092, "uuid": "414dff96-80c4-4e76-92eb-9fa44ad35e37", "value": "T173E36D21F212D0B3C87718F13736B5B1B3DE8E6C19A96807EAD80F59BCA48232F55597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783092, "uuid": "398ba214-38a3-4609-9e92-1a3d05fcd692", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783092, "uuid": "922666b2-0e4a-44a3-9545-b0a32c401a6f", "value": "3072:R6glyuxE4GsUPnliByocWepaAShLlvg8hHatY2:R6gDBGpvEByocWeMAMhgqatL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783092, "uuid": "083ccdb9-65c4-490e-b709-dffe72bd2238", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783092, "uuid": "c8ad0e9c-34ce-450a-8965-1c53b0f18d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783092, "uuid": "28d309fe-2e52-41c9-b75b-f2b113e71726", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91327b0-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "546ac63d-05fe-4b82-881e-7aabc8db608c", "comment": "Malware payload (Mirai)", "value": "2708eb69481a24ca9181ddae68af7e9d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "505511ba-f269-427e-b9c3-d9bfb386dc16", "comment": "Malware payload (Mirai)", "value": "cee2c24acee5d2fe55acb941e75cb280df4393a3429f1bc6bbb03504a32c2114", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "deaf3822-73ca-444a-891b-2e1797da303a", "comment": "Malware payload (Mirai)", "value": "f4b943d5cd5e63b9e53637291aa6208c8d3a2feb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "09dd1aec-2c41-43dd-9d45-3ea3ec7dbdde", "comment": "Malware payload (Mirai)", "value": "9668d699a0daf6dac2f082694b4c476fdad673d3592e45cb98352740c19e53d05fc32091044be2f2f2195983c9a8d6dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "1a6360c3-f35c-449e-ab2f-6f995cf70c65", "value": "T19214641A3A22DF7FF56D867047F38A30579876D62AE19584F19CD70C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "2432911b-371e-4016-a63d-bcc0e3f6de23", "value": "3072:X4x8pomPwVZ8+q/OojXFVSR+wnkIbYeY2cl+4T:XsDob11VYnvYewlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824497, "uuid": "3346227a-8ec3-4cdc-a24c-5e6218b62793", "value": 208360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824497, "uuid": "79a1e0b9-0e4b-4895-a988-3d60b4c490c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "5eaefda4-5e2a-4064-96ad-9ddff873621c", "value": "wife.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ce6997-5903-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779800522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800522, "uuid": "fd0aac91-fcf5-43af-9ec7-bab6ea0cbef8", "comment": "Malware payload (Formbook)", "value": "70d7c36f97ab23cccf43188f079d1d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800522, "uuid": "a158e857-c622-40dc-809d-b14882c5bcd0", "comment": "Malware payload (Formbook)", "value": "cf124a23a7d04cc37a3b50b952a3917b867041170098e6c938e9f26a0f1883e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800522, "uuid": "27e5fdd7-d6d8-474c-ab34-31deae3f2360", "comment": "Malware payload (Formbook)", "value": "9395703fc486f00100f8900aedf2e94ebea071ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800522, "uuid": "47676fcb-d4ef-4e28-b61c-d983b0df6367", "comment": "Malware payload (Formbook)", "value": "a085b93df6fa56d0a2b5ee6d9da130691d6b693a087b98154ce7d02395cde724a95626d0b45a3963482d128149a3af84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800522, "uuid": "3ffa3502-26c7-44b6-8d0f-c7d037d49780", "value": "T14345EC25D7F90108F1F79B58AEB94416A83FBF161D3CC9DC1148128F4B73949A8A9B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800522, "uuid": "2979394e-3da6-479a-a8af-b9719d6e20fa", "value": "6144:gCYWvj4PONanxR+3YXiWEpSM9AKpLhz/A3qUimPajeSuY9lsi0Y5nYTu5CBjhaYO:slZKAg/Aximy6SuSj0GYJBjrnAEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800522, "uuid": "ccda15e6-ea4b-4eee-8890-7ca92fd1911f", "value": 1190728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800522, "uuid": "9d56802f-76bf-40b1-822a-876960b80e2e", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800522, "uuid": "0e3a1101-332a-461f-9bc6-c23873c46121", "value": "SKM_C55826052111400.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e923d1ed-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "038bcd30-382f-492e-9d1d-78441b086b42", "comment": "Malware payload (Mirai)", "value": "2161bc30d1f9567097501e49482b60ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "ff776256-4557-404f-b01f-ec9a840f5a9c", "comment": "Malware payload (Mirai)", "value": "cf616427277a3a64bff1faefc991b73bdab1a10faaaab992237c3e04721bde8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "521310f7-22d8-42ad-8aef-638a5f08ed87", "comment": "Malware payload (Mirai)", "value": "77bb98e8d829c542bb7309204cc1c7c7e054b995", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824497, "uuid": "fd8342eb-373f-4c10-985f-b77ff953a483", "comment": "Malware payload (Mirai)", "value": "b163c86e6f99dcdea54039bbc92f6531090c26e726af7539a54c3f02622a61e0774fc8eb0ae73458eb8679ca81eac0ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "3aaf15fb-4d7c-4afa-87e5-a41347f5a0e7", "value": "T1D124B40A6B519EF7C86FDD7306F58B0124CCB4572564373A3670EB6CB91A98B09E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "eedb8782-8daa-4e34-8154-2788504b0dd9", "value": "3072:AEIyEInHZr5VjcllSiOERFTb87HX++aK6rv1:D1EkEHiHfa/rv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824497, "uuid": "a27e06ed-3256-4194-98be-c3ef64aeeb45", "value": 210600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824497, "uuid": "4bab148f-0e63-4e5b-9b04-23d096820541", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824497, "uuid": "d5f0327c-4a87-4afc-bf36-f69a65250664", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da89a631-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763914, "uuid": "980e2c56-81db-48b7-a960-0df3b863e334", "comment": "Malware payload (Gafgyt)", "value": "966ac85ec7edc973b223bac9b8166ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763914, "uuid": "eb9845fa-f27c-4847-bf15-422d8dfa8258", "comment": "Malware payload (Gafgyt)", "value": "d002a139db788676ac663843eb1a89b8e8f7f2fa37afb8dd9416ddbccd81e57b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763914, "uuid": "86a031d2-c661-4a0e-99bb-208cd0611677", "comment": "Malware payload (Gafgyt)", "value": "694f7a318461779b65deab823b57d3299cd1117d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763914, "uuid": "b42d038e-1506-4609-b3dd-54cb785af43c", "comment": "Malware payload (Gafgyt)", "value": "a0bc260149168442ad285eca1110d0ccf11deb3d77e90d1ad110aaad44249159b8d92cc662781944dfa07082f2eeb388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763914, "uuid": "4d142ce9-f4a0-42eb-8b64-6a9dfe09a0f5", "value": "T1BCB32A17B9528B02C1C215B6FB4E964976136BFCE3EF3212C9249F603B874DB0E2AD51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763914, "uuid": "db57ac2c-d160-4cc9-b011-3ac081889c71", "value": "1536:KLnB+g4MiIGsU8jUQh5sl+aranNTffIpP1MfirfA6RJZPHjRS5SY45h0pQBAr:YtJUEr7GaNz6fA6RJZPHjwwN5h0pQCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763914, "uuid": "39122b07-e984-4369-a511-a3c99c9c5729", "value": 116124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763914, "uuid": "c7d9db07-c536-447b-8604-1332560b5fcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763914, "uuid": "80c61704-6ecc-4ac9-8263-b39f483e4d5a", "value": "FBI.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30345db2-5947-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779829771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829771, "uuid": "2d91e544-4909-4e2b-9f4b-f9a468f733b9", "comment": "Malware payload", "value": "8f182cd86b839bc9c6a45124030f3ae5", "object_relation": "md5", "Tag": [ { "name": "candles-hp", "colour": "#BC8DB8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829771, "uuid": "3505c567-2300-4b83-b511-6efdb25b486a", "comment": "Malware payload", "value": "d0e4d57538e4d6ae7d1114aec99f7a242f8e88711aacf4021009e3d073be3b9b", "object_relation": "sha256", "Tag": [ { "name": "candles-hp", "colour": "#BC8DB8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829771, "uuid": "6cf35b3c-045e-41a6-88f5-3014bd683828", "comment": "Malware payload", "value": "29783340675d57b3db6b599456f8a8305aa3bd60", "object_relation": "sha1", "Tag": [ { "name": "candles-hp", "colour": "#BC8DB8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829771, "uuid": "76e11d34-d307-42a2-9753-eaad00ae90e7", "comment": "Malware payload", "value": "c0b97438b977ee23589cf5a24477487e971784a2eb6e7e86356852f0c02e827212f1bed3671392397c88f66f91e58855", "object_relation": "sha3-384", "Tag": [ { "name": "candles-hp", "colour": "#BC8DB8", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829771, "uuid": "ab316516-a314-4998-a766-ee4e2217b20f", "value": "T19127CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829771, "uuid": "2c8f3762-f431-490a-bd1e-a644ef5edc7e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQC:cqYUQuVDt0TZEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779829771, "uuid": "e169db71-db88-4cec-bef8-d1b43af2dcb6", "value": 21594112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779829771, "uuid": "69842583-70b0-46c6-97f7-3e88f27ad4cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829771, "uuid": "c12f4c5b-e62f-438d-bab0-d1cf45a59e13", "value": "sample_d0e4d575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a68cd6-58a0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779758326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758326, "uuid": "ef8f4cbe-f77a-4a15-a191-6eecc7a5123d", "comment": "Malware payload (Mirai)", "value": "6023d18458c42a685b27e7253fc2eb20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758326, "uuid": "40186a5d-b7f1-4636-a62e-8aac33809faf", "comment": "Malware payload (Mirai)", "value": "d19ea55c4bbbae6762ae07040f6a9903f4633b40fe2dcc5dbf9aa41eef1ec715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758326, "uuid": "d6557d25-c6c1-43b9-bb05-7c2dd057424a", "comment": "Malware payload (Mirai)", "value": "2c6f9b5a10766fc09a816dc754592a229a3b92f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779758326, "uuid": "a06a178d-e609-4d1e-955a-fd55a74ff828", "comment": "Malware payload (Mirai)", "value": "421bff818ff6f897165a75358b7d09efb2db2f2676a48add5fa1e1324db44bdd9ad0aa8728eb14478e9f18a2bd6a23d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758326, "uuid": "f2a14e30-4919-4718-89e7-ce85e3ecc5d1", "value": "T1B4E32B01B9418B23C5C217BBBBDF469D3B32A764D7DB3302AA197F741F4669E0E2A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758326, "uuid": "bee08d87-7305-4002-b4c4-3eb4e22ffa86", "value": "3072:cXj7flvJFf2ld6AB5QFrQEmyl+9JUHZQL2rnginPQuVsiXrx:ST1cd6AArQbyg9mHQOnginPQuVsiXrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779758326, "uuid": "fdbe7861-f60c-4762-a9bd-a96fac99bf1c", "value": 148509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779758326, "uuid": "0c58d839-569d-4482-9dec-1b5b894a1059", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779758326, "uuid": "804c5fc4-b5e0-4eab-9d20-ff0c791ee5ae", "value": "bin.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0052f1b1-5896-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1779753669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753669, "uuid": "11c76fb1-8640-4ff3-b045-c6c86c5762ab", "comment": "Malware payload (SnappyClient)", "value": "e876aaec6709f547efe67586983d6b32", "object_relation": "md5", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753669, "uuid": "1502e13c-ba0c-43b5-b80a-63cf2f045823", "comment": "Malware payload (SnappyClient)", "value": "d282f92b5c355e7af6b3aa95150a8fe792c1efe718306c4acfa70a25a8f207d5", "object_relation": "sha256", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753669, "uuid": "97942bfd-4706-4f0a-a1de-a982776c82fa", "comment": "Malware payload (SnappyClient)", "value": "4d75fc8ebfbcd4c0f1dd415b4aad065ed8160e8a", "object_relation": "sha1", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753669, "uuid": "b25767a8-c39e-4853-b1eb-3e5aec71f638", "comment": "Malware payload (SnappyClient)", "value": "b5b78416f250be5e9e18839074deafc2806f9c09d429d150c17cd9124606d9a199547323f9ddb9e122b8b519328a38b0", "object_relation": "sha3-384", "Tag": [ { "name": "178-104-222-124", "colour": "#CEF9D2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753669, "uuid": "f693c3d9-2a6a-4845-bc8f-45d13617c150", "value": "T1591691D87AC453F06929ABDC8753B4CE0794613E6FBB184C02E148BD3D0AE1766E4DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753669, "uuid": "36a113f1-2754-455f-b86c-034f7d636411", "value": "49152:z1Tohbv/PwQ+y3QUF/Q6QBFHRFyyjriF9y0QQWyMFNdFvyvyhytQyy4CFJrcyTye:r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779753669, "uuid": "22613749-1617-4962-8228-620ee512de8f", "value": 4242131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779753669, "uuid": "07cb85bd-7802-45e4-9fdb-bc76904a2d6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753669, "uuid": "ec65bc7f-2b53-4f77-9905-ef8557d0ed87", "value": "fbcd81e7-6d33-4933-8fcd-351cc5fc3522.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a82a67a-589b-11f1-a769-42010a9c0008", "comment": "Malware payload (GhostPulse)", "timestamp": 1779755915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755915, "uuid": "4ed23e63-6eb0-4ad9-9989-f2c6c8a927ce", "comment": "Malware payload (GhostPulse)", "value": "31ca651c45df6ae738d0066987ab4156", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755915, "uuid": "ff7f1b21-6ea2-4080-ad29-d1ac11071d59", "comment": "Malware payload (GhostPulse)", "value": "d28c7e1fb7db6117c741cac2a5819385de3d1ee51fadc475c15536f5549b4cb2", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755915, "uuid": "ec644087-74e1-4395-8756-034e9fab8eb3", "comment": "Malware payload (GhostPulse)", "value": "ff5bab28860f6c5df7cecdf71b471afd7e3195da", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755915, "uuid": "cc1156e0-ef61-4806-aaa6-1fe424a3831e", "comment": "Malware payload (GhostPulse)", "value": "2b848225c8aaed54eb11ed9946bfc272e01c00697cfb644192f17548bd609b7a439e8045d7c87407500c878709b1e8cf", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "66-163-113-238", "colour": "#9B047D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755915, "uuid": "ecbf8e25-cf0c-41e7-ac48-c2e562790330", "value": "T1EEF63310B38856A0C17380729F8CBB4821F7FAE7578E7B4B55811E696FD11A6920F3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755915, "uuid": "60fe927c-7cd8-4763-993f-fc8c9e50f6d2", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755915, "uuid": "88a7699b-42a3-4452-879b-4aea0fb8772b", "value": "393216:+p36fds3kO/D8+A71bXNc0V9Jcz5G6+n9mFwFldexQ:eRNQ/1b9c0V9JXTnQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755915, "uuid": "925707a2-e9f7-4640-b2bd-b42569435ca3", "value": 15803790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755915, "uuid": "d4e122cb-2746-49a4-85b9-13287c3f033b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755915, "uuid": "308b09b4-d5b7-4b7c-80e1-4dc61deeed82", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef3e7c2-5899-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779755358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755358, "uuid": "9de1604a-6da3-45d0-bf17-9976c899a97d", "comment": "Malware payload (ACRStealer)", "value": "ae08b06697b805aa5cb4a81b93265a94", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755358, "uuid": "a87515b6-7b1a-43ce-a2d6-a113f2e73344", "comment": "Malware payload (ACRStealer)", "value": "d353d849b0a656ad633b677bd3413c5da9975bfac34c90927b948ee1289f058c", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755358, "uuid": "810c4d18-af6f-4c7d-9b7a-9bfd7adf9021", "comment": "Malware payload (ACRStealer)", "value": "00e812d582de6fc59deafdf2af068c9dd41911a2", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755358, "uuid": "8ab88504-f016-48f2-b32c-0375ce484799", "comment": "Malware payload (ACRStealer)", "value": "f8c51886914a3d2b6c08d6770f8e7765cdaa0116384286b746b1075b404c993314ba05e8315c1137cbc766eb086ba822", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hertzfigblob-icu", "colour": "#DBBB17", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755358, "uuid": "7799153b-bb8e-4a1f-8249-cbbf7d9fd810", "value": "T1ABC58C01FCD384B2E406173299E662FF37359D0A4F329A97EA447A7ABA776D50D32301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755358, "uuid": "d1816eba-e623-433a-bc11-233f10db7d79", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755358, "uuid": "599467d0-a470-41b3-9b3b-fb2ad8ed7fd7", "value": "49152:6ldibOU4DU8TW/ac3EH85bTFULXnvKIUDqB9q3p:6ldibt8T9c3EH+HFULXnvKI52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755358, "uuid": "2d62c2c5-ea3b-4633-837b-f0336175313b", "value": 2604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755358, "uuid": "7963f2ef-28ac-48cc-8d87-96f3fe860d6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755358, "uuid": "05f4cfac-f5a8-4e21-a0ee-6e98f33739a2", "value": "kliulij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90996848-589b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779756059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756059, "uuid": "a7ffff46-07fd-43f7-8698-8bef976fb9e9", "comment": "Malware payload", "value": "fb5d71f049293b9028e30f4691bb0444", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756059, "uuid": "b1925570-94a6-4acf-ba80-28691d49dfbc", "comment": "Malware payload", "value": "d364a2f6997fd4874ba180207f6785151532c0fd3f014e36d44f330d50037191", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756059, "uuid": "9a622a6e-4dc6-4074-8459-b0078935ab52", "comment": "Malware payload", "value": "546e5e6e3ba6f89a226c516a7eefdf9a9516028a", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756059, "uuid": "b40b6586-d8e8-4338-967f-2a71ff69aca7", "comment": "Malware payload", "value": "e86a85ff82bf93d27bb5a736a33572320bd62e313e1aa162fe7bc64b952d2fe0085760958403d6139902b43b5f73da54", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756059, "uuid": "d30e83c4-7872-4850-bb8d-8e96e542efc2", "value": "T111A5122679DBD8DBE654867441A0C3379730B7788AB34A5B7C58047DCA633DB2E26F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756059, "uuid": "9c0c0174-c94b-42da-a46e-42a528b0c875", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756059, "uuid": "9f1481a9-69e1-4933-99d0-f28e2ceb896c", "value": "49152:zjYwKC9ZVotfJZ/gU/6k7+r15ZyGwi33NN:4wWrvA1XyUnNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779756059, "uuid": "720c7139-a1bb-465d-8916-fb70153f219c", "value": 2224128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779756059, "uuid": "65082079-6204-4a59-a3a9-a0fff5de8777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756059, "uuid": "3ea008af-a8fb-414f-8b65-d1920b2e2685", "value": "StatingConnectors.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83f67a5-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784472, "uuid": "6a250b81-7102-4510-bfcd-292f9ec8da7c", "comment": "Malware payload", "value": "a4e091171c8050d7cebfa9dcd3b1198b", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784472, "uuid": "1513c18b-b32d-403a-81e6-a4cd486767eb", "comment": "Malware payload", "value": "d3eb882d32f38c23b5a08fd4b50e71713f6c028728eb859ac1eca421f1b10069", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784472, "uuid": "a32826e4-d3f2-41d6-9aa9-cd131e59b9c1", "comment": "Malware payload", "value": "930e1a0cdfeca491c39619a0b24e235e69267f99", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784472, "uuid": "4fd615fd-ce2a-4881-bc1e-cddefb1f277b", "comment": "Malware payload", "value": "417d8d425734ad81c1ddac8a434c7327e8dcfa6092f92aa122536ff28b2dc328287b66e8cd6d50204fca14311aaaccf8", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "komari", "colour": "#D28B4A", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784472, "uuid": "65ce3296-26f4-4341-bed7-d9c0f2228ef9", "value": "T12EC2C653AE9909F61458C6742F8B510AE31562C702516C28BBFD73187F84B1E93BEE3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784472, "uuid": "ea0911f2-f461-4dbf-8a90-685d7171be20", "value": "384:8Pk4vuLcgw3N8lVqv8yEUCAC/vsMxD3kIuuNRasi5kFq2dzu3AQvc6sbB5uIFyJ:8xV3NMqv8PjFU47asLxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784472, "uuid": "fa6ea6a7-7203-491e-a3b8-f5313991fd7d", "value": 27634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784472, "uuid": "5eef3e94-3b1e-4d1c-8f6d-7dc1598c928f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784472, "uuid": "65cd3583-3d72-4a08-a2d3-2c7d4647b9ab", "value": "d3eb882d32f38c23b5a08fd4b50e71713f6c028728eb859ac1eca421f1b10069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403efb4e-5903-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779800592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800592, "uuid": "d1ea4e4d-ab1e-4920-9ef1-00bb4abcae36", "comment": "Malware payload (Formbook)", "value": "14001425f377c7ba40d2458963f933e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800592, "uuid": "d4293fc0-d84b-4da5-9b8f-e1ed017ece38", "comment": "Malware payload (Formbook)", "value": "d43657135da7882b8e1e9f258981462260da25153cc370587ac8597c3f0ddeca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800592, "uuid": "7c4f0218-204f-4471-aedb-d3c8091d5ee9", "comment": "Malware payload (Formbook)", "value": "85d216c6e53ba1dd1fd068e2a4c1a7827f4c7bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800592, "uuid": "60567375-4064-4664-a45c-10b543f11d88", "comment": "Malware payload (Formbook)", "value": "82f5160acb7987c26b958e2ba6f0f9e1426bd60222dc2512806b664a82550b6ab0aa5dc1d9b9d0e40dcc67c1ffeca1ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800592, "uuid": "2c7afe5d-c6fe-4b51-82a6-8a89c0b0ed9c", "value": "T1B8E56C17D66F9B4E18093B51006A5D9AFE89CAFCEF72BBC4E0CF90B614EE1110B451A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800592, "uuid": "73df535f-71a4-4ecd-9dae-dc859c0419ba", "value": "49152:Tb5KRHXu+jAkClqrLvsakC5FPod7Zd3LNtPqjXF7hGTDiW4ECf18PoNHim:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800592, "uuid": "5eb3f12c-f2bf-4bd6-997b-da5d3317026a", "value": 3089299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800592, "uuid": "4ac23d17-7a6c-4dc6-be29-1537f341d622", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800592, "uuid": "9a5de3c1-5578-406d-8337-76d7913df024", "value": "REQUESTING QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ccf7d6-58c6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779774427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774427, "uuid": "2f6a949f-7f63-47ee-a111-a068a71e43f5", "comment": "Malware payload (Vidar)", "value": "0126e5a2527f990118a3e437042c4db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774427, "uuid": "a2603a0c-3fcd-4620-a4f7-9c5656815f2a", "comment": "Malware payload (Vidar)", "value": "d4b6905ef14c2c13a69b31585be4a6a8e49f0918f1ef1406936b7f6f7ecc37b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774427, "uuid": "c83ccfff-5824-47be-b3e4-6c5f7dbb5bf7", "comment": "Malware payload (Vidar)", "value": "3fedade486777ed9f85729c0fb1addbebc6b264e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779774427, "uuid": "27263553-1d85-416b-a81a-afed117dff0f", "comment": "Malware payload (Vidar)", "value": "a61c64f4e914804304c168feaa292be72e2fff16729160861409f737ea6c01df9291b02489d8443a48ba6826126e90fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774427, "uuid": "47217d72-e50a-4de0-8273-0d3a89ef2822", "value": "T19045CE05737970F09E97C32F12D52624CAFFB5762A64C6898350C88AFBF4589682EF53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774427, "uuid": "d192b1aa-5952-4f7b-b842-b9e2a8f6b665", "value": "79b5ebc59d23627580ac969ff6636ef9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774427, "uuid": "b2a7d703-46fb-48d9-9168-f0b7f05ff5e8", "value": "12288:Y28U8L5UgcVglsL8qDyITyrHZY8/OCt9tXxvXfkQaSN77RywKQOH2CHK1:Ymg84qo28lNhZb1AvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779774427, "uuid": "e92fb09e-0be7-4472-b9a9-7a92ec1f3e1c", "value": 1235456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779774427, "uuid": "0ba073ee-9efa-49b2-9ca4-bd76cb3ef912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779774427, "uuid": "30d0191d-89fa-49e2-9079-9ad5ceb30689", "value": "0126e5a2527f990118a3e437042c4db3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2b942c-5933-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779821364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821364, "uuid": "248b6af1-2766-497a-9a9f-5e5a9eeaf566", "comment": "Malware payload (Prometei)", "value": "b012ae8c6c7756c25a119889285ce999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821364, "uuid": "c470551a-4ba9-4008-ad32-f5c6df177b79", "comment": "Malware payload (Prometei)", "value": "d4d8ab6524f349bb970d16e8ce5a12cc559ed6cb26707301690bc8a2f93e3ae8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821364, "uuid": "18089290-807f-454b-b7e7-b68d876caa84", "comment": "Malware payload (Prometei)", "value": "f253c1942f25c3c6a617832c34b99f6990d9df04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779821364, "uuid": "6b0f7f40-adea-4285-adbe-7353fc27c2b5", "comment": "Malware payload (Prometei)", "value": "a2ee2de0f87528f4a68ce1ce474f42e87fb9b5d4022b3a366e51b76efeae3f3edd5e45c8b46f77783e96f5e94e471dbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821364, "uuid": "0f1ab7cb-76c2-4744-9010-f90c38d6bdc5", "value": "T15AA423B4F9219E9F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821364, "uuid": "d958f306-9951-4e68-967e-467c500002f7", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdS:Fs6pyCC/Ya2hpi6T6N48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779821364, "uuid": "be676de2-ecc4-42d7-9bc5-1844c2bfb649", "value": 449073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779821364, "uuid": "cf3ce5e6-342a-4130-ad2e-b577da71049e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779821364, "uuid": "4a3acd69-e911-4a12-8060-1596c4deed65", "value": "d4d8ab6524f349bb970d16e8ce5a12cc559ed6cb26707301690bc8a2f93e3ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf58e4e-5899-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779755031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755031, "uuid": "57a349a6-1a7f-48ac-aaef-5baa84d0634b", "comment": "Malware payload (ACRStealer)", "value": "cd1d120f31b2510c6a68d4f4d294f594", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755031, "uuid": "c8899fa9-8d03-41e0-bad0-82bba8e854f3", "comment": "Malware payload (ACRStealer)", "value": "d5655568fee9c610139d41d367afc74e768e1c8baf70e37912e9ebeb27b5d411", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755031, "uuid": "b7d497bf-64a8-4b67-94e0-8774793596dc", "comment": "Malware payload (ACRStealer)", "value": "734fac0febe2f81724ea584b15ad5a0a7f04ff20", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755031, "uuid": "9eebf955-e5ce-45b2-a3fe-f02d9a2b878a", "comment": "Malware payload (ACRStealer)", "value": "9143f9a66f1b5a74e5d0569166d8f5e5e2ca54aec74ea777af4052089f002b8f8309a45dda65a226355ae76a6e41b24b", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755031, "uuid": "ba8f08d9-8a5d-4197-989c-fc4c6830af23", "value": "T1B1B56C01FCD784F2E802533299AB62BF27359D054F369B97E6547ABAB9736D04D32302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755031, "uuid": "cdf95440-52a2-4593-862c-2ae878b845f0", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755031, "uuid": "312afea1-2ebb-414a-a532-9c8fc3fcd842", "value": "24576:/wTudZT+wOfL9Fejo2UyGfbPjzgR7UeywlYEEbdir38uMR//niWNskSdMLOC1T6e:/FSH3Xey8YMrYfvF1tfB9vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755031, "uuid": "717ea0fe-fb25-4344-ac7e-39eb6ebf0721", "value": 2463360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755031, "uuid": "ccf0b1aa-cf7c-4b01-ae78-775273cf75ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755031, "uuid": "a28bf549-c068-402a-90a7-4cad31f6a2be", "value": "hjbk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74aa4f7c-589b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779756012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756012, "uuid": "603f8062-297c-483c-a54b-5ad026c495b8", "comment": "Malware payload", "value": "774a5f3425acdea4dfb0ef5ba9681617", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756012, "uuid": "06b1c35f-f0af-4168-9cb7-245bd9dcc1c1", "comment": "Malware payload", "value": "d59dc2f22167b0a44bf103d664842112981d4b3dbe62f7a27e671cddbbac9d73", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756012, "uuid": "3ec1a146-a8a0-4c2f-b5d5-bbfc0605a502", "comment": "Malware payload", "value": "ea0a9e34f94d4eff98477b9e33316afea71b2655", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779756012, "uuid": "39e960fd-693a-4b7b-ad24-b46dd93f59e8", "comment": "Malware payload", "value": "63dd1a0884ad43ed1b47a9c0c3668751949c14fd5373c9dd534ba8558e19a4e28fe54c0ab2bdb83e669407cf3ab2c412", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore4-sbs", "colour": "#6D905B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756012, "uuid": "32230d2a-e220-429a-839b-f68233381c32", "value": "T1C795128222C5207ED0770F3338644761DF32FD614637AA9F19B266FA989B9F24A74F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756012, "uuid": "2b5daa22-1c18-4dc7-89a6-906872ddf48a", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756012, "uuid": "a317cd81-e0cd-4cc6-a1f2-a109cb492756", "value": "24576:bjqzQRN1/p8fUu2WowQXnmpYl0lAa/LSiDhOiI/Fc+sk7eU2sO+G2AQRhzIX:bjMQRN1o2Ysvl0xFhOiIC+lev2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779756012, "uuid": "47031cb6-2022-4a00-92a1-68c73565d760", "value": 1921024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779756012, "uuid": "7bf1e6e5-1445-404d-9272-594803b27bc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779756012, "uuid": "aff81d98-a66a-45da-b0bc-c569bedb5899", "value": "SomaliaCruises.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a04efd-5916-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779808726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808726, "uuid": "121d323e-8fe8-40f9-9c3c-dbbea53dc493", "comment": "Malware payload (Vidar)", "value": "6dbad80951844cb24dcf0e8aebfab74b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808726, "uuid": "752f21fc-6415-4a96-9e90-8eb680b199ba", "comment": "Malware payload (Vidar)", "value": "d738c9e602299272575832a8803ab2e185a816fb37d989a9d38ef9f08a6a812a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808726, "uuid": "500ee96d-5da5-42c6-87ca-8406746b212a", "comment": "Malware payload (Vidar)", "value": "fdfb4df62877b3cffed8881270550b970116babe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808726, "uuid": "87683325-0855-4243-ba6d-cc6b485a344d", "comment": "Malware payload (Vidar)", "value": "031cbbb09ae01bab1a721ce138f227aab3c3946d150181918ced8eeb2fa68c769f66a4f1a5733a1826f96763f735a4d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808726, "uuid": "229e4a99-3acc-498b-a4e8-06ab99eb6c35", "value": "T1B4B58D1ABC9005FBC066A3334DBA6291BBB5BC4A0B3227D32E50B2783F766D49D75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808726, "uuid": "7eb3cef5-5289-42d3-968a-0b323c194867", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808726, "uuid": "cefd7927-4529-47ce-9148-e33c6007aaef", "value": "49152:aLG5w21GKMdtRc9+1yGc6zd5PPzoZ9IUL+ukYb89:aC/f9/6z/kiUKulA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779808726, "uuid": "5a6fecf8-3483-4474-8e30-417d61444d17", "value": 2413704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779808726, "uuid": "a8b59d7e-4aa2-40fc-9b4c-d33d5e47e612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808726, "uuid": "da5276e0-c632-498e-beca-2d75454ba547", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed052ef-592d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779818736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818736, "uuid": "d8db6a8b-9a0c-4f48-86fa-fdd927ab50c9", "comment": "Malware payload", "value": "ad9783f38fbb594c73ecc84e577c27d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818736, "uuid": "a744ddef-dbba-4bf3-a3c0-f52f98dabc4b", "comment": "Malware payload", "value": "d776d4add97c7179506ffe40c2a10bb72b17c360e3568ddb498ee8aefef57341", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818736, "uuid": "f5e44b12-a7be-450d-a0c5-b085ff884104", "comment": "Malware payload", "value": "cae730f847756e509557bee656714f9546737c09", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818736, "uuid": "50774cc5-3d83-4802-983e-a495f3026d22", "comment": "Malware payload", "value": "2784ed0c1a61dd431f6da6c6d28b121437b32ce8948f4a3711cebf6794ff9c99d2af3abfdf400c627e9007c9019310c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818736, "uuid": "25741cad-6828-4509-849c-24acdc5abb7f", "value": "T136137D6566853C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818736, "uuid": "79c99ca0-5ec0-41ad-b19c-9528e5b6fc23", "value": "768:PXRWNGxVN9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:plxYcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818736, "uuid": "cb00b32f-3938-463f-9402-cf024b500d08", "value": 45514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818736, "uuid": "ea95bca4-6366-4fb4-bb61-ab971af18184", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818736, "uuid": "6f6ab62a-86f6-4329-82d5-95cceb4fc334", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1b3532-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "3d0b4669-4c8e-4552-95d0-ccc7c10a982f", "comment": "Malware payload (Mirai)", "value": "b5eba8c721abf465b37db3ac63ecdd0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "b190365f-0723-4870-a118-b9ae6d57ee28", "comment": "Malware payload (Mirai)", "value": "d8e7ff27d07bb2b65e99c48f427637cd02c242e427691c8e5b1d0bf6de9b2fdc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "f1419aef-4463-49e8-bf36-04c8c8b179ce", "comment": "Malware payload (Mirai)", "value": "4011821a1a3288fd47b4f993f55b3489300f08de", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824449, "uuid": "f0c8f193-df65-42a7-a406-90ee7b3d8d79", "comment": "Malware payload (Mirai)", "value": "f950cc0420fad81b582d3e928d279e844afd9d55a84a1a52f0576588876f8173df0072c13bd0a45fedaed11d5b63aefe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824449, "uuid": "c34959f7-f1fb-484f-9253-9e69bb080604", "value": "T17DF2E175C19C4FD1EE6A9FF42BC553D97BE80E4B23118CA37102CF519B025068A9AAE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824449, "uuid": "056a3088-f859-4654-aef9-b2bffb38a70e", "value": "768:teDRJ7WcwHDB40LYBm1A/PWyi7yWr/iu2pr344ZQ84uVcqgw09G:tCRocD0Lu/PWUWr/iuurI4H4u+qgw09G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824449, "uuid": "d4a68b86-4372-49ec-8334-5208d9334423", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824449, "uuid": "bde59f39-6644-4ffb-8758-9a7d3759bb75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824449, "uuid": "1aae875f-63c6-4e4a-86b4-b6bc87aa3b38", "value": "Space.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0638de-5908-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803029, "uuid": "e81e0d9f-3455-455e-abf9-b6c8ea77397c", "comment": "Malware payload (Mirai)", "value": "a757fea9d2bf6fb7d1fcca76b75df35a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803029, "uuid": "84fe2e0c-1cfc-4f34-89ab-175966ba8fb4", "comment": "Malware payload (Mirai)", "value": "d9413f6192032c753f4241440496f492e9fd3256975f29151a26701c19817e47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803029, "uuid": "0040d7a4-0f62-4cfa-955b-ff03f51021cd", "comment": "Malware payload (Mirai)", "value": "f67b518741b43e1e5cd3c19bb31e4be457c923fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803029, "uuid": "fee16565-3a32-42cf-8f80-bafc0e09c636", "comment": "Malware payload (Mirai)", "value": "4df3f8fd0b9907714bf34ce8eca40efa094b65b3a0dc70d095c0246f620ddcc4b4d065bbd4eb016ed24e4147934dbdf8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803029, "uuid": "373747e0-ac29-4cbc-b39e-87f26b28d685", "value": "T195530135F8CB4CF2F7AC5E7548D5ADC913C20EEAB2D74FC29942AF9AB900048525AD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803029, "uuid": "102e8810-b483-4d43-9f01-2ca9a4f54a16", "value": "1536:pk6z1bLiqqVhrEbuSP0p1XrPaRkt5MuzhtjQAq0JdZH84u+qgw0t4A:pkeizXCgDamAuVlFRnc4u+qgwI4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803029, "uuid": "7f6c9fb1-06d9-4c30-8448-63765ff0bc05", "value": 62548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803029, "uuid": "12617d71-e36e-44ab-a8ec-e2ee1ada6df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803029, "uuid": "94fe8d7c-3604-4372-ac1a-74506cc6a33d", "value": "wife.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8899b37e-58e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779786110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786110, "uuid": "6692d8c0-a131-427c-b0e2-61fdfe40b90a", "comment": "Malware payload", "value": "a0196c8ece6e3449956e6b35b3a97832", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786110, "uuid": "0f8dd186-547e-4dd4-86a5-101d06144523", "comment": "Malware payload", "value": "d9e90237914c2b57eadb9cfe85dbe617b9a1553e00b0c19dcc2b4312c71ab9a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786110, "uuid": "dbd13842-d1bf-4500-a9a8-7d247a5116c0", "comment": "Malware payload", "value": "cbc58538a844c6913a8a57714791bb257512e60c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786110, "uuid": "85ef8569-120e-46f9-8d18-4903f796af4f", "comment": "Malware payload", "value": "32ecfc04f5c29442dc5d613f13bfcc62f422a9f3964471f79849b1e53cdd1ea634db985aca728564896cadff265acab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786110, "uuid": "71e5dd12-b07d-45b7-9fcc-039b15380787", "value": "T10507AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786110, "uuid": "6818c746-4e4c-413e-9b57-d0c5db18d3ab", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQR:cqYUQuVDt0TZEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779786110, "uuid": "c7b1c2d9-d5fb-4c15-a8de-70f2440c1fc2", "value": 17956864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779786110, "uuid": "7873c737-7283-49b6-939a-213eb58c9e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786110, "uuid": "fc8b70d1-a5f4-477d-88aa-78600f624ba7", "value": "d9e90237914c2b57eadb9cfe85dbe617b9a1553e00b0c19dcc2b4312c71ab9a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afc2262-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779784343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784343, "uuid": "65354e33-fbd9-4d6a-b8df-0fef681b55fe", "comment": "Malware payload (Mirai)", "value": "573905c487b4b5a8d41d0d0c706d7045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784343, "uuid": "8942dea2-3c66-4005-bd0d-05941fe27ed7", "comment": "Malware payload (Mirai)", "value": "da742e29ac2c731b3c7af7c1593edb13fd492c69ac894251c40ba4945734acb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784343, "uuid": "c83a4ea9-fe63-450a-8ea7-38346719c3b0", "comment": "Malware payload (Mirai)", "value": "7decda1e9b12d7ec94f5b3ed8a5f18f01620f353", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784343, "uuid": "3d55c148-d4e4-415c-9206-381e380a98b7", "comment": "Malware payload (Mirai)", "value": "870489c6099c10f8d86429dc9970e806323fdcc3ac4faad4e99e84666540918e1b6caea3290621a6420d2e4452e797b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784343, "uuid": "14221787-493e-49e0-a624-191a83092359", "value": "T11475339311450F74AFD3BE3980147D8AEA60DEB54B7EB3B8B27496741943BE6B230835", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784343, "uuid": "32c12f0c-37d8-494e-b2d0-5af7fcbb4b0f", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbVlGttgKAmxn:EpCKabVQ+9qlNlpjN8H8JZGtuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784343, "uuid": "646f0a39-79f4-4e9d-b055-08be19b25393", "value": 1572864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784343, "uuid": "7833f234-3b6d-4f56-a554-45a60614e3d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784343, "uuid": "7b441e79-957c-4773-94cb-7f317b47b969", "value": "20260525-201951_sftp__home_ubuntu_redtail_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c2f6a00-58e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779786116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786116, "uuid": "924d4285-cee0-498e-8d16-3dbdf74ca6df", "comment": "Malware payload", "value": "a197462944ebe1fab61ba57dba73bfac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786116, "uuid": "a7518154-307b-45dd-890d-c47b5f4c525a", "comment": "Malware payload", "value": "dac1cd07def59d6fc3c275017c98ddfb00a7d2d46780b9bc13f05760620b09ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786116, "uuid": "15ff69ab-491a-4060-968b-65fde6cf519b", "comment": "Malware payload", "value": "0ab8a31870767387e07271f9531a996a0d61a8a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786116, "uuid": "b88a0420-4a0f-498f-8028-f03e69356956", "comment": "Malware payload", "value": "e2cab7d0d77ee51188db72df9b58ecc109eb2cc686616550d307cf88dace387c685b007778e297998825076825f202a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786116, "uuid": "fbe6fa56-5160-44e0-9e13-0a4be6961b5f", "value": "T1FFE69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786116, "uuid": "ba009f2e-993a-4066-9c5c-f876cc2d7c09", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQc:cqYUQuVDt0TZEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779786116, "uuid": "d31d3f76-3a43-4096-8a5f-3cb2243c7d7d", "value": 14974976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779786116, "uuid": "cd2bccc4-0f1a-488c-954b-008181308a69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786116, "uuid": "97e7d503-f096-4149-a9d8-f26636f6141a", "value": "dac1cd07def59d6fc3c275017c98ddfb00a7d2d46780b9bc13f05760620b09ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9eaca8f-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824526, "uuid": "f88c8eb9-c019-4e49-a024-41a2a0a0197f", "comment": "Malware payload (Mirai)", "value": "837b33e0a3ca52fa067d0a8c00b57639", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824526, "uuid": "6d9bf04b-6666-4aff-a04f-7c614eaef820", "comment": "Malware payload (Mirai)", "value": "db352489e2056e82b98b9a678324039462b96dae3d13757dfb820f7fef1a4a1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824526, "uuid": "10f3c140-b50e-47b3-aa06-37764df09510", "comment": "Malware payload (Mirai)", "value": "bc0d473b43edc718475db404aa5f008eb6a6a1bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824526, "uuid": "d739aa06-ec55-45d7-a778-f0b710d37906", "comment": "Malware payload (Mirai)", "value": "d3ffafdc316bee86acd7231ec930b4585d915a903d9a99f0c537bcefc164b4b564a192e7f24b7594ee9389a3a33bcbc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824526, "uuid": "d3856f5e-5f91-4909-bbbf-286f7907876a", "value": "T14583285AF9818B11D4C5127AFA1E164E371347F8E3DE72239E24AF3037CA52B0E6B855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824526, "uuid": "d35e44b0-0627-4ee1-910a-613ac83db119", "value": "1536:Gpn2EgaNGvcV+2sE/7iMPUNBREZEfSHYMac6f3cIIhniT4Bi9gn7O45zYtA:BVE+2dmTEZCSHYMactW4Bi9gnS4V0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824526, "uuid": "ce421487-9883-4e45-90ef-9d5d55da887a", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824526, "uuid": "d00ecd65-974e-4a95-888f-8cc9788b25af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824526, "uuid": "66a2b507-bd2a-4207-a7bf-d0aa814b8a4f", "value": "Space.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64572794-5915-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779808383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808383, "uuid": "bea9c222-10bb-41bb-aec1-3030e74af4da", "comment": "Malware payload", "value": "17de57585f9840d830a8aa989f6ea02b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808383, "uuid": "c478c437-74ae-467c-aab4-e651190f5b12", "comment": "Malware payload", "value": "db4c234a950279b3fee6e07157fd6c6e9ff082f8a72211749a0a3eb84a3bc0f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808383, "uuid": "3f381582-021f-4b3b-9966-41b40e3dea4f", "comment": "Malware payload", "value": "d8a7362cd4eb787512fb79618bb2d40ac52d772e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779808383, "uuid": "c28f35df-6b9c-4ded-be38-e3ca97ad83c8", "comment": "Malware payload", "value": "070d3a8e47df3a42be50239ede8f7fd971c54ae350baf7157e08a67c838068586cdf82995e2163ef303d4b9965b4a2fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808383, "uuid": "6046c8c6-d27a-4759-8632-fd2478ec5cce", "value": "T10725513DDAD5001DB0B29A14BDB5040FA4677B522A3D894F12C9128F4F7390DBBADB6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808383, "uuid": "68a41814-73cf-44f9-b2e9-63df789b818f", "value": "6144:szzXUtuyELiPwARCAYaPcubd1JRY+KVHRtZnBwzjEhUxVhiK9kBw:GXZiPwA0HKcaYTRwKq5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779808383, "uuid": "d9b30e58-efaf-41a4-9bc4-824f93963b65", "value": 993354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779808383, "uuid": "5af2de28-eb22-40eb-b1d1-13ac5ac25ce2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779808383, "uuid": "f46cf709-1ed0-461f-b7e5-e54cde80ab29", "value": "REQ For Payment Invoice FER480120002600086230-800119_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c39f8b-58da-11f1-a769-42010a9c0008", "comment": "Malware payload (BlackMatter)", "timestamp": 1779783069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783069, "uuid": "0a75a6e7-731e-4947-a295-0f421d602525", "comment": "Malware payload (BlackMatter)", "value": "2d9f62b80a942820dda57f5fc77122ac", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783069, "uuid": "8edeea86-4628-4f45-8ff3-7d452dde9f99", "comment": "Malware payload (BlackMatter)", "value": "dc870a75269409d7ccee7984b7c2b6b03f29aabea10a314bf1a068aba23452e4", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783069, "uuid": "f1216d33-7055-453e-9c94-dc677c20f1d7", "comment": "Malware payload (BlackMatter)", "value": "70a68350627248ad98aeaca735c1a717c868bebc", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779783069, "uuid": "4bd3d59a-4b83-4d49-b196-a0c51d16734d", "comment": "Malware payload (BlackMatter)", "value": "1de398237a377e18d669afe18b177a4ba5217a913428729f7872d56b732a6dafd06f2667d6d0926395769a19f3964dd9", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783069, "uuid": "a6366c8a-e475-443e-b198-1b7dac1522c6", "value": "T11FE36D21F212D0B3C87718F53736B572B39E8D2C29A96807DAE80F5DBCA58232F15597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783069, "uuid": "1a71cbd7-28bd-4bf1-8c33-4e0963c9a243", "value": "41fb8cb2943df6de998b35a9d28668e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783069, "uuid": "d62a4a54-5edf-48a6-a70f-d3a1d0eb51e8", "value": "3072:A6glyuxE4GsUPnliByocWepZfDsmWono13N:A6gDBGpvEByocWeLsmznA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779783069, "uuid": "d8c00393-8901-496f-83c8-545eff831cc4", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779783069, "uuid": "fe04ba23-e58b-40e5-aa00-2b15e902bef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779783069, "uuid": "a324b33d-ef14-4dcb-8db1-77d95d3248bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5a002a-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779800313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800313, "uuid": "a43a0fd4-a2ad-4148-81ee-7dcd30f06391", "comment": "Malware payload (MassLogger)", "value": "2e51860c77cc0912431c58d98f976af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800313, "uuid": "473addf8-d5ac-4bc9-bdbe-9dab73e5d5b1", "comment": "Malware payload (MassLogger)", "value": "dcd3ac2042e9b2122791a11679b8d4bb6170286b2b5101655ad157cb6c7c8077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800313, "uuid": "011e33a4-4775-48be-8563-d41fa64cdeec", "comment": "Malware payload (MassLogger)", "value": "615275a5df58e6d7b1869765bdfd97189fe6c5d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800313, "uuid": "b7ca3a76-293a-491f-8b0a-732855deee15", "comment": "Malware payload (MassLogger)", "value": "78693b88fb0a8554e9d81e7510f4523518b28cc2c6d97b7aae76a192c35b957d2fb3bf23c3140e669383d6a0f331c4bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800313, "uuid": "a838c308-90b0-4d0a-8837-35284e849ec0", "value": "T187B55B17D66F974E180A3B51006A5D9AFE89CEFCEF726BC4E0CF90B614EE1110B452A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800313, "uuid": "7735f84c-a8a1-4b8a-b704-15567b778cb3", "value": "49152:P4AT4VFD+Qj7U6Fl9Zk9RE9ALBLafey0fPjhPYJf462/nhjRNbo:7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800313, "uuid": "be8a3711-acf7-4419-b1e8-f8040c328c9d", "value": 2475101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800313, "uuid": "d6a635a0-63b8-46f0-be07-bb8539c53eb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800313, "uuid": "b80d32fb-1a51-4a2f-9c26-38c335e925d3", "value": "PAYMENT SWIFT MT103-20262205.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0849f788-5903-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779800498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800498, "uuid": "8739a61f-41c9-444f-b51b-923a20c54873", "comment": "Malware payload (Formbook)", "value": "949e081d6f191c269f38ced3f10520ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800498, "uuid": "a1660b1c-0fa6-4ff2-b949-faf9c49776e1", "comment": "Malware payload (Formbook)", "value": "df6f087bbe332de8def4d842f8c22a4cd48d46e735e31d84e9485595fa5ccd7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800498, "uuid": "83bd41d0-3407-4f4b-a80f-77181b05f12c", "comment": "Malware payload (Formbook)", "value": "190734f0ad15ab0b4f3451b541d36b15246463c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800498, "uuid": "40571d20-8010-4345-9b2c-5eabd4db688a", "comment": "Malware payload (Formbook)", "value": "48b573f17304e0e07a76f04fcc9185b05d514e88d6b49151caac3effc3e21956621d946f840f0c947aaa4e9d161b8d27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800498, "uuid": "7879dc8c-7e8b-4852-9ce8-073fd8f86ab4", "value": "T19235FE69D7FA070AF4F78AD4BDB51412983FFB162A3C8D4C1195028D0B7390DA969B2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800498, "uuid": "421dc85b-7b2c-4933-9787-22013cd2a859", "value": "6144:ob8TidG+SOhcfnqQuHnHpr5nVa0l+Noqa8O6YIC75n/AJyswjj86Tk0JoC:A3huqBJ1n4hO6YJ5oJutJoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800498, "uuid": "487fe2f4-a871-4a75-8668-ef9b3f3abbd3", "value": 1081362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800498, "uuid": "eaa5b7f2-1d52-46d3-b4ee-3e3827e58300", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800498, "uuid": "15143c18-3821-44bf-8f7e-e39f3913127c", "value": "Power of Attorney.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd60f75c-593a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779824451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "a985613b-e667-4395-975c-0340c1b8f60a", "comment": "Malware payload (Mirai)", "value": "d52c19d80bd5ed40604b00af83379afc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "94618bb9-ed0f-43e8-a49d-6d955aef3fcd", "comment": "Malware payload (Mirai)", "value": "df9db293def911f76943d9ca44399a43b3d4659816ad271bb4741b6b81f639ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "980ba23a-e1a6-4c89-9411-b97f86741d7b", "comment": "Malware payload (Mirai)", "value": "c733eced59052fa9e61512c57e54eef3de96fa43", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779824451, "uuid": "d70e400a-e5ec-4e6c-9bf1-e5dac0c076cd", "comment": "Malware payload (Mirai)", "value": "e738fb9a9679a6412c9ee1aecd1788bb8f527b56fc50804a048f646526fdba9030489cebd49312a045077aa4a4fb9f0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "b77d70d3-2373-4621-aba8-54de9005fda5", "value": "T1D683198BF800DD7DF80FDAB74463490EB931E3910A931A377767BD93AC721A54826E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "003e360b-9375-4915-a497-5627c3103538", "value": "1536:wv7sC9KZb55+W8aclslcjYAht8f489k0rTUhrIpu1HT7ot4O9I/nPaiD:w+5NWpdht8fsnrCupQ9I/PaiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779824451, "uuid": "5d6b824a-4b3e-4d92-97c3-470a927c70f1", "value": 84956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779824451, "uuid": "e3a8f3b7-9fa6-488e-8524-887cab18aded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779824451, "uuid": "17995227-01a0-4612-8c8b-280e3e42158c", "value": "Space.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700a7346-58e3-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779786928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786928, "uuid": "3d22727a-119c-4dee-99b4-3f0c9f792cd9", "comment": "Malware payload (WannaCry)", "value": "ad832e5c4c66871e9f00a3f49ea612c1", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786928, "uuid": "6a2ad2d6-0040-46d6-9f7b-5fe0e838a901", "comment": "Malware payload (WannaCry)", "value": "e1484f2769f3b64d3c72c607d528b6f3cedbc6a6b056c5059d1769e47dd89d17", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786928, "uuid": "96f02fc3-ddfe-4cfa-b985-82da85bb6f08", "comment": "Malware payload (WannaCry)", "value": "4a56edfc09778017cb84934102f7eca7a162b2d1", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779786928, "uuid": "80b51f45-8822-4f95-ae8e-cff058040604", "comment": "Malware payload (WannaCry)", "value": "ff621fa454b3c596059b5f09622dbc2770d2436359b4ed3e0d4ae7ca879028117b08ccc982e30931e1b0e4e30d448304", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786928, "uuid": "28f398d7-c643-444c-bee1-eac138c356fe", "value": "T1BC368D06D9E41B90D6F14BB6697B8700537A7E848D5B921E1764A02E1C33F0CDEE2FAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786928, "uuid": "9c7e41ce-2ccc-4631-bfed-f8ee60114746", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786928, "uuid": "78a49c1e-1dc1-428b-b3f7-9d663ae063b8", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DXDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779786928, "uuid": "fedb76a4-08b8-4b06-b2f5-19547ed921ab", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779786928, "uuid": "c10560de-24de-4fb0-bb20-9611302cfa4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779786928, "uuid": "35ce687e-5393-4419-a876-ba3b376c5652", "value": "e1484f2769f3b64d3c72c607d528b6f3cedbc6a6b056c5059d1769e47dd89d17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bd9777-5903-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779800703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800703, "uuid": "311885cc-534b-45b4-ae24-547991723716", "comment": "Malware payload", "value": "1b80bd5a3abbd087d4d3077fbd7a25fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800703, "uuid": "4fc800ad-f7f2-4f98-ae4c-07a62948fbf4", "comment": "Malware payload", "value": "e18bb2cf3bb47f70b88734774d4386126fac93e14ebc08fcdf6d0be68c665e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800703, "uuid": "89225aea-bde5-4ba0-81ce-d9afd98d1f0a", "comment": "Malware payload", "value": "7de4c1de7ac1431770b96a2748189c3979ca6ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800703, "uuid": "c91b791d-72c5-487d-8350-5181664a2f8d", "comment": "Malware payload", "value": "b89280f1c8d8e0f1f3749e8090a5c66e176a3d4736790a30d084567f5dfccd80b9e536d97299f7cfa2fc4dc0f53968d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800703, "uuid": "61ae4556-774f-4f03-aaa0-dafd31cf0e2f", "value": "T19F353229DBD5041AF1F38B14FDB74432A8377B512A3D895C11C9128D4B73A0DA9AEB2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800703, "uuid": "50deb460-2863-4a33-9962-28070a4a5a62", "value": "6144:22unfDbFZrLwYwa7v/NfGPD0I38zNvnYGU0NUDOL/YdqjZ5NZfiKIsBbWIK:2ffDbFZrLwO8Qz5APDOLP90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800703, "uuid": "3c8edb56-f262-4c74-b472-b2998379ba6c", "value": 1102684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800703, "uuid": "ce08c793-ba09-460d-aa14-ebebc57342bf", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800703, "uuid": "02f9e58e-1ec8-4426-be2f-dc926e5105d9", "value": "INQUIRY 2026SP0519406.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae9d957-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779776504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776504, "uuid": "fbe538be-1b27-4957-bc7d-cec90271b181", "comment": "Malware payload (Mirai)", "value": "6852c83fbf49b7fc4d25b23fbadd0eff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776504, "uuid": "318a43c3-188c-4a84-9447-2165eb6bc94f", "comment": "Malware payload (Mirai)", "value": "e18cff4653b4926388bae9a73d4e2c4b4fec54f254d1e79850ab79b9d7b40962", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776504, "uuid": "356f6664-feaa-4bd0-9ae2-815070d380b6", "comment": "Malware payload (Mirai)", "value": "de5ec7a374d7415a988481eea0d59043bd1fae30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776504, "uuid": "42771ac6-aa39-4f6c-8dba-0bf1aa142d71", "comment": "Malware payload (Mirai)", "value": "b996709626551dc71f27f23ff6a13e24507cde415da5702b1a4b43358c14b26057ddfc71244945699d1a4ebe29d68949", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776504, "uuid": "352b1633-4cac-4d91-b269-6a2addb361f5", "value": "T1E934F6076B918EF7C89BDD3306F6871120CEF4172564772A7278DA5CBA0A54F49E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776504, "uuid": "79e1becf-5eae-4a53-92dd-eca07f30b6a6", "value": "6144:QPg3bkzmx9PxuwjbTiZySK9LkQvSt/2ZI:vrk0PUMbTiZySK9LkQvSt/2ZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776504, "uuid": "1920e43f-31c3-4efd-a9c9-0f333ee4e8c2", "value": 241737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776504, "uuid": "8a20a774-13b6-4dbf-9748-dc0d1bfe2105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776504, "uuid": "3a2744a5-bae7-4446-8227-b1bbdb9f3a3a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db472175-58ad-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1779763915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763915, "uuid": "650981dd-94a6-4edb-a979-57609bb54c0c", "comment": "Malware payload (Gafgyt)", "value": "83d3fe5cd55b3214dcd56f57c4e8e103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763915, "uuid": "30fe010a-b77c-40b3-a7bc-6bad652df8dc", "comment": "Malware payload (Gafgyt)", "value": "e315dcde7eafda86084fd24beb16cdabd3af1f2ed8edcb9f18495ffd84e002b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763915, "uuid": "95df99c4-8e42-4bbc-9974-8e20c49e275d", "comment": "Malware payload (Gafgyt)", "value": "8363d3fbf7282bf6e27ada1899716da951dabb99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779763915, "uuid": "91c5443b-f4f9-4d31-9d46-3dd953c30d54", "comment": "Malware payload (Gafgyt)", "value": "eee692e99660751343ba7bf18f2e6aa8ee2ec98b68f6d43ffef4e43b0e372a833a0a8fde0ce676d683ab59c35881c990", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763915, "uuid": "8ff93bfe-3c25-4b60-a451-e26c705620e9", "value": "T117B319037B0E0F83D1573DF02A7F2BF1979ABEE215A4A184651EBDC062718B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763915, "uuid": "1e277bf5-1a47-49ec-9ae3-bcfeb1c2a334", "value": "3072:itI3YiaM5Gj8iOirEZfODakSFG2wlu5h7pLg:iC3YmYrEZOdYG2B5h9g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779763915, "uuid": "f552c4b3-0ab8-4c57-bcd9-0252af60ed18", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779763915, "uuid": "64f0aaa0-b48b-4853-89c9-18172e7896b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779763915, "uuid": "4301b5a8-b126-4783-94b6-143a891b25c4", "value": "FBI.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ad141e-58a6-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1779760815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760815, "uuid": "f16369a8-84d2-46f1-8d84-0a9d1b9012fa", "comment": "Malware payload (Vidar)", "value": "7f9242c19615f97e2e0fe5e2c8c16a0a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760815, "uuid": "f223e08d-d9ba-4f03-861f-5d7504636b54", "comment": "Malware payload (Vidar)", "value": "e43152523ffafcf62d0ca052f8675de83663d9c84ee74beb2606456ed63d4d82", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760815, "uuid": "732fdff8-566a-4078-ac91-f9e9a0e65f5a", "comment": "Malware payload (Vidar)", "value": "83c4ba82b297a9c8ce2431c83ed78fd417240078", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760815, "uuid": "ff3f59ec-1e3e-4e30-bfb1-68558ee3065d", "comment": "Malware payload (Vidar)", "value": "bb02d58f8513e61b8e1e06eb1a884320a92f745e45872ceea39cbec38c3407cbddf67ee5861e2497406cd6b407b09365", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760815, "uuid": "562ea42c-b12b-4b44-bf83-f21ab078c062", "value": "T17E056C16872353D5F83B9037D55BB787FC707C128224CE7B0AA01E8666A2626673F35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760815, "uuid": "32734de2-8431-48f1-b10f-b23934e07d81", "value": "e99e1d3fccfc3e99082e2d2cb4760ee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760815, "uuid": "9ba44103-29c7-4390-af79-41ae3b063887", "value": "12288:qyE64XCnAQoDN13t2k/MtnBvRva1yCQjV0fD+1hHPyxvB0J9Kmkl2rz:Z4XCnAQWN13tOtBvRy1jQJ0f6/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760815, "uuid": "cd830c2f-9dcb-4b82-829e-3c5e204472d6", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760815, "uuid": "12dae68f-40d8-474a-9aff-26348be88dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760815, "uuid": "fea44620-3aed-499e-bbcf-2818e4522785", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507f1770-5932-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779820805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820805, "uuid": "010f0c43-7085-46bf-8ac7-be9a1390c3fe", "comment": "Malware payload (NanoCore)", "value": "7fdd406f858259f82b9692d8858e9446", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820805, "uuid": "8ed47ac4-09ea-472f-90e3-51cadb254d40", "comment": "Malware payload (NanoCore)", "value": "e48f1c56d011b1cb99607a39092d27abd11cf544b80bf7e539406ca34fab2556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820805, "uuid": "b9ce8c6e-bb07-4fd9-8eb2-5871f21b7cd0", "comment": "Malware payload (NanoCore)", "value": "6a66d8b5a0138b0476b572f5f99827352cc38096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779820805, "uuid": "39f46dde-dfaa-4b92-9bfd-deb64945f5b3", "comment": "Malware payload (NanoCore)", "value": "650a39d5304f47f5d859f337dbfb5cb300813288a9c660835be87fd8cca1eb8a21768044ae50be38603ba7b9280d4612", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820805, "uuid": "8ea2072a-df53-4554-9d5f-854a77a9ac90", "value": "T1B514CE167BA88A2FE2DE8679601612129379C2E3D8C3F3DF28D854B65F177E10A470D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820805, "uuid": "b091db83-a7cb-4e8a-a661-99c2d9eabe38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820805, "uuid": "6f906934-279d-43ec-b713-d4ae77754b8e", "value": "6144:MLV6Bta6dtJmakIM5TZmvN1onPN5rjfmQ8:MLV6BtpmkZvN1MNR18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779820805, "uuid": "ff86f02b-307b-4571-9e94-dc46e1b2e5c4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779820805, "uuid": "775f43e4-15b1-4cf6-bb22-d4e8d830dc49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779820805, "uuid": "eeb87462-5b2c-41f3-af0d-f6e2e666699b", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ac18bf-58fe-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779798663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779798663, "uuid": "280628a6-904b-496f-875f-81a02bcbc9cb", "comment": "Malware payload", "value": "fa6a2f9878deb8d161224baf9ee5f80e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779798663, "uuid": "668c5825-593a-4ed6-a25e-859c2ddfe918", "comment": "Malware payload", "value": "e4bbddec03cc83260dcaf596aaa3f19421c51d445b875c10b6a482b92095d5e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779798663, "uuid": "89e84447-c6e8-480e-9507-9df1b6bb3151", "comment": "Malware payload", "value": "a89befbfc56f559cdd746158d93cd4dbfc355c97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779798663, "uuid": "a41184e1-0da1-470c-b8e9-14f745740e0a", "comment": "Malware payload", "value": "f0181db28ef347c949c02421e6d1026b84948d1ed82426fd7ab1e6b50f99c8206b080d59f83a26e6389e7a2067de0bb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779798663, "uuid": "2c1d345e-a3d3-4f92-9ff4-49ad6d554192", "value": "T12CF69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779798663, "uuid": "2b271efc-d9a4-4a2d-a627-756f84823ee0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQA:cqYUQuVDt0TZEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779798663, "uuid": "1204e568-afdd-4890-8eb6-ef12157a2770", "value": 15335424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779798663, "uuid": "52243ac5-cc10-411f-b182-b3fa118118d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779798663, "uuid": "50adaf15-dcf6-4cc6-b172-f0a6dabb7bf6", "value": "e4bbddec03cc83260dcaf596aaa3f19421c51d445b875c10b6a482b92095d5e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2144ea0d-5907-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779802258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802258, "uuid": "91e9a583-444b-4072-aeca-a4ceb15992ce", "comment": "Malware payload", "value": "65ad96b1a0430db35b7f663c4c6bbb78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802258, "uuid": "6653c7dc-b401-464e-8328-23a62ec8f73e", "comment": "Malware payload", "value": "e6f3ec48c889e5900fb90dada659ffa40d8a42f3b41e6c14fba5971d9d21ce16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802258, "uuid": "d39f731c-11be-4851-b83e-d35e7a3decae", "comment": "Malware payload", "value": "4ef4358f3703dcb942bfa2dbdd286570f9b731da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802258, "uuid": "f5346d3b-dec9-4deb-9f5d-7ffb6bc4d728", "comment": "Malware payload", "value": "19b8111d4eda7c939e7074853b27eba27ceb840cf7b57abd21811345e883fa097abc3872bd98ec7e7ebfe7dedb38d649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802258, "uuid": "b2e42fff-e20b-4bfb-8e5e-51ebf0ddb148", "value": "T15AA5F857F49590E4C0EEE174C726A213BEA13499073437E36FA19AF11B26FE4A6BC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802258, "uuid": "cdb61706-6824-4bb9-aef3-119689b21193", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0+:cqYUQuVDtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779802258, "uuid": "f3626e01-ea2e-4c72-ab1c-70945f73f5a5", "value": 2260992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779802258, "uuid": "6b08eb5c-b247-45b2-83b6-b95ec719d040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802258, "uuid": "f9feb177-a994-4e1a-adff-af74ad19a935", "value": "e6f3ec48c889e5900fb90dada659ffa40d8a42f3b41e6c14fba5971d9d21ce16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b408a3-58f3-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1779793754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793754, "uuid": "5ac3d735-b538-44ec-822c-455d3498f05c", "comment": "Malware payload (MassLogger)", "value": "f6dd4df354e861957179addac1cdf135", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793754, "uuid": "06c1aac1-cd0c-4ebb-ae6c-8541afe4fdf5", "comment": "Malware payload (MassLogger)", "value": "e73fe6ede66c3865b9fd19ec3b1c26350316a376aba898b9de6be425e9e9deb2", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793754, "uuid": "e8d543e2-866a-4e98-8de0-49b71f437d45", "comment": "Malware payload (MassLogger)", "value": "3f49a43846d3047610aea747d76c762c141976a2", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779793754, "uuid": "c952d25a-4df6-4388-9dcd-31649f6d8f99", "comment": "Malware payload (MassLogger)", "value": "acb197fd08fced146080f68e6b60a8f0ab9f5e4f9c035770fb25a1f699a94dcacc3c9b60821a9038f2d3d3e855142eef", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779793754, "uuid": "d2ff5eff-f290-4fe8-a54a-d107a6990182", "value": "T1F7B5233641C7DB4072701E70D6CAAE679A1B94D42FED0A78649FCC93D990F2CD016EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779793754, "uuid": "e6c6ceb1-fb3d-494a-9971-539dbdc23ee2", "value": "3072:N+vUe9yFcGRTZl2E88eluIYhTKdTfw/DGWcgRS3STiilzUPIghX9V6t3M+vYJ4at:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779793754, "uuid": "06f72b02-2a0e-4e9f-8118-23b4aa1c61a8", "value": 2426606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779793754, "uuid": "8a23429c-27a5-4f47-9a2b-527fa54d675e", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779793754, "uuid": "614c7890-105c-43d8-8515-4a571caf27f5", "value": "rrckk9946632.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88673d99-590b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779804149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804149, "uuid": "078f9dee-91df-4a2c-adeb-cb5bcaacd7c6", "comment": "Malware payload (Mirai)", "value": "34650a13eebb4ae8b84775b3ea15da65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804149, "uuid": "8b666ac0-7f68-4315-94e7-e9274cc08ae4", "comment": "Malware payload (Mirai)", "value": "e7e42aa0e99a1672ba3050a7e909a8bd989561f88c741ed6c17489ab101c82d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804149, "uuid": "f2951524-c466-4298-a4a9-c668cc3e040d", "comment": "Malware payload (Mirai)", "value": "1a6e893d4b846bcc2bc308125f9725271394a126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779804149, "uuid": "3ba0933c-05ea-41af-a341-8a0d192588c5", "comment": "Malware payload (Mirai)", "value": "7e6ef37ddba21c06f5a759451458d660a6d6d4268a145530220d533c7d5eced3196ec44759fcd038bc074f72e5ef3670", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804149, "uuid": "f6af083b-6f7d-4e3f-a2a1-76d2905b1973", "value": "T190B33B86E793D0B9D91711B041A7E7396770ED720220CD5ADBA0BFF19871FC2A15A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804149, "uuid": "0d027e2f-2ea9-4baf-abe4-c00e4cae31ef", "value": "1536:DUdVf4ETDnvDmB65PQp+kOInfqzyIWqSkUy31cDZQ0VsgQQSktOJwnr8:DUdVf5TTKB65P4+dQfqzyrBI6ygSzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779804149, "uuid": "50323c09-f198-411c-b1b7-f45564fb8500", "value": 115132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779804149, "uuid": "2e1d63cc-3750-4f98-8d8b-bc0ae3ffcc21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779804149, "uuid": "d42702cf-0866-4a60-8d5f-f96e60274159", "value": "wife.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edd38c1-590a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779803515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803515, "uuid": "ea033241-8ba0-4037-94ff-e11ca38b348f", "comment": "Malware payload (Mirai)", "value": "d145c5aa7849c6047bf0dca4d1220b1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803515, "uuid": "5ec2e821-0aff-4979-a206-56a73ad03839", "comment": "Malware payload (Mirai)", "value": "e82a755d6a0495df44b5e221a1b83624b745eb9ac36aa172d97137e561c2eb42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803515, "uuid": "194d6421-c22c-46d9-b60c-8e0ecccb7eb2", "comment": "Malware payload (Mirai)", "value": "6b7726840d84491f3d8d379f9b482072cfc3e5f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779803515, "uuid": "81bedbf5-7418-46ac-94b3-42d9b4019248", "comment": "Malware payload (Mirai)", "value": "2bdebb76027510483d644e71e8b94c2dbad367a17a3cedfbd3445563546ebabe5188ffcd367e9a9ad791e9f44377e0f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803515, "uuid": "cee478eb-6fd4-412c-873b-578c7172edc2", "value": "T1CEC3E81F6E259F6DF369833447B74E22E39833C62BD1C185D19CE6115EA038E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803515, "uuid": "61842179-b39a-45b4-9835-58d36deb6e6d", "value": "1536:Q/X8Ruuvhc8DrYNc3pCFUsuMZkampTcG5bo0Eu5s2Fej9Gr:fRNvd6isuna5G5bvEu5sPGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779803515, "uuid": "ab857124-316f-439b-bf50-be5e33cc0c77", "value": 118384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779803515, "uuid": "86eb7189-21aa-4b1b-81e4-f5242f35c1c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779803515, "uuid": "b4feeb65-b0bf-4e59-a7bc-2ff4fb0d69c6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e7c3d8-5899-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779755313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755313, "uuid": "0de858d8-dff6-43c5-b819-9350f380edc5", "comment": "Malware payload (Mirai)", "value": "384caa71080e435adeaccbff22df971e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755313, "uuid": "9a1a1499-08d7-4a07-b482-ce9feb3cf626", "comment": "Malware payload (Mirai)", "value": "e869174da22d2e674ff466a44569cf952bb5deabad5baf2baadf74dc00cf0b32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755313, "uuid": "590e98b3-2dd1-49a4-b0a8-1256836cd980", "comment": "Malware payload (Mirai)", "value": "7de207ff88344e4a99d60e42046fa41c7c282683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779755313, "uuid": "1fa214ef-fabd-4357-8936-5dab169e99b2", "comment": "Malware payload (Mirai)", "value": "96bf499591f13980568bbef9091913cc74bc06b5cde386a6f647d38940ab5e5f191bd0851f6322dfd8cc7264a9757387", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755313, "uuid": "1e9f387c-4f14-4723-a802-7d3d67df3f73", "value": "T11AC36A32B9750E2BC5D0693A21F34732F1F6479A21AC9A0E7DA10E4DEF357503217BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755313, "uuid": "a37f363c-fa87-477e-902c-90ba27d55d81", "value": "1536:ORJZVjLld699qM6QWjVu7QZIVma8PoxzTMFBuJhb9zSMtv/P3NWj5St3ZQQVUtej:kPnlELWA7Q9a8PoxzAnahP3N+SJ57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779755313, "uuid": "4986a641-f4b7-4f61-8489-d840a3498dea", "value": 120316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779755313, "uuid": "405e6892-30d9-4650-bae8-0f5d0925c29f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779755313, "uuid": "9f27af77-99fc-4f40-b085-d4833b80a3e1", "value": "bin.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899f0bb6-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784394, "uuid": "efa59a39-08d0-4e6c-b3b3-fd5352b3ce21", "comment": "Malware payload", "value": "ca4132ce769d7e8f41307b5a3ae9b590", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784394, "uuid": "602dee00-d277-4d34-8455-f32442f8accf", "comment": "Malware payload", "value": "ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784394, "uuid": "ca801478-7169-496c-a807-dc434cfc1ca7", "comment": "Malware payload", "value": "1d258170a4325ba9b82d338ad41c334ba56df3b1", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784394, "uuid": "0debf935-9f84-4fe7-b9b6-103e854d076f", "comment": "Malware payload", "value": "e716f396d70d8bfc180a0917c05c565bb915ba0a0d86fb13be68ae3a990cc42b5f77bf3025898ba5bc10554336e484fe", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784394, "uuid": "e118941b-310a-4bbf-af22-dd0fe402c6e4", "value": "T146A1E750112C1AB17246697AD26FFA52B90ECC1B0A7B7B358473A63C74F9DB8E03D6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784394, "uuid": "2ac41bce-535c-4541-bb49-f000c3925624", "value": "96:XRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:XRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784394, "uuid": "38ef25a7-4cce-4a37-8f78-593c51e9b171", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784394, "uuid": "8e786416-c84e-42bd-ac4e-cf15ab3edfa9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784394, "uuid": "c6a2c2ae-d7df-424f-b883-8755c93f3438", "value": "ea73a088909b53110444807188562c406c6c6c89b3748aee016bc996ab1f1318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b93eed-5897-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779754157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754157, "uuid": "894b67cd-fe0c-4d47-b435-1d0d9cdc7bf3", "comment": "Malware payload (Prometei)", "value": "5b8e66688962830f740f3a1fd1fdac53", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754157, "uuid": "bb602598-c6fb-4fd2-aac0-8bda72048fc4", "comment": "Malware payload (Prometei)", "value": "ebc0dbc9238ad6f0cfecece14fb8d8180b5cc2eac93dc016ceefbd693e0815ee", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754157, "uuid": "9847cfe9-6f3c-4541-9843-d59982de005b", "comment": "Malware payload (Prometei)", "value": "f6c7c9b8bc8447a1120e5101c2012d92e2c33d0d", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754157, "uuid": "aca6ba80-035a-467c-8bac-a40699e5d11a", "comment": "Malware payload (Prometei)", "value": "e7412c567d65fd1bbe1eaeb2aee80dd55e7b79bf517f63fb8f371bb1f317223fc4a32742788192dde5ad96ac6d38a42d", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754157, "uuid": "9a1e563b-cf98-4e56-99b2-baa693a5b3a7", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754157, "uuid": "50221dc2-081a-44a0-b2fb-8ad4933a399a", "value": "3:FZwURyWdcW6:FZwURyWdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754157, "uuid": "69e8d75f-de47-40a4-a937-71fc79ee504c", "value": 31, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754157, "uuid": "1ceb847b-bb11-4038-ab62-e5128fef4fed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754157, "uuid": "d8c1003b-4ee9-49b5-938f-4202afe159bc", "value": "ebc0dbc9238ad6f0cfecece14fb8d8180b5cc2eac93dc016ceefbd693e0815ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154d8708-58c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779775609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779775609, "uuid": "cdc5ed19-d271-41ae-a01d-d82374584922", "comment": "Malware payload (Phorpiex)", "value": "1ef357a9018a078640e29531a9ffb98c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779775609, "uuid": "26f5a55f-0fc8-4bcd-ba86-24a1c7ee566e", "comment": "Malware payload (Phorpiex)", "value": "edd6ad227595d25c2cf6cf41d2ac9b6640b2e977aabb2d07eea58fa500b6db19", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779775609, "uuid": "025d9a54-a115-4786-ba25-01d792241a87", "comment": "Malware payload (Phorpiex)", "value": "be220257d1503e4fb1dc2b7be777304d1aa9a341", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779775609, "uuid": "adfc9a51-c6ed-4ed0-9202-64b81cdd7731", "comment": "Malware payload (Phorpiex)", "value": "a86fb34f6507a0096f9ed642524ecb0ce28aecfe902eccb1a3793a8578ee73354275f2ff4c335717f5c05ec447c31b97", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779775609, "uuid": "440c1daa-66a4-41d5-bd9a-02d44e2c61a6", "value": "T11B824B0FF981421AD1E100B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779775609, "uuid": "182cea5e-a120-4bcc-a773-c1172f4bdb4f", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779775609, "uuid": "df2f6851-4270-400e-9c6a-0b3b1cfe74bd", "value": "384:kHIJlVYeryskwEd0ZHu9JgiL7QWav8U9cu:P80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779775609, "uuid": "946876d2-5b01-4e2b-9ce2-7cefd39ee18b", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779775609, "uuid": "a76eb8e1-3f38-44c0-b6f9-c89e6aff1adc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779775609, "uuid": "335f226d-fb65-457d-b29f-f26638b649d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada40bbc-58eb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779790467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790467, "uuid": "8fd8dda8-9c89-4d3b-a612-429a51c713e9", "comment": "Malware payload", "value": "5b17dbe3a9888f0e0b5dcfbbbb435204", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790467, "uuid": "2d7702c8-bf9b-4833-96dc-1a1a1127bb38", "comment": "Malware payload", "value": "ee06c7a4500271bb846ef1cfb474a2b21c8b27f35ea2030f4d9d3ca309a02eac", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790467, "uuid": "31947fd6-9e5f-4c9c-b3b4-0ba23df2eec5", "comment": "Malware payload", "value": "bb62d0ff1f3f1af5c3ac0f69f1a81d23f2a0b3ca", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779790467, "uuid": "669c03d2-5be5-43bd-b821-4e2561f956fc", "comment": "Malware payload", "value": "dc24d627c72c9195be8d67e16e88dce490fb4e77273c0e3a9e68b21162311d2dfd78e4c2e0f2d1620bf94a39b6239ddd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790467, "uuid": "b10866d5-2620-4da7-b910-001f1eb7b178", "value": "T13B412B145FE64714D2A2C73ABCBAF305C9767855EA12CF9E019181C96824214F575F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790467, "uuid": "1725c6f3-b63d-4a22-bb7b-f11370ce30c4", "value": "24:8AttnHYVKVWue/CW+6gPqFO3+/QT4I02YIl0eyG:8mHaWPqs3fMIhyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779790467, "uuid": "85427327-3545-43f2-a573-7633349d6ec1", "value": 1978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779790467, "uuid": "3848085e-0455-461c-b1b8-df1b98e9da3b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779790467, "uuid": "5d426481-2071-4d80-8071-998b1ba35c8f", "value": "Facture_Avril_2026.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29dcc4d-5945-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779829238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829238, "uuid": "da5492da-d2aa-4bb6-89cb-1d4a2e116167", "comment": "Malware payload", "value": "6bf0c9c44884340f288ece684e0d60f9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829238, "uuid": "cbeefdbd-ccc7-4896-9c8a-e135c74df2ea", "comment": "Malware payload", "value": "ee34604cd6aaaff59574a256774548c59dfb78685c2867ec75f7492c37440903", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829238, "uuid": "5d07e5e5-a281-4e50-9591-84ad392de225", "comment": "Malware payload", "value": "ace75ea8804db6a7d17d2ea5ce8416b93d1a7907", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779829238, "uuid": "718ec4f5-b3cf-4cd2-8489-bdad0e261975", "comment": "Malware payload", "value": "7b849147e5aa6dbf56322443744a7c2a113a3d73548fb2614e4f2aacc502e7778f5f85c38e7af40974bf53e26580b187", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829238, "uuid": "cc57f004-8ae0-46fa-a820-e826986eb529", "value": "T1D081E72011ECA6BE4C2643F71B6D1909CE6958D187275FB089DD83C5E006BEF6A6CC9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829238, "uuid": "e6e69fbd-b40d-402c-b1bb-f17976deebe8", "value": "96:REi8KG+topPrAX2yv9zlbxUJvMEsT0WuSYeUjz3yCfOKCJd:rG+topPeVlbxUNME02SXKz1Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779829238, "uuid": "e2c86990-2c66-4936-9eb7-9392b723ce02", "value": 4152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779829238, "uuid": "bf9ad29f-0823-4c41-9f7a-9d80948b4623", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779829238, "uuid": "b5588e48-51ae-417b-829d-13f79cc0eeab", "value": "Request_for_Quotation-RFQ50620260525_BOQ_&_Supply_Commerical_list.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cca9f0-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (LaxuryStealer)", "timestamp": 1779795143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795143, "uuid": "4d0a1f4c-56af-47d2-ba69-b7ded84db8b9", "comment": "Malware payload (LaxuryStealer)", "value": "45e0f7101c8f6fa7a48e0d4864fdac9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaxuryStealer", "colour": "#6A79A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795143, "uuid": "4c6d9f1b-e0f4-400c-9cf8-95f2f6e7b437", "comment": "Malware payload (LaxuryStealer)", "value": "ee3b7e9735c3a61022a5eb1b0b2b321fc84529724d77436a20ca63c276311b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaxuryStealer", "colour": "#6A79A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795143, "uuid": "83a73acb-b11c-4682-929a-30e17da6fc29", "comment": "Malware payload (LaxuryStealer)", "value": "ee6ad17754d7b7b3b6665296da0df18fa65551b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaxuryStealer", "colour": "#6A79A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795143, "uuid": "4faeaa26-25f3-49b3-9fe6-e2ab9f5c51c2", "comment": "Malware payload (LaxuryStealer)", "value": "7b7cdf051cfbd549efa50b5ff29f6534efdf15ff07c6ae4309b3029c5271f8718bb5b95026b178e89343fb4b8593c9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaxuryStealer", "colour": "#6A79A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795143, "uuid": "cc21bd29-b19b-416f-93ca-5354de99ad91", "value": "T1C426CF16B3E90169E5EF4278D1765B17DBB0B0021320DBDF579089B91F23BC26A7B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795143, "uuid": "7142c507-af95-4420-a670-782872ff281f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795143, "uuid": "694ccf1f-c037-45ff-8c76-f054cd16d9cb", "value": "49152:cFblhSBCSA/Bkj0I9EeNSPwEW3cFSI4Tfm3hvbHsjAJcAMkPalI+vIjE7mjOuKan:cFVSAy9Nzm31PMoal27OuKr+gvhf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795143, "uuid": "aeb50c45-2cd4-4394-9374-77a38aa8047b", "value": 4570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795143, "uuid": "c9d8d010-79fd-4e52-b8bd-3359ef15513f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795143, "uuid": "633c0b96-2541-4f19-9a99-bbba94e6b0bb", "value": "ee3b7e9735c3a61022a5eb1b0b2b321fc84529724d77436a20ca63c276311b02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31986ccc-592e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779819036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819036, "uuid": "87f7cddd-fd9d-4b67-b477-498b38d2a445", "comment": "Malware payload", "value": "8eed221c03dada349c651260e2e61845", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819036, "uuid": "96106559-7f2b-4b5a-ab87-79d539e863c3", "comment": "Malware payload", "value": "eef5cb41b2c7fe11ce2a0b05de8c6ed583286a0bbc8c632aa073772dcad3efc6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819036, "uuid": "a1815ba1-dba3-4e07-946c-bd8d97db3fb9", "comment": "Malware payload", "value": "ede50e64f0afc854ce3b2f2edcc401c4a564fcb0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779819036, "uuid": "580cb1d9-5d17-41c2-a1d1-a9f53615b182", "comment": "Malware payload", "value": "68f088592063b2a26ef47648bec63e2e3f24e0f3d105628e0e5300c4489bb4c890bc98e811ac80b6a98e4779e37c554d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819036, "uuid": "4e8bf124-b4a2-4856-9941-70962a3aa930", "value": "T15E7412A721BCA0D1F45D2CB62419C32A26454C5602331B58F7DBBAE1CE7B58BF6132F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819036, "uuid": "5ab78f00-6719-4a68-8e77-8533eb7db99b", "value": "ce65a372bee233e6193587db802a7b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819036, "uuid": "7bff9d29-c57c-41fb-b877-541d17564dca", "value": "6144:pO8txB35TDQtK92ZefDm+Fd0Kdd/+CDbLwL6Qgg/wAG/kaRC0y8BAJL0y5f6O:TtiefWKdd/+CPLE6Jg4AQRzy8BG6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779819036, "uuid": "763a0742-9717-4f55-a757-50af2d3a0213", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779819036, "uuid": "964ac343-e542-4e48-88cb-fb266b086e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779819036, "uuid": "f5b798ae-426c-4c05-9f04-5c26be111301", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fcf577-5906-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779802106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802106, "uuid": "0eb25beb-188c-499f-ace1-03aca219d8d8", "comment": "Malware payload (ACRStealer)", "value": "74238df24469358bd8b4a886cb53179d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802106, "uuid": "dfde7a15-8537-4b4f-8219-956eb1e39a6f", "comment": "Malware payload (ACRStealer)", "value": "ef262340421fcb93d5f0c0d0bf418bc9fc6224398dda3093028ed8c97cc5bba7", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802106, "uuid": "6f5fe7d3-ce65-41dd-8330-305921849b0b", "comment": "Malware payload (ACRStealer)", "value": "26e779d1507ab50ddb6b122a7ce70051d02018ff", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779802106, "uuid": "bd29fd7e-274b-4c1b-9e61-f15088db58f5", "comment": "Malware payload (ACRStealer)", "value": "53d745b7cac1286dff0d5b4d267e94d03342cf9101c360f9dbc9686aa3e0438026296f3dc32e594f53c8a79cb19aabd5", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802106, "uuid": "bac0a9cb-bd7d-46fc-834b-7c76c5329872", "value": "T139B59C41FCDB94B1E512123788A2A2FB2331BD098B369F87D9407F7ABD776E00932655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802106, "uuid": "3eedc788-2927-45bf-a294-6b88ba932383", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802106, "uuid": "24b865b2-1639-490b-ab86-94982b3c9803", "value": "49152:cp0/NJ6BDEfeZ1bfnYZh4tCf+YUUcc4WkkGlYzYD1y:cpETQIfCpfYZutCf+Yvcjk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779802106, "uuid": "55adfb0b-f1fa-4dad-8c04-8803cda24fff", "value": 2274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779802106, "uuid": "f792381f-e1db-4225-aab8-d651ad71baa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779802106, "uuid": "26c73d0d-7be5-4520-810d-46500cfa6a22", "value": "SecuriteInfo.com.Win32.Evo-gen.35359734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa0973a-58de-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779785021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785021, "uuid": "ee3a2a16-9f01-4177-b224-e4a6641276a6", "comment": "Malware payload (ValleyRAT)", "value": "bca55f6a991a6ac4b4d9a2d3a200cfc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785021, "uuid": "3d661e71-211a-4730-8826-025eff138d95", "comment": "Malware payload (ValleyRAT)", "value": "f11b697db1d3e8a162f0d50d5340f151cb5b4e381a4c69b68b667c990711fa57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785021, "uuid": "7c713a9b-a4d8-454a-9952-e8315a1c49a2", "comment": "Malware payload (ValleyRAT)", "value": "01e1a6a8acc73c0d46bf8508dca0a5852b1a1103", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779785021, "uuid": "6756514f-4fa6-4016-b516-283242f483df", "comment": "Malware payload (ValleyRAT)", "value": "a08839a75411a6f7d5c3179bbe87823631a3bdee21d40e3e7c57d2fd3dbe7b7cfe34d845f24913b1e0143f1851af5c4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785021, "uuid": "b5fd6365-f94f-4f0a-979e-9402e037af67", "value": "T1A983F83B9B91A698D7A781FBFF6A651A58BBF0314080B917133C342C591F4E22B7C16D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785021, "uuid": "1811f825-fe54-4501-8ace-3639336f5b05", "value": "61aee1efa149f59d7615c8dc7392ffa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785021, "uuid": "6899b7a5-ef23-4474-b0d6-a9a80d3359cb", "value": "1536:mqQzkeJAbDDRvLtITfL5qUwCDA0qWeZUapgbps0qtYcfO+zzz9:tt1eHwCc03haOtcFmq39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779785021, "uuid": "568acc4e-c987-4b45-8cc5-0772f50d9dfe", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779785021, "uuid": "74096bab-d414-4078-9610-f0ce5d2a38d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779785021, "uuid": "33369c01-5de6-4c62-b126-3bc7e314953b", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u89c4\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e698bf-58cf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779778247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778247, "uuid": "9ccfaae0-c7c8-4d8b-8206-29536de8f9a6", "comment": "Malware payload", "value": "8b130e164ba8f2b267539771842c42d6", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778247, "uuid": "334a890f-1aac-4f33-ac8d-30070bd2dead", "comment": "Malware payload", "value": "f26336dfb7477c2be6c38f459bed7c8351f8548acd344d5f291de17a9c9843cc", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778247, "uuid": "f08619f1-9e3d-478f-a1f8-8ac80e25f4bf", "comment": "Malware payload", "value": "1dba3ddb62f2d959080b2a774d4fca3a634129c0", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779778247, "uuid": "872a9cf5-876f-4b9e-9ca3-5a2433ed4661", "comment": "Malware payload", "value": "a9448afbfadc676f87a83992c64f23e8ee0809626a18a3004be65ca6d4fd2ea4375b2a26aeb444fe357b8a49dec1d376", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778247, "uuid": "5ffaf3b1-96ff-479b-a88c-47126f8f76d3", "value": "T145C4016D42BE5ED694835EE88EF084101247054EAADC603F7A167D78C911F2BBFDB07A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778247, "uuid": "377f4ffd-0689-4f90-9315-b584e1d9efcf", "value": "12288:5ktl/NXlQBkUK1DvgdIIud/RXEioAn1+di1gAISDyUPklmmMb24VcEsb05tQNqFH:cx6k71D4eNRXQRAXxmMx+hbEQNqLa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779778247, "uuid": "4b2cbf8e-23b1-4a42-81c0-4c9deab0fba3", "value": 574034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779778247, "uuid": "018f53ef-c64c-4d90-8fd9-df01db3c0964", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779778247, "uuid": "4244c6fe-71c9-4400-99fe-bc8cc49e5c64", "value": "RFQ_PR36137_ITR9026.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a92395-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1779800116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800116, "uuid": "903e8f83-19a6-41c4-8498-61f173cb5c6e", "comment": "Malware payload (PureHVNC)", "value": "ea4acbbcd841d12c60946dba3d3d8112", "object_relation": "md5", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800116, "uuid": "d09e48ee-b186-4dcd-a84f-e88c7fcc7733", "comment": "Malware payload (PureHVNC)", "value": "f2794e5240bca319618a14ef6f9c1fd2da129b31db4dbf5df9158b863c8a3c66", "object_relation": "sha256", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800116, "uuid": "256ce62b-8278-404a-a32b-d19ae07f46ac", "comment": "Malware payload (PureHVNC)", "value": "ebeb8f5b2c8ddc3468a0b905f52fc752f5138ce7", "object_relation": "sha1", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800116, "uuid": "4e3faa13-b793-43f9-8d3d-05bd1550972a", "comment": "Malware payload (PureHVNC)", "value": "daae67d9fc5f276f22156e6b8db3ccb8c30872707bb3cb3e493403a013efe94e97fd98a5baf8d924f307152d686a6720", "object_relation": "sha3-384", "Tag": [ { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800116, "uuid": "3b75fa9f-ae51-47ae-87b2-80b7a23530ca", "value": "T1F5E6C0DA4364FDE4D1F356089C181EE4CDA1DFE99BF79646AF028EA7903C94C7A24B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800116, "uuid": "d07160d2-c2b4-48f7-b696-efd8c837da9e", "value": "768:N0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0u0ug:BSoRcM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800116, "uuid": "80012760-7838-4dc1-af9d-4d066d1f2fcc", "value": 14793792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800116, "uuid": "48568337-4ccc-4212-a7ee-c178c0602e7b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800116, "uuid": "b24617e7-8c95-459a-9b2d-e0b5b04c09af", "value": "IMG_099009_002900_0000R_26_05_2026.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a04f892-58c5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779773953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773953, "uuid": "1b18792b-71d6-40b0-8930-72b85704498f", "comment": "Malware payload", "value": "00af1d57893224252b48a218d090756f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773953, "uuid": "c429ed3c-bd1f-4c14-a928-296b04f78057", "comment": "Malware payload", "value": "f28253e3a86fd31a63bdbbdad0e82f5bf3280a2ff972a21c166b259cdbef4914", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773953, "uuid": "57753580-33b0-4fbc-9bbd-7a99e304b8d6", "comment": "Malware payload", "value": "2d6158d530df103f8c91c0bdb36b2152731e98c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779773953, "uuid": "6e9e9b90-dca5-4ce0-9839-9a4fe6919528", "comment": "Malware payload", "value": "b6602a6429af97bb9bf8889e429cb3848deb533ee8e1b5736d64d1f989505b6456fe5b18d2482cf450b4fc3f39ea90be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773953, "uuid": "e49e8c26-437f-41f3-86c4-31d5dea1f22a", "value": "T189C65B47E86540E4F5AED27085769263BBB17C489B2123D73B90F3283F76BD06AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773953, "uuid": "a39a6bcd-624f-4291-a7a0-c2249261589e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773953, "uuid": "642ba54d-7c43-4258-82c0-44b12edb30d6", "value": "98304:aMWwj3gMBYygxgIuHF4mzzjxRfJ7WRS4MUt/uuE:aM33kxlQF4mzRRfoMiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779773953, "uuid": "ab9b244a-d202-426e-8998-d59b3c0e159f", "value": 11730948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779773953, "uuid": "e1d9e5f9-697a-49c2-b18f-643f99198437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779773953, "uuid": "273931f2-a696-4bf4-91dd-736e14703514", "value": "00af1d57893224252b48a218d090756f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccfb90c-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (MWSRAT)", "timestamp": 1779795137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795137, "uuid": "da58e800-ebe2-442c-b939-ab4482bfd33e", "comment": "Malware payload (MWSRAT)", "value": "e9cd8e4a4c2462cb62498cffb154725e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MWSRAT", "colour": "#42768A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795137, "uuid": "e9ef4294-347e-42f8-a53e-1e84131e5fd1", "comment": "Malware payload (MWSRAT)", "value": "f2cd0ff148de1677c225690e86e5fc29f78cee724d9109df003e3de6a81175ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MWSRAT", "colour": "#42768A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795137, "uuid": "7bef8c99-2e6f-4d4e-bf48-9cab20096dbd", "comment": "Malware payload (MWSRAT)", "value": "73fd4367b0fbea66e71747d0610e241529513d93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MWSRAT", "colour": "#42768A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795137, "uuid": "71ad1414-8ff2-4cc9-8f62-40c594c31161", "comment": "Malware payload (MWSRAT)", "value": "de04c9bf75d5e1950243ebf42fef9b902d34edd6b04c5738a919997ddb400f0e1cce9127712e81a5ee43d7cacea7e52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MWSRAT", "colour": "#42768A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795137, "uuid": "0d29ba6a-9259-43ab-91a3-ee7157a3f02f", "value": "T17B63824173E94154F1FB6B7999BA85204B37B89A9D35CB0E09DCA00E1BF3B409D61BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795137, "uuid": "b699a98b-e3ef-4352-8038-1f651385acfa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795137, "uuid": "c90458b6-3448-42e6-ad97-97bae51079e6", "value": "1536:7oD3fJ7fGpwBHuRB0koDxGOJ94RYpcV+QHNNBYI+UfUrmlXmGXGQuyUW/b:CfJ7aIHoBvo1n94RqcZT+UfUrmlXmEk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795137, "uuid": "14734776-6a5b-4078-9ca1-456a06fbd3c2", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795137, "uuid": "0b5526d0-30c3-48e7-9988-d1b1abe2bab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795137, "uuid": "41a0e997-4f97-4ba7-8b7a-be953be5e471", "value": "f2cd0ff148de1677c225690e86e5fc29f78cee724d9109df003e3de6a81175ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1b3768-5910-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779806279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806279, "uuid": "c2b4e245-33f2-45fe-aec1-68042f13d1ca", "comment": "Malware payload (Mirai)", "value": "1db1bb3a006e354c3093c40f932b54fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806279, "uuid": "0087cef1-25e9-4eda-a466-5e9d935686c4", "comment": "Malware payload (Mirai)", "value": "f31b6ed4418cf8c018eedf937b9a8f349a0f2072b98c3fed5b2e84d2fd2156f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806279, "uuid": "ffb5276c-dbef-4903-a313-5a83f0702866", "comment": "Malware payload (Mirai)", "value": "6f04191f0adabd60831f66a916c18cd8d96b527b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779806279, "uuid": "53abcb17-911f-45e2-909e-b920aefa1092", "comment": "Malware payload (Mirai)", "value": "08ba512b502b887d8ba57a07dd9b93a040d0f6095025e7ca33241319e4354be42861762e1532b19ce619786810ae2585", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806279, "uuid": "9cef868b-1e1b-450c-9309-abd5d0f4cfdd", "value": "T153930691BC829A1BC6C5537BFA4E428D3326B388E3DE3117CD265F2133CA56B0EA7151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806279, "uuid": "0d9d0f11-ec17-4b19-8c59-2919bf9586d8", "value": "1536:90yfF9yAtPq79EDPkdKzmLylsHXYcFm6Rt/nDmE:mybU9EDEHHXYj6z/qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779806279, "uuid": "2c467753-e123-42c3-94c0-640042fc9113", "value": 88812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779806279, "uuid": "7b55b9d0-5207-4ec4-a75f-b3cb9487d103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779806279, "uuid": "b14185c2-28d1-4c9b-9ec5-383ae970ab75", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b4636b-5940-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779826696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826696, "uuid": "e54ac75c-88c6-4340-9b81-51c7ec2a4e42", "comment": "Malware payload", "value": "755b149810e5842b3b8669fdadca8af0", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826696, "uuid": "eb00b320-f82d-4641-972f-9076468ded32", "comment": "Malware payload", "value": "f51480c02c36d0bb95f7f31b8486f8956881ee900c9700d22b297af5ce975cc1", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826696, "uuid": "b405c83a-8c27-486c-961f-84684fa01891", "comment": "Malware payload", "value": "1ea35cf2e9de3968c9a7bb1df42aae93ba9f0aaf", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779826696, "uuid": "ad7aaa7c-8fbd-43bb-aa9e-6c8300f6654d", "comment": "Malware payload", "value": "8735928dd576335d0f11a4c3f92ee7caf1edde74bb1d426d09b205611c61d3895d3f4ab49a9d716463e70fcf0c67e8fa", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826696, "uuid": "f98b88b8-18b4-4601-8a53-318aa4347d83", "value": "T14BC41211B799ABBAC103F43D8FC825D9150CEC299B16E10B358A7BDD317E79A861E34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826696, "uuid": "4c425373-00e4-43a2-a078-e73bf8389b7e", "value": "12288:aEcwekXheR2wN5CJYK4UVa/GuqIL7uOdPkr78xLu:aHtZN5CJAUBOdPkr7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779826696, "uuid": "11936878-df54-4c37-9373-24f5624d706b", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779826696, "uuid": "9fcec11f-5a51-4580-aba2-0b80ab561be8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779826696, "uuid": "3f1d6ba0-3d8d-4dff-bb5c-b0d0cb3ceaa5", "value": "E006220217_v1_20260521.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fd1c28-590d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779805192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805192, "uuid": "bd3447e9-abc0-423b-931f-864c5cb3a29c", "comment": "Malware payload (Mirai)", "value": "61497d88c06d4f39e7645e00dd48e03d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805192, "uuid": "b46246fe-8d30-4bfc-89bd-eaa3af10e8c0", "comment": "Malware payload (Mirai)", "value": "f533df6fd164ea6f9c8da5c632d1ebe6bf72dc7aa04ac89390c467780f78014f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805192, "uuid": "c4eecff6-0bf7-4d0a-80b0-2a56dcbe76c5", "comment": "Malware payload (Mirai)", "value": "0b439a00819413661fe4287310cce761e08ba162", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779805192, "uuid": "24c5cbae-d0f7-4f20-9bf4-26cdc8af8340", "comment": "Malware payload (Mirai)", "value": "a0e5bd1223abeae14bac4dbab985771b415a5bbfbea3e5d8cc940e2cad1980bc12076b9935d76864bff59784b379b7c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805192, "uuid": "f76abe86-00fc-420a-baa7-c40654604036", "value": "T17A6302AC9B68300CC9ADAC78C1C612DBE7A44252F7DF5B89C714BAC5DF32915DC69428", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805192, "uuid": "6316b818-a676-48d9-92c0-13fb467d7dad", "value": "1536:xh97crE7Jw2rSgWjJyT/Hjircru6neEAq3ujoLyzgEn:xh9QrgJHSgkJIHji4EEAqeseD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779805192, "uuid": "7c32c4ff-0baf-47b8-84e0-ae55fd079099", "value": 71044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779805192, "uuid": "f02e0e73-cae6-47c4-a202-172ac0dc0310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779805192, "uuid": "ffc49083-acc4-4bd7-8649-723747bce627", "value": "wife.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bef7b3c-58ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779791109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791109, "uuid": "20bfa00b-7dd1-48fb-8514-3b97f5e71753", "comment": "Malware payload", "value": "7af509f3426c19c2166212888f30794d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791109, "uuid": "07e7c1b6-6659-4e8e-98d0-42ef5a32b55b", "comment": "Malware payload", "value": "f6438c5187474457b578a36c28cc7debb7f0104661ba5b840a6f4509b578ff42", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791109, "uuid": "ecc932be-7913-4d2a-a5de-19df0e6e788d", "comment": "Malware payload", "value": "4938609172a987330a60dd55b7556eda286db3bb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779791109, "uuid": "ae632ddd-06b0-44dd-ba80-414be65be124", "comment": "Malware payload", "value": "6eba66149de3770f4f7fc94db63388fbdb8abc03c755bb18df11191530c215a0ca11d9d3aa34512aaa6e23102befb311", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791109, "uuid": "3370ba4f-9b49-400e-bd42-16225316d139", "value": "T1ED31504B39642630930EA3FE859FA5484ED0C4172805CC15F94D93F50F449A6E390BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791109, "uuid": "ab6016d2-0fbd-43d7-bd2f-faac22296414", "value": "48:JSp+NLUKjp0hXYw4OmCTbDAuIRsFbvvBDvuUfnsL/CO4NKMgX:zl901uOmiouIRiDWUfneLqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779791109, "uuid": "7a404cf0-34db-45db-9a62-ebea78bf1e0e", "value": 1768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779791109, "uuid": "3fa2914c-cbd0-4993-aa06-ef122d4938f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779791109, "uuid": "f4e28ef7-373a-4ba8-85fe-9a74cdfff1a0", "value": "viewer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4a545e-592c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779818463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818463, "uuid": "16ca00e9-d48e-4a0c-b3e6-930b7fce2f13", "comment": "Malware payload", "value": "de1142713a7f681c728cff960cfd6994", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818463, "uuid": "1bbf9234-6153-4ecc-8511-173677b891e2", "comment": "Malware payload", "value": "f81c3b8ec666088d0fa14068eb07f948e0d78d481e2f0e88218d02f65bdcafbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818463, "uuid": "1eb3adc2-78d8-42a4-abd6-7f403147b343", "comment": "Malware payload", "value": "5a7c558b87223e5c1e578dc8dc264750cdb4843f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818463, "uuid": "dde3ce3c-7d91-4a7a-96ab-27f8c4714954", "comment": "Malware payload", "value": "41040bba6c0b3e406c66c28c7d2df724af10977a8e5ef67c0f085a4cd7e8d28f9cdd31ec9ecc298d46686d7dd039920b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818463, "uuid": "0997f465-7ac7-463d-ab0b-758ee49a9d27", "value": "T10CF69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818463, "uuid": "22cad711-1faf-48ad-b0a3-2d36a7e0769a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQh:cqYUQuVDt0TZEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818463, "uuid": "e7817d46-76a9-4e57-8896-d8d509873283", "value": 15269888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818463, "uuid": "5f14d8ee-bbd9-4286-8162-3b39d5a67e85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818463, "uuid": "e119476e-32a3-44ae-b8d1-4635277bf9c6", "value": "f81c3b8ec666088d0fa14068eb07f948e0d78d481e2f0e88218d02f65bdcafbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2697dc3-5896-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1779754076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754076, "uuid": "597c90a1-faab-4412-961d-c859ee568f08", "comment": "Malware payload (ACRStealer)", "value": "d5bd883babc6f45396cf37e6aeb34c11", "object_relation": "md5", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754076, "uuid": "1e1b7875-8273-4218-ab2a-4abbd27ec6f5", "comment": "Malware payload (ACRStealer)", "value": "f93d8d79ae62c9864e53e5abf92f5c905c358b6ac397c69418765a303947c1d1", "object_relation": "sha256", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754076, "uuid": "3bbc9645-cc04-4dcd-93f8-0d635142a256", "comment": "Malware payload (ACRStealer)", "value": "dd9f226ba9fa75c4078cba6c83726b0a32454ffa", "object_relation": "sha1", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779754076, "uuid": "93925dc8-f7b7-45cd-b9b9-ef60eab5d93f", "comment": "Malware payload (ACRStealer)", "value": "ccccbec94a48e8360d7e52fe6c0a65c792ac6562135dac83d91745d19507584aecd07718f7e163e5be5227725673eaca", "object_relation": "sha3-384", "Tag": [ { "name": "5-252-155-72", "colour": "#CFF749", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ultahost-gl", "colour": "#5349D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754076, "uuid": "91d1cd0c-5dca-4d1a-a725-5d8c34a5cac6", "value": "T18BB57D11FDC745F2E50212325AAB62BF23399D090F329B9BEA583A7AF9775D10C36305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754076, "uuid": "e49e0143-0295-4435-a256-08c9fa3c4d62", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754076, "uuid": "118e7319-9ef3-415d-a573-2c9ade512560", "value": "24576:zuU/qDDOpqwpfLPMe1z+e3I5XDdaA1uc3R4C2Y03XhvF2W3WDF6bZDYit+B9XGc:zuBDQxz0b3RJ2Y0JFDmDF6bZDYisB9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779754076, "uuid": "8e37399c-7e43-4023-9dca-eb9f49cc94cb", "value": 2392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779754076, "uuid": "01322c04-0298-4c6b-9a2d-08dd3f78a122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779754076, "uuid": "21b7a6f9-c03f-424c-8393-cd32c0792873", "value": "uRgOy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b88ec3-592c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779818096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818096, "uuid": "fe972a06-dca2-4313-8f78-c49aedbbcd78", "comment": "Malware payload", "value": "a669efe4219460cdd45c82d16af5136e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818096, "uuid": "74c40f84-ae45-4b93-8e5b-3d38c7d7a687", "comment": "Malware payload", "value": "f9542292625b52a50e31c9e5ebc5f72cbc45e911ad71e0a5591340f66363b90b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818096, "uuid": "0dfec181-e240-4a0c-bf49-e7d79d8e931b", "comment": "Malware payload", "value": "83131f238cfac57b64c350752c6a035816e402c8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779818096, "uuid": "038cb3ed-d5f0-4180-a9fb-78549265950b", "comment": "Malware payload", "value": "65f2d560b83f6e9b5f6b6b7a436e763784c25d119aa5540adba0bfa5fcdd6bf4f29cece71ee8e4689c77870cbb5a9df0", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818096, "uuid": "febefb2b-1530-4d60-a0c4-657956dae2d4", "value": "T1151453D59BD503E5159518BD8A1A532A21B1F31B3C2EDAC0FDED83832F38A507968BF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818096, "uuid": "fb9b73c3-428b-4d73-a929-c81a71a8523d", "value": "1536:kxATdVgre6bhu1kFVjeOBrUSs/4VYZNaS07j4qZELcq3RqXiubL4rlHvdCsuXufU:kxA6bh33peAshDFh/P8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779818096, "uuid": "dc4746a0-0fa2-495f-8192-0fac62747e11", "value": 194597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779818096, "uuid": "1a45aea6-936c-467e-904b-ebc31b4b7fe5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779818096, "uuid": "4d27113c-e24a-43a1-851b-6c48b157be1c", "value": "X_Logs_Summer_8090.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0802102e-58cc-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1779776875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776875, "uuid": "de250f55-252b-4cd5-a70a-88f89b385528", "comment": "Malware payload (ConnectWise)", "value": "36515521cc53617be9ed9a87e36444e4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776875, "uuid": "aea8e57b-8b29-473e-9222-6bac54d2a396", "comment": "Malware payload (ConnectWise)", "value": "fa0e321997505d431853b8c8bbe42bf76e86e7e2c884133e4609b5416d8bd9ea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776875, "uuid": "10393f0a-4166-45a8-9d8a-69160850605b", "comment": "Malware payload (ConnectWise)", "value": "4ca4e65bb79c18ffc4f28e65a14bc9695e8184b5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776875, "uuid": "627ddcbc-f045-48e3-96c6-22e0a575604e", "comment": "Malware payload (ConnectWise)", "value": "0836610567802aedb65d49f15fbe8a1032b155dc98c27581aadc2aa3f1d8682c0f9a95a186ebe7a4a3bc6189be0e119c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776875, "uuid": "3353c970-81fe-4cb8-8a8c-31c032a8dad5", "value": "T10E1100763259B7354A5A86509D639301BE4E42DF13009DDA705FA0393B1C9C6FAF91C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776875, "uuid": "75416c5f-d30a-49eb-906b-639a0b8aa5cc", "value": "24:A0ba47OoMZNh2yV50JIH+yBp+rI+aVRb/a55:L247mZV50w+GQrj0O55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776875, "uuid": "95ddd834-7764-438a-ae4f-4f8ceb4a2759", "value": 1088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776875, "uuid": "6777f697-91ab-4fc6-a59c-5a9e29aebda7", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776875, "uuid": "3514ceba-d701-4f5e-85db-2fc4cbc2bc57", "value": "SSA_DOCUMENT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf109fc-58cb-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779776857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776857, "uuid": "f194bdbd-23fa-4a0c-b5ed-bd73b09db00c", "comment": "Malware payload (LummaStealer)", "value": "f9eb06e24a4c261d43b1989dd7d780a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776857, "uuid": "7d90a890-dc11-4f91-8a76-a8648a00e182", "comment": "Malware payload (LummaStealer)", "value": "fa41d6b4e53c71633387a987d3bed687430e7a4e7b91e757e362fbbee7386e1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776857, "uuid": "343ff1dc-50d0-4599-89d4-c66cc541d533", "comment": "Malware payload (LummaStealer)", "value": "aff18d7f63006977f47c5fd34763d0fc6e738fcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779776857, "uuid": "d2ec01e4-6bc6-4867-9da5-c3e2d060fdc4", "comment": "Malware payload (LummaStealer)", "value": "7a059920e73cb3704eac02f2293e0e8abb466bfc6b8a72d34940d1de334097f2d7b52add828eef0c1322af01acb4568c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776857, "uuid": "787dddab-1d39-43d6-a631-0f49ff168b4b", "value": "T18DC58D01FCC784B6E4025632C5EB92FF2335AC098F329A9BEA547E7ABD771D50826315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776857, "uuid": "1cf99a40-cbb6-470e-8085-6da897b60c4a", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776857, "uuid": "9b42460e-857b-40e7-bbc7-267c244b2574", "value": "24576:+PxSxcyqCYpg/LMALSgKFHPeLhwAcY/uCSbfo0rYW3Yuxi7vq64D4w3Lf/l/zUHF:+AxglFou7doqvf/tzMeOQK55bsGitmHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779776857, "uuid": "b4e0c65d-2942-4a90-8797-b9629b13958e", "value": 2515592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779776857, "uuid": "de71ca80-8778-4c11-a791-37e20476c661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779776857, "uuid": "2bff6de0-ca74-4ede-8499-8221efae0daf", "value": "SecuriteInfo.com.Win32.Evo-gen.52292642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4ac0b9-58f6-11f1-a769-42010a9c0008", "comment": "Malware payload (MagazineStealer)", "timestamp": 1779795134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795134, "uuid": "7936bacb-0456-45c1-8b33-ab3b6b05a2bf", "comment": "Malware payload (MagazineStealer)", "value": "172613a9cfd55c77df03a74ccc7c36eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MagazineStealer", "colour": "#10CD96", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795134, "uuid": "738d8a34-7b75-4915-bd75-d257ab34639b", "comment": "Malware payload (MagazineStealer)", "value": "fb16fd36f3d54e7532cdfaa8f77e3321d6b0f71aa179744628d8d45f5025d5b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MagazineStealer", "colour": "#10CD96", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795134, "uuid": "1368a933-75e0-409d-8bc3-378279cbfc9a", "comment": "Malware payload (MagazineStealer)", "value": "00686a415324872cb042a71d59f0172bc7bb8dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MagazineStealer", "colour": "#10CD96", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779795134, "uuid": "81144fc2-1e7b-4dd6-a071-79ab573ff42f", "comment": "Malware payload (MagazineStealer)", "value": "131d85aa6ebbd5b7dd065292c61d64d15196e90279720065fefef32edb97d56f7480ce8690dc3423d3c1035110fb526c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MagazineStealer", "colour": "#10CD96", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795134, "uuid": "afd16180-ea95-4ee7-9a50-7b3d6e2fc3fe", "value": "T1B9F3D05792E272F8E84BC77C6496066073B4F879C315CD7A128694398C72EB86E37B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795134, "uuid": "45b1eff4-90a2-4239-890b-d5582545c480", "value": "95ffeab8661021bf6587d5024110e043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795134, "uuid": "30120ef2-fd2a-4e94-85de-9e2b488742f6", "value": "3072:LHJSQBaRLp7B2N7AjWEtma+tP6FUOog5q9vx:LHMnbWEtmmFUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779795134, "uuid": "4d4ee74d-a79a-4621-b63b-12046cfb6832", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779795134, "uuid": "360fdcfb-79c0-4870-b7d7-1f50bea79484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779795134, "uuid": "ca3d5452-b162-4570-87f1-0785fed408e3", "value": "fb16fd36f3d54e7532cdfaa8f77e3321d6b0f71aa179744628d8d45f5025d5b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8f7d16-58a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779760537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760537, "uuid": "7924681d-5171-483f-b63c-d5ad478fb0f3", "comment": "Malware payload (Mirai)", "value": "e3ab19e37c6da244b69c6544fe78aee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760537, "uuid": "01666d44-d528-4fee-808d-81eac9a997c3", "comment": "Malware payload (Mirai)", "value": "fbc4e5e8c0ec973857cd14a72b4f2e2f9d588182c2336c3427783ec858e20bd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760537, "uuid": "06c20ceb-3393-4155-abee-bfb9e4afab1e", "comment": "Malware payload (Mirai)", "value": "fff6a877c2ee61fa88c2ca04ca91261c5c5ed639", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779760537, "uuid": "509fbee7-9806-4913-a720-47c6ca30981b", "comment": "Malware payload (Mirai)", "value": "d674b1d83217980341a43e3c0d49a6457b79fd6da6c6ddc886e545a086797a0731f251b9ef1cde31fd023869a70d819b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760537, "uuid": "60df3acc-7a6b-4c61-9487-952586fe2277", "value": "T199043C05AF828B27C4C21779BA9F43557323EB6893DB33039A187BB42F837D90E66515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760537, "uuid": "a1feebfc-cbde-4d46-adce-5ff3b9ba0518", "value": "3072:1zI61Q7nKC8axKvN1plWH8jU3ppf1CcC0yUft:+cQ7nKjaCN5WH84ppf4cC0yUft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779760537, "uuid": "30999d69-9225-4957-91cc-3630d2af2ec9", "value": 188931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779760537, "uuid": "06ab8579-01d0-422f-be86-257de7b25ad7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779760537, "uuid": "bbd70286-d885-4922-b194-b591dc134fb1", "value": "bin.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a85cb2-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779784334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784334, "uuid": "b1bf4ca3-1122-4f9b-8826-73e60c6655c3", "comment": "Malware payload", "value": "b0f39d22b3888def825d980457b42b87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784334, "uuid": "cfd709ba-4e3f-40c3-a358-60465919d0c6", "comment": "Malware payload", "value": "fcbc6f221902f90575f945fec23880a757f8f9ae921c19d2b29858cf15de2a63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784334, "uuid": "7237acbe-e828-4aee-8cd4-b626412e4f9b", "comment": "Malware payload", "value": "b9f408ba5ffb831e1da0a3b13c4b1d8f7bb7f623", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784334, "uuid": "1352ddc1-773e-43b8-a5a0-b7d418738989", "comment": "Malware payload", "value": "bde86bff563447234357cf87e4f58bc4bfa6ac92d1777b678a1255ba587278bb311999372e2d6608a9965cc645a120ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784334, "uuid": "ff0025b0-2714-4681-ae90-3a49dd27bb12", "value": "T11157CF7792067CEDE9B94DB4C41015816DA878874778E3C7BAC870E6A6EB6D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784334, "uuid": "d0020ed0-0b71-4b5b-b2d6-b0930c4c6e3b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ0:cqYUQuVDt0TZEA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784334, "uuid": "2350ff15-8b5f-46d8-96e5-b51926ecc856", "value": 29327360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784334, "uuid": "6c9a8956-dd59-4122-9d05-5e2349d83e62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784334, "uuid": "28cdb0c6-8769-486d-9117-aad32d22785f", "value": "20260526-003436_sftp__root__3199154146702282899_sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed0ecbe-5902-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779800187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800187, "uuid": "43db7308-a251-4f6b-9995-b48add1cd407", "comment": "Malware payload (AgentTesla)", "value": "db9b789678c1696457aef3195cef7532", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800187, "uuid": "abf29e72-50be-4142-9b9b-3054a4400470", "comment": "Malware payload (AgentTesla)", "value": "fdb7456a43bc3c0296c18043bf32f21b8a29d099f91fb690a6816d202d6ad51a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800187, "uuid": "41544a48-e17a-476d-ac49-ef3a2bc075bb", "comment": "Malware payload (AgentTesla)", "value": "405901b8cab69c3bd77badd08f8c68519ca53c2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779800187, "uuid": "b3935209-8a1f-4920-92ff-a07ab3649c0e", "comment": "Malware payload (AgentTesla)", "value": "bf6fb598ad93423f4ad79521392c1d58469db79b75aa891635fd38d68120001573ed0602f184c6a5225059f0e94f0a2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800187, "uuid": "77ea9565-ff3f-468e-8f6a-c4530b059743", "value": "T1D615D02C3B5E9105D9359BBDEA274B5523F0C0065ED3D32BBFE942A8994BBF25C12342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800187, "uuid": "3daf738d-837b-4499-b37d-79612cc390da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800187, "uuid": "78986fd6-0e47-48f0-8afa-eaa276697ac2", "value": "12288:dx/D7sbzBU4dBUqtAxFNvJoUqTrXoqFrxIFX5xHH6oGHpzC685Tg:dxL7sbmmUttJoprYG2xHH6oGHFSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779800187, "uuid": "9f4b3126-eab6-4028-a930-f5d2ce66edcd", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779800187, "uuid": "8754ddbf-f40e-4b38-9a5b-460f9927d7e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779800187, "uuid": "1c71e84f-badf-4f1b-9e81-fbbc9842ffad", "value": "Documentos.xlsx 804 KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a6aa2d-5952-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779834776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834776, "uuid": "d3010b6a-9815-43c2-8755-e95d0f575c5a", "comment": "Malware payload", "value": "2d777189330f13117e39f66d89f52279", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834776, "uuid": "1651d494-8bba-48e9-9aca-bd6595f60acd", "comment": "Malware payload", "value": "fe77313c83205a27f54daee59e41ad6dc364d6de2e93859880510047e766c41b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834776, "uuid": "a4b6d98d-d587-449a-acec-9c94bab2335c", "comment": "Malware payload", "value": "2a629c4944b7d0ae774822dd25bd1e08a5c87683", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779834776, "uuid": "e1c7e120-5156-4875-8eb7-6eb1088f8850", "comment": "Malware payload", "value": "e38ab32d659680653bdaca90aa8d65ba577dc32d34e07c73246ed3c25a69157daf7b13fd542b87843582a438f51dc7bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834776, "uuid": "9c38589a-f22f-4f2b-96c2-4aa44fa9e9b5", "value": "T16613F1099F11EF52DF0008B32D5CA6AD89BBB79A0B3B356198E5AD4FC3560976C9F300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834776, "uuid": "0dc9af30-9dab-4fe9-bb2c-8f03de9ffd64", "value": "768:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsUkAtkgP1NjSfLL5UZmVA:pxpJNlEYvXndUt/afLuZmVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779834776, "uuid": "39253d5a-f423-4cfd-9f06-8c6de92cdbb2", "value": 41640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779834776, "uuid": "1a08e09d-9d10-4de3-9a6e-cb998aee9807", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779834776, "uuid": "72c0c2e8-00fe-4c0f-b248-ba85bb9bd579", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3e8223-58dd-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779784370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784370, "uuid": "6d30c4c5-41db-4d13-a7d3-045754132272", "comment": "Malware payload (Mirai)", "value": "4a1abd0905a16b40f3b3ca1a7c260e5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784370, "uuid": "08299386-202b-4914-8b09-954c8b04108e", "comment": "Malware payload (Mirai)", "value": "ff86e2a06ae29422a4085e1dcbbfa32d4748a8cb1e6e194505a32ae6b6460295", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784370, "uuid": "e5350fe0-b1b3-4af7-ad2f-e1e632bce464", "comment": "Malware payload (Mirai)", "value": "eda42aed443616891e4339d6842519b1b92c2f3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779784370, "uuid": "f8726484-1bfd-4030-bdd9-7bf342ba031c", "comment": "Malware payload (Mirai)", "value": "dad06c19d2a2f1754f3edcac838910fce8150758c867594d2e08ce1ee0f2d67b830114b5bc75e122a85a3fdbbbef309e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false }, { "name": "static", "colour": "#F15EE1", "exportable": true, "hide_tag": false }, { "name": "x86-64", "colour": "#FF71AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784370, "uuid": "35b18888-6b48-4d67-bcf2-fd39aa62157d", "value": "T188653393128A5FB5BF92FE3D801424CAD675DEB11B3DB3A4F2B087750D43AA1D271829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784370, "uuid": "da110adc-b92b-4027-8365-076966b8315a", "value": "24576:wKSc8CzOx8GxVvM3lQ+9Xknlat2lp8MhzUE8swuW46sJ/gWhHhbVlGttgKT:EpCKabVQ+9qlNlpjN8H8JZGtuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779784370, "uuid": "bfe22958-d280-4675-b0be-8d35828b5f4a", "value": 1409024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779784370, "uuid": "a35e0411-5195-4f4a-81f0-6fe0552c47c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779784370, "uuid": "762ced4b-8be1-4dce-b43a-56040479d12e", "value": "20260525-015647_sftp__root_redtail_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }